1 1 00:00:00,780 --> 00:00:02,970 Behavioral analysis. 2 2 00:00:02,970 --> 00:00:05,340 Now, in the last lesson we talked about shell code. 3 3 00:00:05,340 --> 00:00:08,730 And shell code is really easy to hide and obfuscate 4 4 00:00:08,730 --> 00:00:10,320 because you can do a lot of things with it 5 5 00:00:10,320 --> 00:00:12,690 to evade signature-based antivirus detection 6 6 00:00:12,690 --> 00:00:14,130 if you're an attacker. 7 7 00:00:14,130 --> 00:00:16,740 Because of this threat hunting and security monitoring 8 8 00:00:16,740 --> 00:00:18,690 must use behavioral-based techniques 9 9 00:00:18,690 --> 00:00:20,403 to really identify infections. 10 10 00:00:21,240 --> 00:00:24,390 Now, to do this, we're going to use a lot of different tools 11 11 00:00:24,390 --> 00:00:26,070 and one of the most common ones we're going to use 12 12 00:00:26,070 --> 00:00:28,563 is a tool suite called Sysinternals. 13 13 00:00:29,460 --> 00:00:31,080 Sysinternals is a suite of tools 14 14 00:00:31,080 --> 00:00:33,570 designed to assist with troubleshooting issues with Windows, 15 15 00:00:33,570 --> 00:00:35,760 is originally made for system administrators 16 16 00:00:35,760 --> 00:00:38,040 but a lot of these tools are well-suited 17 17 00:00:38,040 --> 00:00:40,500 to investigate security issues as well. 18 18 00:00:40,500 --> 00:00:43,080 These tools are all available at Microsoft's website 19 19 00:00:43,080 --> 00:00:45,690 for free and it's part of their tool suite. 20 20 00:00:45,690 --> 00:00:47,220 Now, the great thing about these tools 21 21 00:00:47,220 --> 00:00:49,710 is it allows us to start building up a baseline 22 22 00:00:49,710 --> 00:00:51,630 to identify what normal is. 23 23 00:00:51,630 --> 00:00:53,610 One of the first years we want to do this with 24 24 00:00:53,610 --> 00:00:55,710 is what's called process analysis. 25 25 00:00:55,710 --> 00:00:57,540 Well, we want to start figuring out what processes 26 26 00:00:57,540 --> 00:00:59,460 are running on a window system. 27 27 00:00:59,460 --> 00:01:01,980 Now we can use a tool called Process Explorer to do this 28 28 00:01:01,980 --> 00:01:04,440 and this is part of the Sysinternals tool suite. 29 29 00:01:04,440 --> 00:01:06,960 Process Explorer can filter out legitimate activity 30 30 00:01:06,960 --> 00:01:08,490 what we know is known good, 31 31 00:01:08,490 --> 00:01:10,380 and that way we can identify very quickly 32 32 00:01:10,380 --> 00:01:12,240 what is anomalous behavior. 33 33 00:01:12,240 --> 00:01:15,240 The way this works is essentially we can run the system 34 34 00:01:15,240 --> 00:01:17,550 and we can see what normal looks like 35 35 00:01:17,550 --> 00:01:20,010 and we can save inside of Process Explorer 36 36 00:01:20,010 --> 00:01:21,750 all those running processes. 37 37 00:01:21,750 --> 00:01:24,270 Then we can run some malware in a sandbox 38 38 00:01:24,270 --> 00:01:26,370 and we can run that process tool again 39 39 00:01:26,370 --> 00:01:28,950 and now we can compare what we had as our baseline 40 40 00:01:28,950 --> 00:01:30,600 versus what is running now 41 41 00:01:30,600 --> 00:01:33,480 and that can help us identify what the malware is doing. 42 42 00:01:33,480 --> 00:01:35,160 That's how you can do it inside of a sandbox 43 43 00:01:35,160 --> 00:01:36,870 to identify malware patterns. 44 44 00:01:36,870 --> 00:01:39,450 But if you already have a good baseline for a system 45 45 00:01:39,450 --> 00:01:40,530 that's a production system 46 46 00:01:40,530 --> 00:01:42,360 like your workstation on your desk. 47 47 00:01:42,360 --> 00:01:43,740 And then we think you're infected, 48 48 00:01:43,740 --> 00:01:45,510 we can run this tool again and compare it 49 49 00:01:45,510 --> 00:01:48,060 to that known good baseline to see if there's any changes. 