1 1 00:00:00,330 --> 00:00:01,680 In the last few lessons, 2 2 00:00:01,680 --> 00:00:03,120 we discussed the different types 3 3 00:00:03,120 --> 00:00:05,610 of threat classifications and threat types. 4 4 00:00:05,610 --> 00:00:06,630 Now in this lesson, 5 5 00:00:06,630 --> 00:00:09,510 we're going to focus on the concept of threat research. 6 6 00:00:09,510 --> 00:00:12,390 As I said before, historically we use malware 7 7 00:00:12,390 --> 00:00:15,240 and threat signatures to detect malicious activity, 8 8 00:00:15,240 --> 00:00:17,730 but this is becoming less and less effective 9 9 00:00:17,730 --> 00:00:21,060 with the rise of more sophisticated adversary tactics. 10 10 00:00:21,060 --> 00:00:24,240 Because of this, cybersecurity analysts like you 11 11 00:00:24,240 --> 00:00:27,540 have to move away from the use of a single static signature 12 12 00:00:27,540 --> 00:00:29,490 and instead start identifying 13 13 00:00:29,490 --> 00:00:32,280 and correlating multiple indicators of compromise 14 14 00:00:32,280 --> 00:00:34,200 to identify those attacks. 15 15 00:00:34,200 --> 00:00:35,520 This becomes essential 16 16 00:00:35,520 --> 00:00:37,440 when conducting threat hunting as well, 17 17 00:00:37,440 --> 00:00:39,150 which we're going to focus on more in depth 18 18 00:00:39,150 --> 00:00:40,770 later on in this course. 19 19 00:00:40,770 --> 00:00:42,780 For now though, we're going to take a look 20 20 00:00:42,780 --> 00:00:45,120 at three different concepts in this lesson, 21 21 00:00:45,120 --> 00:00:48,450 reputational threat research, indicators of compromise, 22 22 00:00:48,450 --> 00:00:50,160 and behavioral threat research 23 23 00:00:50,160 --> 00:00:51,630 and how we're going to use these three 24 24 00:00:51,630 --> 00:00:54,390 to identify threats during our research. 25 25 00:00:54,390 --> 00:00:57,300 Now the first area is reputational threat research 26 26 00:00:57,300 --> 00:00:58,710 and here we have to focus on 27 27 00:00:58,710 --> 00:01:01,347 the reputation of something or reputation data. 28 28 00:01:01,347 --> 00:01:03,297 When we talk about reputation data, 29 29 00:01:03,297 --> 00:01:06,420 these are things like blacklists of known threat sources 30 30 00:01:06,420 --> 00:01:09,000 such as malware signatures, IP address ranges, 31 31 00:01:09,000 --> 00:01:10,479 and DNS domains. 32 32 00:01:10,479 --> 00:01:13,530 All of this data helps provide the basis 33 33 00:01:13,530 --> 00:01:15,900 for what we're going to use inside our research 34 34 00:01:15,900 --> 00:01:19,380 because they tell us known things that we know are bad, 35 35 00:01:19,380 --> 00:01:22,290 for instance, this website gives malware, 36 36 00:01:22,290 --> 00:01:25,980 this IP address was seen in an attack, things like that. 37 37 00:01:25,980 --> 00:01:27,630 Now, one of the ways that we can see 38 38 00:01:27,630 --> 00:01:30,210 these different things based on reputational data 39 39 00:01:30,210 --> 00:01:32,643 is by looking at sites like Talos Intelligence. 40 40 00:01:32,643 --> 00:01:33,780 Here on the screen, 41 41 00:01:33,780 --> 00:01:36,705 you can see the homepage For the Talos Reputation Center. 42 42 00:01:36,705 --> 00:01:39,630 This area is going to track all the activity and rates 43 43 00:01:39,630 --> 00:01:43,110 for each source address with a granular reputation score 44 44 00:01:43,110 --> 00:01:46,560 and a basic score of good, neutral or poor. 45 45 00:01:46,560 --> 00:01:47,760 This basically tells us, 46 46 00:01:47,760 --> 00:01:50,730 do we have a good reputation or a bad reputation? 