1 1 00:00:00,840 --> 00:00:02,970 Service interruptions. 2 2 00:00:02,970 --> 00:00:04,920 Service interruptions are another area 3 3 00:00:04,920 --> 00:00:08,040 that you should consider when developing your IOCs. 4 4 00:00:08,040 --> 00:00:10,530 Now, just because there's a service interruption though, 5 5 00:00:10,530 --> 00:00:12,850 it doesn't mean that this is an indicator 6 6 00:00:13,749 --> 00:00:14,582 that you've been attacked. 7 7 00:00:14,582 --> 00:00:17,220 Sometimes, application services may fail to start 8 8 00:00:17,220 --> 00:00:21,000 or stop unexpectedly for any number of different reasons. 9 9 00:00:21,000 --> 00:00:22,680 Some may be a maintenance issue, 10 10 00:00:22,680 --> 00:00:24,330 some may be normal wear and tear, 11 11 00:00:24,330 --> 00:00:26,850 and some may be that you're under attack. 12 12 00:00:26,850 --> 00:00:29,430 Now, if you have failed application services, 13 13 00:00:29,430 --> 00:00:31,410 this is any application interruption 14 14 00:00:31,410 --> 00:00:33,720 that's caused by a service either failing to start 15 15 00:00:33,720 --> 00:00:36,060 or halting abruptly. 16 16 00:00:36,060 --> 00:00:37,230 If you want to identify 17 17 00:00:37,230 --> 00:00:39,420 any of these failed application services 18 18 00:00:39,420 --> 00:00:42,180 the best thing to do is look through your logs. 19 19 00:00:42,180 --> 00:00:43,050 In your logs, 20 20 00:00:43,050 --> 00:00:45,120 you should be able to have a full history 21 21 00:00:45,120 --> 00:00:48,840 of every service that was started or abruptly stopped. 22 22 00:00:48,840 --> 00:00:51,480 Now, as you look through those failed application services 23 23 00:00:51,480 --> 00:00:53,430 and those logs, you're going to have to determine 24 24 00:00:53,430 --> 00:00:55,380 if this was something that was malicious 25 25 00:00:55,380 --> 00:00:57,780 or if it was something that's just benign 26 26 00:00:57,780 --> 00:00:59,670 and happened as an accident. 27 27 00:00:59,670 --> 00:01:00,540 As you do this, 28 28 00:01:00,540 --> 00:01:02,670 you need to consider a lot of different things 29 29 00:01:02,670 --> 00:01:05,310 from your cybersecurity perspective as an analyst. 30 30 00:01:05,310 --> 00:01:06,630 First, you want to consider 31 31 00:01:06,630 --> 00:01:09,510 if security services are prevented from running. 32 32 00:01:09,510 --> 00:01:10,920 This can be an indication 33 33 00:01:10,920 --> 00:01:13,260 that there is something malicious on the system. 34 34 00:01:13,260 --> 00:01:15,630 Many times malware will install itself 35 35 00:01:15,630 --> 00:01:17,610 and then prevent other security softwares 36 36 00:01:17,610 --> 00:01:20,280 such as antivirus from loading in the background. 37 37 00:01:20,280 --> 00:01:22,530 Second, you want to consider the process 38 38 00:01:22,530 --> 00:01:23,610 that's running the service 39 39 00:01:23,610 --> 00:01:25,500 and whether or not it's compromised. 40 40 00:01:25,500 --> 00:01:27,300 If you find something malicious, 41 41 00:01:27,300 --> 00:01:28,740 you can then look at that process 42 42 00:01:28,740 --> 00:01:32,040 and see which process launched that malicious process. 