50 50 00:01:48,060 --> 00:01:50,190 And if there are, that could be a suspect area 51 51 00:01:50,190 --> 00:01:51,870 that we want to investigate further. 52 52 00:01:51,870 --> 00:01:53,970 This is really great when you're doing threat hunting 53 53 00:01:53,970 --> 00:01:55,830 and incident response. 54 54 00:01:55,830 --> 00:01:57,570 The big concept here when we're doing this 55 55 00:01:57,570 --> 00:02:00,540 is that to first understand what legitimate processes are 56 56 00:02:00,540 --> 00:02:02,760 so that way you can identify anything else 57 57 00:02:02,760 --> 00:02:04,470 and those would be suspicious. 58 58 00:02:04,470 --> 00:02:06,750 So to help you with that, let's go through 59 59 00:02:06,750 --> 00:02:08,730 and talk about a couple of processes 60 60 00:02:08,730 --> 00:02:10,560 on a typical Window system 61 61 00:02:10,560 --> 00:02:12,750 and what is considered legitimate. 62 62 00:02:12,750 --> 00:02:13,950 Anything outside of these 63 63 00:02:13,950 --> 00:02:15,720 would be things you should label as suspicious 64 64 00:02:15,720 --> 00:02:17,430 and look into further. 65 65 00:02:17,430 --> 00:02:19,680 The first two I want to talk about is system idle 66 66 00:02:19,680 --> 00:02:23,760 which is PID 0 and system, which is PID 4. 67 67 00:02:23,760 --> 00:02:26,490 Now these two are always going to have these PIDs 68 68 00:02:26,490 --> 00:02:28,950 which is the process identification number. 69 69 00:02:28,950 --> 00:02:32,130 These are kernel-level binaries that are used as the parent 70 70 00:02:32,130 --> 00:02:34,830 of the first user mode process, and that process 71 71 00:02:34,830 --> 00:02:39,360 is called Session Manager SubSystem or smss.exe. 72 72 00:02:39,360 --> 00:02:41,490 If you go into your Process Explorer 73 73 00:02:41,490 --> 00:02:44,190 or you look at your processors tab inside of Windows, 74 74 00:02:44,190 --> 00:02:47,490 you're going to see these two processes are always there. 75 75 00:02:47,490 --> 00:02:50,160 Next we have the Client Server Runtime SubSystem 76 76 00:02:50,160 --> 00:02:53,190 which is csrss.exe. 77 77 00:02:53,190 --> 00:02:55,350 This manages low-level Windows functions 78 78 00:02:55,350 --> 00:02:57,660 and it's normal to see several of these running. 79 79 00:02:57,660 --> 00:02:59,220 Now, as long as these are run 80 80 00:02:59,220 --> 00:03:02,160 from the %SystemRoot%\System32 81 81 00:03:02,160 --> 00:03:04,500 and they have no parent, they're legitimate. 82 82 00:03:04,500 --> 00:03:05,520 If you start seeing them 83 83 00:03:05,520 --> 00:03:06,990 and they have some kind of a parent, 84 84 00:03:06,990 --> 00:03:08,100 it means it may be malware 85 85 00:03:08,100 --> 00:03:11,400 that's trying to masquerade as this process. 86 86 00:03:11,400 --> 00:03:13,560 The next one we have is WINNIT. 87 87 00:03:13,560 --> 00:03:17,430 Now, winnit.exe is going to manage drivers and services 88 88 00:03:17,430 --> 00:03:20,280 and should only have a single instance running as a process 89 89 00:03:20,280 --> 00:03:22,020 when you look at Process Explorer. 90 90 00:03:22,020 --> 00:03:23,490 If you see more than that, again, 91 91 00:03:23,490 --> 00:03:25,890 it could be masquerading as malware. 