1
00:00:00,120 --> 00:00:01,470
In this lesson, we will discuss

2
00:00:01,470 --> 00:00:03,900
some common indicators of compromise

3
00:00:03,900 --> 00:00:05,550
in the world of cybersecurity,

4
00:00:05,550 --> 00:00:07,470
indicators of compromise, commonly referred to

5
00:00:07,470 --> 00:00:11,190
as IoCs are pieces of forensic data that identify

6
00:00:11,190 --> 00:00:14,310
potentially malicious activity on a network or system.

7
00:00:14,310 --> 00:00:16,650
These IoCs serve as the digital evidence

8
00:00:16,650 --> 00:00:18,750
that a security breach has occurred.

9
00:00:18,750 --> 00:00:20,820
These indicators of compromise include things

10
00:00:20,820 --> 00:00:23,850
like account lockouts and current session usage

11
00:00:23,850 --> 00:00:27,660
blocked content, impossible travel, resource consumption.

12
00:00:27,660 --> 00:00:30,510
Resource inaccessibility, out of cycle logging,

13
00:00:30,510 --> 00:00:32,700
publish says documenting that you've been hacked

14
00:00:32,700 --> 00:00:34,380
and missing logs.

15
00:00:34,380 --> 00:00:36,330
First, we have account lockouts.

16
00:00:36,330 --> 00:00:38,220
An account lockout is a common indicator

17
00:00:38,220 --> 00:00:40,500
of compromise that occurs when an account has been locked

18
00:00:40,500 --> 00:00:42,930
out due to multiple failed login attempts.

19
00:00:42,930 --> 00:00:45,540
This could indicate a brute force attack that was attempted

20
00:00:45,540 --> 00:00:47,370
by the hacker who was trying to gain access

21
00:00:47,370 --> 00:00:49,110
by guessing the user's password.

22
00:00:49,110 --> 00:00:50,529
For example, if an account is locked

23
00:00:50,529 --> 00:00:53,310
out after numerous unsuccessful login attempts

24
00:00:53,310 --> 00:00:55,680
in a short period, it is usually a clear sign

25
00:00:55,680 --> 00:00:57,600
that someone is trying to break into the account.

26
00:00:57,600 --> 00:01:00,540
Account lockout policies vary among different systems.

27
00:01:00,540 --> 00:01:02,370
Some systems may lock out an account

28
00:01:02,370 --> 00:01:04,620
after a certain number of attempts of failed logins

29
00:01:04,620 --> 00:01:07,230
while others may increase the delay between login attempts

30
00:01:07,230 --> 00:01:09,840
after each failure to effectively slow down the attacker

31
00:01:09,840 --> 00:01:12,060
and make a successful brute force attack much

32
00:01:12,060 --> 00:01:13,140
more impractical.

33
00:01:13,140 --> 00:01:15,000
The duration of the account lockout will also

34
00:01:15,000 --> 00:01:16,740
vary depending on your system.

35
00:01:16,740 --> 00:01:18,654
Some systems may implement a temporary lockout

36
00:01:18,654 --> 00:01:20,820
where the account is automatically unlocked

37
00:01:20,820 --> 00:01:21,870
after a certain period of time

38
00:01:21,870 --> 00:01:25,830
such as 15 minutes or four hours, or some time-based reset.

39
00:01:25,830 --> 00:01:27,750
Other high security systems may require a

40
00:01:27,750 --> 00:01:28,800
manual intervention

41
00:01:28,800 --> 00:01:31,020
by an administrator to unlock the account to ensure

42
00:01:31,020 --> 00:01:33,342
that the suspicious activity is investigated prior

43
00:01:33,342 --> 00:01:35,370
to the account being unlocked.

44
00:01:35,370 --> 00:01:38,280
While account lockout is a valuable security feature

45
00:01:38,280 --> 00:01:40,037
it must be balanced with usability.

