In this chapter,
we're going to cover the various tools and detection
methodologies to analyze malicious activity on your network.
We're going to talk about network scanners, the DNS U
all identification tools strings and of course hashing utilities,
we're going to demonstrate some different tools and
show you how to actually use those tools to
run tests on your own systems or networks to better prepare you for the cys A exam.
In this episode,
we're going to talk about packet captures and how to utilize
them to identify different malware or malicious activity on your network.
Specifically,
we're going to use a tool called wireshark to
go through those specific packet captures and identify the process
to look at those different malicious activities that could
be utilized by an attacker on your own network.
While the book covers Tshark as well as Berkeley,
we're not going to cover this in this episode as they're not part of the cy
A requirements
and honestly, they're kind of outdated.
We really don't use them that often packet
capture is the idea of taking information that's
crossing through your network and collecting that information
in such a way that it logs everything.
We can see different ports where it's going from, from IP address to IP address
and we can look at it from the reverse perspective.
So not only can you see the packet
of information going away from your computer system,
you can see everything coming into it.
You can also
view other information across the network depending on
where you have your sniffer put into place.
That means I could sniff information at a switch and see the different
aspects of traffic going both from the switch and away from the switch.
If I have it set up correctly,
we call this packet analysis where we can go
through and look at the different packets of information
and trace not only the information that's going from and to and from the device,
but also the information that's passing through it.
In the next chapter,
we're actually going to go through wireshark show you how to set up wireshark.
So it's easier to read
and how to identify the different information tidbits that you
need to be aware of to properly read the tool.
Now, obviously,
we can't go through wireshark and take 20 hours
to go through every single aspect of it.
But our hope is to lay you a high level overview of it so that you can identify
the basic principles of how wireshark functions in order to pass the cys A exam.
Wireshark is a packet capture and analysis tool.
It allows you to view and capture data as it's moving throughout the
network so that you can actually view it and see what's going on.
Now,
we talked about some of the basic principles of how you can identify IP
addresses and where it's going to as well as where it's going from.
But you can identify as well malware signatures if you have it set up properly,
you can also look at protocol analysis means
you can identify what protocol it's using,
whether it's TCP
FTP
or http
you kind of get the point,
but it goes through and actually identifies those
different protocols that allows you to identify where it's
coming from and what services is most likely trying
to utilize or address throughout the traffic patterns.
We can also do a domain name system analysis which pinpoints the IP
address and links it to the name in which the user input.
For instance, if you put in something like amazon.com,
it will not only show you that the user
to go to amazon.com, but the associated IP address that's linked to it.
This helps you to identify if maybe some DNS poisoning is going on or some other
DNS spoofing technology that it would allow you
to succinctly identify those processes through malware activity.
We can also identify the payload.
If somebody sends a picture through wireshark or excuse me, through the network,
wireshark can identify it and you can actually
pull that picture out exactly how they use.
Had a process that, that picture
we can go through and identify
different behaviors through the different processes.
We can identify if the user went through one website and
clicked on another website or a link for that website.
We can identify what the user typed in and the
different IP addresses that the user may have visited.
Throughout this episode,
we talked briefly about wireshark and everything that comes in play with it.
We talked about the different features of the tools that you can
utilize within Wireshark to make your life a little bit better.
As an analyst,
we talk about packet capture and how Wireshark
along with other tools can capture files called PCAP
files.
Wireshark is a phenomenal tool that you're going to use throughout your career.
You should expect to see tidbits of wireshark captures
in your cy a exam.
Now, don't worry,
they're not going to have you going through at a very deep
level that you may need to take a 40 hour course for.
But what you can expect to see is small snippet
or packet captures that have identified through a screenshot.
Exactly what we're looking for.
You should be able to identify whether something is a dictionary attack,
a brute force attack.
You should be able to identify what IP address the traffic came from as well as where
it's going to the timestamp associated with it as
well as the other features associated with Wireshark.
Don't worry,
we're gonna go through those in chapter 10 and to show you not only how to set that up,
but how to read the wireshark as well.