Instructor: Service interruptions. 2 2
Service interruptions are another area 3 3
that you should consider when developing your IOCs. 4 4
Now, just because there's a service interruption though, 5 5
it doesn't mean that this is an indicator 6 6
that you've been attacked. 7 7
Sometimes, application services may fail to start 8 8
or stop unexpectedly for any number of different reasons. 9 9
Some may be a maintenance issue, 10 10
some may be normal wear and tear, 11 11
and some may be that you're under attack. 12 12
Now, if you have failed application services, 13 13
this is any application interruption 14 14
that's caused by a service either failing to start 15 15
or halting abruptly. 16 16
If you want to identify 17 17
any of these failed application services 18 18
the best thing to do is look through your logs. 19 19
In your logs, 20 20
you should be able to have a full history 21 21
of every service that was started or abruptly stopped. 22 22
Now, as you look through those failed application services 23 23
and those logs, you're going to have to determine 24 24
if this was something that was malicious 25 25
or if it was something that's just benign 26 26
and happened as an accident. 27 27
As you do this, 28 28
you need to consider a lot of different things 29 29
from your cybersecurity perspective as an analyst. 30 30
First, you want to consider 31 31
if security services are prevented from running. 32 32
This can be an indication 33 33
that there is something malicious on the system. 34 34
Many times malware will install itself 35 35
and then prevent other security softwares 36 36
such as antivirus from loading in the background. 37 37
Second, you want to consider the process 38 38
that's running the service 39 39
and whether or not it's compromised. 40 40
If you find something malicious, 41 41
you can then look at that process 42 42
and see which process launched that malicious process. 43 43
If it was something that was a system process, for example, 44 44
that may indicate that the entire system is compromised 45 45
and something you need to look into. 46 46
Third, the service may be disabled by a DDoS or a DoS. 47 47
In this case, you may have a denial of service going on, 48 48
and if this is happening, this would be a clear indicator 49 49
or compromise that you'd want to make note of. 50 50
And fourth, you want to check for excessive bandwidth usage, 51 51
because if there's excessive bandwidth usage 52 52
this could disrupt your service as well. 53 53
Now, just because there's 54 54
a large amount of bandwidth being used doesn't mean 55 55
you're actually under attack though. 56 56
This could actually be real traffic from your users 57 57
that's all just happening at the same time. 58 58
For example, if there's a big world event, 59 59
and all your users tried to go and look at the news 60 60
right at the same time that could cause 61 61
a denial of service for your service 62 62
due to excessive bandwidth. 63 63
It's not malicious, it's just something that happened 64 64
that everybody was interested in all at the same time, 65 65
and that puts an excessive load on your systems. 66 66
Now, as you're trying to check 67 67
into these different service interruptions, 68 68
you're going to use different tools to do that. 69 69
If you're using a Windows system, 70 70
there are certain service analysis tools that you can use. 71 71
These tools can help you identify 72 72
suspicious service activity, 73 73
even when anti-malware scanners fail to identify it. 74 74
Now, one of the ways you can do this is 75 75
by looking in task manager. 76 76
By going into your task manager, 77 77
you can view all the running services. 78 78
Another way you could check for running services is 79 79
by looking at Services.msc 80 80
which is a snap in plugin inside of Windows 81 81
that lets you see all the running services. 82 82
And from there you could see a description 83 83
of what each one does, 84 84
and you could start or stop those services as appropriate. 85 85
If you prefer working in the command line 86 86
you can use the net start command. 87 87
Net start will display all running services 88 88
on a computer from the command line. 89 89
When you run that command, 90 90
you'll get a list outputted to your screen 91 91
of everything that is currently running. 92 92
And then, you can go ahead 93 93
and start or stop those using additional commands. 94 94
Finally, within Windows 95 95
you can also use PowerShell 96 96
and use the commandlet Get Service to be able to see 97 97
all those different services that are running. 98 98
And again, this will show you the status 99 99
whether they're stopped, started, or running, 100 100
the name of it, and a short display name 101 101
that gives you a little bit more information about it. 102 102
Now, if you're using Linux, there are other tools available 103 103
for service analysis as well. 104 104
When you're dealing with Linux, 105 105
one of the big ones you're going to use is cron. 106 106
Cron is a task scheduler 107 107
in Linux that can configure processes to run 108 108
as daemons or background processes or services 109 109
during the Machine's startup. 110 110
We've talked about cron before 111 111
when we compared it to the task scheduler inside of Windows. 112 112
Now when you look at cron, 113 113
you can look at the different cron tab jobs 114 114
that are scheduled. 115 115
As you can see here on the screen 116 116
there are several different cron jobs 117 117
that we have scheduled daily, weekly, 118 118
or monthly showing you what will be done 119 119
at a certain time based on those scheduled tasks 120 120
that we have. 121 121
Another command within Linux is Systemctl. 122 122
This can list and monitor 123 123
the startup processes using the appropriate control 124 124
for the Init Daemon, which is that startup process 125 125
that happens every time you start up the Linux system. 126 126
Other commands you can use 127 127
from the command line would be things like PS and top. 128 128
The PS and top commands are used to monitor 129 129
running processes. 130 130
PS will show you all the processes on a system, 131 131
and top will show you all those running processes 132 132
as well as the memory being consumed 133 133
and it will allow you to sort that into a particular order. 134 134
By using all of these different tools 135 135
inside Windows or Linux, 136 136
you're going to be able to identify 137 137
what services are being run 138 138
and which ones are being interrupted, and why.