1 1 00:00:00,480 --> 00:00:02,550 Anomalous activity. 2 2 00:00:02,550 --> 00:00:04,740 In this lesson, we're going to look for indicators 3 3 00:00:04,740 --> 00:00:08,250 of compromise that are made up of anomalous activity. 4 4 00:00:08,250 --> 00:00:10,710 Now, when I talk about anomalous activity, 5 5 00:00:10,710 --> 00:00:13,050 this means we need to look in different areas, 6 6 00:00:13,050 --> 00:00:15,990 such as web applications, databases, 7 7 00:00:15,990 --> 00:00:19,020 DNS services, and remote access servers. 8 8 00:00:19,020 --> 00:00:20,880 By looking at these, we can identify 9 9 00:00:20,880 --> 00:00:23,280 anything that looks unusual to us. 10 10 00:00:23,280 --> 00:00:24,630 If it's something that's unusual, 11 11 00:00:24,630 --> 00:00:26,550 that would be deemed anomalous, 12 12 00:00:26,550 --> 00:00:28,470 and based on that anomalous activity, 13 13 00:00:28,470 --> 00:00:32,400 this can then be categorized as benign, meaning harmless, 14 14 00:00:32,400 --> 00:00:35,190 or something that is malicious that we have to identify 15 15 00:00:35,190 --> 00:00:37,890 as a potential indicator of compromise. 16 16 00:00:37,890 --> 00:00:40,650 Now, as we start looking at this anomalous activity, 17 17 00:00:40,650 --> 00:00:42,930 there are lots of different symptoms of it. 18 18 00:00:42,930 --> 00:00:45,420 This can include things like strange log entries, 19 19 00:00:45,420 --> 00:00:48,540 excessive per process ports and resource consumption, 20 20 00:00:48,540 --> 00:00:50,520 and unusual user accounts. 21 21 00:00:50,520 --> 00:00:51,540 We've mentioned some of these 22 22 00:00:51,540 --> 00:00:54,090 when we looked at host-based IOCs earlier, 23 23 00:00:54,090 --> 00:00:56,640 but now we're going to dig a little bit deeper. 24 24 00:00:56,640 --> 00:00:58,110 Now, as we start looking at these, 25 25 00:00:58,110 --> 00:01:01,650 we might have things like unexpected outbound communication, 26 26 00:01:01,650 --> 00:01:04,410 unexpected output, or service defacement, 27 27 00:01:04,410 --> 00:01:06,030 and we're going to talk about each of these three 28 28 00:01:06,030 --> 00:01:07,380 in this lesson. 29 29 00:01:07,380 --> 00:01:10,500 First, unexpected outbound communication. 30 30 00:01:10,500 --> 00:01:12,630 In this area, we are looking through all 31 31 00:01:12,630 --> 00:01:15,330 of our network connections and trying to identify them 32 32 00:01:15,330 --> 00:01:16,740 and make sure we understand them, 33 33 00:01:16,740 --> 00:01:19,710 and that any outbound connections are approved. 34 34 00:01:19,710 --> 00:01:22,890 If I'm looking through my firewall logs or my router logs 35 35 00:01:22,890 --> 00:01:25,080 and I start seeing a lot of connections going out 36 36 00:01:25,080 --> 00:01:26,610 and I don't know where they're going 37 37 00:01:26,610 --> 00:01:27,870 and I haven't approved them, 38 38 00:01:27,870 --> 00:01:30,840 that could be an unexpected outbound communication. 39 39 00:01:30,840 --> 00:01:33,240 That could be a sign that there's a C2 channel, 40 40 00:01:33,240 --> 00:01:36,030 or beaconing, or something like that that's going on, 41 41 00:01:36,030 --> 00:01:38,100 and it's something that I want to look into further. 42 42 00:01:38,100 --> 00:01:40,080 All of that is stuff that could be categorized 43 43 00:01:40,080 --> 00:01:42,120 as anomalous activity. 44 44 00:01:42,120 --> 00:01:44,820 The second area is unexpected output. 45 45 00:01:44,820 --> 00:01:46,800 Now, unexpected output can occur 46 46 00:01:46,800 --> 00:01:49,620 when you have unusual request patterns or responses, 47 47 00:01:49,620 --> 00:01:53,580 and these can be indicative of an ongoing or past attack. 48 48 00:01:53,580 --> 00:01:56,070 For example, if you have a web application 49 49 00:01:56,070 --> 00:01:58,140 and when you go and run a query against it, 50 50 00:01:58,140 --> 00:02:01,350 you get some sort of unexpected output from that query, 51 51 00:02:01,350 --> 00:02:04,290 that could indicate that that server has been under attack 52 52 00:02:04,290 --> 00:02:06,660 either now or in the past, and so it is something 53 53 00:02:06,660 --> 00:02:08,610 you'd want to look into further. 