analyzing network IOCs

indicator of compromise(IOC)

a sign that an asset or network has been attacked or is currently under attack

traffic spike

a sharp increase in connection requests in comparison with a given baseline

DDoS

an attack that uses multiple compromised hosts(a botnet) to overwhelm a service with request or response traffic

-IOCs: an excessive number of TIME_WAIT connections in a load balancer or web server’s state table

-a large amount of outbound traffic from the network could indicate the network contains victimized hosts being used in a DDoS against others

distributed reflection Dos(DRDoS)

a network-based attack where the attacker dramatically increases the bandwidth sent to a victim during a DDoS attack by implementing an amplification factor

• occurs when the adversary spoofs the victim’s IP address and tries to open connections with multiple servers

slashdot effect(slashdotting)

causes a website to crash when a smaller website becomes popular quickly due to exposure on social sharing site like slashdot, reddit, and twitter

how can you mitigate a DDoS attack?

1. conduct real-time log analysis to identify patterns of suspicious traffic and redirect to a black hole or sinkhole

2. use geolocation and IP reputation data to redirect or ignore suspicious traffic

3. agressively close slower connections by reducing timeouts on affected servers

4. use caching and backend infrastructure to offload processing to other servers

5. utilize enterprise DDoS protection services such as cloudflare or akamai

beaconing

a means for a network node to advertise its presence and establish a link with other nodes

• can be used legitimately, such as a beacon management frame being sent by a wireless access point

jitter

use of random delay to frustrate indicators based on regular connection attempt intervals

internet relay chat(IRC)

a group communication protocol with networks divided into discrete channels that are the individual forums used by clients to chat

• the use of IRC as a command and control channel is on the decline since many organizations just block it

C2 communication channels

• IRC

• HTTP/HTTPS(mitigate by using an intercepting proxy at the network’s edge)

• DNS

• social media websites

• cloud services

• media and document files

DNS IoCs

1. several queries being repeated when a bot is checking into a control server for more orders

2. commands sent within request or response queries will be longer and more complicated than normal. EVASION: attackers break their control messages into several query chunks to not trip sensors

irregular Peer-toPeer(P2P) communication

attack indicator where hosts within a network establish connections over unauthorized ports or data transfers

• attackers commonly use server message block(SMB) since it is typical within Windows File/Printer sharing environments

ARP spoofing/poisoning

occurs when an attacker redirects an IP address to a MAC address that was not its intended destination

• use an IDS to identify the suspicious traffic patterns caused by ARP poisoning generating far more ARP traffic than usual

rogue device mitigation

use digital certificates on endpoints and servers to authenticate and encrypt traffic using IPSec or HTTPS

rogue devices

an authorized device or service on a corporate or private network that allows unauthorized individuals to connect to that network

• often begin their attack by scanning and sweeping to find other hosts and vulnerabilities

rogue system detection

a process of identifying and removing machines from a network

network tap

a physical device that is attached to cabling to record packets passing over that network segment

wireless access point(WAP)

different devices that are connectedf to a network and extend the physical network into the wireless spectrum

2 types:

1. a rogue access point that is connected to a network

2. an attacker sets up their own access point with a connection to the Internet

how can you perform rogue device detection?

• visual inspection- ensure that an attacker didn’t install additional equipment or counterfeit equipment with fake asset tags

• network mapping and host discovery

• wireless monitoring

• packet sniffing and traffic flow

• NAC and intrusion detection

network mapping and host discovery

enumeration scanners can identify hosts via banner grabbing or fingerprinting of devices across the network

wireless monitoring

wireless sniffing and discovery can be used to find unknown or unidentifiable SSIDs showing up within range of the office

packet sniffing and traffic flow

can be used to identify the use of unauthorized protocols on the network and unusual peer-to-peer communication flows

NAC and intrusion detection

security suites and appliances can combine automated network scanning with defense and remediation suites to try to prevent rogue devices from accessing the network

port scan

enumerates the status of TCP and UDP ports on a target system using software tools

fingerprinting

identifies the type and version of an operating system(or server application) by analyzing its responses to network scans

sweep

a scan directed at multiple IP addresses to discover whether a host responds to connection requests for particular ports

footprinting

phase of an attack or penetration test in which the attacker or tester gathers information about the target before attacking it

well known ports

ports 0-1023

registered ports

ports 1024 to 49151

dynamic ports

ports 49152 to 65535

data exfiltration

the process by which an attacker takes data that is stored inside of a private network and moves it to an external network

channels include:

• HTTP or HTTPS transfers

• HTTP requests to databases

• DNS

• overt channels

• explicit tunnels

mitigation: strong encryption of data at rest and data in transit

HTTP/HTTPS transfers

an attacker uses commercial file sharing services to upload the exfiltrated data from a victim

HTTP Requests to Database Services

an adversary may use SQL injection or similar techniques to copy records from the database to which they should not have access

• IoC: spike in requests to a PHP or other script files, and unusually large HTTP response packets

DNS as a data exfiltration channel

use of DNS queries to transmit data out of a network enclave

• IoC: atypical query types being used, such as TXT, MX, CNAME, and NULL

Overt Channels-data exfiltration

use of FTP, instant messaging, peer-to-peer, email, and other obvious file and data sharing tools

explicit tunnels

use of SSH or VPNs to create a tunnel to transmit the data cross a given network

• IoC: atypical endpoints involved in tunnels due to their geographic location

covert channel

communication path that allows data to be sent outside of the network without alerting any intrusion detection or data loss countermeasures

• can enable the stealthy transmission of data from node to node using means security controls don’t anticipate

• methods:

  • transmitting data over nonstandard port

  • encoding data in TCP/IP packet headers

  • segmenting data into multiple packets

  • obfuscating data using hex

  • transmitting encrypted data

MITIGATION: advanced intrusion detection and user behavior analytics tools are best, but won’t detect everything

covert storage channel

utilizes one process to write to a storage location and another process to read from that location

covert timing channel

utilizes one process to alter a system resource so that changes in its response time can signal information to a recipient process

steganography

the practice of concealing data within another file, message, image, or video

• modern tools hide digital information so that the human eye cannot tell the difference

You received a laptop from a user who recently left the company. While adjusting the settings, you get curious and open a terminal session in the operating system. Entering 'history' into the prompt, you see the following:

> for i in $(seq 255); do ping -c 1 10.1.0.$i; done

Which of the following best describes the actions that were performed by this line of code?

conducted a ping sweep of the subnet. the code is performing a ping sweep of the subnet 10.1.0.0/24. the code states that for every number the sequence from 1 to 255, conduct a ping to 10.1.0.x, where x is the number from 1 to 255. when it completes this sequence, it is to return to the terminal prompt. the ping command uses an echo request and then receives an echo reply back from the target of the ping. a ping sweep does not use a SYN scan, that would require the use of a tool like nmap or hping

The management at Steven’s work is concerned about rogue devices being attached to the network. Which of the following solutions would quickly provide the most accurate information that Steve could use to identify rogue devices on a wired network?

router and switch based MAC address reporting.

if the company uses a management system or inventory process to capture these addresses, then a report from one of these devices will show what is connected to the network even when they are not currently in the inventory. this information could then be used to track down rogue devices based on the physical port it is connected to on a network device