1
00:00:00,120 --> 00:00:00,953
In this lesson,

2
00:00:00,953 --> 00:00:02,580
we're going to talk about metadata

3
00:00:02,580 --> 00:00:03,870
and how it can be used inside

4
00:00:03,870 --> 00:00:06,300
of your incident response investigations.

5
00:00:06,300 --> 00:00:07,800
Now when you talk about metadata,

6
00:00:07,800 --> 00:00:09,600
this is data about data,

7
00:00:09,600 --> 00:00:11,880
or data about a file or application

8
00:00:11,880 --> 00:00:13,260
or other thing.

9
00:00:13,260 --> 00:00:15,420
Most commonly you're going to see metadata

10
00:00:15,420 --> 00:00:16,253
include things like

11
00:00:16,253 --> 00:00:18,505
the file name, the file size, the file type,

12
00:00:18,505 --> 00:00:21,060
the creation date, the modification date,

13
00:00:21,060 --> 00:00:23,430
the last access date, who owns the file,

14
00:00:23,430 --> 00:00:24,870
the checksum associated with the file

15
00:00:24,870 --> 00:00:26,220
and things like that.

16
00:00:26,220 --> 00:00:27,053
So let me go ahead

17
00:00:27,053 --> 00:00:28,890
and show you some metadata about a file

18
00:00:28,890 --> 00:00:30,690
called invoice.pdf

19
00:00:30,690 --> 00:00:33,090
that we suspect is malicious or suspicious,

20
00:00:33,090 --> 00:00:35,460
and we're using it as part of our investigation.

21
00:00:35,460 --> 00:00:38,190
So we take this file called invoice.pdf

22
00:00:38,190 --> 00:00:40,740
and when we give this to a malware analysis person,

23
00:00:40,740 --> 00:00:42,900
they're going to go ahead and reverse engineer that,

24
00:00:42,900 --> 00:00:44,525
and figure out is there any malware inside of it.

25
00:00:44,525 --> 00:00:47,760
Because often, these PDFs will have malware embedded inside

26
00:00:47,760 --> 00:00:49,620
of them because it's a common attack vector

27
00:00:49,620 --> 00:00:51,330
that's used by criminals.

28
00:00:51,330 --> 00:00:53,580
Now, when we have something like invoice.pdf,

29
00:00:53,580 --> 00:00:56,160
usually we're going to see this as part of a phishing campaign.

30
00:00:56,160 --> 00:00:57,810
Somebody's going to send an email to your organization

31
00:00:57,810 --> 00:00:59,024
and say, "Hey, here's your overdue invoice.

32
00:00:59,024 --> 00:01:00,900
"You need to pay it today."

33
00:01:00,900 --> 00:01:02,220
And somebody will click on that

34
00:01:02,220 --> 00:01:03,674
and open the file to look at the invoice.

35
00:01:03,674 --> 00:01:05,730
And when they do, it looks like an invoice,

36
00:01:05,730 --> 00:01:07,770
but there's also some hidden malware in there

37
00:01:07,770 --> 00:01:09,390
that could actually run on your system,

38
00:01:09,390 --> 00:01:10,945
and infect the system and take hold.

39
00:01:10,945 --> 00:01:13,410
And that's why this is really effective.

40
00:01:13,410 --> 00:01:15,865
So what kind of metadata can we use from this file

41
00:01:15,865 --> 00:01:18,210
to be able to block this from the future

42
00:01:18,210 --> 00:01:19,680
once we know it's malicious?

43
00:01:19,680 --> 00:01:21,870
Well, the most commonly used thing is going

44
00:01:21,870 --> 00:01:25,200
to be the MD5 or SHA-256 checksum.

45
00:01:25,200 --> 00:01:27,930
Remember, these checksums serve as a digital fingerprint

46
00:01:27,930 --> 00:01:29,773
to uniquely identify this file including

47
00:01:29,773 --> 00:01:31,740
the malware it contains.

48
00:01:31,740 --> 00:01:35,730
So we can use this as a way to add this into our system

49
00:01:35,730 --> 00:01:37,440
and use these file hashes

50
00:01:37,440 --> 00:01:38,790
as something that can be checked

51
00:01:38,790 --> 00:01:41,130
as something that entering in or out of our network.

52
00:01:41,130 --> 00:01:42,360
And if it sees that hash,

53
00:01:42,360 --> 00:01:43,530
it will block those files

54
00:01:43,530 --> 00:01:45,090
from being downloaded to the future.

55
00:01:45,090 --> 00:01:47,040
So if one person on our network fell

56
00:01:47,040 --> 00:01:48,240
for this phishing attack,

57
00:01:48,240 --> 00:01:49,705
we want to make sure nobody else does as well.

58
00:01:49,705 --> 00:01:53,160
And we can do that by blocking these hash values from being

59
00:01:53,160 --> 00:01:56,340
able to be executed or opened on our systems.

60
00:01:56,340 --> 00:01:58,260
Some other things we'll see is the file name,

61
00:01:58,260 --> 00:02:00,210
the file size and the file type.

62
00:02:00,210 --> 00:02:03,030
For example, the file name says invoice.pdf,

63
00:02:03,030 --> 00:02:04,020
which is fine.

64
00:02:04,020 --> 00:02:05,280
But if we saw the file type,

65
00:02:05,280 --> 00:02:06,630
wasn't a PDF document

66
00:02:06,630 --> 00:02:09,342
and instead it was a ".doc" or an ".exe" type of document,

67
00:02:09,342 --> 00:02:10,335
that would be a mismatch

68
00:02:10,335 --> 00:02:14,130
between the file extension of PDF and the file type.

69
00:02:14,130 --> 00:02:16,020
In Windows, we use the three characters

70
00:02:16,020 --> 00:02:18,450
after the "." to identify the file type.