54 54 00:02:08,610 --> 00:02:11,310 Now, in addition to looking for unexpected output, 55 55 00:02:11,310 --> 00:02:14,550 sometimes that output can come in the form of code. 56 56 00:02:14,550 --> 00:02:17,400 For example, if you're trying to detect a code injection, 57 57 00:02:17,400 --> 00:02:20,160 you can do this by monitoring the number of database reads 58 58 00:02:20,160 --> 00:02:24,060 or examining the HTTP response packet sizes. 59 59 00:02:24,060 --> 00:02:25,500 If you're using a web application, 60 60 00:02:25,500 --> 00:02:27,210 and it makes a call to a database 61 61 00:02:27,210 --> 00:02:30,030 and gets back a very large amount of information, 62 62 00:02:30,030 --> 00:02:32,460 it could be a symptom that you had a code injection, 63 63 00:02:32,460 --> 00:02:34,920 like an SQL injection, that is now returning 64 64 00:02:34,920 --> 00:02:38,430 all of the database instead of just a single query. 65 65 00:02:38,430 --> 00:02:40,530 Additionally, if you find an application 66 66 00:02:40,530 --> 00:02:42,720 that's displaying unformatted error messages 67 67 00:02:42,720 --> 00:02:45,270 or strange strings, this could be an indication 68 68 00:02:45,270 --> 00:02:47,430 of an application that's been tampered with, 69 69 00:02:47,430 --> 00:02:51,030 and again, this is another form of unexpected output. 70 70 00:02:51,030 --> 00:02:54,180 Now, the third category we have is service defacement. 71 71 00:02:54,180 --> 00:02:55,980 When we talk about service defacement, 72 72 00:02:55,980 --> 00:02:58,860 this occurs when an attacker gains control of a web server 73 73 00:02:58,860 --> 00:03:01,260 and alters the website's presentation. 74 74 00:03:01,260 --> 00:03:03,870 This can be done for lots of different reasons. 75 75 00:03:03,870 --> 00:03:07,170 For example, some defacement attacks are like this, 76 76 00:03:07,170 --> 00:03:08,467 where they're just trying to show somebody, 77 77 00:03:08,467 --> 00:03:10,650 "Hey, I was able to break into your system, 78 78 00:03:10,650 --> 00:03:12,060 and you should really fix your system 79 79 00:03:12,060 --> 00:03:13,950 because it's vulnerable to attack," 80 80 00:03:13,950 --> 00:03:16,620 and they're doing it more just as a way to get credibility 81 81 00:03:16,620 --> 00:03:18,540 as a hacker in the community. 82 82 00:03:18,540 --> 00:03:20,880 But it can also be more subtle than this. 83 83 00:03:20,880 --> 00:03:23,640 There are some cases where companies have been attacked, 84 84 00:03:23,640 --> 00:03:26,070 and somebody has gone in and modified their website 85 85 00:03:26,070 --> 00:03:29,640 just slightly to put out different branding and messaging. 86 86 00:03:29,640 --> 00:03:33,060 This can actually have a negative effect on the company. 87 87 00:03:33,060 --> 00:03:36,390 For example, maybe an attacker has taken over a website 88 88 00:03:36,390 --> 00:03:38,550 for a health food store, and they started posting 89 89 00:03:38,550 --> 00:03:40,260 a lot of products that have chemicals in them 90 90 00:03:40,260 --> 00:03:41,550 and things like that. 91 91 00:03:41,550 --> 00:03:43,620 That can actually be negative for that store 92 92 00:03:43,620 --> 00:03:46,290 and much more subtle and less likely to be detected 93 93 00:03:46,290 --> 00:03:48,000 for a longer period of time. 94 94 00:03:48,000 --> 00:03:50,760 This is, again, a type of website defacement. 95 95 00:03:50,760 --> 00:03:52,830 If you find that your organization's website 96 96 00:03:52,830 --> 00:03:54,900 has been defaced, you want to go in 97 97 00:03:54,900 --> 00:03:56,850 and restore to a known good backup, 98 98 00:03:56,850 --> 00:03:58,560 and then you want to go through and figure out 99 99 00:03:58,560 --> 00:04:00,720 how they were able to get into your website 100 100 00:04:00,720 --> 00:04:03,520 and change it so you can block them from doing it again.