92 92 00:03:25,890 --> 00:03:28,530 The next one we have is Services.exe 93 93 00:03:28,530 --> 00:03:30,420 and this is one I see a lot of malware 94 94 00:03:30,420 --> 00:03:31,830 trying to masquerade as. 95 95 00:03:31,830 --> 00:03:33,750 So this is one you want to look closely at. 96 96 00:03:33,750 --> 00:03:36,870 Services.exe is going to host nonboot drivers 97 97 00:03:36,870 --> 00:03:38,520 and background services for you 98 98 00:03:38,520 --> 00:03:41,100 and this process should only have one instance 99 99 00:03:41,100 --> 00:03:43,080 of Services.exe running 100 100 00:03:43,080 --> 00:03:45,210 and it should be a child of WINNIT. 101 101 00:03:45,210 --> 00:03:48,060 Now, there's other service processes that you should see. 102 102 00:03:48,060 --> 00:03:51,120 Those will be as a child of Services.exe 103 103 00:03:51,120 --> 00:03:53,160 or servicehost.exe. 104 104 00:03:53,160 --> 00:03:54,810 If it's a child anywhere else, 105 105 00:03:54,810 --> 00:03:56,490 it probably is something that is malicious 106 106 00:03:56,490 --> 00:03:58,680 and you should look into further. 107 107 00:03:58,680 --> 00:04:00,330 Now, another thing about services 108 108 00:04:00,330 --> 00:04:01,920 is anytime you look at services, 109 109 00:04:01,920 --> 00:04:03,870 it should be started by the system, 110 110 00:04:03,870 --> 00:04:06,450 local service or network service accounts. 111 111 00:04:06,450 --> 00:04:08,790 If it's started by somebody who has a username, 112 112 00:04:08,790 --> 00:04:10,770 that is usually a malicious process 113 113 00:04:10,770 --> 00:04:13,740 so you should flag it and look into it further. 114 114 00:04:13,740 --> 00:04:16,740 Next, we have the Local Security Authority SubSystem 115 115 00:04:16,740 --> 00:04:20,130 or lsass.exe. 116 116 00:04:20,130 --> 00:04:21,690 This is going to handle authentication 117 117 00:04:21,690 --> 00:04:24,390 and authorization services for the system 118 118 00:04:24,390 --> 00:04:26,430 and it should have a single instance running 119 119 00:04:26,430 --> 00:04:28,533 as a child of winnit.exe. 120 120 00:04:29,370 --> 00:04:32,073 If you see it elsewhere, that might be suspicious. 121 121 00:04:33,090 --> 00:04:37,140 Next, we have WINLOGON, which is winlogon.exe. 122 122 00:04:37,140 --> 00:04:39,450 This is going to manage access to the user desktop 123 123 00:04:39,450 --> 00:04:41,310 and it should only have one instance 124 124 00:04:41,310 --> 00:04:44,640 of each user session with the desktop window manager 125 125 00:04:44,640 --> 00:04:47,880 the dwm.exe as its child process 126 126 00:04:47,880 --> 00:04:49,980 in most of the modern versions of Windows. 127 127 00:04:51,330 --> 00:04:54,146 Another one that's very common to see is USERINIT. 128 128 00:04:54,146 --> 00:04:56,430 userinit.exe sets up the shell 129 129 00:04:56,430 --> 00:04:59,550 typically your explorer.exe file, and then it quits. 130 130 00:04:59,550 --> 00:05:01,110 So you should only see this briefly 131 131 00:05:01,110 --> 00:05:02,850 during your log on process. 132 132 00:05:02,850 --> 00:05:06,570 If the computer has been logged on for say 30 or 40 minutes 133 133 00:05:06,570 --> 00:05:09,210 and you go look and you see userinit.exe, 134 134 00:05:09,210 --> 00:05:12,480 that would be something you should flag as suspicious. 135 135 00:05:12,480 --> 00:05:15,003 And finally, we have Explorer, explorer.exe. 136 136 00:05:16,083 --> 00:05:17,760 This is the typical user shell, 137 137 00:05:17,760 --> 00:05:19,920 and it's launched with the user's account privileges 138 138 00:05:19,920 --> 00:05:21,360 rather than the systems. 