Instructor: Behavioral analysis. 2 2
Now, in the last lesson we talked about shell code. 3 3
And shell code is really easy to hide and obfuscate 4 4
because you can do a lot of things with it 5 5
to evade signature-based antivirus detection 6 6
if you're an attacker. 7 7
Because of this threat hunting and security monitoring 8 8
must use behavioral-based techniques 9 9
to really identify infections. 10 10
Now, to do this, we're going to use a lot of different tools 11 11
and one of the most common ones we're going to use 12 12
is a tool suite called Sysinternals. 13 13
Sysinternals is a suite of tools 14 14
designed to assist with troubleshooting issues with Windows, 15 15
is originally made for system administrators 16 16
but a lot of these tools are well-suited 17 17
to investigate security issues as well. 18 18
These tools are all available at Microsoft's website 19 19
for free and it's part of their tool suite. 20 20
Now, the great thing about these tools 21 21
is it allows us to start building up a baseline 22 22
to identify what normal is. 23 23
One of the first years we want to do this with 24 24
is what's called process analysis. 25 25
Well, we want to start figuring out what processes 26 26
are running on a window system. 27 27
Now we can use a tool called Process Explorer to do this 28 28
and this is part of the Sysinternals tool suite. 29 29
Process Explorer can filter out legitimate activity 30 30
what we know is known good, 31 31
and that way we can identify very quickly 32 32
what is anomalous behavior. 33 33
The way this works is essentially we can run the system 34 34
and we can see what normal looks like 35 35
and we can save inside of Process Explorer 36 36
all those running processes. 37 37
Then we can run some malware in a sandbox 38 38
and we can run that process tool again 39 39
and now we can compare what we had as our baseline 40 40
versus what is running now 41 41
and that can help us identify what the malware is doing. 42 42
That's how you can do it inside of a sandbox 43 43
to identify malware patterns. 44 44
But if you already have a good baseline for a system 45 45
that's a production system 46 46
like your workstation on your desk. 47 47
And then we think you're infected, 48 48
we can run this tool again and compare it 49 49
to that known good baseline to see if there's any changes. 50 50
And if there are, that could be a suspect area 51 51
that we want to investigate further. 52 52
This is really great when you're doing threat hunting 53 53
and incident response. 54 54
The big concept here when we're doing this 55 55
is that to first understand what legitimate processes are 56 56
so that way you can identify anything else 57 57
and those would be suspicious. 58 58
So to help you with that, let's go through 59 59
and talk about a couple of processes 60 60
on a typical Window system 61 61
and what is considered legitimate. 62 62
Anything outside of these 63 63
would be things you should label as suspicious 64 64
and look into further. 65 65
The first two I want to talk about is system idle 66 66
which is PID 0 and system, which is PID 4. 67 67
Now these two are always going to have these PIDs 68 68
which is the process identification number. 69 69
These are kernel-level binaries that are used as the parent 70 70
of the first user mode process, and that process 71 71
is called Session Manager SubSystem or smss.exe. 72 72
If you go into your Process Explorer 73 73
or you look at your processors tab inside of Windows, 74 74
you're going to see these two processes are always there. 75 75
Next we have the Client Server Runtime SubSystem 76 76
which is csrss.exe. 77 77
This manages low-level Windows functions 78 78
and it's normal to see several of these running. 79 79
Now, as long as these are run 80 80
from the %SystemRoot%\System32 81 81
and they have no parent, they're legitimate. 82 82
If you start seeing them 83 83
and they have some kind of a parent, 84 84
it means it may be malware 85 85
that's trying to masquerade as this process. 86 86
The next one we have is WINNIT. 87 87
Now, winnit.exe is going to manage drivers and services 88 88
and should only have a single instance running as a process 89 89
when you look at Process Explorer. 90 90
If you see more than that, again, 91 91
it could be masquerading as malware. 92 92
The next one we have is Services.exe 93 93
and this is one I see a lot of malware 94 94
trying to masquerade as. 95 95
So this is one you want to look closely at. 96 96
Services.exe is going to host nonboot drivers 97 97
and background services for you 98 98
and this process should only have one instance 99 99
of Services.exe running 100 100
and it should be a child of WINNIT. 101 101
Now, there's other service processes that you should see. 102 102
Those will be as a child of Services.exe 103 103
or servicehost.exe. 104 104
If it's a child anywhere else, 105 105
it probably is something that is malicious 106 106
and you should look into further. 107 107
Now, another thing about services 108 108
is anytime you look at services, 109 109
it should be started by the system, 110 110
local service or network service accounts. 111 111
If it's started by somebody who has a username, 112 112
