analyzing host related IoCs

malicious process

a process executed without proper authorizationn from the system owner for the purpose of damaging or compromising the system

abnormal process behavior

indicator that a legitimate process has been corrupted with malicious code for the purpose of damaging or compromising the system

windows tools to identify malicious processes

• SFC(system file checker)

• analyze the processes themselves using tools like process monitor or process explorer

• tasklist - command line version of the task manager

• PE explorer-proprietary software

linux tools to identify malicious processes

• pstree

• ps

daemons

a background service in the Linux operating system that runs as a process with the letter “d” after it(e.g., httpd, sshd, ftpd)

systemd

the init daemon in Linux that is first executed by the kernel during the boot up process and always has the process ID (PID) of 1

process identification(PID)

a unique identification number of a process launched by a linux system

parent pid(PPID)

a unique identification number of the parent process for every process launched by a linux system

pstree

a linux command that provides the parent/child relationship of the processes on a given system

ps

linux command that lists the attributes of all current processes

• shows only process started by the current user by default

• ps - A or ps -e will provide a full list of all running processes for all users

• ps -C cron will display the process for the cron command

• ps -A | sort -k 3 will display the process sorted by the third column(execution time)

fileless malware

executes from memory without saving anything to the filesystem

• still likely to leave metadata on the file system even if it is fileless

fileless detection techniques

require analysis of the contents of system memory and process behavior, rather than relying on scanning the file system

memory analysis technique

allows to reverse engineer the code used by the process, discover how the process interacts with the file system, and how it interacts with the registry

• FTK and EnCase include memory analysis modules

volatility framework

an open source memory forensics tool that has different modules for analyzing specific elements of memory

Memoryze

a free memory forensic software by FireEye that helps incident responders find evil in live memory, works a lot like volatility framework

proccesor usage

percentage of CPU time utilized on a per process level

memory consumption

amount of memory utilized on a per process level

free

linux command that outputs a summary of the amount of used and freely available memory on the computer

top

linux command that creates a scrollable table of every running process and is constantly refreshed so that you see the most up to date statistics

• htop utility provides similar functionality and contains a more easy to read output when run in the default configuration

memory overflow

a means of exploiting a vulnerability in an application to execute arbitrary code or to crash the process(or with an ongoing memory leak to crash the system)

if you expect a memory overflow, what can you do to test that?

run the code in a sandbox debugging environment to find the process exploiting a buffer overflow condition

• an analyst may identify a buffer overflow attack by a signature created by the exploit code

staging area

a place where an adversary begins to collect data in preparation for data exfiltration, such as temporary files and folders, user profile locations, data masked as logs, alternate data streams(ADS), or in the recycle bin

• data is often compressed and encrypted in the staging area

• there are tools that scan host file systems for file archive, compression and encryption types to detect data staging areas

alternate data streams (ADS)

a feature that’s embedded inside an NTFS

• allows files and directories to hold multiple streams of data. while the default data stream holds the main file content, an ADS acts as a hidden compartment to store metadata or secret files without altering the visible file size

file system viewer

tool that allows searching the file system for keywords quickly, including system areas such as the Recycle Bin and NTFS shadow copy and system volume information

• analyzing file metadata allows for the reconstruction of the timeline of events that have taken place on the computer

windows dir command

has some advanced functionality for file system analysis

dir /Ax (windows)

/Ax filters all file/folder types that match the given parameter(x), such as dir/AH displays only hidden files and folders

dir /Q (windows)

/Q displays who owns each file, along with the standard information

dir /R (windows)

/R displays alternate data streams for a file

IoC: hard drive space filling up

could indicate that malware may be caching files locally for exfiltration over the network or via USB

disk utilization tools

can scan a file system and retrieve comprehensive statistics

can provide information such as:

• visual representation

• directory listing

• real time usage of data being written

linux file system analysis tools

• lsof

• df

• du

lsof (linux)

tool that retrieves a list of all files currently open on the OS

• allows us to quickly get a list of all the resources that a process is currently using

• in linux, everything is treated as a file

• ex: “lsof -u root -a p 1645” this says I want to show all of the files that are currently open on this computer that were opened by the user root and they’re actively using the process number 1645. This way you can find everything that’s associated with that particular process

df (linux)

tool that retrieves how much disk space is being used by all mounted file systems and how much space is available for each

du (linux)

tool that retrieves how much disk space each directory is using based on the specified directory

• ex: “du /var/log” this will tell you how much space the log directory is using

cryptography analysis tools

tools used to determine the type of encryption algorithm being used and assess the strength of the encryption key

privilege escalation

the practice of exploiting flaws in an operating system or other application to gain a greater level of access that was intended for the user or application

monitoring authentication and authorization systems

5 key things to look at:

• unauthorized sessions

• failed log-ons

• new accounts

• guest account usage

• off-hours usage

unauthorized session

occurs when certain accounts access devices or services that they should not be authorized to access

failed log ons

any attempt to authenticate to the system using the incorrect username/password combination or other credentials

new accounts

an attacker may be able to create new accounts in a system and can be especially dangerous if they create an administrator account

guest account usage

guest accounts can enable an attacker to log on to a domain and begin footprinting the network

off hours usage

an account being used in off hours may indicate an attacker attempting to catch the organization unaware

Microsoft Policy Analyzer

can identify whether a policy deviates from a configuration baseline

AccessChk, AccessEnum

are a part of Sysinternals and can analyze privileges applied to a file or resource

prefetch file

a file that records the names of applications that have been run, as well as the date and time, file path, run count, and DLLs used by the executable

shimcache

an application usage cache that is stored in the Registry as the key

Amcache

an application usage cache that is stored as a hive file

persistence

the ability of a threat actor to maintain covert access to a target host or network

registry

a hierarchical database that stores low-level settings for the Microsoft Windows operating system and for the kernel, device drivers, services, Security Accounts Manager, and the user interface

• a registry viewer tool can extract the Windows Registry files from an image and display them on the analysis workstation

• windows does have the built in regedit tool but it doesn’t display the last modication time of a value by default

regdump

a tool that dumps the contents of the registry in a text file with simple formatting so that you can search specific strings in the file with find

• use grep to search the contents if analyzing the contents on Linux

Windows autorun keys

are specific locations in the windows registry that the operating system to automatically launch programs, scripts, or drivers when the computer boots up or when a user logs in

• Run - initializes its values asynchronously when loading them from the registry

• RunOnce - initializes its values in order when loading them from the registry

• remember for exam:

  • Run- runs tasks asynchronously in any order

  • RunOnce- runs tasks in specific order

Windows Task Scheduler

enables the creation of new tasks to run at predefined times

• task scheduler may be able to capture the history of non-system services, like malware that installs itself as its own service

crontab

tool that manages cron jobs, the Linux equivalent of scheduled tasks

• crontab -l command shows the current scheduled cron jobs

Which of the following is NOT a host-related indicator of compromise?

• processor consumption

• drive capacity consumption

• beaconing

• memory consumption

beaconing is considered a network related IoC