139 139 00:05:21,360 --> 00:05:24,060 And it's likely going to be the parent for all of the processes 140 140 00:05:24,060 --> 00:05:26,130 that are started by the logged-on user. 141 141 00:05:26,130 --> 00:05:29,310 So when I go into Windows and I launch the computer, 142 142 00:05:29,310 --> 00:05:32,670 I'm starting up explorer.exe, that's my desktop. 143 143 00:05:32,670 --> 00:05:34,260 Then if I open up Microsoft Word, 144 144 00:05:34,260 --> 00:05:37,620 Word should be a child of explorer.exe 145 145 00:05:37,620 --> 00:05:40,590 because I'm the logged-on user and I launched Word. 146 146 00:05:40,590 --> 00:05:42,390 Anything other than that would be suspicious 147 147 00:05:42,390 --> 00:05:44,850 and you should flag it and look at it. 148 148 00:05:44,850 --> 00:05:46,050 Now, I mentioned a couple times 149 149 00:05:46,050 --> 00:05:47,407 you should flag something and say, 150 150 00:05:47,407 --> 00:05:48,870 "This is suspicious and you should look 151 151 00:05:48,870 --> 00:05:49,980 into it further." 152 152 00:05:49,980 --> 00:05:53,370 What else might make a process look suspicious to you? 153 153 00:05:53,370 --> 00:05:56,430 Well, for me, any process name that I don't recognize 154 154 00:05:56,430 --> 00:05:58,170 is something that would be suspicious. 155 155 00:05:58,170 --> 00:05:59,340 And when I say something suspicious, 156 156 00:05:59,340 --> 00:06:01,380 it means I should look into it further, that's all. 157 157 00:06:01,380 --> 00:06:02,820 It doesn't mean it's necessarily bad 158 158 00:06:02,820 --> 00:06:04,020 but it's just something I don't know 159 159 00:06:04,020 --> 00:06:05,970 and so I need to learn a little bit more about it. 160 160 00:06:05,970 --> 00:06:07,980 So if I see an unrecognized name, 161 161 00:06:07,980 --> 00:06:10,290 what I should do is I should start looking online 162 162 00:06:10,290 --> 00:06:11,790 to see if it's a known process 163 163 00:06:11,790 --> 00:06:14,130 and usually I'm going to use Microsoft's website to do that 164 164 00:06:14,130 --> 00:06:16,140 since they are the official source. 165 165 00:06:16,140 --> 00:06:18,150 Second, any process name that's similar 166 166 00:06:18,150 --> 00:06:20,100 to a legitimate system process. 167 167 00:06:20,100 --> 00:06:23,100 If I see something like scvhost, 168 168 00:06:23,100 --> 00:06:25,980 that's very close to svchost, 169 169 00:06:25,980 --> 00:06:27,358 and so that looks like something 170 170 00:06:27,358 --> 00:06:28,500 that somebody's trying to trick me. 171 171 00:06:28,500 --> 00:06:30,150 So I'm going to look into that further. 172 172 00:06:30,150 --> 00:06:32,490 If I see something that has a scrambled name, 173 173 00:06:32,490 --> 00:06:34,170 something that looks like it's randomly generated 174 174 00:06:34,170 --> 00:06:36,930 that would also be something that would be suspicious to me. 175 175 00:06:36,930 --> 00:06:38,820 Another thing I'd be looking at is any process 176 176 00:06:38,820 --> 00:06:41,490 that appears without an icon, version information, 177 177 00:06:41,490 --> 00:06:43,410 a description or a company name. 178 178 00:06:43,410 --> 00:06:45,930 All of these are things that are just suspicious to me 179 179 00:06:45,930 --> 00:06:47,490 and neither means it's poor coding 180 180 00:06:47,490 --> 00:06:49,710 or it might be malicious. 181 181 00:06:49,710 --> 00:06:52,770 After that, I might look at any processes that are unsigned, 182 182 00:06:52,770 --> 00:06:55,650 especially if it's from a well-known company like Microsoft. 183 183 00:06:55,650 --> 00:06:57,960 Microsoft signs all of their stuff. 184 184 00:06:57,960 --> 00:07:00,090 So if you find somebody that says Microsoft Corporation 185 185 00:07:00,090 --> 00:07:02,400 and it's unsigned, it's most likely malicious 186 186 00:07:02,400 --> 00:07:03,663 or at least suspicious. 