Instructor: Unauthorized Software. 2 2
Unauthorized software is one of the most obvious 3 3
IOCs that you can encounter. 4 4
Essentially, you find some piece of software 5 5
that shouldn't be there. 6 6
It could be a worm, a virus, a Trojan, 7 7
or any other kind of malware. 8 8
If you see this and you get a malware alert, 9 9
this is an indicator 10 10
that something is there that shouldn't be, 11 11
and this is unauthorized software. 12 12
Now, in addition to these obvious examples of malware, 13 13
there are more subtle software-based indicators 14 14
of compromise that could involve the presence 15 15
of attack tools on a given system, 16 16
because a lot of the attack tools that are out there 17 17
are actually used by system administrators as well. 18 18
For example, we've talked about Netcat before, 19 19
we've talked about Nmap before, and Wireshark. 20 20
All of these are tools that can be used 21 21
by an analyst or an administrator, 22 22
but they can also be used by an attacker. 23 23
So when you find them, 24 24
you have to determine are they authorized or not? 25 25
And if they aren't, that could be an indicator of compromise 26 26
of that system that some attacker's now put new tools 27 27
on that system for them to use. 28 28
Now, unauthorized software doesn't always have to mean 29 29
some kind of malware or admin tool. 30 30
It can just be software 31 31
that a user isn't permitted to install themself. 32 32
For example, unauthorized software can include 33 33
legitimate software that shouldn't be installed 34 34
on a particular workstation. 35 35
In one company I worked at, we had a lot of users 36 36
who would want a particular piece of software, 37 37
maybe something like Adobe Acrobat or Microsoft Visio, 38 38
and if we didn't provide it for them, 39 39
they would go to the store, buy it themself, 40 40
and then try to install it on the computer. 41 41
Now, if they were successful in doing that, 42 42
that is technically unauthorized software, 43 43
because they weren't approved 44 44
to install it on that workstation. 45 45
And now the big problem with this 46 46
isn't that that piece of software was bad, 47 47
but it now introduces new vulnerabilities, 48 48
because we have to know it's there so we can patch it 49 49
and update it and make sure we have a valid license for it 50 50
and all of those type of things. 51 51
So all of those things are things you have to consider 52 52
as well when you're dealing with software. 53 53
Another area of concern is if users start installing 54 54
other services on their machines. 55 55
For example, Apache may be an authorized 56 56
piece of software for you to install on a web server, 57 57
but does that mean that everyone in the organization 58 58
should be able to install Apache on their workstation 59 59
and run their own web server? 60 60
Well, of course not. 61 61
That would be silly, because it would be something 62 62
that would be a big glaring vulnerability. 63 63
So as we're scanning our network 64 64
and looking for different pieces of software, 65 65
these are the kind of things we're looking for, 66 66
things that are out of place, things that are not authorized 67 67
and shouldn't be out there on those given workstations. 68 68
Now, another thing an attacker can do 69 69
is they can modify normal files for malicious use. 70 70
For example, think about your host file on a computer. 71 71
If you think back to your A+ studies, 72 72
you'll remember that a host file is essentially a local DNS. 73 73
So if I modify that host file 74 74
and I change youtube.com to a particular IP address, 75 75
it's always going to trust the host file over the DNS server. 76 76
It checks there first, and so I can actually bypass 77 77
you going to a valid DNS server by using your host file 78 78
and modifying it as an attacker. 79 79
And so this is something to keep in mind as well. 80 80
As you conduct the analysis of a workstation, 81 81
you're going to come across a lot of different files out there, 82 82
and a lot of different file types 83 83
based on the applications that are installed. 84 84
Now, to look at these, you're going to have to use 85 85
an application viewer in some cases. 86 86
Most of your forensic toolkits, such as Encase shown here, 87 87
can go in and read a lot of these different file formats. 88 88
For example, here I'm looking at the webcache 89 89
for a particular internet browser. 90 90
This allows me to go into that 91 91
and I can see what has been cashed and what has been viewed 92 92
by that user with that web browser by going through it. 93 93
In addition to that, it will allow me to go through 94 94
and look at lots of different pieces of information 95 95
and create a timeline from it. 96 96
These application viewers can allow you to go in 97 97
and look for different types of applications and files, 98 98
such as browser histories and cookies, 99 99
examining contact databases, looking at email mailboxes, 100 100
or even extracting histories of calls from VoIP software. 101 101
As I said, most forensic toolkits 102 102
can view application usage and history, 103 103
so if you're using something like Encase or FTK, 104 104
or even the Sleuth toolkit, they have this capability 105 105
and it makes your job a lot easier. 106 106
Another thing we have to consider 107 107
in our analysis is prefetch files. 108 108
Now, prefetch files are files that record the names 109 109
of applications that have been run, 110 110
as well as the date and time, the file path, the run count, 111 111
and the DLLs that were used by the executable. 112 112
This is a treasure trove of information 113 113
for the cybersecurity analyst, 114 114
because these prefetch files have a lot of information 115 115
about what has been done as you ran this executable. 116 116
And so if you are running some kind of a piece of malware, 117 117
you can get a lot of information 118 118
from these prefetch files as well. 119 119
Now, in addition to those prefetch files, 120 120
you also want to look at the shimcache. 121 121
Now, a shimcache is an application usage cache 122 122
that is stored as a registry key. 123 123
This allows you to go in and use this as an artifact 124 124
as you're generating a timeline 125 125
and you're trying to figure out exactly 126 126
what happened when on a given system. 127 127
If you're looking for the shimcache, 128 128
you can find it at HKLM/SYSTEM/CurrentControlSet 129 129
/Control/SessionManager/AppCompatCache 130 130
/AppCompatCache. 131 131
Now, I know that's really long and complicated. 132 132
You do not need to memorize that location for the exam, 133 133
but in the real world, it is something helpful 134 134
and something you should be familiar with. 135 135
The last one we want to talk about is the Amcache. 136 136
Now, Amcache is an application usage cache 137 137
that's stored as a hive file, and you can find this 138 138
on the C drive under the Windows directory, 139 139
/appcompat/Programs/Amcache.hve. 140 140
Again, this is a hive file, and so it can't be opened 141 141
by the reg edit tool, but it can be inspected 142 142
by different file system forensic tools like Encase and FTK.