1
00:00:00,000 --> 00:00:02,009
In this lesson, we're going to take a look

2
00:00:02,009 --> 00:00:04,740
at an endpoint log to see what it looks like

3
00:00:04,740 --> 00:00:07,500
when malware gets infected on your system.

4
00:00:07,500 --> 00:00:10,110
So in this case, I've got about 10 to 15 lines

5
00:00:10,110 --> 00:00:12,540
from an endpoint system that is going to show us

6
00:00:12,540 --> 00:00:14,850
what happens inside of that system

7
00:00:14,850 --> 00:00:16,560
based on the actions of a user

8
00:00:16,560 --> 00:00:18,630
and the based on the actions of the system.

9
00:00:18,630 --> 00:00:21,120
So here you could see the time column is first,

10
00:00:21,120 --> 00:00:22,740
and then we'll see the event ID,

11
00:00:22,740 --> 00:00:25,620
and then the description, the user, the action taken,

12
00:00:25,620 --> 00:00:28,440
and some details telling you about what was happening.

13
00:00:28,440 --> 00:00:31,560
So on the exam, they may not show you the detail column

14
00:00:31,560 --> 00:00:33,420
because that really does give it away.

15
00:00:33,420 --> 00:00:35,370
But again, a lot of the things under the description

16
00:00:35,370 --> 00:00:36,900
or the action taken column

17
00:00:36,900 --> 00:00:38,430
will be able to give you enough information

18
00:00:38,430 --> 00:00:39,840
to know what is happening here,

19
00:00:39,840 --> 00:00:42,990
and that is that this system is being infected with malware.

20
00:00:42,990 --> 00:00:44,340
Now, as we go through and look at this,

21
00:00:44,340 --> 00:00:46,770
we're going to start with line 2101,

22
00:00:46,770 --> 00:00:48,780
and you see that the web browser has been started.

23
00:00:48,780 --> 00:00:50,640
It was opened by the username taylor,

24
00:00:50,640 --> 00:00:52,770
and the user initiated that web browser.

25
00:00:52,770 --> 00:00:54,810
The user then went and browsed around for a minute,

26
00:00:54,810 --> 00:00:56,340
and eventually they found a file

27
00:00:56,340 --> 00:00:57,420
that they wanted to download.

28
00:00:57,420 --> 00:00:59,940
So they downloaded that and initiated the download.

29
00:00:59,940 --> 00:01:02,940
The download started, and this was called setup.exe.

30
00:01:02,940 --> 00:01:05,370
And then setup.exe was finished downloading

31
00:01:05,370 --> 00:01:07,440
and they executed that file.

32
00:01:07,440 --> 00:01:10,350
When they did that, the antivirus actually created an alert,

33
00:01:10,350 --> 00:01:11,910
and that is generated by your system,

34
00:01:11,910 --> 00:01:14,610
and it said that this was flagged as suspicious.

35
00:01:14,610 --> 00:01:17,070
Next, we see that the user overrode that

36
00:01:17,070 --> 00:01:18,547
and they ignored the alert and said,

37
00:01:18,547 --> 00:01:20,910
"Nah, I want to install that software anyway."

38
00:01:20,910 --> 00:01:24,210
So the user went ahead and executed the file, setup.exe,

39
00:01:24,210 --> 00:01:27,060
and that started launching a stage one dropper.

40
00:01:27,060 --> 00:01:29,790
Now, setup.exe was a stage one dropper,

41
00:01:29,790 --> 00:01:31,380
which means it's a piece of malware,

42
00:01:31,380 --> 00:01:32,970
but it's not the malware that's actually going to do

43
00:01:32,970 --> 00:01:34,620
really bad things to your system yet.

44
00:01:34,620 --> 00:01:35,850
Instead, it's just going to be used

45
00:01:35,850 --> 00:01:37,830
to go download a larger program

46
00:01:37,830 --> 00:01:39,780
that contains all the malicious code it needs

47
00:01:39,780 --> 00:01:41,430
to run the stage two.

48
00:01:41,430 --> 00:01:43,650
So next we see in line 2502,

49
00:01:43,650 --> 00:01:46,350
there is an outbound connection detected by the system,

50
00:01:46,350 --> 00:01:47,670
and there's a connection established

51
00:01:47,670 --> 00:01:51,870
to a remote server of 92.168.47.81,

52
00:01:51,870 --> 00:01:54,630
and that is where our stage two dropper's going to be located.

53
00:01:54,630 --> 00:01:56,520
So we're going to download that file.

