Continuous Monitoring Flashcards

Question

Which of the following devices or applications is the most appropriate for configuring application whitelisting?

Answer 1

Host-based Intrusion Prevention System Another significant source of valuable detects, the application whitelisting tool can be handled by a Host IPS. Network IDS, OS firewalls, and NAC don't provide this functionality.

Answer 2

Evidence of compromise that might already exist An additional aspect of reorienting our organizations to be more focused on detection is the establishment of hunt teams. The idea of a hunt team is to have a team separate from that of traditional analysts. The primary purpose of this new class of analysts, known as the hunt team, is to go looking for evidence of compromise that might already exist.  Rather than waiting passively and hoping a sensor/log will be suitably positioned and tuned such that alerts are thrown, the hunt team goes looking for the compromise in the first place.

Answer 3

The lack of tools able to natively interpret the data PcapNg is the "next generation" format for pcap files; it is used natively by Wireshark; it is not handled by many other tools however. PcapNG uniquely provides insight into the packet drop count, interface and directional information. The snaplength size "limitation" is specific to tcpdump and may trivially be overcome using the -s0 switch.

Answer 4

An IDS rule focused on encrypted traffic without a certificate exchange Monitoring outbound traffic for TLS certificate exchange would have detected the presence of either unencrypted traffic over 443/TCP or traffic that was encrypted with no prior certificate negotiation.

Answer 5

Block if "Content-Type: application/pdf" is present in the HTTP header Beyond just blocking via URL and website categorization another approach to web content filtering is to block access based upon MIME or Content-Type.

Answer 6

Content Delivery Network domain names For resiliency, malware often has an algorithmic way to determine future DNS host names without having to have a fully prepopulated list hardcoded. These algorithms are referred to as a Domain Generation Algorithms (DGA). One approach for combatting DGAs is entropy analysis of domain name requests in which randomly generated strings are identified and blocked. Many Content Delivery Networks' high entropy domain names would be flagged, disrupting access to legitimate sites. Consequently, CDNs must be whitelisted. Fast flux domains are a primary target of DGA analysis. Domain servers' security weaknesses are not addressed by DGA analysis. Hijacked domain names are not modified, so if they were not identified before the hijack by DGA analysis, they would not be identified after the hijack.

Answer 7

Investigate what typical flows are for these hosts Occurrences on the network that appear atypical should be compared to a baseline to determine if they are normal

Answer 8

IDS signatures can be written to detect that record leaving the network HoneyShares/HoneyFiles - These are simply shares and files meant to entice the adversary, but that are very closely monitored/alerted on any type of access.

Answer 9

Adobe Acrobat creating new registry entries An installed program that creates new registry entries is most likely to trip an IPS prevention. It's an unexpected event that the program would not ordinarily be expected to take. HIPS does help prevent (or log) connection attempts, like an attacker's pivot, but not if such attempts have been allowed for connections from Trusted sources or network segments. While opening a new Word file containing macros should be expected to trigger an IPS response, reopening the file would be an allowed routine action - tuning the IPS to allow it keeps routine business activity flowing. DNS requests are also allowed routine actions.

Answer 10

The block rules from the perimeter router The SI FW should double check all the filtering that is done by the border router

Answer 11

The SSL handshake was skipped This is unencrypted C2 traffic passed over port 443. In normal SSL traffic, immediately after the three-way handshake the client issues a Client Hello to begin negotiating encryption. However, in this case that first transmission (in frame 14) performs a POST in clear text instead of the Client Hello. Frames 14 and 15 are in the correct order. There is no indication of any file transfer, nor of an X.509 certificate (because the certificate negotiation was skipped).

Answer 12

OpenAppID A recent development in the Application Inspection/Identification space is OpenAppId. Sourcefire/Cisco released OpenAppId at RSA 2014. The project seeks to allow an open source framework for identification of particular applications.

Answer 13

By providing analysts with a tool to escalate from detection to response A SIEM improves an organization's ability to correlate and manage data collected from multiple sensors.  This in turn improves an organization's ability actually analyze, detect, and respond to significant events. 

Answer 14

The accounts 'backup' and 'sink' are both root accounts Accounts with the same userid in Linux/Unix are the same account just under a different name. In this case, 'backup' and 'sink' are both root accounts.

Answer 15

Debug programs The image shows LSA secrets in the Windows registry. LSA secrets facilitates non-interactive authentication by *service accounts; via storing the encrypted password(s) in the registry Any account with 'debug programs' user rights/priv can access and decrypt these passwords. *To be more specific, these are account passwords for services that are set to run by OS-level users (rather than Local System, Network Services, or Local Service type accounts).