that is usually a malicious process 113 113
so you should flag it and look into it further. 114 114
Next, we have the Local Security Authority SubSystem 115 115
or lsass.exe. 116 116
This is going to handle authentication 117 117
and authorization services for the system 118 118
and it should have a single instance running 119 119
as a child of winnit.exe. 120 120
If you see it elsewhere, that might be suspicious. 121 121
Next, we have WINLOGON, which is winlogon.exe. 122 122
This is going to manage access to the user desktop 123 123
and it should only have one instance 124 124
of each user session with the desktop window manager 125 125
the dwm.exe as its child process 126 126
in most of the modern versions of Windows. 127 127
Another one that's very common to see is USERINIT. 128 128
userinit.exe sets up the shell 129 129
typically your explorer.exe file, and then it quits. 130 130
So you should only see this briefly 131 131
during your log on process. 132 132
If the computer has been logged on for say 30 or 40 minutes 133 133
and you go look and you see userinit.exe, 134 134
that would be something you should flag as suspicious. 135 135
And finally, we have Explorer, explorer.exe. 136 136
This is the typical user shell, 137 137
and it's launched with the user's account privileges 138 138
rather than the systems. 139 139
And it's likely going to be the parent for all of the processes 140 140
that are started by the logged-on user. 141 141
So when I go into Windows and I launch the computer, 142 142
I'm starting up explorer.exe, that's my desktop. 143 143
Then if I open up Microsoft Word, 144 144
Word should be a child of explorer.exe 145 145
because I'm the logged-on user and I launched Word. 146 146
Anything other than that would be suspicious 147 147
and you should flag it and look at it. 148 148
Now, I mentioned a couple times 149 149
you should flag something and say, 150 150
"This is suspicious and you should look 151 151
into it further." 152 152
What else might make a process look suspicious to you? 153 153
Well, for me, any process name that I don't recognize 154 154
is something that would be suspicious. 155 155
And when I say something suspicious, 156 156
it means I should look into it further, that's all. 157 157
It doesn't mean it's necessarily bad 158 158
but it's just something I don't know 159 159
and so I need to learn a little bit more about it. 160 160
So if I see an unrecognized name, 161 161
what I should do is I should start looking online 162 162
to see if it's a known process 163 163
and usually I'm going to use Microsoft's website to do that 164 164
since they are the official source. 165 165
Second, any process name that's similar 166 166
to a legitimate system process. 167 167
If I see something like scvhost, 168 168
that's very close to svchost, 169 169
and so that looks like something 170 170
that somebody's trying to trick me. 171 171
So I'm going to look into that further. 172 172
If I see something that has a scrambled name, 173 173
something that looks like it's randomly generated 174 174
that would also be something that would be suspicious to me. 175 175
Another thing I'd be looking at is any process 176 176
that appears without an icon, version information, 177 177
a description or a company name. 178 178
All of these are things that are just suspicious to me 179 179
and neither means it's poor coding 180 180
or it might be malicious. 181 181
After that, I might look at any processes that are unsigned, 182 182
especially if it's from a well-known company like Microsoft. 183 183
Microsoft signs all of their stuff. 184 184
So if you find somebody that says Microsoft Corporation 185 185
and it's unsigned, it's most likely malicious 186 186
or at least suspicious. 187 187
The fifth thing I like to look at 188 188
is any process whose digital signature 189 189
doesn't match the identified publisher. 190 190
Now, what this means is sometimes 191 191
somebody might have stolen somebody's digital key 192 192
and so if they stole a developer's private key, 193 193
they can then issue their own stuff 194 194
and pretend to be that company. 195 195
But if the company field 196 196
and the digital signature aren't matching, 197 197
that is usually an indication 198 198
that this is a piece of malware 199 199
or at least something very suspicious. 200 200
The sixth thing I want to look at is any process 201 201
that doesn't have a parent-child relationship 202 202
with a principal Windows process. 203 203
Now, when I talk about a principal Windows process, 204 204
what is that? 205 205
Well, that's something like explorer.exe. 206 206
Remember I said explorer.exe should be launching 207 207
all the processes pretty much for a logged-on user. 208 208
And so if I'm not seeing that 209 209
and I see those processes somewhere else, 210 210
that might be something that's suspicious. 211 211
I'd look into them further. 212 212
The seventh thing I like to look at 213 213
and this is much further down my list, obviously, 214 214
is any process hosted by Windows utilities like Explorer. 215 215
Now, Explorer should have some things that are underneath it 216 216
