1 1 00:00:00,450 --> 00:00:02,850 Disk and file systems. 2 2 00:00:02,850 --> 00:00:04,350 In this lesson, we are going to look 3 3 00:00:04,350 --> 00:00:06,120 at the different indicators of compromise 4 4 00:00:06,120 --> 00:00:09,360 that may exist on your disk or file system. 5 5 00:00:09,360 --> 00:00:10,710 Now, as we said before, 6 6 00:00:10,710 --> 00:00:14,010 there is a lot of new fileless malware that's out there, 7 7 00:00:14,010 --> 00:00:16,590 and while this is really prevalent in the industry, 8 8 00:00:16,590 --> 00:00:18,360 malware is still likely to leave 9 9 00:00:18,360 --> 00:00:22,320 metadata on the file system, even if it is fileless. 10 10 00:00:22,320 --> 00:00:24,210 Now, one of the common ways this happens 11 11 00:00:24,210 --> 00:00:26,760 is by using staging areas. 12 12 00:00:26,760 --> 00:00:29,160 Now, a staging area is a place where an adversary 13 13 00:00:29,160 --> 00:00:32,910 begins to collect data in preparation for data exfiltration. 14 14 00:00:32,910 --> 00:00:35,610 This may be a place like a temporary file or folder. 15 15 00:00:35,610 --> 00:00:39,600 It might be user profile locations, data masked as logs, 16 16 00:00:39,600 --> 00:00:41,760 alternate data streams, or ADS, 17 17 00:00:41,760 --> 00:00:45,000 or even files being placed into the recycle bin. 18 18 00:00:45,000 --> 00:00:47,460 All of these are places that data can be staged 19 19 00:00:47,460 --> 00:00:49,920 awaiting for it to be moved off of that network 20 20 00:00:49,920 --> 00:00:52,140 and into an attacker's network. 21 21 00:00:52,140 --> 00:00:53,700 Now, when an attacker does this, 22 22 00:00:53,700 --> 00:00:55,320 they often will take that data 23 23 00:00:55,320 --> 00:00:57,060 and compress it or encrypt it 24 24 00:00:57,060 --> 00:00:59,250 and then place it into the staging area. 25 25 00:00:59,250 --> 00:01:02,610 So this can be one of the common IOCs that you can look for. 26 26 00:01:02,610 --> 00:01:03,840 So if you start finding files 27 27 00:01:03,840 --> 00:01:05,310 that are compressed or encrypted 28 28 00:01:05,310 --> 00:01:07,110 and placed into certain directories, 29 29 00:01:07,110 --> 00:01:10,260 this could be an indication of a staging area. 30 30 00:01:10,260 --> 00:01:12,750 Another common area that's used by attackers 31 31 00:01:12,750 --> 00:01:15,180 is that of alternate data streams. 32 32 00:01:15,180 --> 00:01:17,760 Now, alternate data streams, or ADS, 33 33 00:01:17,760 --> 00:01:21,720 is a feature that's embedded inside an NTFS file system. 34 34 00:01:21,720 --> 00:01:24,150 Now, NTFS is the file system that's used 35 35 00:01:24,150 --> 00:01:26,040 on all Windows machines. 36 36 00:01:26,040 --> 00:01:27,390 So you could see here on the screen, 37 37 00:01:27,390 --> 00:01:29,490 I have a directory called Test7. 38 38 00:01:29,490 --> 00:01:33,150 And inside of that we're taking the word Sample123 39 39 00:01:33,150 --> 00:01:36,103 and echoing that into a file called ... 40 40 00:01:37,200 --> 00:01:39,630 And inside that file of ... 41 41 00:01:39,630 --> 00:01:44,630 we're using an alternate data stream, called Sampleabc.txt. 42 42 00:01:44,970 --> 00:01:46,320 That's actually where the file 43 43 00:01:46,320 --> 00:01:49,530 is going to contain that word, Sample123. 44 44 00:01:49,530 --> 00:01:51,090 Now you can see I've done the same thing here 45 45 00:01:51,090 --> 00:01:55,410 using null as the file and then a colon, Sample.txt. 46 46 00:01:55,410 --> 00:01:57,420 I'm placing this Sample.txt 47 47 00:01:57,420 --> 00:02:00,930 as an alternate data stream in the null file. 48 48 00:02:00,930 --> 00:02:02,340 You could see my third attempt here, 49 49 00:02:02,340 --> 00:02:05,490 I was going to try to send it over a comms link of com1, 50 50 00:02:05,490 --> 00:02:06,660 which is a serial port, 51 51 00:02:06,660 --> 00:02:09,660 but on this system that wasn't recognized. 