5C. Analyse Host-related IoCs

Question 1

Malicious processes (to monitor/be aware of)

Answer 1

• process baseline (to detect deviations)
• scan running processes for malicious code
• registry changes (unexpected changes/access)
• open files (Linux ‘lsof’ command)
• network traffic
• high resource usage

Question 2

Fileness malware

Answer 2

malware code that executes without having to be launched from an .exe file saved somewhere on the file system. Fileless detection require analysis of the contents of system memory and process behaviour.

Question 3

Disk and File System IoCs

Answer 3

• excessive log information (e.g., due to brute force attempt, downloading content)
• use of temp file/folders, user profile locations, data masked as log file, alternate data streams, recycle bin usage

Question 4

Data staging and detection technique

Answer 4

the process of preparing and organising data for exfiltration from a target system or network. To detect, scan host file systems for file archive, compression, and encryption (e.g., RAR), look for files in system folders.

Question 5

File system viewers

Answer 5

• Tool that allows you to search the file system for keywords quickly e.g., system areas such as the Recycle Bin and NTFS shadow copy
• analysing file metadata allows for the reconstruction of a timeline of events

Question 6

Linux File System analysis tool

Answer 6

• lsof (displays currently opened files)
• df (displays disk space being used)
• du (display how much disk space each directory is using)

Question 7

Windows File System analysis tool

Answer 7

• dir /Ax (filters all files/folder types that match the given parameter (x) (e.g., /AH displays only hidden files/folders)
• dir /Q (displays owner of each file)
• dir /R (displays alternate streams for a file)

Question 8

Unauthorised privilege IoCs

Answer 8

• unauthorised sessions
• failed logins
• new user accounts showing up
• guest account activity
• privilege usage outside of working hrs
• security policy integrity (changes being made to)

Question 9

Unauthorised Software IoCs

Answer 9

• presence of unknown software (or unexpected security tools or DNS servers installed on host)
• absence or disabling of prefetch files

Question 10

Prefetch files are…

Answer 10

files that record the names of applications that have been run plus other information (date and time, file path, run count, and DLLs used by the executable)

Question 11

Unauthorised Change/Hardware IoCs

Answer 11

• system config changes
• hardware peripherals that have been attached to host
• application behaviour changes (e.g., attacker may open ports, start services, directory exclusion to scanning software)

Question 12

Persistence IoCs

Answer 12

• Registry changes (e.g., Outrun items, Services, File associations, Scheduled tasks)
• startup tasks
• Hidden files/directories (where malware/data may be stored)
• Boot sector malware
• Rootkits