46
00:01:40,037 --> 00:01:42,600
Overly strict account lockout policies can lead

47
00:01:42,600 --> 00:01:45,180
to increased support calls and frustrated users.

48
00:01:45,180 --> 00:01:46,800
For example, if an account is locked

49
00:01:46,800 --> 00:01:49,140
after three failed attempt, a user could be locked

50
00:01:49,140 --> 00:01:51,030
out simply by mistyping their password.

51
00:01:51,030 --> 00:01:53,520
So it's important to weigh the security benefits

52
00:01:53,520 --> 00:01:55,560
against the possible user inconvenience

53
00:01:55,560 --> 00:01:57,870
that a low lockout threshold may create.

54
00:01:57,870 --> 00:02:00,259
Second, we have concurrent session usage.

55
00:02:00,259 --> 00:02:02,520
Concurrent session usage refers

56
00:02:02,520 --> 00:02:05,760
to multiple active sessions from a single user account.

57
00:02:05,760 --> 00:02:07,920
This could indicate that the account has been compromised

58
00:02:07,920 --> 00:02:09,419
and it's being used by attacker

59
00:02:09,419 --> 00:02:11,550
while the legitimate user is logged in.

60
00:02:11,550 --> 00:02:13,980
For example, if an employee is logged into their account

61
00:02:13,980 --> 00:02:16,320
from their office computer, but another session

62
00:02:16,320 --> 00:02:19,140
from a different location is active at the same time

63
00:02:19,140 --> 00:02:21,780
it's a strong indication of a security breach.

64
00:02:21,780 --> 00:02:24,060
In this example, it could have been a false positive

65
00:02:24,060 --> 00:02:26,820
since an employee could be logged in from different devices.

66
00:02:26,820 --> 00:02:29,753
However, exercising caution is important here because

67
00:02:29,753 --> 00:02:31,860
if one session is in the United States

68
00:02:31,860 --> 00:02:34,260
while the other active session is happening from Europe

69
00:02:34,260 --> 00:02:37,138
then it is a good sign that a compromise has occurred.

70
00:02:37,138 --> 00:02:39,870
Third, we have blocked content.

71
00:02:39,870 --> 00:02:41,820
Blocked content is another indicator

72
00:02:41,820 --> 00:02:44,280
of compromise that refers to attempts to access

73
00:02:44,280 --> 00:02:46,080
or download content that has been blocked

74
00:02:46,080 --> 00:02:47,550
by security protocol.

75
00:02:47,550 --> 00:02:49,230
This could indicate a user trying to

76
00:02:49,230 --> 00:02:50,670
access malicious content

77
00:02:50,670 --> 00:02:53,460
or an attacker trying to download sensitive data.

78
00:02:53,460 --> 00:02:54,300
For example

79
00:02:54,300 --> 00:02:56,580
if there are repeat attempts to download a blocked file

80
00:02:56,580 --> 00:02:59,010
it could suggest that a user's account has been compromised

81
00:02:59,010 --> 00:03:00,840
and is being used to steal data.

82
00:03:00,840 --> 00:03:02,730
Fourth, we have impossible travel.

83
00:03:02,730 --> 00:03:04,530
Impossible Travel is a unique indicator

84
00:03:04,530 --> 00:03:06,690
of compromise that involves detecting logins

85
00:03:06,690 --> 00:03:08,790
from geographically distant locations

86
00:03:08,790 --> 00:03:11,430
within a specific timeframe that makes physical travel

87
00:03:11,430 --> 00:03:13,800
between those locations impossible to achieve.

88
00:03:13,800 --> 00:03:16,830
For example, if a user account logs in from New York

89
00:03:16,830 --> 00:03:19,260
and then from London within an hour, there's a good chance

90
00:03:19,260 --> 00:03:20,910
that an account compromise has occurred

91
00:03:20,910 --> 00:03:23,490
because a single user cannot travel from New York

92
00:03:23,490 --> 00:03:26,730
to London in less than five or six hours by taking a plane.