52 52 00:02:09,660 --> 00:02:11,760 Now, as I went through and I did DIR, 53 53 00:02:11,760 --> 00:02:14,580 you can see all of the files in a particular folder. 54 54 00:02:14,580 --> 00:02:18,060 Now when you look at it, you see four different files here. 55 55 00:02:18,060 --> 00:02:20,847 You see ., which is this directory, 56 56 00:02:20,847 --> 00:02:22,780 .., which is the parent directory, 57 57 00:02:22,780 --> 00:02:25,290 ..., which is that file that I made 58 58 00:02:25,290 --> 00:02:28,140 with the alternate data stream having that text file in it 59 59 00:02:28,140 --> 00:02:30,090 and notice it has zero bytes, 60 60 00:02:30,090 --> 00:02:32,850 because the null file had no information in it, 61 61 00:02:32,850 --> 00:02:35,160 but the alternate data stream did, 62 62 00:02:35,160 --> 00:02:37,710 and that's being hidden by this operating system. 63 63 00:02:37,710 --> 00:02:39,000 And then you can see again 64 64 00:02:39,000 --> 00:02:41,967 that we have this null:sample.txt:$data, 65 65 00:02:44,760 --> 00:02:46,410 which is an alternate data stream 66 66 00:02:47,339 --> 00:02:48,172 inside of an alternate data stream, 67 67 00:02:48,172 --> 00:02:49,740 which gets a little confusing. 68 68 00:02:49,740 --> 00:02:51,690 Now again, the concept here is that an attacker 69 69 00:02:51,690 --> 00:02:54,660 can hide information in these alternate data streams 70 70 00:02:54,660 --> 00:02:57,810 and that way an analyst has to work really hard to find it. 71 71 00:02:57,810 --> 00:02:59,933 Now luckily for us, there are tools that will scan 72 72 00:02:59,933 --> 00:03:01,704 an entire hard drive or file share 73 73 00:03:01,704 --> 00:03:04,770 and identify all of the alternate data streams. 74 74 00:03:04,770 --> 00:03:07,470 This way, we can identify those and then look at them 75 75 00:03:07,470 --> 00:03:09,030 to see if they contain information 76 76 00:03:09,030 --> 00:03:11,400 that's being prepared for exfiltration. 77 77 00:03:11,400 --> 00:03:13,470 In addition to looking for alternate data streams, 78 78 00:03:13,470 --> 00:03:16,410 there are tools that will scan the entire host file system 79 79 00:03:16,410 --> 00:03:19,680 for file archives, compression and encryption types 80 80 00:03:19,680 --> 00:03:22,950 and this will help you detect those data staging areas. 81 81 00:03:22,950 --> 00:03:25,980 Another great tool to use is a file system viewer. 82 82 00:03:25,980 --> 00:03:28,260 Now, a file system viewer is a tool that allows you 83 83 00:03:28,260 --> 00:03:31,800 to search the file system for certain keywords very quickly 84 84 00:03:31,800 --> 00:03:33,360 and this can include system areas, 85 85 00:03:33,360 --> 00:03:36,480 such as the recycle bin and NTFS shadow copy 86 86 00:03:36,480 --> 00:03:38,970 and system volume information stores. 87 87 00:03:38,970 --> 00:03:40,470 As you use these tools, 88 88 00:03:40,470 --> 00:03:42,870 you can start analyzing the file metadata 89 89 00:03:42,870 --> 00:03:45,690 and this will allow you to reconstruct a timeline of events 90 90 00:03:45,690 --> 00:03:48,900 that may have taken place on a particular computer. 91 91 00:03:48,900 --> 00:03:51,390 As an analyst, one of the things you're always trying to do 92 92 00:03:51,390 --> 00:03:53,070 is create a timeline. 