187 187 00:07:04,560 --> 00:07:05,820 The fifth thing I like to look at 188 188 00:07:05,820 --> 00:07:07,860 is any process whose digital signature 189 189 00:07:07,860 --> 00:07:09,990 doesn't match the identified publisher. 190 190 00:07:09,990 --> 00:07:11,640 Now, what this means is sometimes 191 191 00:07:11,640 --> 00:07:14,670 somebody might have stolen somebody's digital key 192 192 00:07:14,670 --> 00:07:16,920 and so if they stole a developer's private key, 193 193 00:07:16,920 --> 00:07:18,810 they can then issue their own stuff 194 194 00:07:18,810 --> 00:07:20,580 and pretend to be that company. 195 195 00:07:20,580 --> 00:07:21,750 But if the company field 196 196 00:07:21,750 --> 00:07:23,760 and the digital signature aren't matching, 197 197 00:07:23,760 --> 00:07:25,110 that is usually an indication 198 198 00:07:25,110 --> 00:07:26,310 that this is a piece of malware 199 199 00:07:26,310 --> 00:07:28,410 or at least something very suspicious. 200 200 00:07:28,410 --> 00:07:30,330 The sixth thing I want to look at is any process 201 201 00:07:30,330 --> 00:07:32,610 that doesn't have a parent-child relationship 202 202 00:07:32,610 --> 00:07:35,040 with a principal Windows process. 203 203 00:07:35,040 --> 00:07:37,200 Now, when I talk about a principal Windows process, 204 204 00:07:37,200 --> 00:07:38,070 what is that? 205 205 00:07:38,070 --> 00:07:40,140 Well, that's something like explorer.exe. 206 206 00:07:40,140 --> 00:07:42,900 Remember I said explorer.exe should be launching 207 207 00:07:42,900 --> 00:07:46,020 all the processes pretty much for a logged-on user. 208 208 00:07:46,020 --> 00:07:47,400 And so if I'm not seeing that 209 209 00:07:47,400 --> 00:07:49,050 and I see those processes somewhere else, 210 210 00:07:49,050 --> 00:07:50,550 that might be something that's suspicious. 211 211 00:07:50,550 --> 00:07:52,320 I'd look into them further. 212 212 00:07:52,320 --> 00:07:53,880 The seventh thing I like to look at 213 213 00:07:53,880 --> 00:07:55,770 and this is much further down my list, obviously, 214 214 00:07:55,770 --> 00:07:58,950 is any process hosted by Windows utilities like Explorer. 215 215 00:07:58,950 --> 00:08:01,380 Now, Explorer should have some things that are underneath it 216 216 00:08:01,380 --> 00:08:02,790 but I like to look at all of those 217 217 00:08:02,790 --> 00:08:04,380 and make sure they're ones that I know what they are 218 218 00:08:04,380 --> 00:08:05,400 and I trust them. 219 219 00:08:05,400 --> 00:08:07,110 But I also want to look at things like Notepad 220 220 00:08:07,110 --> 00:08:09,150 and Task Manager, 'cause a lot of times 221 221 00:08:09,150 --> 00:08:11,670 malware will embed themself under those 222 222 00:08:11,670 --> 00:08:14,100 and try to have those things launch them as malware. 223 223 00:08:14,100 --> 00:08:16,020 And so if I see something like Notepad 224 224 00:08:16,020 --> 00:08:18,510 and Notepad is calling some other executable, 225 225 00:08:18,510 --> 00:08:19,770 that's usually a little funny 226 226 00:08:19,770 --> 00:08:22,650 because Notepad doesn't usually run other executables. 227 227 00:08:22,650 --> 00:08:24,420 It runs text files, right? 228 228 00:08:24,420 --> 00:08:25,800 And so that'd be something that would be suspicious 229 229 00:08:25,800 --> 00:08:27,390 and we'd look into further. 