93
00:03:26,730 --> 00:03:28,459
Often you will see impossible travel

94
00:03:28,459 --> 00:03:30,900
and concurrent sessions usage grouped together

95
00:03:30,900 --> 00:03:34,170
since they often but not always occur simultaneously.

96
00:03:34,170 --> 00:03:36,030
Fifth, we have resource consumption.

97
00:03:36,030 --> 00:03:38,130
Unusual spikes in resource consumption such

98
00:03:38,130 --> 00:03:41,340
as CPU, memory or network bandwidth can serve

99
00:03:41,340 --> 00:03:43,290
as a good indicator of compromise.

100
00:03:43,290 --> 00:03:45,812
This excessive resource utilization can indicate a

101
00:03:45,812 --> 00:03:49,050
malware infection or a distributed to denial service attack

102
00:03:49,050 --> 00:03:52,020
or DDoS attack that is concurrently underway.

103
00:03:52,020 --> 00:03:54,540
For example, if a server that typically uses 20%

104
00:03:54,540 --> 00:03:58,170
of a CPU capacity and then suddenly jumps to 90%

105
00:03:58,170 --> 00:03:59,010
it could be a good sign

106
00:03:59,010 --> 00:04:01,650
that the server is under attack or has been compromised.

107
00:04:01,650 --> 00:04:04,320
Another example would be if you're browsing the web

108
00:04:04,320 --> 00:04:07,290
on your workstation and your GPU usage is at 90%

109
00:04:07,290 --> 00:04:08,220
this is a good indication

110
00:04:08,220 --> 00:04:10,800
that the system may be a zombie and has been enrolled

111
00:04:10,800 --> 00:04:13,890
as a crypto mining agent or performing some other kind

112
00:04:13,890 --> 00:04:17,279
of computational resource heavy task for a threat actor

113
00:04:17,279 --> 00:04:19,380
both of which have become very popular attacks

114
00:04:19,380 --> 00:04:20,519
in the recent years.

115
00:04:20,519 --> 00:04:23,075
Six, we have resource inaccessibility.

116
00:04:23,075 --> 00:04:25,151
Resource inaccessibility refers

117
00:04:25,151 --> 00:04:27,930
to the inability to access certain resources such

118
00:04:27,930 --> 00:04:30,630
as files, databases, or network services.

119
00:04:30,630 --> 00:04:32,850
This could indicate a ransomware attack where

120
00:04:32,850 --> 00:04:35,130
an attacker encrypts a victim's files

121
00:04:35,130 --> 00:04:37,560
and demands a ransom for their release.

122
00:04:37,560 --> 00:04:40,131
For example, if a user suddenly cannot access

123
00:04:40,131 --> 00:04:42,600
these files and receives a ransom note

124
00:04:42,600 --> 00:04:44,760
this is an obvious and clear sign that they're

125
00:04:44,760 --> 00:04:46,770
a victim of a ransomware attack.

126
00:04:46,770 --> 00:04:49,530
Seventh, we have an out-of-cycle logging.

127
00:04:49,530 --> 00:04:52,230
Out-of-cycle logging refers to log entries that

128
00:04:52,230 --> 00:04:54,960
occur at unusual times such as late nights or

129
00:04:54,960 --> 00:04:57,897
on weekends where no one is expected to be working.

130
00:04:57,897 --> 00:05:00,750
This type of out-of-cycle logging usually indicates

131
00:05:00,750 --> 00:05:03,060
that an attacker is trying to hide their activities

132
00:05:03,060 --> 00:05:04,830
during off peak hours.

133
00:05:04,830 --> 00:05:07,032
For example, if their log entry show activity at

134
00:05:07,032 --> 00:05:10,039
3:00 AM when office is typically closed, this could

135
00:05:10,039 --> 00:05:13,380
suggest that a security breach has occurred on the network.