93 93 00:03:53,070 --> 00:03:54,990 By creating that timeline, you can figure out 94 94 00:03:54,990 --> 00:03:57,990 exactly what that adversary has done on that system 95 95 00:03:57,990 --> 00:03:59,310 or on that network 96 96 00:03:59,310 --> 00:04:01,290 and that will help you better defend in the future 97 97 00:04:01,290 --> 00:04:04,410 against those attacks and reconstitute your network 98 98 00:04:04,410 --> 00:04:07,020 after an adversary has been inside one. 99 99 00:04:07,020 --> 00:04:08,043 Here on the screen, 100 100 00:04:08,961 --> 00:04:10,770 you can see a tool called the file system browser. 101 101 00:04:10,770 --> 00:04:13,830 Notice here that we can see inside that drive 102 102 00:04:13,830 --> 00:04:16,140 and we're not seeing just the files and folders, 103 103 00:04:16,140 --> 00:04:18,360 like boot and documents and settings, 104 104 00:04:18,360 --> 00:04:21,030 but we're also seeing those hidden files and folders 105 105 00:04:21,030 --> 00:04:22,800 or those system files and folders, 106 106 00:04:22,800 --> 00:04:24,840 like the ones that begin with a dollar sign. 107 107 00:04:24,840 --> 00:04:26,700 These are shadow files 108 108 00:04:26,700 --> 00:04:28,230 and these are ones that are normally hidden 109 109 00:04:28,230 --> 00:04:29,670 from the operating system, 110 110 00:04:29,670 --> 00:04:32,100 but by using a tool like file system browser, 111 111 00:04:32,100 --> 00:04:35,430 you as an analyst can go in and look at those things. 112 112 00:04:35,430 --> 00:04:37,560 Now, you can also look at these types of files 113 113 00:04:37,560 --> 00:04:39,330 by using the command line. 114 114 00:04:39,330 --> 00:04:41,160 All the way back in your A+ studies 115 115 00:04:41,160 --> 00:04:44,280 you learned about the DIR command, or dir. 116 116 00:04:44,280 --> 00:04:46,260 This Windows directory command has some 117 117 00:04:46,260 --> 00:04:49,410 advanced functionality for file system analysis. 118 118 00:04:49,410 --> 00:04:51,510 There are lots of different options that we need to consider 119 119 00:04:51,510 --> 00:04:54,420 and we're going to cover just three of them in this lesson. 120 120 00:04:54,420 --> 00:04:57,810 Now, the first one is dir/Ax. 121 121 00:04:57,810 --> 00:05:01,470 When you use dir/Ax, the X is actually going to be 122 122 00:05:01,470 --> 00:05:02,610 a variable here. 123 123 00:05:02,610 --> 00:05:06,330 So if I use /Ax it's going to then identify the filter 124 124 00:05:06,330 --> 00:05:08,160 for all the different file or folder types 125 125 00:05:08,160 --> 00:05:11,460 that will match that given parameter of X, that variable. 126 126 00:05:11,460 --> 00:05:13,593 So for example, if I use dir/AH, 127 127 00:05:14,460 --> 00:05:17,460 that's going to give me all of the hidden files and folders. 128 128 00:05:17,460 --> 00:05:19,830 To find a full list of all the different variables 129 129 00:05:19,830 --> 00:05:21,300 or parameters you could use, 130 130 00:05:21,300 --> 00:05:24,000 go ahead and look at the command line dir 131 131 00:05:24,000 --> 00:05:25,920 using the help command and it will give you 132 132 00:05:25,920 --> 00:05:27,780 all the information on it. 133 133 00:05:27,780 --> 00:05:30,360 Next, we have dir/Q. 134 134 00:05:30,360 --> 00:05:33,150 Now, for dir/Q, the /Q is going to tell us 135 135 00:05:33,150 --> 00:05:35,430 to display who owns each file. 136 136 00:05:35,430 --> 00:05:37,440 This will also give us all of our standard information, 137 137 00:05:37,440 --> 00:05:39,570 but also who owns that file. 138 138 00:05:39,570 --> 00:05:41,164 And that's important 139 139 00:05:41,164 --> 00:05:42,240 because if we start seeing files that should be 140 140 00:05:42,240 --> 00:05:44,070 owned by a particular user, 141 141 00:05:44,070 --> 00:05:45,780 but they're now being owned by system 142 142 00:05:45,780 --> 00:05:49,290 or some other driver or device, that could actually indicate 143 143 00:05:49,290 --> 00:05:52,710 that that file has been taken over by an adversary. 