but I like to look at all of those 217 217
and make sure they're ones that I know what they are 218 218
and I trust them. 219 219
But I also want to look at things like Notepad 220 220
and Task Manager, 'cause a lot of times 221 221
malware will embed themself under those 222 222
and try to have those things launch them as malware. 223 223
And so if I see something like Notepad 224 224
and Notepad is calling some other executable, 225 225
that's usually a little funny 226 226
because Notepad doesn't usually run other executables. 227 227
It runs text files, right? 228 228
And so that'd be something that would be suspicious 229 229
and we'd look into further. 230 230
The eighth thing is any process that is packed or compressed 231 231
because again, when I talked about earlier 232 232
that, yes, there are legitimate uses for packed files, 233 233
but in general that is something 234 234
that is heavily used by malware. 235 235
So it doesn't necessarily mean right away 236 236
that it is malicious, but it is something 237 237
I want to look further into. 238 238
If you're using Process Explorer, 239 239
anything that's highlighted purple 240 240
is considered a packed or compressed file, 241 241
and that should draw your attention to it pretty quickly 242 242
and analyze that as potential malware. 243 243
Now, what do you do when you find 244 244
one of these suspicious processes, 245 245
I just gave you eight different ways 246 246
to identify things that may be suspicious. 247 247
What do you do with them now? 248 248
Well, the first thing you're going to do 249 249
is identify how the process interacts with the registry 250 250
and the file system. 251 251
As this file or process is launched, what is it doing? 252 252
Is it making changes to your registry? 253 253
Is it putting additional files on the system? 254 254
And if so, are those things allowed? 255 255
This is something that malware loves to do. 256 256
When you run malware, it tries to embed itself further 257 257
and it does that by going into the registry 258 258
or going into the file system. 259 259
The second thing is you have to ask yourself 260 260
how is this process being launched? 261 261
Who started this process? 262 262
Did the user do it? 263 263
Did some service do it? 264 264
Did some kind of scheduled task do it? 265 265
And once you figure that out 266 266
that will help you eliminate it 267 267
if it is something that's malicious 268 268
and you need to turn it off. 269 269
The third thing is, is that image file 270 270
located in the system folder or a temp folder? 271 271
A lot of times when you get malware, 272 272
it's coming and being launched from a temp folder 273 273
not from the system folder. 274 274
So if a process is being launched from a system folder, 275 275
it's probably a little bit more trustworthy 276 276
than if it's coming from a temp folder. 277 277
So it's another area I look at. 278 278
And then four, what files are being manipulated 279 279
by the process? 280 280
Again, when you launch this file, what is it touching? 281 281
Is it reading files, is it changing files? 282 282
All that stuff is information you want to gather 283 283
about this process so you can determine 284 284
what it's doing and if it's malicious or not. 285 285
The fifth thing you want to do is figure out 286 286
does the process restore itself after reboot 287 287
if you deleted it? 288 288
If I went in and deleted this process 289 289
and then rebooted my computer and it comes right back, 290 290
that's a sign that there's something malicious 291 291
or suspicious going on. 292 292
And the sixth thing I want to look at 293 293
is does a system privilege 294 294
or service get blocked if I delete the process? 295 295
Now, sometimes if you have shimmed something into it 296 296
or injected that code into some kind of system DLL, 297 297
that can cause problems if you delete it. 298 298
And again, malicious people want to make sure 299 299
their software stays intact. 300 300
And so if you take out something and delete that process, 301 301
does it break your system? 302 302
Does it cause privilege issues? 303 303
If so, that's another thing that adds 304 304
to your toolkit as you start looking 305 305
at investigating this piece of software. 306 306
And then the seventh and final one is, 307 307
is the process interacting with the network? 308 308
This is a big one because we want to see 309 309
if there's any communication going in and out 310 310
because again malware likes to communicate with its owner. 311 311
It goes out into a C2 network. 312 312
We need to figure out what domain it is or what IP it is 313 313
so then we can potentially block that. 314 314
Now, a lot of these UEBA programs 315 315
are relying on the capabilities of artificial intelligence 316 316
and machine learning to help you orchestrate 317 317
and automate a lot of this work for you. 318 318
But it is still important as an analyst 319 319
to know how to do this manually 320 320
so you can identify these things on your own 321 321
and know what you're looking at. 322 322
We don't always want to be relying on the machines 323 323
even though the machines are there to help us.