230 230 00:08:27,390 --> 00:08:30,300 The eighth thing is any process that is packed or compressed 231 231 00:08:30,300 --> 00:08:31,860 because again, when I talked about earlier 232 232 00:08:31,860 --> 00:08:35,220 that, yes, there are legitimate uses for packed files, 233 233 00:08:35,220 --> 00:08:37,050 but in general that is something 234 234 00:08:37,050 --> 00:08:38,820 that is heavily used by malware. 235 235 00:08:38,820 --> 00:08:40,500 So it doesn't necessarily mean right away 236 236 00:08:40,500 --> 00:08:42,210 that it is malicious, but it is something 237 237 00:08:42,210 --> 00:08:43,770 I want to look further into. 238 238 00:08:43,770 --> 00:08:45,480 If you're using Process Explorer, 239 239 00:08:45,480 --> 00:08:46,860 anything that's highlighted purple 240 240 00:08:46,860 --> 00:08:49,260 is considered a packed or compressed file, 241 241 00:08:49,260 --> 00:08:51,390 and that should draw your attention to it pretty quickly 242 242 00:08:51,390 --> 00:08:53,910 and analyze that as potential malware. 243 243 00:08:53,910 --> 00:08:55,530 Now, what do you do when you find 244 244 00:08:55,530 --> 00:08:57,120 one of these suspicious processes, 245 245 00:08:57,120 --> 00:08:58,620 I just gave you eight different ways 246 246 00:08:58,620 --> 00:09:01,110 to identify things that may be suspicious. 247 247 00:09:01,110 --> 00:09:02,520 What do you do with them now? 248 248 00:09:02,520 --> 00:09:03,750 Well, the first thing you're going to do 249 249 00:09:03,750 --> 00:09:06,660 is identify how the process interacts with the registry 250 250 00:09:06,660 --> 00:09:08,430 and the file system. 251 251 00:09:08,430 --> 00:09:11,250 As this file or process is launched, what is it doing? 252 252 00:09:11,250 --> 00:09:13,140 Is it making changes to your registry? 253 253 00:09:13,140 --> 00:09:15,060 Is it putting additional files on the system? 254 254 00:09:15,060 --> 00:09:17,670 And if so, are those things allowed? 255 255 00:09:17,670 --> 00:09:19,200 This is something that malware loves to do. 256 256 00:09:19,200 --> 00:09:21,990 When you run malware, it tries to embed itself further 257 257 00:09:21,990 --> 00:09:23,910 and it does that by going into the registry 258 258 00:09:23,910 --> 00:09:25,920 or going into the file system. 259 259 00:09:25,920 --> 00:09:27,420 The second thing is you have to ask yourself 260 260 00:09:27,420 --> 00:09:29,340 how is this process being launched? 261 261 00:09:29,340 --> 00:09:30,660 Who started this process? 262 262 00:09:30,660 --> 00:09:31,830 Did the user do it? 263 263 00:09:31,830 --> 00:09:33,210 Did some service do it? 264 264 00:09:33,210 --> 00:09:34,770 Did some kind of scheduled task do it? 265 265 00:09:34,770 --> 00:09:35,910 And once you figure that out 266 266 00:09:35,910 --> 00:09:37,320 that will help you eliminate it 267 267 00:09:37,320 --> 00:09:38,700 if it is something that's malicious 268 268 00:09:38,700 --> 00:09:40,380 and you need to turn it off. 269 269 00:09:40,380 --> 00:09:42,480 The third thing is, is that image file 270 270 00:09:42,480 --> 00:09:45,330 located in the system folder or a temp folder? 271 271 00:09:45,330 --> 00:09:47,040 A lot of times when you get malware, 272 272 00:09:47,040 --> 00:09:49,530 it's coming and being launched from a temp folder 273 273 00:09:49,530 --> 00:09:51,150 not from the system folder. 274 274 00:09:51,150 --> 00:09:53,820 So if a process is being launched from a system folder, 275 275 00:09:53,820 --> 00:09:55,290 it's probably a little bit more trustworthy 276 276 00:09:55,290 --> 00:09:56,700 than if it's coming from a temp folder. 277 277 00:09:56,700 --> 00:09:58,500 So it's another area I look at. 278 278 00:09:58,500 --> 00:10:00,960 And then four, what files are being manipulated 279 279 00:10:00,960 --> 00:10:02,220 by the process? 