1
00:00:00,060 --> 00:00:02,070
In this lesson, we're going to take a quick look

2
00:00:02,070 --> 00:00:03,690
at application logs.

3
00:00:03,690 --> 00:00:05,700
Now, application logs are going to be created

4
00:00:05,700 --> 00:00:08,610
for every single application you have on your system.

5
00:00:08,610 --> 00:00:11,130
A lot of these are going to be logged directly inside

6
00:00:11,130 --> 00:00:12,900
of the applications folder itself,

7
00:00:12,900 --> 00:00:15,480
or they may be consolidated centrally inside

8
00:00:15,480 --> 00:00:19,170
of your logging system, such as a SIEM or a Syslog server

9
00:00:19,170 --> 00:00:22,860
or on a Windows machine inside your application log file.

10
00:00:22,860 --> 00:00:25,530
Now for this example, I'm using a generalized version

11
00:00:25,530 --> 00:00:26,760
of a log file.

12
00:00:26,760 --> 00:00:29,100
And in this application log we're going to see a lot

13
00:00:29,100 --> 00:00:30,107
of different events that have happened,

14
00:00:30,107 --> 00:00:32,430
we'll have to determine what was malicious,

15
00:00:32,430 --> 00:00:35,550
what was suspicious, and what was just normal user activity.

16
00:00:35,550 --> 00:00:38,010
Now as we go through this generic log, you'll see the date,

17
00:00:38,010 --> 00:00:40,440
the time, the event ID, the description,

18
00:00:40,440 --> 00:00:43,140
the user who performed the action, the action taken,

19
00:00:43,140 --> 00:00:44,430
and the details.

20
00:00:44,430 --> 00:00:47,400
Here, we can see all these actions happened on the same day

21
00:00:47,400 --> 00:00:49,230
and within a couple of minutes of each other

22
00:00:49,230 --> 00:00:51,990
starting at 17:31 in the afternoon

23
00:00:51,990 --> 00:00:54,240
and finishing around 17:33.

24
00:00:54,240 --> 00:00:57,120
So all this happened within about a minute or two.

25
00:00:57,120 --> 00:00:59,010
Next, you'll see the event ID.

26
00:00:59,010 --> 00:01:01,920
This is an event ID that is created by the operating system,

27
00:01:01,920 --> 00:01:04,440
so you can easily identify what these events are,

28
00:01:04,440 --> 00:01:06,210
and you'll notice these are all sequential,

29
00:01:06,210 --> 00:01:08,310
so if I was talking to another cybersecurity analyst,

30
00:01:08,310 --> 00:01:10,980
I could say, "Hey, look at line 5,400,

31
00:01:10,980 --> 00:01:12,360
I think there's something wrong there,"

32
00:01:12,360 --> 00:01:14,940
and they can know exactly where in the logs to look.

33
00:01:14,940 --> 00:01:17,010
The next thing we have is our description column,

34
00:01:17,010 --> 00:01:18,930
and here you can see all the things that happened.

35
00:01:18,930 --> 00:01:21,360
And from here we're going to look at all of these entries,

36
00:01:21,360 --> 00:01:24,180
line by line, and see exactly what happened.

37
00:01:24,180 --> 00:01:26,490
So first, we see that a document was opened

38
00:01:26,490 --> 00:01:30,480
and that document was opening the 'AnnualReport.docx' file.

39
00:01:30,480 --> 00:01:33,360
So obviously, we're using a word processor here.

40
00:01:33,360 --> 00:01:35,370
The second thing was that a template was loaded

41
00:01:35,370 --> 00:01:37,260
and that template was loaded successfully.

42
00:01:37,260 --> 00:01:39,360
There is no error shown in the details.

43
00:01:39,360 --> 00:01:41,220
Third, we have the document being saved

44
00:01:41,220 --> 00:01:44,940
and the user saved the document called 'MeetingNotes.docx'.

45
00:01:44,940 --> 00:01:47,460
So far, I don't see anything malicious here.

46
00:01:47,460 --> 00:01:49,470
The fourth line is that a print job started

47
00:01:49,470 --> 00:01:51,660
and jsmith tried to start a print job

48
00:01:51,660 --> 00:01:54,540
to print out the 'Contract_Agreement.docx' file,

49
00:01:54,540 --> 00:01:56,010
and the next line shows that that print

50
00:01:56,010 --> 00:01:57,450
was successfully completed

51
00:01:57,450 --> 00:02:01,260
and 'Contract_Agreement.docx' was printed.

