Narrator: Application-related Indicators of Compromise. 2 2
In this lesson, we're going to talk about the importance 3 3
of looking at application-related indicators of compromise. 4 4
Now this is important 5 5
because by observing application behavior, 6 6
we can start to identify and reveal signs of an intrusion. 7 7
Now a lot of this is going to overlap 8 8
with some of the things we looked at in host-based analysis 9 9
for those IOCs as well. 10 10
But this is more 11 11
than just looking at the operating system itself. 12 12
It's more focused on the applications 13 13
that run on top of that operating system. 14 14
For example, while it's common that most of our applications 15 15
that are attached to our operating systems 16 16
or run on top of those operating systems 17 17
could be subject to malware these days, 18 18
so can web applications. 19 19
By observing their behavior inside these applications 20 20
and analyzing their code 21 21
or analyzing the changes they make to a system 22 22
or procedure call, 23 23
we're going to be able to identify indicators of compromise 24 24
that we can use to identify other infected systems 25 25
from those same applications. 26 26
Now when it comes to identifying these different types 27 27
of indicators of compromise, where can we find them? 28 28
Well, the most commonplace is our application logs. 29 29
These application logs can provide indicators of compromise 30 30
for us, and we're going to go through some of those logs 31 31
in this section of the course. 32 32
Now the final area that we have to consider 33 33
is virtualization, 34 34
because a lot of our applications these days 35 35
are run in containers, using things like Docker 36 36
and other containerization mechanisms. 37 37
This allows applications to run 38 38
inside a virtualized environment, 39 39
and so we are going to spend some time 40 40
looking at virtualization as well inside this section.