Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Network Forensics > Exam 2 > Flashcards

Exam 2 Flashcards

1
Q

Incident Response

A

The planned response process for dealing with network intrusions and misuse of computer systems.
Also known as Incident Handling.
Generally, the intrusion is still active when IR is deployed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Incident Response: Event

A

An observable change to normal behavior on a system or network.
Not necessarily negative.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Incident Response: Vulnerability

A

A documented security flaw in system software or hardware.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Incident Response: Exploit

A

A security attack using a vulnerability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Incident Response: Threat

A

The potential for an attacker to exploit a vulnerability.

Weighted by consequences of vulnerability and likelihood of exploit taking advantage of the vulnerability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Incident Response: Alert

A

A notification of an event to responsible parties.

Requires further investigation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Incident Response: Incident

A

A malicious event caused by an attacker exploiting a vulnerability.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Incident Response: Cycle

A 
Preparation.
Identification.
Containment.
Eradication.
Recovery.
Follow-Up / Lessons Learned.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Process

A

An instance of a running application/executable.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Windows Task Manager

A

GUI to view processes.
Ctrl-Alt-Del or ‘taskmgr.exe’ to access system’s task manager.
‘tasklist’ command line also works.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Should we necessarily trust the Task Manager on an infected system to tell us the truth?

A

We can use our OWN copy of tasklist.exe.

We can also use our own copy of Process Explorer (SysInternals) or Process Hacker (available on SourceForge).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Services

A

A background process that requires no user interaction.
Windows Task Manager.
tasklist /svc’ gives us services with corresponding processes.
Windows Service Control Manager GUI ‘services.msc’.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Scheduled Task

A 
A scheduled task is a process/service that runs when a specific condition is met.
Usually timestamp(s).
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Windows Task Scheduler

A

Provides GUI to scheduled tasks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Persistence

A

Keeps coming back!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Autoruns

A

Most often used tricks involve using Windows Registry database.
Sysinternals includes a tool called Autoruns that
looks at ALL of the known methods for persistence.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

ipconfig

A

Network configuration details can be seen using ipconfig.
Use ‘ipconfig /all’ to display all the NIC configurations
Includes IP address(es), MAC address, default gateway router, DNS/DHCP servers.
Can also see the DNS cache with ‘ipconfig /dns’.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Listening

A

App is bound to a port and waiting for connections.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Established

A

There is an established communication stream.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

netstat

A

Use netstat to view network connections on an end system.
‘netstat’ by default does DNS and known port lookups
Time consuming and sometimes wrong!
‘netstat -na’ to turn off this feature.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

User Accounts

A

Once a malicious actor compromises a system, they commonly create an administrator account to access later.
Bank on people not monitoring the accounts on a system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Sysinternals Suite

A 
A suite of network troubleshooting utilities provided for free by Windows.
Autoruns was previously discussed
TCPView (think a GUI of netstat info)
TCPView Console (command line view)
Process Explorer (better Task Manager)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Sysinternals Ps Tools

A

Sysinternals Suite includes a set of tools for management of remote connections.
Begin with “Ps”.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

PsFile

A

Shows files being accessed remotely.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

PsLoggedOn

A

Shows users logged onto system (local or remote).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

PsExec

A

Allows the execution of processes remotely on system
Requires username and password for user account
BEWARE!!!
Attackers commonly install PsExec on a system they compromise to execute commands on it including a backdoor setup.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

PCAPS

A

A “full packet capture” is generally stored in a PCAP file
.pcap extension most common.
Contains a bit for bit copy of what traversed the wire.
Windows uses WinPcap.
Note that while we use the term packets for captures we are actually capturing Layer 2 FRAMES.
As previously discussed what traverses the wire is a frame.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Network Sniffer

A

A tool that places a target NIC into promiscuous mode.
TCPDUMP and tshark offer command line sniffer tools.
Wireshark in a network sniffer with GUI.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Promiscuous Mode