71
00:02:18,450 --> 00:02:20,790
But in Linux and Mac systems,

72
00:02:20,790 --> 00:02:22,260
that is not actually needed.

73
00:02:22,260 --> 00:02:25,170
And so instead, it looks at the first couple of bytes inside

74
00:02:25,170 --> 00:02:27,235
of a file to determine what file type it is.

75
00:02:27,235 --> 00:02:30,030
So if we look inside this file based

76
00:02:30,030 --> 00:02:31,260
on the first couple of bytes

77
00:02:31,260 --> 00:02:32,880
and we determine it's actually a file

78
00:02:32,880 --> 00:02:35,400
that includes a JPEG or an executable,

79
00:02:35,400 --> 00:02:36,360
or a batch file

80
00:02:36,360 --> 00:02:38,640
or something like that and not a PDF,

81
00:02:38,640 --> 00:02:40,266
but the extension says ".pdf"

82
00:02:40,266 --> 00:02:41,850
that would also be something

83
00:02:41,850 --> 00:02:44,425
that's suspicious and we can learn that from the metadata.

84
00:02:44,425 --> 00:02:47,123
Other things we can look at is the creation modified

85
00:02:47,123 --> 00:02:48,870
and access dates.

86
00:02:48,870 --> 00:02:49,890
If we look at these dates

87
00:02:49,890 --> 00:02:51,090
and they're not in alignment with

88
00:02:51,090 --> 00:02:52,320
what we would expect,

89
00:02:52,320 --> 00:02:53,153
that would be something

90
00:02:53,153 --> 00:02:54,570
that we would be worried about.

91
00:02:54,570 --> 00:02:56,520
For example, if the creation date

92
00:02:56,520 --> 00:02:58,770
of this file was actually 2012,

93
00:02:58,770 --> 00:03:00,420
but I received the invoice today,

94
00:03:00,420 --> 00:03:02,310
that probably is not an accurate file

95
00:03:02,310 --> 00:03:03,870
and it would be something I want to block,

96
00:03:03,870 --> 00:03:06,210
and treat as suspicious or malicious.

97
00:03:06,210 --> 00:03:09,420
Similarly, if I look at the file and it was created modified

98
00:03:09,420 --> 00:03:11,340
and access just a few minutes ago,

99
00:03:11,340 --> 00:03:13,140
that can also be suspicious.

100
00:03:13,140 --> 00:03:14,220
Now, in the case of an invoice,

101
00:03:14,220 --> 00:03:15,053
it probably wouldn't be

102
00:03:15,053 --> 00:03:17,700
that suspicious because I would normally create my invoice

103
00:03:17,700 --> 00:03:20,040
and send it to you immediately after creating it.

104
00:03:20,040 --> 00:03:22,170
And so you'd expect the creation, modified,

105
00:03:22,170 --> 00:03:24,600
and access date to be all within a couple of minutes

106
00:03:24,600 --> 00:03:26,850
of each other as we see here.

107
00:03:26,850 --> 00:03:29,160
The other thing we can look at is the owner of the file.

108
00:03:29,160 --> 00:03:31,433
Who is the user who created or owns this file?

109
00:03:31,433 --> 00:03:33,205
And so if we found this file was malicious

110
00:03:33,205 --> 00:03:36,210
and we found out that Joe was the person who started it,

111
00:03:36,210 --> 00:03:37,043
then we can go and say,

112
00:03:37,043 --> 00:03:38,784
"Hey Joe, why do you have this malicious file?"

113
00:03:38,784 --> 00:03:39,727
And he might say,

114
00:03:39,727 --> 00:03:41,557
"Oh, well I got an email earlier

115
00:03:41,557 --> 00:03:43,444
"from a vendor and I clicked on it to pay the invoice,

116
00:03:43,444 --> 00:03:45,367
"and that's why it got created on his

117
00:03:45,367 --> 00:03:47,340
"system as him as the owner."

118
00:03:47,340 --> 00:03:48,570
And that would be something we can explain

119
00:03:48,570 --> 00:03:50,100
away during our investigation.

120
00:03:50,100 --> 00:03:51,224
But these are all things that we can use

121
00:03:51,224 --> 00:03:52,325
as part of our investigation.

122
00:03:52,325 --> 00:03:54,285
It's more data about this file,

123
00:03:54,285 --> 00:03:56,730
and where it's been and what it's doing.

124
00:03:56,730 --> 00:03:58,950
In addition to that, we could see the file path.

125
00:03:58,950 --> 00:04:01,945
If this is located in the C:\TEMP\ directory,

126
00:04:01,945 --> 00:04:04,380
that would be something that is suspicious or malicious

127
00:04:04,380 --> 00:04:06,690
because a lot of times malware tries to run from

128
00:04:06,690 --> 00:04:08,640
that Temporary Directory as opposed

129
00:04:08,640 --> 00:04:10,408
to running from a trusted directory

130
00:04:10,408 --> 00:04:12,750
like a user's document folder.

131
00:04:12,750 --> 00:04:15,060
Again, these are things that are all pieces of a clue

132
00:04:15,060 --> 00:04:16,920
and nothing by itself is going to tell us

133
00:04:16,920 --> 00:04:18,120
that this is malicious,

134
00:04:18,120 --> 00:04:19,410
but it does give us additional

135
00:04:19,410 --> 00:04:21,250
pieces of information that we can then use

136
00:04:21,250 --> 00:04:22,890
as we're looking at these files

137
00:04:22,890 --> 00:04:23,790
and use them as part

138
00:04:23,790 --> 00:04:25,240
of our indicators of compromise inside

139
00:04:25,240 --> 00:04:26,943
of our investigations.