1
1

00:00:00,360  -->  00:00:03,570
<v Narrator>Application-related Indicators of Compromise.</v>
2

2

00:00:03,570  -->  00:00:05,940
In this lesson, we're going to talk about the importance
3

3

00:00:05,940  -->  00:00:09,540
of looking at application-related indicators of compromise.
4

4

00:00:09,540  -->  00:00:10,530
Now this is important
5

5

00:00:10,530  -->  00:00:13,020
because by observing application behavior,
6

6

00:00:13,020  -->  00:00:16,950
we can start to identify and reveal signs of an intrusion.
7

7

00:00:16,950  -->  00:00:19,230
Now a lot of this is going to overlap
8

8

00:00:19,230  -->  00:00:22,350
with some of the things we looked at in host-based analysis
9

9

00:00:22,350  -->  00:00:24,240
for those IOCs as well.
10

10

00:00:24,240  -->  00:00:25,260
But this is more
11

11

00:00:25,260  -->  00:00:27,750
than just looking at the operating system itself.
12

12

00:00:27,750  -->  00:00:29,610
It's more focused on the applications
13

13

00:00:29,610  -->  00:00:32,430
that run on top of that operating system.
14

14

00:00:32,430  -->  00:00:35,760
For example, while it's common that most of our applications
15

15

00:00:35,760  -->  00:00:37,560
that are attached to our operating systems
16

16

00:00:37,560  -->  00:00:39,450
or run on top of those operating systems
17

17

00:00:39,450  -->  00:00:41,550
could be subject to malware these days,
18

18

00:00:41,550  -->  00:00:43,560
so can web applications.
19

19

00:00:43,560  -->  00:00:46,620
By observing their behavior inside these applications
20

20

00:00:46,620  -->  00:00:47,880
and analyzing their code
21

21

00:00:47,880  -->  00:00:49,920
or analyzing the changes they make to a system
22

22

00:00:49,920  -->  00:00:51,240
or procedure call,
23

23

00:00:51,240  -->  00:00:54,150
we're going to be able to identify indicators of compromise
24

24

00:00:54,150  -->  00:00:56,940
that we can use to identify other infected systems
25

25

00:00:56,940  -->  00:00:58,893
from those same applications.
26

26

00:01:00,000  -->  00:01:02,550
Now when it comes to identifying these different types
27

27

00:01:02,550  -->  00:01:05,460
of indicators of compromise, where can we find them?
28

28

00:01:05,460  -->  00:01:08,640
Well, the most commonplace is our application logs.
29

29

00:01:08,640  -->  00:01:11,550
These application logs can provide indicators of compromise
30

30

00:01:11,550  -->  00:01:14,040
for us, and we're going to go through some of those logs
31

31

00:01:14,040  -->  00:01:16,050
in this section of the course.
32

32

00:01:16,050  -->  00:01:17,820
Now the final area that we have to consider
33

33

00:01:17,820  -->  00:01:19,200
is virtualization,
34

34

00:01:19,200  -->  00:01:21,210
because a lot of our applications these days
35

35

00:01:21,210  -->  00:01:24,120
are run in containers, using things like Docker
36

36

00:01:24,120  -->  00:01:26,460
and other containerization mechanisms.
37

37

00:01:26,460  -->  00:01:28,230
This allows applications to run
38

38

00:01:28,230  -->  00:01:30,030
inside a virtualized environment,
39

39

00:01:30,030  -->  00:01:31,590
and so we are going to spend some time
40

40

00:01:31,590  -->  00:01:34,413
looking at virtualization as well inside this section.