A

Will accept any packet that it receives on the wire for processing.
The sniffer will record all packets that traverse the NIC in a PCAP.
Sniffers generally must be run with administrator privileges.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Wireshark

A

GUI.
Both a network/packet sniffer and protocol analyzer.
Includes dissectors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Capture Filters

A

Can be applied to limit the traffic we capture.
Limit the scope (minimize data loss).
Make it easier to find what we are looking for later.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Once we apply a Capture Filter:

A

Traffic that matches -> Copied to PCAP.
Traffic that doesn’t -> dropped by sniffer.
We will NEVER be able to see those packets again.
This is the opposite of Display Filters.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Software Shortcoming: Network Sniffer

A

Remember that a hub sends traffic to everyone attached.
A promiscuous NIC on a hub-based LAN would see ALL traffic on the network.
Most modern LANs are not using hubs…using switches!
If our promiscuous NIC is on a device connected to a switch, will only see our own traffic?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Hardware Network Sniffers

A

Two most common implementations:
Network taps.
Port spanning.

35
Q

Taps

A

A hardware device that is placed between two network devices to send all traffic between them to a monitoring device.
Traffic still goes to proper destination, but also goes to monitor.
The monitoring device could be a server or just a system running TCPDUMP or Wireshark.

36
Q

Hardware Sniffer Placement

A

Placement of a network sniffer is very important.
It is important we consider WHAT traffic we want to monitor.
WHERE on the network would allow us to see that traffic.
Not every part of the network sees everything.
Different segments have a different POV.

37
Q

Port Spanning

A

Some switches have a built in SPAN port.
It is possible to configure the switch to mirror traffic to/from one of its ports to the SPAN port.
Also possible to mirror traffic to/from all ports to the SPAN port.
Can create a bottleneck = results in lost packets.

38
Q

Hashing

A

The process of taking data, processing it with a hashing function (math magic), and resulting in a fixed-length output.
MD5, SHA-1, SHA-256, SHA-512.

39
Q

Investigative Leads

A

Gathered from host artifacts, PCAPs, log files, storage media images, etc.
Evidence we gather during IR.

40
Q

OSINT

A

Open source intelligence (OSINT) tools to learn more about these leads (for attribution).
Doesn’t require law enforcement legal process.
WHOIS/DNS.
SMTP Headers.
VirusTotal.

41
Q

WHOIS for IPs

A

When we have a suspect IP address, we can perform a WHOIS query on it to determine what block of IPs it belongs to.
MAY include info on the org, location, and contact info associated with the block of IP addresses.

42
Q

WHOIS for Domains

A

When we have a suspect domain, we can perform a WHOIS.
Will first perform a DNS query to return the DNS records it can find for the domain.
This data is retrieved from DNS.
Will include the Registrar.

43
Q

SMTP Headers

A

Recall that SMTP is used to SEND email.
It takes multiple hops to multiple SMTP servers to get to the recipient’s mail server (where they retrieve it from).
Generally you want to look for an indicator about the originator (first hop) of the email.

44
Q

VirusTotal

A

If during IR or forensics a potential sample is uncovered, use VirusTotal to determine if anyone (AntiVirus and AntiMalware companies) has IDed it already as malicious

45
Q

Packet Sniffer

A

Sniffer places a NIC in promiscuous mode.
Captures all traffic the NIC sees in a PCAP.
Only goal is to produce a bit for bit copy
of what traverses the NIC.

46
Q

Protocol Analyzer

A

Has some knowledge of how protocols are specified and what headers and data they contain.
DECIPHERS the content of the bits into something
meaningful.
Also called a packet analyzer or network analyzer.

47
Q

Wireshark: Packet List

A

Contains all the packets in the capture file.

Columns correspond to different information about each packet.

48
Q

Wireshark: Packet Details

A

Contains the contents of the currently selected
packet in a form dissected by Wireshark (analyzer!).
Displayed by the LAYERS of the packet.
Each layer can be opened to examine the contents of its header.
All the way until you reach the data/payload.

