In our last episode,
we talked about the different network systems
associated with malware and indicators of compromise.
We discovered different perspectives on how those network symptoms
can be utilized from an analyst point of view.
In this course, we're going to talk about host symptoms.
We're going to dive a little bit more
in depth about the different indicators of compromise and
what you should know in order to prepare yourself
for the CYN exam associated with both the Windows
platform as well as the Linux platform
and the overall direction you should take as an analyst in order to perform well.
On this example,
host related symptoms are specific symptoms that
are associated with the host or the client
that the user most likely sees.
Now,
it doesn't just say the user as in the administrative assistant or
the operations guy as you as the it person as well.
You need to understand that as an analyst, a lot of those symptoms that we see,
we usually delegate back to the IT world.
But as a cybersecurity professional, you need to be able to identify those as well.
Remember as a cybersecurity professional,
you're supposed to have a background or a foundational knowledge in it as well.
And so those host related symptoms that we're going to talk about today
really play a role in how you proceed with your career in cybersecurity.
So the different related host systems that you
need to be associated with are unauthorized applications.
Now, let's see. It's pretty cut and dry, right.
We're talking about applications that we didn't
authorize as a company or an organization
that maybe the employee put on their device.
Usually this is something simple, like, I don't know, Minesweeper or Solitaire.
And we don't really authorize those applications usually
on our company decisis because employees usually play those
games instead of doing their work and it
comes from high that they shouldn't have them.
Now, while those can be nuisance applications that we need to get rid of,
there's other applications that we should be aware of as well.
There's a license applications ie something maybe
like Adobe Acrobat where the individual employee
downloaded it and provided that application for them to do their job better,
but it's a licensed copy but not licensed to the organization.
This could pose legal issues.
It could also pose issues where we have licenses specifically for organization,
but the employee decided to download their own version.
Uh This could pose problems with both hr where they're coming in and saying, hey,
you're using your own money to buy company assets,
which is not a good thing to start with.
But also, we don't know where that software came from.
There's also unlicensed software if we take that same application yet,
they didn't pay for it.
They got it off some random website
that app
could potentially have unwanted malware or back doors associated with it.
So it's better just to cut that off off from the start.
And that's why we don't give admin access to a lot of computer users.
So unauthorized applications can include anything from Facebook.
It could be linked in, it could be solitaire,
it could even be proprietary software that we utilize on a day to day basis.
But it didn't come from us. It came from an outside vendor.
These are all unauthorized applications that you need
to be aware of as a cybersecurity professional,
there's also unauthorized processes.
This is usually indicative to malware or
to a application that's behaving abnormally that
maybe was taken advantage of or updated in a way that we didn't authorize
when we talk about unauthorized processes. These processes play
with our internal systems because they can actually cause the
operating system to crash or cause logs within the system.
That's why we sandbox everything before we roll
out a software to the general public.
So, again,
unauthorized process is usually an indicator of an unauthorized application,
but it could also be an unauthorized application that's
been taken advantage of or fraught with malicious activity.
There's unauthorized privileges.
This usually comes into play where a user or a employee
uh has permissions that they shouldn't normally have.
Usually this is indicative of an employee that's moving
from one position over to a new position,
usually in promotion or even a lateral transfer, for instance,
in our own world with it or cybersecurity if
I'm a cybersecurity professional and my job is cybersecurity,
but I only work on host devices, but I mean,
transferred over to the network portion ie routers, firewalls,
IP S SI DS s that sort of thing.
Uh I really don't need to have access to those client based machines anymore.
And my permission should be stripped
so they don't have access to those anymore.
However,
a lot of times what will end up
happening is I get promoted or laterally transferred over
and I maintain those past permissions and nobody
went through it and actually slice those off.
This happens more outside of it than anywhere else.
Uh,
maybe they're an administrative assistant that got moved
to hr but they maintained access to systems
and folders and files and even in finances
that they don't really need access to anymore,
you may be thinking to yourself. Ok. Well, what's the big deal?
They could still utilize it? They're still proficient in it.
But you have to remember we're not really worried about our employees so much.
I say that with a grain of salt.
But what happens if that account is taken advantage of or actually hacked?
Somebody has unauthorized access to the account we have expanded their network of
availability within our own organization which could play havoc with our systems.
It's better to just get people permissions for what they need.
This is where at least privilege comes into play.
Then there's
a
data exfiltration. This is where data is leaving machine that was unauthorized.
This could take in the form of the
network where somebody is actually uploading information from
their client computer to a third party website
or maybe they're sending it via email.
It could also be on a USB or even external drive.
These are all problems with a host related symptoms associated with
malware on a device or malicious activity on a device that we need to be aware of.
As an analyst,
you need to be associated and aware of these different layers
and understand that the rules are the rules of the rules.
There are no special permissions when it comes to play
unauthorized privileges. Processes, application
data exfiltration are common problems that you should expect to
see as a data analyst or as a cyber analyst.