136
00:05:13,380 --> 00:05:15,660
Eight, we have missing logs.

137
00:05:15,660 --> 00:05:19,110
Missing logs, like out-of-cycle logging is another sign

138
00:05:19,110 --> 00:05:20,730
that a compromise has occurred.

139
00:05:20,730 --> 00:05:23,460
Attackers often delete to hide their activities

140
00:05:23,460 --> 00:05:25,440
and make it harder for investigators to trace their

141
00:05:25,440 --> 00:05:27,630
attackers footsteps through the network.

142
00:05:27,630 --> 00:05:30,240
For example, if a systems log suddenly have a gap

143
00:05:30,240 --> 00:05:32,970
of several hours or days, this might suggest

144
00:05:32,970 --> 00:05:34,920
that an attacker has been tampering with the logs to

145
00:05:34,920 --> 00:05:36,300
cover their tracks.

146
00:05:36,300 --> 00:05:39,870
Ninth and finally, we have published articles or documents

147
00:05:39,870 --> 00:05:41,700
that your organization has been hacked.

148
00:05:41,700 --> 00:05:44,070
Sometimes an attacker will publicly disclose

149
00:05:44,070 --> 00:05:46,710
that they hacked the system either to boast

150
00:05:46,710 --> 00:05:49,440
about their skills or cause reputational damage

151
00:05:49,440 --> 00:05:50,700
to the organization.

152
00:05:50,700 --> 00:05:53,250
This type of publishing can occur on social media

153
00:05:53,250 --> 00:05:54,150
hacker forums

154
00:05:54,150 --> 00:05:57,510
in a newspaper article, or even on a victim's own website.

155
00:05:57,510 --> 00:06:00,300
For example, if a company's website is defaced

156
00:06:00,300 --> 00:06:01,590
with the message claiming

157
00:06:01,590 --> 00:06:04,260
that the Hacktivism group was responsible for the attack

158
00:06:04,260 --> 00:06:05,940
this is obviously a clear sign

159
00:06:05,940 --> 00:06:07,890
that your website has been compromised.

160
00:06:07,890 --> 00:06:10,590
So remember, recognizing these indicators

161
00:06:10,590 --> 00:06:11,790
of compromise is crucial

162
00:06:11,790 --> 00:06:14,340
to your success as a cybersecurity professional.

163
00:06:14,340 --> 00:06:16,260
Indicators of compromise are the evidence

164
00:06:16,260 --> 00:06:18,900
includes left behind by a threat actor

165
00:06:18,900 --> 00:06:20,400
that can provide us insights

166
00:06:20,400 --> 00:06:22,980
and some early warning signs of potential breaches so

167
00:06:22,980 --> 00:06:26,280
that we can act swiftly to contain and mitigate any damage.

168
00:06:26,280 --> 00:06:28,230
However, it's important to remember

169
00:06:28,230 --> 00:06:30,930
that not all indicators of compromise necessarily means

170
00:06:30,930 --> 00:06:32,430
that a compromise has occurred.

171
00:06:32,430 --> 00:06:34,320
Instead, there are hints or clues

172
00:06:34,320 --> 00:06:35,610
that something has happened

173
00:06:35,610 --> 00:06:37,292
and it's still up to us to decide

174
00:06:37,292 --> 00:06:40,620
if it is a true compromise or if it was simply the result

175
00:06:40,620 --> 00:06:43,692
of a system error or it was a legitimate user activity

176
00:06:43,692 --> 00:06:46,200
or it is simply a false positive.

177
00:06:46,200 --> 00:06:47,970
For this reason, you will spend a lot

178
00:06:47,970 --> 00:06:50,760
of your time as a cybersecurity professional combing

179
00:06:50,760 --> 00:06:52,350
through event logs to determine

180
00:06:52,350 --> 00:06:55,053
if an event was really part of a compromise or not.