52
00:02:01,260 --> 00:02:04,500
Now the next line at 5400 is where things start to get

53
00:02:04,500 --> 00:02:05,640
a little suspicious for us,

54
00:02:05,640 --> 00:02:07,650
because we're seeing a blocked action.

55
00:02:07,650 --> 00:02:10,169
Here, we have a macro execution attempt.

56
00:02:10,169 --> 00:02:13,740
This was done by jsmith and it was inside of the docx file

57
00:02:13,740 --> 00:02:15,660
called 'Q3-Financials.docx'.

58
00:02:15,660 --> 00:02:17,670
In there, there was a macro detected

59
00:02:17,670 --> 00:02:20,430
and based on the security setting of Word at the time,

60
00:02:20,430 --> 00:02:22,620
this was detected and blocked.

61
00:02:22,620 --> 00:02:26,370
The next one we have at 5401 is a macro security alert.

62
00:02:26,370 --> 00:02:28,590
This was a notification being sent to the user

63
00:02:28,590 --> 00:02:30,870
saying there's a potentially malicious macro

64
00:02:30,870 --> 00:02:33,690
inside of your file, and so we wanted to inform the user

65
00:02:33,690 --> 00:02:36,000
of this action so they could decide what to do.

66
00:02:36,000 --> 00:02:38,160
Now at this point, we go to 5402

67
00:02:38,160 --> 00:02:39,450
and we see that the macro content

68
00:02:39,450 --> 00:02:40,950
was being scanned by the system.

69
00:02:40,950 --> 00:02:42,000
The scan was complete

70
00:02:42,000 --> 00:02:44,910
and the macro code matches known malware,

71
00:02:44,910 --> 00:02:46,740
telling us this is something malicious

72
00:02:46,740 --> 00:02:48,330
that we want to take care of.

73
00:02:48,330 --> 00:02:51,450
At 5403, we see the file was quarantined

74
00:02:51,450 --> 00:02:53,370
and the action taken was quarantined

75
00:02:53,370 --> 00:02:57,090
and we see the file 'Q3-Financials.docx' was quarantined,

76
00:02:57,090 --> 00:02:58,920
so it can no longer infect our system

77
00:02:58,920 --> 00:03:00,630
or other people's systems.

78
00:03:00,630 --> 00:03:03,900
Next, at 5404, we see the document was closed

79
00:03:03,900 --> 00:03:07,410
and that was the user closing the 'AnnualReport.docx'.

80
00:03:07,410 --> 00:03:09,540
Next, we see a template was unloaded

81
00:03:09,540 --> 00:03:11,160
and this was unloading that template file

82
00:03:11,160 --> 00:03:14,880
that was loaded earlier up in line 5396.

83
00:03:14,880 --> 00:03:16,890
Then, we have a document being saved

84
00:03:16,890 --> 00:03:19,500
and they saved 'RevisedPlan.docx'.

85
00:03:19,500 --> 00:03:20,880
They then sent an email

86
00:03:20,880 --> 00:03:23,730
and that was sent out with 'MeetingMinutes.docx'.

87
00:03:23,730 --> 00:03:25,410
And then we see the document was opened,

88
00:03:25,410 --> 00:03:28,710
the user opened the 'Budget_Planning.xlsx',

89
00:03:28,710 --> 00:03:30,390
which is an Excel document.

90
00:03:30,390 --> 00:03:34,140
And then we have 5409, where an admin alert was generated

91
00:03:34,140 --> 00:03:36,630
to let the administrators know there was a malicious macro

92
00:03:36,630 --> 00:03:40,320
detected and blocked for 'Q3-Financials.docx'.

93
00:03:40,320 --> 00:03:42,390
So at this point, what do we know happened?

94
00:03:42,390 --> 00:03:44,850
Well, we can see that there was one file that was infected

95
00:03:44,850 --> 00:03:47,220
with malware and everything else seems normal

96
00:03:47,220 --> 00:03:48,660
and it's not a malicious issue,

97
00:03:48,660 --> 00:03:51,150
but the one that was malicious is that macro.

98
00:03:51,150 --> 00:03:52,710
And so if we were asked on the exam

99
00:03:52,710 --> 00:03:55,140
which of these files is suspicious or malicious,

100
00:03:55,140 --> 00:03:57,960
we would answer 'Q3-Financials.docx'

101
00:03:57,960 --> 00:03:59,493
based on this log analysis.