Within this role.
Those related systems.
On the processor side,
we can see here a screenshot of a windows processing system where it
identifies very quickly the different processes
associated within the confines of AC pu
you can identify the different CPUS as
as well as the network related traffic associated with the host.
Now oftentimes when it comes to network related traffic,
we look at the baseline activity as the network as a whole.
And we identify indicator as a compromise like that.
We talked about that last course. But what about a single host machine
if I've got a single host that is all of a sudden
producing five times the amount of traffic that it normally would.
That's a problem. And that's an indicator of compromise.
We need to be aware of this could also be associated with specific
processes or even a client traffic that's being utilized for data exfiltration.
A lot of the systems that you see here,
especially in the process of network or memory are indicative of a machine
going and doing different aspects of its applications and ways that we
normally wouldn't see.
For instance, if I'm an administrative assistant,
my memory should not be ticking up to overflow maxims, right?
I'm just using office and email. I'm not watching youtube videos.
I'm not playing the latest video games.
I'm not doing all those things, they're gonna stress out my system.
And so my memory should be at a baseline level of about 50%.
However, in this,
you can see where we have extenuated
circumstances where our memory is skyrocketing,
meaning that it's utilizing way more ram than we should.
And we,
we also see our CPU is at a minimal level, but starting to see a peak right at the end,
these are all indicators of compromise within a machine.
Does it mean that there's unnecessarily a problem no,
it could be legitimate traffic where an organization is
downloading a new piece of software or maybe they're,
they're profiling a new software that they want to utilize
and that's causing the machine to overrun.
We just need to be aware of it and then embark on an investigation to identify,
is it legitimate traffic or is it malicious traffic and those come
a host related machine in both ways,
we can also see the different systems associated
with it in a client based atmosphere,
abnormal process behavior which we've already beaten to death.
That comes into play of where is the process that come play coming into play?
And how does it interact with other processes on our environment?
There's file system changes.
If we have our file systems suddenly moving around and changing,
that's a problem,
we expect to see minor influxes and file system
changes where somebody goes in and then like,
oh well, this this file name. Is that something that I like?
So let's change it to this file name or creating a new file within our desktop
system to incorporate new uh uh bit work
or new business features within our environment,
that's all perfectly normal.
But if we start to see the system 230 system
32 within a windows environment suddenly changing its file names
or adding to it or maybe the size is changing
dramatically either for uh lesser files or more data.
That could be an issue
whenever we look at file
changes on a host machine.
We really need to concentrate on the fact of is this legitimate traffic?
Because 90% of the time, it's not, not within a file system structure.
And so if we start to see changes within our file system,
we need to lock that down fairly quickly and maybe
even have a knee jerk reaction associated with it.
There's registry changes as well.
If we see a registry being changed again, there could be a legitimate purpose for it.
But more often than not,
our average everyday user is not going to have that capability.
And so if we see a registry change,
we want to lock the system down because that is an indicator of compromise.
There's unauthorized scheduled chass usually within a windows environment,
we schedule the task to take place.
We are updating the machines usually during the maintenance window.
If we see unauthorized schedule tasks where something comes into
play and it's unauthorized or a task comes into play,
say at 10 p.m. rather than 2 a.m. that could be an indicator of compromise.
The same thing if it happens at 8 a.m. in the morning and our main
window is say 10 p.m. to 6 a.m.
That could be an indicator of compromise.
Well, it doesn't necessarily mean there's a malicious activity going on.
It could develop towards a trend and that one point
could be indicative of a problem within the overarching system.
So we just need to be able to keep an eye on it.
And if we see these changes all taking place simultaneously,
that's a big indicator of compromise that we
need to really investigate as soon as possible.
Throughout this course,
we talked about the different host related
systems and how it interplay with networking.
We identified how those hosts and the symptoms that we utilized in an indicator
promos. We also looked at how
the systems as a whole really played with malicious
activity and what we should keep an eye on.
You have to remember just like networking hosts are no different and sometimes
there's traffic that's legitimate and sometimes
there's traffic that obviously is unauthorized.
The important part of an analyst is to
understand what permissions does each user have.
And what's the normal within that atmosphere.
Obviously,
if a normal system behavior is is to change file systems on a regular basis,
that's not really an indicator of compromise.
But if I have a laptop that hasn't been changed in three years and all of a sudden,
it's doing massive updates that we're unaware of.
That's a big indicator of compromise.
It really comes at a common sense versus technical skill.
And that's really where your part comes into play as an analyst.
You need to be able to mix that common sense
theoretical understanding with the technical perspective of what you're seeing.
Cys A is no,
you're going to expect exam questions such as, hey,
you identified your CPU or memory being high.
What are the next steps? Should you a investigate? B, lock it down. C ignore it.
You kind of get the point,
those different types of test questions you need to be familiar with and
be able to quickly identify what direction you should be able to go.
Usually those questions are scenario based and so just take the
scenario from a common sense perspective and you should be fine.