- So welcome to lesson eight,
given a scenario, analyze indicators of malicious activity.
In our first lesson 8.1,
we're gonna talk specifically about,
what is an indicator of malicious activity?
Now, there are two primary types of indicators
that are used to help identify
and detect cybersecurity threats.
We have Indicators of Attacks, known as IoAs,
and Indicators of Compromise known as IoCs.
Now, IoAs, Indicators of Attack, are behaviors or actions
that suggest an attack is happening right now
or is about to happen.
Now IoAs are proactive.
Indicators of Compromise, IoCs,
are evidence that a system may have been compromised.
IoCs are reactive.
So we're gonna take a look at both IoAs and IoCs.
Now, Indicators of Attack are used to detect threats
before they cause significant damage or compromise.
That Indicators of Attack in the aggregate are gonna be
a set of behaviors or actions,
sometimes referred to as the tradecraft,
that are typically observed
during the early stage of an attack
although they could be identified anywhere
throughout the Cyber Kill Chain.
And I'll do the Cyber Kill Chain with you in just a sec.
Now, these behaviors include network traffic patterns,
system events, and user activities.
Now, the Cyber Kill Chain framework was actually developed
by Lockheed Martin,
and it explains how attackers move through a network
to identify vulnerabilities that they can exploit.
So it generally starts with a reconnaissance, right,
learning about the target, then weaponization.
So they learn about the target.
They determine how they're going to attack.
So they go through the weaponization process.
They deliver whatever the weaponization is.
Maybe it's malware.
Maybe it's injection.
Maybe it is a physical attack.
Then there's the exploitation.
And lastly, the installation.
So the installation of whatever they had in that network,
if they're putting something into the network itself.
And then a connection back to a command and control center,
and then action on objectives.
Now I put a little URL down on the bottom of the slide.
If you wanna learn more
about the Lockheed Martin Cyber Kill Chain,
go ahead right through that URL
and you can get lots of information about how this works.
The common Indicators of Attack include
unusual network traffic, phishing emails,
unusual system events,
or unauthorized software being installed.
So unusual network traffic and/or geographic irregularities,
like access from places
that normally don't come to your network could be indicative
of communications with a C&C, a command and control server,
or indicative of data exfiltration
or reconnaissance activity.
Phishing emails are designed to trick our users
into taking an action, right?
An increase in the volume of phishing emails could be
an indicator of attack.
Unusual system events such as errors, warnings,
system crashes, account lockouts, missing system logs,
any anomalies in admin activity,
all could be indicators of an attack.
And unauthorized software,
meaning the presence of unauthorized software or files
or unapproved devices on our network,
again, could all be indicators of an attack,
an attack that is happening or is about to happen.
Indicators of Compromise are artifacts
about an event that has already happened.
And we use our Indicators of Compromise to identify,
has there been a security breach?
Now, Indicators of Compromise rely on known artifacts.
Another way to think about an artifact is evidence or clues.
Typical artifacts that are left behind
by an attacker include new user accounts,
or file hashes, virus signatures, malicious files,
command and control connections,
modification of the system or registry settings,
evidence of data exfiltration,
or patterns of suspicious behavior.
Now, not all IoCs necessarily indicate a compromise.
So you might have an IoC,
but it doesn't mean that there definitely was a compromise,
that you need to do validation.
So multiple IoCs may need to be correlated
to confirm a compromise.
It's really important
that we have a strong incident response plan in place
in our organizations to quickly detect
and respond to Indicators of Attack
and Indicators of Compromise.
And we'll be talking in later lessons
about a strong incident response plan.
And that, my friends, brings us to three-second challenge,
five challenge questions, three seconds each.
You know how to do it.
Evidence or clues used to determine
if a compromise has occurred.
One, two, three.
That's gonna be artifacts.
Number two, a remote device
that issues malicious instructions.
One, two, three.
That's gonna be a command and control server, or a C2.
Number three, gathering information to use in an attack.
This was the very first thing we saw
in the Cyber Kill Chain.
One, two, three.
That's reconnaissance.
Number four, the stages of an attack
as described by Lockheed Martin.
One, two, three.
That is our Cyber Kill Chain framework.
And lastly, number five,
tricking a user into performing an action.
One, two, three.
That's social engineering.
We did a whole lesson on that.
Hope you got that one right.
All right, let's do a security-in-action about indicators.
Really short little one here.
You're staffing the Help Desk.
A user calls in to report
that his laptop has been "acting funny" all day.
That's all they say.
So my question to you is, how are you gonna respond?
Now, hopefully you don't say,
"Yeah, yeah, right, bye," right?
You take it seriously.
But what are you gonna do?
That's all you've got to go on,
that his laptop has been acting funny all day.
How are you gonna respond?
Go ahead and put me on pause, jot down some notes,
come back, and we'll do a response together.
Well, number one,
you really wanna take the caller seriously.
Even if it's someone
who's like just normally a pain in the butt
and you're like,
"Oh God, this person's always calling me,"
you still need to take the caller seriously.
You wanna work with the caller to describe acting funny.
What does acting funny mean?
See if you can really get him or her
to be much more detailed.
Now, if warranted, we can collaborate with the user
to create an activity trail
that includes suspicious emails or calls,
maybe any links they've clicked on,
any unexpected attachments that they opened,
or any web browsing they did.
And then we wanna investigate
any corresponding artifacts right?
Firewall logs, maybe the local browser history,
or DLP, data loss prevention activity.
And if appropriate, right,
we're going to escalate
and follow our incident response protocols.
But when they call, just acting funny,
we don't know what that means, right?
Is that an indicator of attack?
Is that an indicator of compromise?
Is it maybe nothing?
But we still need to take the caller seriously?
We need to try to define what happened
a little bit more precisely, right?
Then we need to perhaps looking for those artifacts
and investigating them and trying to determine
what might have happened.
And then if it's warranted,
we wanna initiate our incident response protocols.
Doing that, definitely security-in-action.
That takes us to our word cloud.
Not much there, right?
I know you can do all of these pretty easily.
So let's move right on to our next lesson.