49
Q

Wireshark: Packet Bytes

A

Displays the contents of the currently selected
packet in its raw (unprocessed) form.
Displayed in Hex (with an ASCII translation).
This is the binary data that is ACTUALLY sent across the wire.

50
Q

Wireshark: Dissectors

A

What makes Wireshark a protocol analyzer.
So it can ID the types of data in each frame and pull out all the fields from all the headers and payload data.
This is how it can display all the layers in the Packet Details.

51
Q

Nonstandard Ports

A

Wireshark relies a lot on standard port numbers to identify what dissector to use.
If we ID that a port looks like a certain protocol, we can force Wireshark to apply a dissector on those packets.

52
Q

Nonstandard Ports: “Decode as”

A

Right Click and select “Decode as”.
Select the protocol you want Wireshark to interpret the port as.
Also go to Edit ‐> Preferences.
Can select the protocol dissector and add the nonstandard port to its list of ports.

53
Q

Display Filters

A

Used by protocol analyzers to limit the packets being displayed to the analyst from the PCAP.
It is still in the PCAP…just not currently displayed.

54
Q

Applying a Display Filter

A

Method #1: Just type it into the Display Filter bar.
Method #2: Find something of interest in the Packet Details, Right Click, and select Prepare as Filter or Apply as Filter.
Method #3: Use the Expression Wizard.

55
Q

Capture Filters vs Display Filters

A

Both allow you to filter for a specific protocol.
Both allow you to filter for a specific address/domains.
Display Filters allow you to filter on specific fields in
headers/data.

56
Q

Wireshark: Timestamps

A

Default = seconds since start of capture.
View ‐> Time Display Format.
MANY time options.
Date/Timestamp probably more helpful.

57
Q

Wireshark: Time Shifting

A

CTRL‐SHIFT‐T
• Sometimes the clock on a system may be a tad off
• Time shifting allows you to shift all timestamps by a set amount
• Especially useful for merging PCAPs that don’t sync

58
Q

Wireshark: Time Reference

A

CTRL‐T on a selected packet in Packet List
• Selected packet becomes a time reference point
• All subsequent packets’ time is in reference to that packet
• Only works if timestamp is in seconds since capture

59
Q

Wireshark: Name Resolutions

A

• Wireshark has the ability to do name resolutions
• MAC Addresses (the vender from the OUI)
• IP Addresses (domains associated with the IP)
• Port Numbers (protocols associated with standard port)
If this is on while capturing, Wireshark may send additional traffic not actually going on the NIC
• DNS requests to resolve the IPs (for PTR records)
• This should be turned off when capturing!
View ‐> Name Resolution
• Edit ‐> Preferences ‐> Name Resolution

60
Q

Saving PCAPS

A 
File ‐> Save As (or hit CTRL‐SHIFT‐S).
File ‐> Export Specified Packets
• Can save:
• Single current selected packet
• Marked packets
• Packets from first marked to
last marked
• A range of packets by packet no
61
Q

Merging PCAPS

A

Sometimes we may have more than one PCAP file we want to merge into a single PCAP for analysis
• File ‐> Merge
• Merge currently opened PCAP with another file

62
Q

Finding a Packet

A 
Edit ‐> Find Packet
• CTRL‐F
• Can search packets for:
• Strings (Example: “evil”)
• Hex Values (Example: 90909090)
• Regular Expressions (Example: “.*\.doc”)
63
Q

Go To = Teleporting

A

You can jump directly to a specific packet
• Go ‐> Go To Packet
• CTRL‐G
Jump by the Packet Number
• NOTE: Packet Number is a Wireshark thing

64
Q

Wireshark: Bookmarking

A 
We can mark packets that are especially important
• Edit ‐> Mark/Unmark Packet
• CTRL‐ M
• Hit it again to unmark the packet
We can jump from one marked
packet to another
• Edit ‐> Next Mark or
Edit ‐> Previous Mark
• We saw we can also save just marked packets
• File ‐ > Export Specified Packets
65
Q