280 280 00:10:02,220 --> 00:10:05,280 Again, when you launch this file, what is it touching? 281 281 00:10:05,280 --> 00:10:07,650 Is it reading files, is it changing files? 282 282 00:10:07,650 --> 00:10:09,780 All that stuff is information you want to gather 283 283 00:10:09,780 --> 00:10:11,730 about this process so you can determine 284 284 00:10:11,730 --> 00:10:14,070 what it's doing and if it's malicious or not. 285 285 00:10:14,070 --> 00:10:15,690 The fifth thing you want to do is figure out 286 286 00:10:15,690 --> 00:10:18,420 does the process restore itself after reboot 287 287 00:10:18,420 --> 00:10:19,680 if you deleted it? 288 288 00:10:19,680 --> 00:10:21,330 If I went in and deleted this process 289 289 00:10:21,330 --> 00:10:23,610 and then rebooted my computer and it comes right back, 290 290 00:10:23,610 --> 00:10:25,440 that's a sign that there's something malicious 291 291 00:10:25,440 --> 00:10:27,360 or suspicious going on. 292 292 00:10:27,360 --> 00:10:28,500 And the sixth thing I want to look at 293 293 00:10:28,500 --> 00:10:29,940 is does a system privilege 294 294 00:10:29,940 --> 00:10:32,850 or service get blocked if I delete the process? 295 295 00:10:32,850 --> 00:10:35,160 Now, sometimes if you have shimmed something into it 296 296 00:10:35,160 --> 00:10:38,070 or injected that code into some kind of system DLL, 297 297 00:10:38,070 --> 00:10:40,050 that can cause problems if you delete it. 298 298 00:10:40,050 --> 00:10:41,970 And again, malicious people want to make sure 299 299 00:10:41,970 --> 00:10:43,530 their software stays intact. 300 300 00:10:43,530 --> 00:10:45,870 And so if you take out something and delete that process, 301 301 00:10:45,870 --> 00:10:47,460 does it break your system? 302 302 00:10:47,460 --> 00:10:49,020 Does it cause privilege issues? 303 303 00:10:49,020 --> 00:10:51,030 If so, that's another thing that adds 304 304 00:10:51,030 --> 00:10:52,650 to your toolkit as you start looking 305 305 00:10:52,650 --> 00:10:54,720 at investigating this piece of software. 306 306 00:10:54,720 --> 00:10:56,340 And then the seventh and final one is, 307 307 00:10:56,340 --> 00:10:58,830 is the process interacting with the network? 308 308 00:10:58,830 --> 00:11:00,510 This is a big one because we want to see 309 309 00:11:00,510 --> 00:11:02,670 if there's any communication going in and out 310 310 00:11:02,670 --> 00:11:06,090 because again malware likes to communicate with its owner. 311 311 00:11:06,090 --> 00:11:07,770 It goes out into a C2 network. 312 312 00:11:07,770 --> 00:11:10,050 We need to figure out what domain it is or what IP it is 313 313 00:11:10,050 --> 00:11:11,970 so then we can potentially block that. 314 314 00:11:11,970 --> 00:11:13,890 Now, a lot of these UEBA programs 315 315 00:11:13,890 --> 00:11:16,290 are relying on the capabilities of artificial intelligence 316 316 00:11:16,290 --> 00:11:18,480 and machine learning to help you orchestrate 317 317 00:11:18,480 --> 00:11:20,910 and automate a lot of this work for you. 318 318 00:11:20,910 --> 00:11:22,800 But it is still important as an analyst 319 319 00:11:22,800 --> 00:11:24,720 to know how to do this manually 320 320 00:11:24,720 --> 00:11:26,730 so you can identify these things on your own 321 321 00:11:26,730 --> 00:11:28,080 and know what you're looking at. 322 322 00:11:28,080 --> 00:11:30,030 We don't always want to be relying on the machines 323 323 00:11:30,030 --> 00:11:32,330 even though the machines are there to help us.