Alerts, Endpoint Monitoring & Troubleshooting

When does malware usually require the user to explicitly install the product and confirm the UAC consent prompt?

to infect a fully patched host

What can some critical exploits allow malicious code to do?

execute without authorization

What might malware generate without being fully installed?

something that looks like a Windows notification

How can malware misuse push notifications?

by using the push notification system that allows a website to send messages to a device or app

What is the purpose of a fake notification used by malware?

to trick or frighten the user into installing the malware

What example of a fake notification is given?

a fake virus alert

What else may a malicious notification do besides frighten the user?

link to a site that has a high chance of performing a drive-by download on an unpatched host

What is false alert anti-virus?

a particularly popular way to disguise a Trojan

How did early false alert anti-virus attacks appear?

a website would display a pop-up disguised as a normal Windows dialog box with a fake security alert warning that viruses had been detected

Why did attackers shift away from the early website pop-up vector?

browsers and security software have moved to block this vector

What social engineering method became popular after browsers and security software blocked the pop-up vector?

cold-calling vulnerable users and claiming to represent Microsoft support or the user’s ISP

What do attackers ask users to do in the cold-calling version of the attack?

enable a remote desktop tool

Why is proper monitoring of endpoint systems critical?

rapid detection of malicious issues on workstations

How can software monitoring solutions help?

quickly identifying issues and sending alerts to the security response team

What is endpoint detection and response (EDR)?

a monitoring solution that integrates with existing security tools and can provide automated response solutions for each endpoint

What does managed detection and response (MDR) add beyond monitoring?

customized dashboards and detection using intelligence

How is MDR usually provided?

outsourced to a third-party managed security service provider (MSSP)

What does extended detection and response (XDR) extend beyond?

the organization's endpoints

What systems can XDR extend to?

cloud systems, applications, etc.

What can XDR integrate to provide updated response and mitigation strategies?

intelligence-based systems from trusted sources

What does malware often target?

the web browser

What are common symptoms of spyware or adware infection in a browser?

random or frequent pop-ups, additional toolbars, a sudden change of home page or search provider, different search results, slow performance, and excessive crashing

What may viruses and Trojans do without the user opening the browser?

spawn pop-ups

What is redirection?

the user tries to open one page but gets sent to another

How can adware use redirection?

a blunt means of driving traffic through a site

How can spyware use redirection?

to capture authentication details

What browser signs can indicate an untrusted or invalid certificate?

the padlock icon is replaced by an alert icon, the URL has strikethrough formatting, and the site content is likely to be blocked by a warning message

What are common causes of certificate warnings?

self-signed or untrusted CA, FQDN different from the certificate subject name, or expired or revoked certificate

What could certificate warnings indicate?

the site is misconfigured or malware is attempting to redirect the browser to a spoofed page

What should be analyzed to determine the likely cause of a certificate warning?

the certificate information and the URL

What happens first in the malicious proxy on-path attack described?

a user requests a connection to a secure site and inspects the site's certificate

What may intercept the secure-site request and present a spoofed certificate?

malware on the host or some type of evil-twin access point

When would a spoofed certificate produce no browser warning?

if the malware is able to compromise the trusted root certificate store

What happens if the browser accepts the spoofed certificate or the user overrides a warning?

the malware implements a proxy and forwards the request to the site, establishing a session

What can the malware do once it is in the middle of the session?

intercept and modify all the traffic that would normally be encrypted

What can you try first when browser issues are found or browser performance is below expectations?

repair or reinstall the browser application

What browser data or features may you clear or disable to determine the root cause?

clear the browser cache and cookies, and disable any add-ons or plug-ins

Why might you download another browser and test performance?

to see if the performance also suffers, which may indicate larger problems with the website or resource