43 43 00:01:32,040 --> 00:01:34,560 If it was something that was a system process, for example, 44 44 00:01:34,560 --> 00:01:36,717 that may indicate that the entire system is compromised 45 45 00:01:36,717 --> 00:01:38,940 and something you need to look into. 46 46 00:01:38,940 --> 00:01:43,440 Third, the service may be disabled by a DDoS or a DoS. 47 47 00:01:43,440 --> 00:01:46,408 In this case, you may have a denial of service going on, 48 48 00:01:46,408 --> 00:01:49,140 and if this is happening, this would be a clear indicator 49 49 00:01:49,140 --> 00:01:51,600 or compromise that you'd want to make note of. 50 50 00:01:51,600 --> 00:01:54,810 And fourth, you want to check for excessive bandwidth usage, 51 51 00:01:54,810 --> 00:01:56,610 because if there's excessive bandwidth usage 52 52 00:01:56,610 --> 00:01:58,950 this could disrupt your service as well. 53 53 00:01:58,950 --> 00:02:00,060 Now, just because there's 54 54 00:02:00,060 --> 00:02:02,400 a large amount of bandwidth being used doesn't mean 55 55 00:02:02,400 --> 00:02:04,260 you're actually under attack though. 56 56 00:02:04,260 --> 00:02:07,110 This could actually be real traffic from your users 57 57 00:02:07,110 --> 00:02:09,630 that's all just happening at the same time. 58 58 00:02:09,630 --> 00:02:11,520 For example, if there's a big world event, 59 59 00:02:11,520 --> 00:02:14,130 and all your users tried to go and look at the news 60 60 00:02:14,130 --> 00:02:16,320 right at the same time that could cause 61 61 00:02:16,320 --> 00:02:18,180 a denial of service for your service 62 62 00:02:18,180 --> 00:02:19,620 due to excessive bandwidth. 63 63 00:02:19,620 --> 00:02:21,780 It's not malicious, it's just something that happened 64 64 00:02:21,780 --> 00:02:24,240 that everybody was interested in all at the same time, 65 65 00:02:24,240 --> 00:02:26,850 and that puts an excessive load on your systems. 66 66 00:02:26,850 --> 00:02:28,020 Now, as you're trying to check 67 67 00:02:28,020 --> 00:02:29,970 into these different service interruptions, 68 68 00:02:29,970 --> 00:02:32,010 you're going to use different tools to do that. 69 69 00:02:32,010 --> 00:02:33,480 If you're using a Windows system, 70 70 00:02:33,480 --> 00:02:36,570 there are certain service analysis tools that you can use. 71 71 00:02:36,570 --> 00:02:38,130 These tools can help you identify 72 72 00:02:38,130 --> 00:02:39,810 suspicious service activity, 73 73 00:02:39,810 --> 00:02:43,440 even when anti-malware scanners fail to identify it. 74 74 00:02:43,440 --> 00:02:45,120 Now, one of the ways you can do this is 75 75 00:02:45,120 --> 00:02:47,100 by looking in task manager. 76 76 00:02:47,100 --> 00:02:48,480 By going into your task manager, 77 77 00:02:48,480 --> 00:02:51,480 you can view all the running services. 78 78 00:02:51,480 --> 00:02:53,670 Another way you could check for running services is 79 79 00:02:53,670 --> 00:02:56,160 by looking at Services.msc 80 80 00:02:56,160 --> 00:02:59,100 which is a snap in plugin inside of Windows 81 81 00:02:59,100 --> 00:03:00,960 that lets you see all the running services. 82 82 00:03:00,960 --> 00:03:02,760 And from there you could see a description 83 83 00:03:02,760 --> 00:03:04,140 of what each one does, 84 84 00:03:04,140 --> 00:03:08,070 and you could start or stop those services as appropriate. 85 85 00:03:08,070 --> 00:03:10,050 If you prefer working in the command line 86 86 00:03:10,050 --> 00:03:12,420 you can use the net start command. 87 87 00:03:12,420 --> 00:03:14,670 Net start will display all running services 88 88 00:03:14,670 --> 00:03:17,100 on a computer from the command line. 89 89 00:03:17,100 --> 00:03:18,240 When you run that command, 90 90 00:03:18,240 --> 00:03:20,070 you'll get a list outputted to your screen 91 91 00:03:20,070 --> 00:03:22,200 of everything that is currently running. 