Narrator: Anomalous activity. 2 2
In this lesson, we're going to look for indicators 3 3
of compromise that are made up of anomalous activity. 4 4
Now, when I talk about anomalous activity, 5 5
this means we need to look in different areas, 6 6
such as web applications, databases, 7 7
DNS services, and remote access servers. 8 8
By looking at these, we can identify 9 9
anything that looks unusual to us. 10 10
If it's something that's unusual, 11 11
that would be deemed anomalous, 12 12
and based on that anomalous activity, 13 13
this can then be categorized as benign, meaning harmless, 14 14
or something that is malicious that we have to identify 15 15
as a potential indicator of compromise. 16 16
Now, as we start looking at this anomalous activity, 17 17
there are lots of different symptoms of it. 18 18
This can include things like strange log entries, 19 19
excessive per process ports and resource consumption, 20 20
and unusual user accounts. 21 21
We've mentioned some of these 22 22
when we looked at host-based IOCs earlier, 23 23
but now we're going to dig a little bit deeper. 24 24
Now, as we start looking at these, 25 25
we might have things like unexpected outbound communication, 26 26
unexpected output, or service defacement, 27 27
and we're going to talk about each of these three 28 28
in this lesson. 29 29
First, unexpected outbound communication. 30 30
In this area, we are looking through all 31 31
of our network connections and trying to identify them 32 32
and make sure we understand them, 33 33
and that any outbound connections are approved. 34 34
If I'm looking through my firewall logs or my router logs 35 35
and I start seeing a lot of connections going out 36 36
and I don't know where they're going 37 37
and I haven't approved them, 38 38
that could be an unexpected outbound communication. 39 39
That could be a sign that there's a C2 channel, 40 40
or beaconing, or something like that that's going on, 41 41
and it's something that I want to look into further. 42 42
All of that is stuff that could be categorized 43 43
as anomalous activity. 44 44
The second area is unexpected output. 45 45
Now, unexpected output can occur 46 46
when you have unusual request patterns or responses, 47 47
and these can be indicative of an ongoing or past attack. 48 48
For example, if you have a web application 49 49
and when you go and run a query against it, 50 50
you get some sort of unexpected output from that query, 51 51
that could indicate that that server has been under attack 52 52
either now or in the past, and so it is something 53 53
you'd want to look into further. 54 54
Now, in addition to looking for unexpected output, 55 55
sometimes that output can come in the form of code. 56 56
For example, if you're trying to detect a code injection, 57 57
you can do this by monitoring the number of database reads 58 58
or examining the HTTP response packet sizes. 59 59
If you're using a web application, 60 60
and it makes a call to a database 61 61
and gets back a very large amount of information, 62 62
it could be a symptom that you had a code injection, 63 63
like an SQL injection, that is now returning 64 64
all of the database instead of just a single query. 65 65
Additionally, if you find an application 66 66
that's displaying unformatted error messages 67 67
or strange strings, this could be an indication 68 68
of an application that's been tampered with, 69 69
and again, this is another form of unexpected output. 70 70
Now, the third category we have is service defacement. 71 71
When we talk about service defacement, 72 72
this occurs when an attacker gains control of a web server 73 73
and alters the website's presentation. 74 74
This can be done for lots of different reasons. 75 75
For example, some defacement attacks are like this, 76 76
where they're just trying to show somebody, 77 77
"Hey, I was able to break into your system, 78 78
and you should really fix your system 79 79
because it's vulnerable to attack," 80 80
and they're doing it more just as a way to get credibility 81 81
as a hacker in the community. 82 82
But it can also be more subtle than this. 83 83
There are some cases where companies have been attacked, 84 84
and somebody has gone in and modified their website 85 85
just slightly to put out different branding and messaging. 86 86
This can actually have a negative effect on the company. 87 87
For example, maybe an attacker has taken over a website 88 88
for a health food store, and they started posting 89 89
a lot of products that have chemicals in them 90 90
and things like that. 91 91
That can actually be negative for that store 92 92
and much more subtle and less likely to be detected 93 93
for a longer period of time. 94 94
This is, again, a type of website defacement. 95 95
If you find that your organization's website 96 96
has been defaced, you want to go in 97 97
and restore to a known good backup, 98 98
and then you want to go through and figure out 99 99
how they were able to get into your website 100 100
and change it so you can block them from doing it again.