144 144 00:05:52,710 --> 00:05:55,320 And the third one we have is dir/R. 145 145 00:05:55,320 --> 00:05:56,820 Now, this is a capital R. 146 146 00:05:56,820 --> 00:05:58,710 The /R is going to display 147 147 00:05:58,710 --> 00:06:01,440 all the alternate data streams for a file. 148 148 00:06:01,440 --> 00:06:02,790 This is another way for us to find 149 149 00:06:02,790 --> 00:06:05,010 those alternate data streams and figure out 150 150 00:06:05,010 --> 00:06:06,660 if there are any things that are being hidden 151 151 00:06:06,660 --> 00:06:08,220 inside of them. 152 152 00:06:08,220 --> 00:06:11,610 Now, another type of disk or file indicator of compromise 153 153 00:06:11,610 --> 00:06:14,490 occurs when you start seeing your hard drive fill up. 154 154 00:06:14,490 --> 00:06:16,830 If the drive starts losing capacity, 155 155 00:06:16,830 --> 00:06:19,980 that could be an indication that something bad is happening. 156 156 00:06:19,980 --> 00:06:21,210 Now, it's also just an indication 157 157 00:06:21,210 --> 00:06:22,980 that somebody's using a lot of hard drive space, 158 158 00:06:22,980 --> 00:06:25,020 but when you see something like that, 159 159 00:06:25,020 --> 00:06:26,370 you do want to question it. 160 160 00:06:26,370 --> 00:06:28,380 If you're used to seeing lots of free space 161 161 00:06:28,380 --> 00:06:30,840 on a given hard drive for your baseline assets, 162 162 00:06:30,840 --> 00:06:32,820 but now you're seeing very little space, 163 163 00:06:32,820 --> 00:06:36,180 that machine may be used to stage information. 164 164 00:06:36,180 --> 00:06:37,680 That means people are taking information 165 165 00:06:37,680 --> 00:06:40,680 from all over the network and putting it on that one machine 166 166 00:06:40,680 --> 00:06:42,540 in preparation for the adversary to take it 167 167 00:06:42,540 --> 00:06:45,930 from that machine and then upload it to their own servers. 168 168 00:06:45,930 --> 00:06:46,890 When this happens, 169 169 00:06:46,890 --> 00:06:50,220 essentially malware is starting to cache those files locally 170 170 00:06:50,220 --> 00:06:52,350 for later exfiltration over the network 171 171 00:06:52,350 --> 00:06:55,170 or later on if somebody plugs in a USB device 172 172 00:06:55,170 --> 00:06:57,150 to download all those things locally. 173 173 00:06:57,150 --> 00:06:58,650 Both of these are reasons why you may see 174 174 00:06:58,650 --> 00:07:00,420 the hard drive filling up and having 175 175 00:07:00,420 --> 00:07:03,480 a very high capacity consumption being used. 176 176 00:07:03,480 --> 00:07:05,280 Now, the next tool we want to talk about 177 177 00:07:05,280 --> 00:07:07,260 is disc utilization tools. 178 178 00:07:07,260 --> 00:07:09,480 So, instead of just going into my computer 179 179 00:07:09,480 --> 00:07:11,550 and looking and seeing if your hard drive is filled, 180 180 00:07:11,550 --> 00:07:13,560 you can actually use a tool to do that. 181 181 00:07:13,560 --> 00:07:16,380 And disk utilization tools can actually scan a file system 182 182 00:07:16,380 --> 00:07:20,010 and retrieve a comprehensive list of different statistics. 183 183 00:07:20,010 --> 00:07:21,930 This may give you other information about it, 184 184 00:07:21,930 --> 00:07:24,990 such as a visual representation of the storage space 185 185 00:07:24,990 --> 00:07:26,760 so you know how much is being used. 186 186 00:07:26,760 --> 00:07:28,380 It might provide you with a directory listing 187 187 00:07:28,380 --> 00:07:30,750 of that storage space, telling you all the different files 188 188 00:07:30,750 --> 00:07:33,810 and folders in it, and it can also give you real-time usage 189 189 00:07:33,810 --> 00:07:36,360 of data being written to that disk. 190 190 00:07:36,360 --> 00:07:38,460 All of these are good indicators you can use 191 191 00:07:38,460 --> 00:07:41,190 to develop your indicators of compromise. 