92 92 00:03:22,200 --> 00:03:23,700 And then, you can go ahead 93 93 00:03:23,700 --> 00:03:26,820 and start or stop those using additional commands. 94 94 00:03:26,820 --> 00:03:28,350 Finally, within Windows 95 95 00:03:28,350 --> 00:03:30,120 you can also use PowerShell 96 96 00:03:30,120 --> 00:03:32,850 and use the commandlet Get Service to be able to see 97 97 00:03:32,850 --> 00:03:35,100 all those different services that are running. 98 98 00:03:35,100 --> 00:03:36,690 And again, this will show you the status 99 99 00:03:36,690 --> 00:03:39,330 whether they're stopped, started, or running, 100 100 00:03:39,330 --> 00:03:41,820 the name of it, and a short display name 101 101 00:03:41,820 --> 00:03:44,040 that gives you a little bit more information about it. 102 102 00:03:44,040 --> 00:03:46,890 Now, if you're using Linux, there are other tools available 103 103 00:03:46,890 --> 00:03:49,050 for service analysis as well. 104 104 00:03:49,050 --> 00:03:50,100 When you're dealing with Linux, 105 105 00:03:50,100 --> 00:03:52,650 one of the big ones you're going to use is cron. 106 106 00:03:52,650 --> 00:03:54,120 Cron is a task scheduler 107 107 00:03:54,120 --> 00:03:56,550 in Linux that can configure processes to run 108 108 00:03:56,550 --> 00:03:59,490 as daemons or background processes or services 109 109 00:03:59,490 --> 00:04:01,080 during the Machine's startup. 110 110 00:04:01,080 --> 00:04:02,700 We've talked about cron before 111 111 00:04:02,700 --> 00:04:06,120 when we compared it to the task scheduler inside of Windows. 112 112 00:04:06,120 --> 00:04:07,560 Now when you look at cron, 113 113 00:04:07,560 --> 00:04:09,420 you can look at the different cron tab jobs 114 114 00:04:09,420 --> 00:04:10,440 that are scheduled. 115 115 00:04:10,440 --> 00:04:11,820 As you can see here on the screen 116 116 00:04:11,820 --> 00:04:13,380 there are several different cron jobs 117 117 00:04:13,380 --> 00:04:15,240 that we have scheduled daily, weekly, 118 118 00:04:15,240 --> 00:04:17,760 or monthly showing you what will be done 119 119 00:04:17,760 --> 00:04:20,460 at a certain time based on those scheduled tasks 120 120 00:04:20,460 --> 00:04:21,431 that we have. 121 121 00:04:21,431 --> 00:04:25,080 Another command within Linux is Systemctl. 122 122 00:04:25,080 --> 00:04:26,310 This can list and monitor 123 123 00:04:26,310 --> 00:04:28,950 the startup processes using the appropriate control 124 124 00:04:28,950 --> 00:04:31,740 for the Init Daemon, which is that startup process 125 125 00:04:31,740 --> 00:04:34,800 that happens every time you start up the Linux system. 126 126 00:04:34,800 --> 00:04:35,820 Other commands you can use 127 127 00:04:35,820 --> 00:04:38,640 from the command line would be things like PS and top. 128 128 00:04:38,640 --> 00:04:41,554 The PS and top commands are used to monitor 129 129 00:04:41,554 --> 00:04:42,387 running processes. 130 130 00:04:42,387 --> 00:04:44,549 PS will show you all the processes on a system, 131 131 00:04:44,549 --> 00:04:47,550 and top will show you all those running processes 132 132 00:04:47,550 --> 00:04:49,500 as well as the memory being consumed 133 133 00:04:49,500 --> 00:04:52,320 and it will allow you to sort that into a particular order. 134 134 00:04:52,320 --> 00:04:54,150 By using all of these different tools 135 135 00:04:54,150 --> 00:04:56,070 inside Windows or Linux, 136 136 00:04:56,070 --> 00:04:57,570 you're going to be able to identify 137 137 00:04:57,570 --> 00:04:59,670 what services are being run 138 138 00:04:59,670 --> 00:05:02,163 and which ones are being interrupted, and why.