Answer 16

Sysmon Microsoft's Sysinternals Sysmon is a great free tool that monitors application use (and more). EMET allows newer security controls (e.g. ASLR, DEP, and ROP mitigation) to be back-ported to legacy Microsoft OS's, such as XP and includes protections for some 3rd party apps, specifically Java and Adobe Acrobat. WSUS is a Microsoft provided patching console. SCCM is a Microsoft tool that can be used to push 3rd party patches.

Answer 17

Ability to manage the local clients through GPO A strength of WFAS in its default configuration includes the ability to centrally manage the configuration via group policy. WFAS does not provide centralized logging, logging is disabled by default, and outbound filtering is turned off by default.

Answer 18

Ponemon Institute

Answer 19

Segmenting a network into VLANs according to trust level Detective controls seek to monitor a network or host for an adverse event and alert, preventive controls seek to prevent the adverse event from occurring.

Answer 20

Transaction Transaction data contains no content, only packet metadata such as IP addresses, ports, and bytes transferred. It is flow data plus some layer 7 content, like HTTP GETs. Alert data is composed of IDS alerts. Flow data is summary data, showing socket pairs, protocols, and bytes transferred - think NetFlow. Statistical data shows a numeric analysis of network traffic. String data is a sequence of printable characters. A tool like ngrep is typically used to extract string data from pcaps.

Answer 21

Third party notification 70% of initial discoveries are reported by third parties.

Answer 22

PRADS Of the tools listed, PRADS is the only one that is a true-passive tool. Nmap, the Nmap scripting engine (NSE), and WhatsUp offer some options to be less intrusive, however, they are all active scan tools at their core. Passive scanning is far safer than active scanning, relying on Pcap files or sniffing a live network. Read-only access is all that's required.

Answer 23

Test scans before running on production system Always test scans before running on production system.  If available, It is much safer to initially scan development systems.  Ensure all active scanning occurs during an approved maintenance window.  Begin scanning a limited amount of systems, and gradually increase the scope.

Answer 24

Detect persistent connections over HTTP A border router can routinely be used to provide insight into persistent connections. Detecting anomalous traffic where common ports like HTTP, SMTP, or SSL are in use is unlikely because routers do not typically inspect packets at the application level where they could detect anomalous behavior. For the same reason, the router's lack of layer 7 visibility limits it from detecting or preventing client-side attacks.

Answer 25

Track anomalies in the issuer fields of X.509 certs Many types of malware uses public key certificates, e.g. X.509, but skimp on details. Legitimate sites populate the X.509 Organization (-O) and Country (-C) fields but malware often skips these.

Answer 26

Server returns a binary when sent a parameter to a PHP file The server returns an exe when the request by the client is unspecific. This in combination with the host name, the GET string, and the exe, is an indication that this might be a malicious communication stream.

Answer 27

Plain text password harvesting from RAM Win8.1 and 2012R2 eliminate plain text passwords from RAM, the other attack vectors remain approachable by attackers.

Answer 28

Tap A network tap will meet the need. A mirror-port will not forward malformed packets (or VLAN tags). A hub operates at half-duplex. Using a VM (hypervisor) is not a hardware based solution.

Answer 29

Establishing a HTTPS session The packet shows the TLS handshake taking place for an HTTPS session. Observe the image. From the information provided what can an analyst determine about the file?

Answer 30

One interesting way to potentially identify the source of a file on Windows NTFS partitions is through the Zone.Identifier Alternate Data Stream (ADS). The point of the Zone.Identifier is to indicate the zone of trust from which the particular file was acquired. Zone.Id=3 indicates the file was downloaded from the Internet. The information provided will not tell if the file is signed or renamed. Depending upon where the file was copied from Zone.Identifier information may help identify what trust zone it was in (if the SMB source volume used NTFS). But in that case its value would not = 3.

Answer 31

Preventing unneeded software A baseline configuration has identified and determined the required and necessary components of a system and software; thereby enabling admins to remove unneeded software and reduce the scope of patch management. Baseline configurations are not related to application whitelisting, application signatures, or removing local admin access.

Answer 32

When new listening services are set to run on startup Recording a baseline configuration of /etc will let the administrator know when system configurations have changed.

Answer 33

Credential compromise Credential compromise allows the attacker to log into the network as an authorized user which helps to cover the tracks of the attack

Answer 34

Account lockout threshold is not set by default The built in administrator account on Windows systems does not have account lockout configured by default, meaning that password guessing can be automated without fear of the account locking.  This allows an attacker to systematically try every possible combination of passwords fairly quickly.  While this would cause a significant amount of logging, these logs can be cleared once administrator access is gained.  The built in administrator account is the one account that all attackers know is there, and has a standard, well-known RID.

