Instructor: In the last few lessons, 2 2
we discussed the different types 3 3
of threat classifications and threat types. 4 4
Now in this lesson, 5 5
we're going to focus on the concept of threat research. 6 6
As I said before, historically we use malware 7 7
and threat signatures to detect malicious activity, 8 8
but this is becoming less and less effective 9 9
with the rise of more sophisticated adversary tactics. 10 10
Because of this, cybersecurity analysts like you 11 11
have to move away from the use of a single static signature 12 12
and instead start identifying 13 13
and correlating multiple indicators of compromise 14 14
to identify those attacks. 15 15
This becomes essential 16 16
when conducting threat hunting as well, 17 17
which we're going to focus on more in depth 18 18
later on in this course. 19 19
For now though, we're going to take a look 20 20
at three different concepts in this lesson, 21 21
reputational threat research, indicators of compromise, 22 22
and behavioral threat research 23 23
and how we're going to use these three 24 24
to identify threats during our research. 25 25
Now the first area is reputational threat research 26 26
and here we have to focus on 27 27
the reputation of something or reputation data. 28 28
When we talk about reputation data, 29 29
these are things like blacklists of known threat sources 30 30
such as malware signatures, IP address ranges, 31 31
and DNS domains. 32 32
All of this data helps provide the basis 33 33
for what we're going to use inside our research 34 34
because they tell us known things that we know are bad, 35 35
for instance, this website gives malware, 36 36
this IP address was seen in an attack, things like that. 37 37
Now, one of the ways that we can see 38 38
these different things based on reputational data 39 39
is by looking at sites like Talos Intelligence. 40 40
Here on the screen, 41 41
you can see the homepage For the Talos Reputation Center. 42 42
This area is going to track all the activity and rates 43 43
for each source address with a granular reputation score 44 44
and a basic score of good, neutral or poor. 45 45
This basically tells us, 46 46
do we have a good reputation or a bad reputation? 47 47
Just like in the real world when you meet somebody new, 48 48
you have to know are they somebody you can trust 49 49
or are they somebody you can't trust, 50 50
and their reputation is what's going to tell you that. 51 51
Similarly, an email address, an IP address 52 52
and other things do have reputations associated with them 53 53
and these are going to be either good, poor, or neutral. 54 54
The second area we want to talk about 55 55
is indicators of compromise. 56 56
Now an indicator of compromise is a residual sign 57 57
that an asset or network has been successfully attacked 58 58
or is continuing to be attacked right now. 59 59
When we talk about an IOC or an indicator of compromise, 60 60
these can be all sorts of different things, 61 61
like a hash value, an IP address, 62 62
a file being left on a system, or anything else like this, 63 63
anything that gives us a clue 64 64
that something has happened on this system. 65 65
For example, here on the screen, you can see a list of IOCs 66 66
from a particular incident. 67 67
You'll notice the source, the summary, and the attribute. 68 68
For instance, the source could have been the file system 69 69
or the registry or prefetch or something like that. 70 70
The summary is what we actually are looking for 71 71
and the attribute was it created, modified, visited, 72 72
or whatever the action was. 73 73
Now based on our analysis, 74 74
we can piece together a preliminary narrative 75 75
of what we think happened 76 76
based on all these indicators of compromise. 77 77
For instance, 78 78
the attacker may have sent a spearfishing email 79 79
and this contained a malicious PDF attachment 80 80
known as ultrawidget.pdf. 81 81
When this person saved it to the desktop 82 82
at this particular time, we then saw five minutes later 83 83
that windows/sys/WOW//acmCleanup.exe 84 84
was created as well as a run key was used for persistence. 85 85
This again, is another indicator of compromise. 86 86
As we go down these events, 87 87
we can see all the different things that happened 88 88
from opening this file, to installing that software, 89 89
to running that software 90 90
and all the different things that happened on this system. 91 91
Now as I said, each of these things individually 92 92
is an indicator of compromise and a single thing 93 93
could reference multiple different attacks 94 94
or multiple different people, 95 95
but as we start looking at these indicator compromises 96 96
and we put them together, 97 97
we can start figuring out those patterns. 98 98
Now what are some other things 99 99