192 192 00:07:41,190 --> 00:07:42,570 Now, in the rest of this lesson, 193 193 00:07:42,570 --> 00:07:45,450 we are going to talk about some specific tools for Linux, 194 194 00:07:45,450 --> 00:07:48,060 because we just covered a lot of Windows tools. 195 195 00:07:48,060 --> 00:07:50,700 Now, when I talk about Linux file system analysis tools, 196 196 00:07:50,700 --> 00:07:52,200 there are many of them out there, 197 197 00:07:52,200 --> 00:07:57,030 but the ones we're going to cover are lsof, df and du. 198 198 00:07:57,030 --> 00:07:59,400 Now, lsof is a tool that retrieves a list 199 199 00:07:59,400 --> 00:08:01,440 of all the files that are currently open 200 200 00:08:01,440 --> 00:08:03,330 on the operating system. 201 201 00:08:03,330 --> 00:08:05,100 This allows us to quickly get a list 202 202 00:08:05,100 --> 00:08:08,700 of all the resources that a process is currently using. 203 203 00:08:08,700 --> 00:08:09,990 Now, why is that? 204 204 00:08:09,990 --> 00:08:11,490 Well, it's because in Linux, 205 205 00:08:11,490 --> 00:08:13,500 everything is treated as a file, 206 206 00:08:13,500 --> 00:08:16,830 whether it's a file, a folder, a disk, 207 207 00:08:16,830 --> 00:08:18,810 or even a resource like a printer. 208 208 00:08:18,810 --> 00:08:20,760 All of those are considered files 209 209 00:08:20,760 --> 00:08:22,440 inside the Linux operating system, 210 210 00:08:22,440 --> 00:08:24,690 so using lsof can quickly get us list 211 211 00:08:24,690 --> 00:08:26,700 of all of those resources. 212 212 00:08:26,700 --> 00:08:31,700 For example, let's say I did lsof -u root -a p 1645. 213 213 00:08:34,950 --> 00:08:36,270 What does that say? 214 214 00:08:36,270 --> 00:08:39,300 Well, this says I want to show all of the files 215 215 00:08:39,300 --> 00:08:41,640 that are currently open on this computer 216 216 00:08:41,640 --> 00:08:43,800 that were opened by the user root 217 217 00:08:43,800 --> 00:08:48,360 and they're actively using the process number 1645. 218 218 00:08:48,360 --> 00:08:50,670 And this way I can find everything that's associated 219 219 00:08:50,670 --> 00:08:52,500 with that particular process. 220 220 00:08:52,500 --> 00:08:54,600 This is really helpful when you start doing 221 221 00:08:54,600 --> 00:08:57,540 adversary hunting and you start having pieces of information 222 222 00:08:57,540 --> 00:09:00,150 like you know there was a malicious process that was run 223 223 00:09:00,150 --> 00:09:02,250 and now you want to see everything else that was launched 224 224 00:09:02,250 --> 00:09:03,570 from that process. 225 225 00:09:03,570 --> 00:09:06,360 This type of a command can allow you to do that. 226 226 00:09:06,360 --> 00:09:08,430 Next, we want to talk about df. 227 227 00:09:08,430 --> 00:09:11,370 Now, df is a tool that retrieves how much disk space 228 228 00:09:11,370 --> 00:09:13,980 is being used by all mounted file systems 229 229 00:09:13,980 --> 00:09:16,680 and how much space is available for each. 230 230 00:09:16,680 --> 00:09:18,930 Essentially, df is going to find out 231 231 00:09:18,930 --> 00:09:20,610 how much disk space is there 232 232 00:09:20,610 --> 00:09:22,560 for all of your different disks. 233 233 00:09:22,560 --> 00:09:25,447 Now, the other command we want to talk about is du. 234 234 00:09:25,447 --> 00:09:27,480 And du is a tool that enables you to retrieve 235 235 00:09:27,480 --> 00:09:30,210 how much disk space each directory is using 236 236 00:09:30,210 --> 00:09:32,250 based on a specified directory. 