54
00:01:56,520 --> 00:02:00,210
That begins in line 2601 where the file is downloaded,

55
00:02:00,210 --> 00:02:02,760
and then the file completes in 2602.

56
00:02:02,760 --> 00:02:06,240
You could see here that this was downloaded by setup.exe,

57
00:02:06,240 --> 00:02:08,250
and the file is called update.bin,

58
00:02:08,250 --> 00:02:09,660
which is a binary file,

59
00:02:09,660 --> 00:02:11,610
and that was successfully downloaded.

60
00:02:11,610 --> 00:02:13,200
At that point, that file

61
00:02:13,200 --> 00:02:15,600
is going to actually deactivate our antivirus,

62
00:02:15,600 --> 00:02:17,670
so our antivirus can't protect us anymore.

63
00:02:17,670 --> 00:02:20,970
And then in line 2801, the stage two dropper,

64
00:02:20,970 --> 00:02:23,490
which was update.bin, is executed,

65
00:02:23,490 --> 00:02:26,070
and this begins our payload deployment.

66
00:02:26,070 --> 00:02:27,870
Next, we're going to see a new process

67
00:02:27,870 --> 00:02:29,250
is created in the system,

68
00:02:29,250 --> 00:02:30,990
and that new process was detected.

69
00:02:30,990 --> 00:02:33,450
And we've realized that that is a malicious process

70
00:02:33,450 --> 00:02:35,840
called malproc.exe.

71
00:02:35,840 --> 00:02:38,340
At this point, we see there's an unauthorized system

72
00:02:38,340 --> 00:02:39,750
modification occurring,

73
00:02:39,750 --> 00:02:41,160
and that is an unauthorized change.

74
00:02:41,160 --> 00:02:43,470
And so the system registry was actually being modified

75
00:02:43,470 --> 00:02:47,550
by that malicious process called malproc.exe.

76
00:02:47,550 --> 00:02:49,110
Next, we see some anomalies

77
00:02:49,110 --> 00:02:50,820
inside of our network activity,

78
00:02:50,820 --> 00:02:51,960
and we actually get an alert for that

79
00:02:51,960 --> 00:02:53,940
because of unusual outbound traffic,

80
00:02:53,940 --> 00:02:57,210
which, in this case, is most likely malproc.exe

81
00:02:57,210 --> 00:02:59,760
going and sending data back to the attacker

82
00:02:59,760 --> 00:03:02,670
so they can then have a data exfiltration from your system.

83
00:03:02,670 --> 00:03:05,100
And finally, we see that our security system

84
00:03:05,100 --> 00:03:07,020
is going to go ahead and create an alert for us

85
00:03:07,020 --> 00:03:08,310
that sends out a breach alert,

86
00:03:08,310 --> 00:03:10,980
saying that we have a suspected data breach happening,

87
00:03:10,980 --> 00:03:12,270
and this was because of an indicator

88
00:03:12,270 --> 00:03:13,680
of compromise that was detected.

89
00:03:13,680 --> 00:03:15,480
And so we want our analyst to go in

90
00:03:15,480 --> 00:03:16,800
and analyze what's going on,

91
00:03:16,800 --> 00:03:17,970
see what data was taken,

92
00:03:17,970 --> 00:03:20,130
and how we can recover from this incident.

93
00:03:20,130 --> 00:03:21,510
That's the idea of how you can read

94
00:03:21,510 --> 00:03:22,860
these endpoint detection logs

95
00:03:22,860 --> 00:03:24,780
to figure out what is going on.

96
00:03:24,780 --> 00:03:27,600
As I said, on the exam, you're probably not going to see

97
00:03:27,600 --> 00:03:29,070
a lot of endpoint detection logs

98
00:03:29,070 --> 00:03:30,840
because endpoint detection logs

99
00:03:30,840 --> 00:03:32,880
tend to have a lot of good detail in here.

100
00:03:32,880 --> 00:03:35,040
They'll tell you exactly what is going on,

101
00:03:35,040 --> 00:03:36,360
and so it becomes really easy to understand

102
00:03:36,360 --> 00:03:38,490
that this was a malicious process that was happening

103
00:03:38,490 --> 00:03:41,310
because of the stage one and stage two dropper.

104
00:03:41,310 --> 00:03:42,930
That being said, if you do get one of these

105
00:03:42,930 --> 00:03:44,220
on the exam, be thankful

106
00:03:44,220 --> 00:03:45,600
because it's going to be a pretty easy question

107
00:03:45,600 --> 00:03:46,500
for you to answer.