47 47 00:01:50,730 --> 00:01:52,980 Just like in the real world when you meet somebody new, 48 48 00:01:52,980 --> 00:01:55,110 you have to know are they somebody you can trust 49 49 00:01:55,110 --> 00:01:56,760 or are they somebody you can't trust, 50 50 00:01:56,760 --> 00:01:59,310 and their reputation is what's going to tell you that. 51 51 00:01:59,310 --> 00:02:02,130 Similarly, an email address, an IP address 52 52 00:02:02,130 --> 00:02:05,520 and other things do have reputations associated with them 53 53 00:02:05,520 --> 00:02:08,640 and these are going to be either good, poor, or neutral. 54 54 00:02:08,640 --> 00:02:10,020 The second area we want to talk about 55 55 00:02:10,020 --> 00:02:12,090 is indicators of compromise. 56 56 00:02:12,090 --> 00:02:14,790 Now an indicator of compromise is a residual sign 57 57 00:02:14,790 --> 00:02:17,850 that an asset or network has been successfully attacked 58 58 00:02:17,850 --> 00:02:20,850 or is continuing to be attacked right now. 59 59 00:02:20,850 --> 00:02:23,762 When we talk about an IOC or an indicator of compromise, 60 60 00:02:23,762 --> 00:02:26,310 these can be all sorts of different things, 61 61 00:02:26,310 --> 00:02:28,800 like a hash value, an IP address, 62 62 00:02:28,800 --> 00:02:31,711 a file being left on a system, or anything else like this, 63 63 00:02:31,711 --> 00:02:33,720 anything that gives us a clue 64 64 00:02:33,720 --> 00:02:36,150 that something has happened on this system. 65 65 00:02:36,150 --> 00:02:39,360 For example, here on the screen, you can see a list of IOCs 66 66 00:02:39,360 --> 00:02:40,686 from a particular incident. 67 67 00:02:40,686 --> 00:02:44,040 You'll notice the source, the summary, and the attribute. 68 68 00:02:44,040 --> 00:02:46,140 For instance, the source could have been the file system 69 69 00:02:46,140 --> 00:02:49,740 or the registry or prefetch or something like that. 70 70 00:02:49,740 --> 00:02:51,750 The summary is what we actually are looking for 71 71 00:02:51,750 --> 00:02:54,960 and the attribute was it created, modified, visited, 72 72 00:02:54,960 --> 00:02:56,529 or whatever the action was. 73 73 00:02:56,529 --> 00:02:58,320 Now based on our analysis, 74 74 00:02:58,320 --> 00:03:00,660 we can piece together a preliminary narrative 75 75 00:03:00,660 --> 00:03:01,930 of what we think happened 76 76 00:03:02,971 --> 00:03:04,410 based on all these indicators of compromise. 77 77 00:03:04,410 --> 00:03:05,340 For instance, 78 78 00:03:05,340 --> 00:03:07,680 the attacker may have sent a spearfishing email 79 79 00:03:07,680 --> 00:03:10,020 and this contained a malicious PDF attachment 80 80 00:03:10,020 --> 00:03:12,210 known as ultrawidget.pdf. 81 81 00:03:12,210 --> 00:03:14,310 When this person saved it to the desktop 82 82 00:03:14,310 --> 00:03:17,550 at this particular time, we then saw five minutes later 83 83 00:03:17,550 --> 00:03:19,603 that windows/sys/WOW//acmCleanup.exe 84 84 00:03:22,920 --> 00:03:26,670 was created as well as a run key was used for persistence. 85 85 00:03:26,670 --> 00:03:28,675 This again, is another indicator of compromise. 86 86 00:03:28,675 --> 00:03:30,540 As we go down these events, 87 87 00:03:30,540 --> 00:03:32,370 we can see all the different things that happened 88 88 00:03:32,370 --> 00:03:34,890 from opening this file, to installing that software, 89 89 00:03:34,890 --> 00:03:35,970 to running that software 90 90 00:03:35,970 --> 00:03:38,700 and all the different things that happened on this system. 91 91 00:03:38,700 --> 00:03:41,100 Now as I said, each of these things individually 92 92 00:03:41,100 --> 00:03:43,680 is an indicator of compromise and a single thing 93 93 00:03:43,680 --> 00:03:45,630 could reference multiple different attacks 94 94 00:03:45,630 --> 00:03:46,997 or multiple different people, 95 95 00:03:46,997 --> 00:03:50,130 but as we start looking at these indicator compromises 96 96 00:03:50,130 --> 00:03:51,420 and we put them together, 97 97 00:03:51,420 --> 00:03:53,580 we can start figuring out those patterns. 98 98 00:03:53,580 --> 00:03:54,690 Now what are some other things 99 99 00:03:54,690 --> 00:03:56,940 you can look at for indicators of compromise? 100 100 00:03:56,940 --> 00:03:58,770 Well, you might have unauthorized software 101 101 00:03:58,770 --> 00:04:01,507 and files on the system, you might have suspicious emails, 102 102 00:04:01,507 --> 00:04:04,562 you might have suspicious registry and file system changes, 103 103 00:04:04,562 --> 00:04:07,320 there might be unknown important protocol usage, 104 104 00:04:07,320 --> 00:04:09,240 there might be excessive bandwidth usage, 105 105 00:04:09,240 --> 00:04:11,398 there might be rogue hardware that you find on your network. 106 106 00:04:11,398 --> 00:04:13,830 You might find a service disruption or defacement 107 107 00:04:13,830 --> 00:04:17,329 or you might see suspicious or unauthorized account usage. 108 108 00:04:17,329 --> 00:04:20,259 All of these are types of indicators of compromise, 109 109 00:04:20,259 --> 00:04:23,250 and later on we're going to talk more about threat hunting 110 110 00:04:23,250 --> 00:04:25,560 and developing your own indicators of compromise 111 111 00:04:25,560 --> 00:04:26,930 as you're looking through systems. 112 112 00:04:26,930 --> 00:04:28,380 For the exam, 113 113 00:04:28,380 --> 00:04:31,410 you need to not just know what these basic categories are, 114 114 00:04:31,410 --> 00:04:32,838 but you need to be able to identify them. 115 115 00:04:32,838 --> 00:04:34,915 If I show you a snippet from a log, 116 116 00:04:34,915 --> 00:04:36,817 you need to be able to look at that and say, 117 117 00:04:36,817 --> 00:04:40,373 "Ah, based on this log, I see that this bad thing happened 118 118 00:04:40,373 --> 00:04:42,510 and this is an indicator of compromise, 119 119 00:04:42,510 --> 00:04:45,150 and it indicates that we had unauthorized software 120 120 00:04:45,150 --> 00:04:47,610 and files on the network" or something of that nature. 121 121 00:04:47,610 --> 00:04:51,930 Remember, an IOC is evidence that an attack was successful. 122 122 00:04:51,930 --> 00:04:54,990 In addition to this, you may hear the term IOA, 123 123 00:04:54,990 --> 00:04:57,000 which is an indicator of attack. 124 124 00:04:57,000 --> 00:04:59,580 This is a term used for evidence of an intrusion attempt 125 125 00:04:59,580 --> 00:05:01,650 that is in progress right now. 126 126 00:05:01,650 --> 00:05:03,840 So maybe on that long list 127 127 00:05:03,840 --> 00:05:05,760 of IOCs I showed you on the screen, 128 128 00:05:05,760 --> 00:05:08,430 we've only gotten through the first one or two of those. 129 129 00:05:08,430 --> 00:05:11,970 That might be an IOA, an indicator that an attack has begun 130 130 00:05:11,970 --> 00:05:14,160 but the entire attack has not finished 131 131 00:05:14,160 --> 00:05:15,840 and has not been successful yet. 132 132 00:05:15,840 --> 00:05:18,930 So this is the difference between IOC and an IOA. 133 133 00:05:18,930 --> 00:05:20,700 Most of the time in the industry though, 134 134 00:05:20,700 --> 00:05:24,000 we do talk about IOCs or indicators of compromise, 135 135 00:05:24,000 --> 00:05:25,080 and you'll hear me reference that 136 136 00:05:25,080 --> 00:05:26,790 a lot throughout this course. 137 137 00:05:26,790 --> 00:05:29,730 Now our third area is behavioral threat research. 138 138 00:05:29,730 --> 00:05:30,960 Behavioral threat research 139 139 00:05:30,960 --> 00:05:33,420 is a term that refers to the correlation of IOCs 140 140 00:05:33,420 --> 00:05:34,930 into different attack patterns. 141 141 00:05:34,930 --> 00:05:37,635 Like I said, we took all these different IOCs 142 142 00:05:37,635 --> 00:05:39,960 and if I see them in this particular order, 143 143 00:05:39,960 --> 00:05:42,840 that may indicate that adversary X has done this, 144 144 00:05:42,840 --> 00:05:44,130 and if I see 'em in a different order, 145 145 00:05:44,130 --> 00:05:46,224 it might be that adversary Y has done this, 146 146 00:05:46,224 --> 00:05:48,780 and that is based on their TTPs. 147 147 00:05:48,780 --> 00:05:50,370 This is all their different strategies 148 148 00:05:50,370 --> 00:05:51,615 and the way they do business. 149 149 00:05:51,615 --> 00:05:53,059 When you talk about a TTP, 150 150 00:05:53,059 --> 00:05:56,430 this is your tactics, techniques and procedures. 151 151 00:05:56,430 --> 00:05:57,690 These are behavior patterns 152 152 00:05:57,690 --> 00:06:00,176 that were used in the historical cyber attacks previously 153 153 00:06:00,176 --> 00:06:03,000 and it tells you what the different adversary actions are. 154 154 00:06:03,000 --> 00:06:04,380 By learning these, you're going to be able 155 155 00:06:04,380 --> 00:06:06,960 to start understanding the way your adversary thinks 156 156 00:06:06,960 --> 00:06:09,000 and how you could try to get one step ahead of them 157 157 00:06:09,000 --> 00:06:11,326 to prevent them from getting further into your networks. 158 158 00:06:11,326 --> 00:06:13,620 Now, there are lots of different areas that we talk 159 159 00:06:13,620 --> 00:06:15,011 when we talk about TTPs, 160 160 00:06:15,011 --> 00:06:17,580 there are different TTPs that have different actions. 161 161 00:06:17,580 --> 00:06:19,800 For instance, we have DDoSs, 162 162 00:06:19,800 --> 00:06:21,720 or distributed denial of services, 163 163 00:06:21,720 --> 00:06:25,410 we have viruses or worms, we have network reconnaissance, 164 164 00:06:25,410 --> 00:06:28,290 we have APTs, and we have data exfiltration. 165 165 00:06:28,290 --> 00:06:30,512 When I talk about a DDoS or a DDoS, 166 166 00:06:30,512 --> 00:06:33,251 this is a distributed denial of service attack. 167 167 00:06:33,251 --> 00:06:35,490 This is where you might see a traffic surge 168 168 00:06:35,490 --> 00:06:37,552 coming to you from multiple different areas. 169 169 00:06:37,552 --> 00:06:40,530 The idea here is that an attacker can leverage their botnet 170 170 00:06:40,530 --> 00:06:42,870 to try to take down your service, 171 171 00:06:42,870 --> 00:06:45,210 and if you could start seeing unusual activity 172 172 00:06:45,210 --> 00:06:46,590 all coming into your servers 173 173 00:06:46,590 --> 00:06:48,001 from various places around the world, 174 174 00:06:48,001 --> 00:06:51,105 that may be the indication that a DDoS is underway. 175 175 00:06:51,105 --> 00:06:53,475 Another thing we might look at is viruses and worms. 176 176 00:06:53,475 --> 00:06:56,730 If I start looking at your system and I have high CPU 177 177 00:06:56,730 --> 00:06:58,770 or memory usage, this could be a sign 178 178 00:06:58,770 --> 00:07:01,080 that there's some kind of malware infecting your host, 179 179 00:07:01,080 --> 00:07:02,947 or you might see a virus detect alert 180 180 00:07:02,947 --> 00:07:04,710 if there's a known signature, 181 181 00:07:04,710 --> 00:07:06,529 but again, if this is a new piece of malware 182 182 00:07:06,529 --> 00:07:08,310 and a new virus or worm, 183 183 00:07:08,310 --> 00:07:10,050 you're going to have to look for secondary effects 184 184 00:07:10,050 --> 00:07:12,180 like high CPU, high memory, 185 185 00:07:12,180 --> 00:07:14,340 high network usage and things like that. 186 186 00:07:14,340 --> 00:07:16,050 Now another TTP that might be used 187 187 00:07:16,050 --> 00:07:17,580 is network reconnaissance. 188 188 00:07:17,580 --> 00:07:19,216 Somebody might be scanning your systems 189 189 00:07:19,216 --> 00:07:20,449 and you can detect that. 190 190 00:07:20,449 --> 00:07:23,100 For instance, if I start scanning your system 191 191 00:07:23,100 --> 00:07:25,860 and I start at port one, then port two, then port three, 192 192 00:07:25,860 --> 00:07:26,970 then port four, 193 193 00:07:26,970 --> 00:07:29,217 you can see that as a port scan inside your logs. 194 194 00:07:29,217 --> 00:07:31,410 This is a form of network reconnaissance 195 195 00:07:31,410 --> 00:07:34,418 and you can associate that action with my TTP 196 196 00:07:34,418 --> 00:07:37,315 of scanning you before I'm going to attack you. 197 197 00:07:37,315 --> 00:07:39,840 The next thing we want to talk about is APTs 198 198 00:07:39,840 --> 00:07:41,430 and we've talked about this already. 199 199 00:07:41,430 --> 00:07:43,050 An advanced persistent threat 200 200 00:07:43,050 --> 00:07:45,510 is where the attacker needs to have some sort of command 201 201 00:07:45,510 --> 00:07:48,000 and control over your system to maintain persistence 202 202 00:07:48,000 --> 00:07:50,340 and be able to do things on your system. 203 203 00:07:50,340 --> 00:07:52,380 So one of the big things you're going to be looking for 204 204 00:07:52,380 --> 00:07:55,380 from an APT when you're trying to find their TTPs 205 205 00:07:55,380 --> 00:07:57,450 is what is their C2 mechanism? 206 206 00:07:57,450 --> 00:07:59,520 Because by seeing what that C2 mechanism is, 207 207 00:07:59,520 --> 00:08:00,810 that's usually going to be unique 208 208 00:08:00,810 --> 00:08:02,979 to each and every APT that's out there. 209 209 00:08:02,979 --> 00:08:05,820 Now, some of the C2 mechanisms in servers 210 210 00:08:05,820 --> 00:08:08,163 can use different things as a way to hide themselves, 211 211 00:08:08,163 --> 00:08:10,440 and there's two really common ones, 212 212 00:08:10,440 --> 00:08:13,110 port hopping and fast flux DNS. 213 213 00:08:13,110 --> 00:08:16,500 Now, port hopping is when an APT's C2 application 214 214 00:08:16,500 --> 00:08:18,570 might use any port to communicate from, 215 215 00:08:18,570 --> 00:08:20,940 and so it might use port 22 right now 216 216 00:08:20,940 --> 00:08:22,200 and if it thinks it's being detected, 217 217 00:08:22,200 --> 00:08:26,040 it'll jump to port 53 and it'll jump to port 1258, 218 218 00:08:26,040 --> 00:08:27,420 or whatever port it's going to use, 219 219 00:08:27,420 --> 00:08:28,980 and by jumping between ports, 220 220 00:08:28,980 --> 00:08:31,050 it can try to evade detection as well. 221 221 00:08:31,050 --> 00:08:34,440 Another method they use is using fast flux DNS. 222 222 00:08:34,440 --> 00:08:36,600 Now this is a technique that rapidly changes 223 223 00:08:36,600 --> 00:08:39,090 the IP address associated with the domain, 224 224 00:08:39,090 --> 00:08:40,440 so what ends up happening here 225 225 00:08:40,440 --> 00:08:42,000 is that you have one domain name, 226 226 00:08:42,000 --> 00:08:43,470 but you have multiple IP addresses 227 227 00:08:43,470 --> 00:08:44,760 that are associated with it, 228 228 00:08:44,760 --> 00:08:47,370 and so even if you start blocking IP addresses, 229 229 00:08:47,370 --> 00:08:49,140 they can change the backend IP address 230 230 00:08:49,140 --> 00:08:52,170 and still route their communications to the C2 server. 231 231 00:08:52,170 --> 00:08:53,430 This allows an adversary 232 232 00:08:53,430 --> 00:08:55,468 to defeat your IP based blacklisting 233 233 00:08:55,468 --> 00:08:58,380 and it allows them to maintain communication 234 234 00:08:58,380 --> 00:09:00,900 and remain as an advanced persistent threat 235 235 00:09:00,900 --> 00:09:02,730 by maintaining that CT communication 236 236 00:09:02,730 --> 00:09:04,860 between them and your machine. 237 237 00:09:04,860 --> 00:09:07,710 Now, one of the ways you can detect this fast flux DNS 238 238 00:09:07,710 --> 00:09:10,530 is by looking at the communication patterns that emerge 239 239 00:09:10,530 --> 00:09:12,780 as these changes keep happening, because we're going to see 240 240 00:09:12,780 --> 00:09:15,900 that your machine now went from this IP to that IP, 241 241 00:09:15,900 --> 00:09:17,970 to this third IP to the fourth IP, 242 242 00:09:17,970 --> 00:09:19,950 and that can be detected through your proxy logs. 243 243 00:09:19,950 --> 00:09:22,770 Now the last behavior or TTP we want to talk about 244 244 00:09:22,770 --> 00:09:25,737 is data exfiltration, and this is a big one these days. 245 245 00:09:25,737 --> 00:09:28,142 You can see this either by looking at your database 246 246 00:09:28,142 --> 00:09:30,780 or your file shares and seeing a high volume 247 247 00:09:30,780 --> 00:09:32,580 of network transfer that's happening. 248 248 00:09:32,580 --> 00:09:33,690 If you look at your logs 249 249 00:09:33,690 --> 00:09:35,670 and you see a big change in the amount of data 250 250 00:09:35,670 --> 00:09:37,830 that's being sent out, that could indicate 251 251 00:09:37,830 --> 00:09:40,140 that you have a data exfiltration in progress. 252 252 00:09:40,140 --> 00:09:42,360 For instance, if I look at my servers, 253 253 00:09:42,360 --> 00:09:43,502 and I know that every week 254 254 00:09:43,502 --> 00:09:45,990 we normally have two gigabytes worth of data 255 255 00:09:45,990 --> 00:09:47,490 that's transferred to our students, 256 256 00:09:47,490 --> 00:09:49,471 but this week we have 60 gigabytes. 257 257 00:09:49,471 --> 00:09:51,537 That could be a possible IOC 258 258 00:09:51,537 --> 00:09:53,850 and a possible behavior that I need to look into 259 259 00:09:53,850 --> 00:09:55,890 that might be data exfiltration. 260 260 00:09:55,890 --> 00:09:58,380 Now notice I said might, it doesn't always mean that it is. 261 261 00:09:58,380 --> 00:10:00,780 When I look into it, I might determine 262 262 00:10:00,780 --> 00:10:02,730 that I sold 30 times the amount 263 263 00:10:02,730 --> 00:10:04,320 of courses than I normally do, 264 264 00:10:04,320 --> 00:10:06,090 so with 30 times more students, 265 265 00:10:06,090 --> 00:10:07,583 I would have 30 times more data, 266 266 00:10:07,583 --> 00:10:10,200 and so that would be an explained anomaly 267 267 00:10:10,200 --> 00:10:11,806 and not a data exfiltration. 268 268 00:10:11,806 --> 00:10:13,290 But if I look and say, 269 269 00:10:13,290 --> 00:10:14,970 well, I had a 100 students last week 270 270 00:10:14,970 --> 00:10:16,530 and a 100 students this week, 271 271 00:10:16,530 --> 00:10:18,720 and I went up by 30 times the amount of data, 272 272 00:10:18,720 --> 00:10:19,918 something there isn't right, 273 273 00:10:19,918 --> 00:10:21,900 and so we'd have to look into that further 274 274 00:10:21,900 --> 00:10:23,839 to see if this is a data exfiltration event. 275 275 00:10:23,839 --> 00:10:26,610 Another indication of data exfiltration 276 276 00:10:26,610 --> 00:10:28,989 might be if you see file types or compression 277 277 00:10:28,989 --> 00:10:31,470 or encryption that's being used on data 278 278 00:10:31,470 --> 00:10:33,120 and you normally don't have that. 279 279 00:10:33,120 --> 00:10:35,520 This is especially true within your networks. 280 280 00:10:35,520 --> 00:10:37,950 For example, when you get data from my server, 281 281 00:10:37,950 --> 00:10:41,100 it is encrypted because we have an https connection 282 282 00:10:41,100 --> 00:10:43,165 between your computer and my web server. 283 283 00:10:43,165 --> 00:10:46,333 But if you had two computers on your local area network 284 284 00:10:46,333 --> 00:10:48,780 and you're sending data back and forth between them, 285 285 00:10:48,780 --> 00:10:50,973 most of the time you're not encrypting that data. 286 286 00:10:50,973 --> 00:10:53,790 If you start seeing a lot of encryption within your network, 287 287 00:10:53,790 --> 00:10:55,620 that is something that might be an indicator 288 288 00:10:55,620 --> 00:10:57,217 of data exfiltration.