Answer 35

Derive it from an industry-proven configuration Baseline configurations should be derived from industry-proven configuration, such as those provided by the Center for Internet Security. Vendor settings may sacrifice security in order to maintain vendor-specific functions, and so simply duplicating them is not recommended. Building a baseline configuration from scratch is not recommended. Enabling all possible security options will likely negatively impact system usability.

Answer 36

Many SNMP-based monitoring tools (e.g. WhatsUp, MRTG, RRDTool, etc.) include network discovery nodes.

Answer 37

Logon/Logoff: Network Policy Server Each of the above will, by default, log any "success" to the Event Viewer. Only a failure specific to Logon/Logoff: NPS will be logged when the default settings are in place.

Answer 38

Compile them in open IOC format in an XML file IOCs, or Indicators of Compromise represent a much more formal approach to documenting artifacts associated with intrusions and activities. The main benefit of IOCs over the simple DWL are its ability to scale for multiple analysts. Further, IOCs are built for  information exchange, which allows for the easier sharing of intelligence

Answer 39

Between the firewall and the guest wireless router Another common location to situate a monitoring interface is where the firewall connects into the internal network. Like the DMZ sensor, this sensor would typically be configured to protect the internal network from external actors, which in this case is anyone not on the internal network.

Answer 40

VirusTotal VirusTotal enables the responder to submit the file for broad AV analysis by nearly five dozen AV scanners (including Malwarebytes). Behavioral analysis on VirusTotal is performed by nearly two dozen file characterization analyzers and datasets (including Cuckoo). The website may be submitted to VirusTotal for analysis by nearly 60 website and domain scanning engines and datasets (including Malwarebytes hpHosts). The other tools lack the ability to provide broad AV analysis that is VirusTotal's hallmark. Qualys Security and Compliance Suite contains no malware analysis capabilities - it provides numerous tools valuable for identifying vulnerabilities with SSL/TSL implementations, missing O/S and browser plug-in patches, and asset inventory. Cuckoo sandbox is a malware detonation device that scans files using behavioral analysis. Like several leading AV vendors, Malwarebytes Suite offers deep protection on a host thanks to deeply embedding itself gaining broad visibility into actions software may take.

Answer 41

5056 Long tail analysis is used to help find the signal in the noise by focusing on less common events, which are depicted further right on the graph.  Of the options the event 5056 would be the most useful during long tail analysis.

Answer 42

Signature matching Where an IDS is searching for strings, such as credit card numbers, (or hashes, names of executables, etc.) the methodology in use is based on signature matching.

Answer 43

The type of file being downloaded One approach to web content filtering is to block access based upon MIME or Content-Type. When downloading content via HTTP, a Content- Type header is provided that identifies the type of file being delivered. Proxies can look for these headers to identify types of content the might warrant additional scrutiny (in say an automated dynamic analysis sandbox) or just get blocked without scrutiny.

Answer 44

Hyndman A predictable transfer of EXEs is a cornerstone defensible network concept. Core to this is detecting and, when possible, disallowing clients to receive executables from other clients. Clients should receive EXE files from an internal software distribution server. The shown snort rule, if implemented on the sensor called Hyndman, would detect client to client EXE transfers.

Answer 45

Patch management The overwhelming majority of all exploits begin with abusing a known flaw that simply has not been patched, even though a patch was available. Patch management implies an ongoing practice. Network segmentation is a bit subjective and may not be related to implementing any security controls. HIDS is not a preventative measure. A baseline configuration is too subjective, it may have not been built for security and there is no indication it is an ongoing process (like patch management).

Answer 46

Use ngrep to search for specific ASCII characters String data is a sequence of printable characters; ngrep can be used to search for strings such as "JOIN".

Answer 47

Providing twenty four hour coverage for IDS alerts A MSSP can be utilized for perimeter management, penetration & vulnerability testing. It should not be considered a replacement for the entire SOC.

Answer 48

C The IPS needs to have visibility into the packet flow in order to detect the attack. Position C is the only location through which the packet will traverse.

Answer 49

Packet captures from a snort sensor on that network segment In addition to application logs, pcaps can help because they show the actual data that would have been passed to the application-layer.

Answer 50

It will be accepted and not logged Incoming packets for interfaces with the Public profile, for the application shown, will be allowed

Answer 51

Full packet captures Transferring large packet captures to a centralized server requires considerable bandwidth.