you can look at for indicators of compromise? 100 100
Well, you might have unauthorized software 101 101
and files on the system, you might have suspicious emails, 102 102
you might have suspicious registry and file system changes, 103 103
there might be unknown important protocol usage, 104 104
there might be excessive bandwidth usage, 105 105
there might be rogue hardware that you find on your network. 106 106
You might find a service disruption or defacement 107 107
or you might see suspicious or unauthorized account usage. 108 108
All of these are types of indicators of compromise, 109 109
and later on we're going to talk more about threat hunting 110 110
and developing your own indicators of compromise 111 111
as you're looking through systems. 112 112
For the exam, 113 113
you need to not just know what these basic categories are, 114 114
but you need to be able to identify them. 115 115
If I show you a snippet from a log, 116 116
you need to be able to look at that and say, 117 117
"Ah, based on this log, I see that this bad thing happened 118 118
and this is an indicator of compromise, 119 119
and it indicates that we had unauthorized software 120 120
and files on the network" or something of that nature. 121 121
Remember, an IOC is evidence that an attack was successful. 122 122
In addition to this, you may hear the term IOA, 123 123
which is an indicator of attack. 124 124
This is a term used for evidence of an intrusion attempt 125 125
that is in progress right now. 126 126
So maybe on that long list 127 127
of IOCs I showed you on the screen, 128 128
we've only gotten through the first one or two of those. 129 129
That might be an IOA, an indicator that an attack has begun 130 130
but the entire attack has not finished 131 131
and has not been successful yet. 132 132
So this is the difference between IOC and an IOA. 133 133
Most of the time in the industry though, 134 134
we do talk about IOCs or indicators of compromise, 135 135
and you'll hear me reference that 136 136
a lot throughout this course. 137 137
Now our third area is behavioral threat research. 138 138
Behavioral threat research 139 139
is a term that refers to the correlation of IOCs 140 140
into different attack patterns. 141 141
Like I said, we took all these different IOCs 142 142
and if I see them in this particular order, 143 143
that may indicate that adversary X has done this, 144 144
and if I see 'em in a different order, 145 145
it might be that adversary Y has done this, 146 146
and that is based on their TTPs. 147 147
This is all their different strategies 148 148
and the way they do business. 149 149
When you talk about a TTP, 150 150
this is your tactics, techniques and procedures. 151 151
These are behavior patterns 152 152
that were used in the historical cyber attacks previously 153 153
and it tells you what the different adversary actions are. 154 154
By learning these, you're going to be able 155 155
to start understanding the way your adversary thinks 156 156
and how you could try to get one step ahead of them 157 157
to prevent them from getting further into your networks. 158 158
Now, there are lots of different areas that we talk 159 159
when we talk about TTPs, 160 160
there are different TTPs that have different actions. 161 161
For instance, we have DDoSs, 162 162
or distributed denial of services, 163 163
we have viruses or worms, we have network reconnaissance, 164 164
we have APTs, and we have data exfiltration. 165 165
When I talk about a DDoS or a DDoS, 166 166
this is a distributed denial of service attack. 167 167
This is where you might see a traffic surge 168 168
coming to you from multiple different areas. 169 169
The idea here is that an attacker can leverage their botnet 170 170
to try to take down your service, 171 171
and if you could start seeing unusual activity 172 172
all coming into your servers 173 173
from various places around the world, 174 174
that may be the indication that a DDoS is underway. 175 175
Another thing we might look at is viruses and worms. 176 176
If I start looking at your system and I have high CPU 177 177
or memory usage, this could be a sign 178 178
that there's some kind of malware infecting your host, 179 179
or you might see a virus detect alert 180 180
if there's a known signature, 181 181
but again, if this is a new piece of malware 182 182
and a new virus or worm, 183 183
you're going to have to look for secondary effects 184 184
like high CPU, high memory, 185 185
high network usage and things like that. 186 186
Now another TTP that might be used 187 187
is network reconnaissance. 188 188
Somebody might be scanning your systems 189 189
and you can detect that. 190 190
For instance, if I start scanning your system 191 191
and I start at port one, then port two, then port three, 192 192
then port four, 193 193
you can see that as a port scan inside your logs. 194 194
This is a form of network reconnaissance 195 195
and you can associate that action with my TTP 196 196
of scanning you before I'm going to attack you. 197 197
The next thing we want to talk about is APTs 198 198
and we've talked about this already. 199 199
An advanced persistent threat 200 200
is where the attacker needs to have some sort of command 201 201
and control over your system to maintain persistence 202 202
and be able to do things on your system. 203 203
So one of the big things you're going to be looking for 204 204
from an APT when you're trying to find their TTPs 205 205
is what is their C2 mechanism? 206 206
Because by seeing what that C2 mechanism is, 207 207
that's usually going to be unique 208 208
to each and every APT that's out there. 209 209
Now, some of the C2 mechanisms in servers 210 210
can use different things as a way to hide themselves, 211 211
and there's two really common ones, 212 212
port hopping and fast flux DNS. 213 213
Now, port hopping is when an APT's C2 application 214 214
might use any port to communicate from, 215 215
and so it might use port 22 right now 216 216
and if it thinks it's being detected, 217 217
it'll jump to port 53 and it'll jump to port 1258, 218 218
or whatever port it's going to use, 219 219
and by jumping between ports, 220 220
it can try to evade detection as well. 221 221
Another method they use is using fast flux DNS. 222 222
Now this is a technique that rapidly changes 223 223
the IP address associated with the domain, 224 224
so what ends up happening here 225 225
is that you have one domain name, 226 226
but you have multiple IP addresses 227 227
that are associated with it, 228 228
and so even if you start blocking IP addresses, 229 229
they can change the backend IP address 230 230
and still route their communications to the C2 server. 231 231
This allows an adversary 232 232
to defeat your IP based blacklisting 233 233
and it allows them to maintain communication 234 234
and remain as an advanced persistent threat 235 235
by maintaining that CT communication 236 236
between them and your machine. 237 237
Now, one of the ways you can detect this fast flux DNS 238 238
is by looking at the communication patterns that emerge 239 239
as these changes keep happening, because we're going to see 240 240
that your machine now went from this IP to that IP, 241 241
to this third IP to the fourth IP, 242 242
and that can be detected through your proxy logs. 243 243
Now the last behavior or TTP we want to talk about 244 244
is data exfiltration, and this is a big one these days. 245 245
You can see this either by looking at your database 246 246
or your file shares and seeing a high volume 247 247
of network transfer that's happening. 248 248
If you look at your logs 249 249
and you see a big change in the amount of data 250 250
that's being sent out, that could indicate 251 251
that you have a data exfiltration in progress. 252 252
For instance, if I look at my servers, 253 253
and I know that every week 254 254
we normally have two gigabytes worth of data 255 255
that's transferred to our students, 256 256
but this week we have 60 gigabytes. 257 257
That could be a possible IOC 258 258
and a possible behavior that I need to look into 259 259
that might be data exfiltration. 260 260
Now notice I said might, it doesn't always mean that it is. 261 261
When I look into it, I might determine 262 262
that I sold 30 times the amount 263 263
of courses than I normally do, 264 264
so with 30 times more students, 265 265
I would have 30 times more data, 266 266
and so that would be an explained anomaly 267 267
and not a data exfiltration. 268 268
But if I look and say, 269 269
well, I had a 100 students last week 270 270
and a 100 students this week, 271 271
and I went up by 30 times the amount of data, 272 272
something there isn't right, 273 273
and so we'd have to look into that further 274 274
to see if this is a data exfiltration event. 275 275
Another indication of data exfiltration 276 276
might be if you see file types or compression 277 277
or encryption that's being used on data 278 278
and you normally don't have that. 279 279
This is especially true within your networks. 280 280
For example, when you get data from my server, 281 281
it is encrypted because we have an https connection 282 282
between your computer and my web server. 283 283
But if you had two computers on your local area network 284 284
and you're sending data back and forth between them, 285 285
most of the time you're not encrypting that data. 286 286
If you start seeing a lot of encryption within your network, 287 287
that is something that might be an indicator 288 288
of data exfiltration.