237 237 00:09:32,250 --> 00:09:35,520 So when we deal with df, we're dealing with the entire disk. 238 238 00:09:35,520 --> 00:09:36,833 When we're dealing with du, 239 239 00:09:37,863 --> 00:09:39,030 we are dealing with a specific directory. 240 240 00:09:39,030 --> 00:09:41,190 Sometimes you want to look at the full disk, 241 241 00:09:41,190 --> 00:09:43,260 sometimes you want to look at the directory. 242 242 00:09:43,260 --> 00:09:46,260 For example, if I was using something on a server, 243 243 00:09:46,260 --> 00:09:48,300 I would be more inclined to look at a directory, 244 244 00:09:48,300 --> 00:09:49,740 instead of the full disc. 245 245 00:09:49,740 --> 00:09:51,750 If I was looking at a workstation, on the other hand, 246 246 00:09:51,750 --> 00:09:54,030 I'd be more inclined to look at df 247 247 00:09:54,030 --> 00:09:55,770 looking at the disk itself. 248 248 00:09:55,770 --> 00:09:58,860 Now, if I'm going to use du, how would I use that command? 249 249 00:09:58,860 --> 00:10:03,510 Well, I would type something like this: du/var/log. 250 250 00:10:03,510 --> 00:10:06,930 This will tell me how much space is the log directory using 251 251 00:10:06,930 --> 00:10:08,760 on this particular computer. 252 252 00:10:08,760 --> 00:10:11,310 That would be a good indication if I'm above baseline, 253 253 00:10:11,310 --> 00:10:15,300 below baseline, or at baseline of what I expect to see. 254 254 00:10:15,300 --> 00:10:16,350 The final thing we need to talk 255 255 00:10:16,350 --> 00:10:19,950 about when we talk about disk and file IOCs is cryptography 256 256 00:10:19,950 --> 00:10:22,320 because a lot of times people will encrypt files 257 257 00:10:22,320 --> 00:10:25,260 in preparation for staging, like we talked about before. 258 258 00:10:25,260 --> 00:10:27,750 Now you can use cryptographic analysis tools 259 259 00:10:27,750 --> 00:10:29,880 to help you determine the type of encryption algorithm 260 260 00:10:29,880 --> 00:10:31,890 that's being used and assess the strength 261 261 00:10:31,890 --> 00:10:33,360 of the encryption key. 262 262 00:10:33,360 --> 00:10:35,100 If you find some directories or files 263 263 00:10:35,100 --> 00:10:37,860 on your drive that are encrypted and you didn't encrypt them 264 264 00:10:37,860 --> 00:10:39,570 and your user didn't encrypt them, 265 265 00:10:39,570 --> 00:10:42,300 this might be something that's being used as staging. 266 266 00:10:42,300 --> 00:10:43,380 Now, as you look at that, 267 267 00:10:43,380 --> 00:10:45,570 you want to find out what's inside those files. 268 268 00:10:45,570 --> 00:10:47,970 Well, to do that, you're going to have to analyze them 269 269 00:10:47,970 --> 00:10:49,710 using cryptography to figure out 270 270 00:10:49,710 --> 00:10:53,070 if you can even open those or figure out what that key is. 271 271 00:10:53,070 --> 00:10:54,960 Now, just like we use encryption to protect 272 272 00:10:54,960 --> 00:10:57,690 our data from attackers, attackers use encryption 273 273 00:10:57,690 --> 00:10:59,430 to protect our data from us 274 274 00:10:59,430 --> 00:11:01,170 because they're trying to steal that data. 275 275 00:11:01,170 --> 00:11:03,270 And so as an analyst, you have to recover 276 276 00:11:03,270 --> 00:11:05,970 or brute force the user password to be able to obtain 277 277 00:11:05,970 --> 00:11:08,670 the decryption key for an encrypted volume. 278 278 00:11:08,670 --> 00:11:10,440 And so, if there's some piece of malware 279 279 00:11:10,440 --> 00:11:13,830 or ransomware or an attacker that has encrypted these files, 280 280 00:11:13,830 --> 00:11:16,800 without that key, those files are as good as gone. 281 281 00:11:16,800 --> 00:11:17,970 You won't be able to read them 282 282 00:11:17,970 --> 00:11:19,870 and you won't be able to analyze them.