Answer 52

Post-exploitation Post-exploitation activity is both more likely to cause actual damage, and, surprisingly to some, also generally an easier detect. We will explore some of the post-exploitation activity commonly employed by modern adversaries later. However, simply focusing on an adversary's attempts to persist and pivot pays huge defensive dividends.

Answer 53

A NULL response Adversaries have developed a means to co-opt this WPAD functionality by providing their own response the WPAD requests if we do not provide our own. Using this method, suitably positioned adversaries could launch a MITM attack against clients. Configuring WPAD DHCP/DNS/NetBIOS null responses if not actively being used is highly recommended.

Answer 54

Nothing will get logged by Windows Firewall Another significant weakness, but one that is much easier to rectify is the poor logging configuration. By default logging allowed or even blocked connections is not enabled.

Answer 55

TCP/80 from database servers One would expect the following types of traffic to be seen on a network with outbound filtering in-place: TCP/80 - from Proxy TCP/443 - from Proxy UDP/53 - from DNS Servers  TCP/25 - from Mail Servers  UDP/123 - from NTP Servers Note that, by design, desktops/servers cannot talk directly out to the internet. While this might not be achievable, it serves as a strong goal to aim for.

Answer 56

X.509 certificates that do not have the Organization field populated Many types of malware uses public key certificates, e.g. X.509, but skimp on details. Legitimate sites populate the X.509 Organization (-O) and Country (-C) fields but malware often skips these.

Answer 57

It is missing patches The workstation needs its security patches installed first, then auto-updates should be enabled.

Answer 58

Avoids signature detection Many types of malware and malware creation tools generate strings randomly. They do this to avoid signature detection: if the malware is called "evil.exe," it would be trivial to detect by pattern matching. High entropy entries are mostly used for entries that normally are in the clear, such as program names and DNS entries. Consequently, an attacker's identity is unlikely to be obscured by a high-entropy entry since such telltales are hidden deep within code and are often left there by accident. There are no international language differences that a high entropy string would excel at solving. Strings that may use high entropy names like certificate CNs and DNS entries are generally not encrypted in transit.

Answer 59

Most organizations fail pretty miserably at perimeter-style detection, once things move internal detection becomes even less likely to have already been instrumented. This is made harder by the volume of data that needs to be correlated and analyzed.

Answer 60

Servers don't typically contain client applications for end-users The primary distinguishing feature that make desktops more challenging than servers to secure is simple: users. Active users drastically change the security posture of a system. They want to install applications, access data/resources, and also provide a more obvious conduit for adversaries to introduce their malicious content.

Answer 61

Web-app firewall The input, , is related to a SQL injection attack. A router and SI-firewall will not be able to detect this attack as they are not layer-7 aware. A web-app firewall is customized to be aware of these types of attacks and to prevent/detect them. The HIDS may provide aid towards this attack, however, they will not be the first to see a SQL injection attack given the servers areCorrect…

Answer 62

An NGFW which drops packets containing shell commands This is an interactive shell tunneled through ICMP. The NGFW with its application identification/inspection capabilities can be extremely beneficial. The most significant security boon comes from the ability to potentially identify non-conforming Layer 7 traffic.

Answer 63

Client-side attack A client side attack requires user interaction, in this case, the downloading and opening of the document. A service side attack uses a listening port to deliver an attack to the vulnerable device. A phishing attack refers to an attack sent by email.

Answer 64

Firewall rules prevent externally initiated communication with desktop systems Firewalls are normally configured to deny inbound connections requests by default with exceptions made for listed servers and services. This would prevent an inbound request for communication to a desktop from being successful.

Answer 65

Vulnerabilities and data at rest CSM is primarily vulnerability-focused and focuses on data at rest.

Answer 66

Ability to view all applicable packets associated with the alert An NSM frontend application (e.g. Sguil, Snorby, Squert) that allows an easy pivot to view all packet data associated with an alert(s) is a desired feature. The other options do not describe use cases for an NSM frontend application.

Answer 67

The password for service accounts is stored within LSA Secrets (HKLM\Security\Policies\Secrets).  Any account with the Debug Programs user privilege can access and decrypt this data. Bypass Traverse Checking determines which users have permission to navigate to an object path in the NTFS file system or in the registry without being checked for Traverse Folder special access permission.  Log on as a Service is used to determines which service accounts can register a process as a service.  Replace a Process Level Token emables a user to start processes as another user if they know the victim user's credentials.

Answer 68

provides a central place to filter web access from clients Forcing all communications through the proxy creates an incredibly useful choke point for both preventive and detective capabilities.

Continuous Monitoring Flashcards

(92 cards)