Wireshark: Statistics

A

Statistics Menu
• Protocol Hierarchy
• Conversations
• Endpoints

66
Q

Protocol Hierarchy

A

Distribution of traffic by protocol

• See what protocols dominate the traffic (or look for anomalies)

67
Q

Endpoints

A

Each device sending or receiving data on the network is an endpoint
• Correspond to our network addresses
• Endpoints statistics show us all of the endpoints seen in the network traffic capture
• Generally good to look for “big talkers” and “anomaly outliers”

68
Q

Conversations

A

Communication between two endpoints is a conversation.

Conversations statistics show us each conversation in the network traffic capture.

69
Q

Following Streams

A

Almost all data transmitted over a network must be chunked into multiple data units
• One of the greatest weapons in an analyst’s Wireshark toolbox
is the ability to Follow Streams of data
• Wireshark automatically reassembles data into a
consolidated format

70
Q

Four Types of Streams

A

TCP Stream – Reassembles TCP segments for a specific session
• UDP Stream – Reassembles UDP datagrams for a specific session
• SSL Stream – Reassembles data chunks from SSL/TLS encrypted
protocols like HTTPS for a specific TCP session
• HTTP Stream – Reassembles/Decompresses data chunks from
HTTP for a specific TCP session

71
Q

Three Methods for Following Streams

A 
All begin with selecting
a packet of interest whose stream you wish to view
• 1) Right‐Click, Follow ‐> \_\_\_\_\_ Stream
• 2) Analyze ‐> Follow ‐> \_\_\_\_\_ Stream
• 3) Keyboard Shortcuts
72
Q

Export Objects

A

Wireshark provides capability to carve out files from packets
• Files are typically chunked in many separate packets
• Wireshark can reassemble and
export them for you
• File ‐> Export Objects
• Most commonly done for HTTP

73
Q

Network Miner

A

Protocol analyzer GUI tool.
Packet Sniffer.
The real strength of Network Miner is in carving files from packets.

74
Q

CLI

A

Command Line Interface.

tcpdump and TShark.

75
Q

Command Line Flags

A
  • i: specifies the NIC to capture on
  • w: writes to a specified PCAP file
  • r: reads from a specified PCAP file
  • c: limits the number of packets displayed/captured
76
Q

Increasing Verbosity

A

Increase verbosity to see more details per packet.
“-v”, “-vv”, or
“-vvv” in Tcpdump
“-V” in Tshark

77
Q

Command Line: Name Resolution

A

Tcpdump and Tshark attempt to do name
resolution for addresses for us (by default).
Use “-n” in both to turn OFF

78
Q

Tshark: Filters

A

Like Wireshark, TShark allows for two types of filter:
• Capture Filters and Display Filters
• Think Capture Filters used with -i and Display Filters with -r
Use -f to specify a capture filter
Use -Y to specify a display filter

79
Q

Command Line: Filters (For PCAP Downsizing)

A

Take a large PCAP (that would take long to load in GUI) and filter it down to a smaller PCAP
• We achieve this by using BOTH -r and -w with some filter

80
Q

Tshark: Time Display

A

To change that to date/timestamp use “-ad”

81
Q

Tshark: Statistics

A

Use “-z”

Use “-z help” to see all available statistics options

82
Q

Tshark: Conversations

A

Use “-z conv,ip” to display the IPv4 Conversations

83
Q

GUI vs. Command Line

A

Wireshark’s GUI takes a lot of processing power
• Can result in greater % of dropped (lost) packets in a capture!
• Tcpdump and Tshark are better tools for packet sniffing
Very large PCAPs can overwhelm resources in Wireshark
• The entire file must be loaded into RAM (GUI too)
• Just opening a large PCAP can take a long time to fully load!
• Tcpdump and Tshark can be used to filter the large PCAP down into a smaller (new) PCAP of “interesting” packets to analyze in Wireshark (with GUI)

Network Forensics (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions