In this lesson, we're going to take a look
at an endpoint log to see what it looks like
when malware gets infected on your system.
So in this case, I've got about 10 to 15 lines
from an endpoint system that is going to show us
what happens inside of that system
based on the actions of a user
and the based on the actions of the system.
So here you could see the time column is first,
and then we'll see the event ID,
and then the description, the user, the action taken,
and some details telling you about what was happening.
So on the exam, they may not show you the detail column
because that really does give it away.
But again, a lot of the things under the description
or the action taken column
will be able to give you enough information
to know what is happening here,
and that is that this system is being infected with malware.
Now, as we go through and look at this,
we're going to start with line 2101,
and you see that the web browser has been started.
It was opened by the username taylor,
and the user initiated that web browser.
The user then went and browsed around for a minute,
and eventually they found a file
that they wanted to download.
So they downloaded that and initiated the download.
The download started, and this was called setup.exe.
And then setup.exe was finished downloading
and they executed that file.
When they did that, the antivirus actually created an alert,
and that is generated by your system,
and it said that this was flagged as suspicious.
Next, we see that the user overrode that
and they ignored the alert and said,
"Nah, I want to install that software anyway."
So the user went ahead and executed the file, setup.exe,
and that started launching a stage one dropper.
Now, setup.exe was a stage one dropper,
which means it's a piece of malware,
but it's not the malware that's actually going to do
really bad things to your system yet.
Instead, it's just going to be used
to go download a larger program
that contains all the malicious code it needs
to run the stage two.
So next we see in line 2502,
there is an outbound connection detected by the system,
and there's a connection established
to a remote server of 92.168.47.81,
and that is where our stage two dropper's going to be located.
So we're going to download that file.
That begins in line 2601 where the file is downloaded,
and then the file completes in 2602.
You could see here that this was downloaded by setup.exe,
and the file is called update.bin,
which is a binary file,
and that was successfully downloaded.
At that point, that file
is going to actually deactivate our antivirus,
so our antivirus can't protect us anymore.
And then in line 2801, the stage two dropper,
which was update.bin, is executed,
and this begins our payload deployment.
Next, we're going to see a new process
is created in the system,
and that new process was detected.
And we've realized that that is a malicious process
called malproc.exe.
At this point, we see there's an unauthorized system
modification occurring,
and that is an unauthorized change.
And so the system registry was actually being modified
by that malicious process called malproc.exe.
Next, we see some anomalies
inside of our network activity,
and we actually get an alert for that
because of unusual outbound traffic,
which, in this case, is most likely malproc.exe
going and sending data back to the attacker
so they can then have a data exfiltration from your system.
And finally, we see that our security system
is going to go ahead and create an alert for us
that sends out a breach alert,
saying that we have a suspected data breach happening,
and this was because of an indicator
of compromise that was detected.
And so we want our analyst to go in
and analyze what's going on,
see what data was taken,
and how we can recover from this incident.
That's the idea of how you can read
these endpoint detection logs
to figure out what is going on.
As I said, on the exam, you're probably not going to see
a lot of endpoint detection logs
because endpoint detection logs
tend to have a lot of good detail in here.
They'll tell you exactly what is going on,
and so it becomes really easy to understand
that this was a malicious process that was happening
because of the stage one and stage two dropper.
That being said, if you do get one of these
on the exam, be thankful
because it's going to be a pretty easy question
for you to answer.