Final Exam Flashcards
(50 cards)
1
Q
NetFlow
A
NetFlow is statistical data about traffic flows on network
• Think of a flow as a unique TCP/UDP session
• We clump the packets together!
• It disregards packet data/payload
• Focuses in on the headers (metadata)
2
Q
NetFlow Pros
A
- Takes up less storage space
- Cheaper to implement on network devices (routers)
- Encrypted traffic looks same as normal traffic
3
Q
NetFlow Cons
A
- Harder to analyze/less informative without packet content
- Creates additional network traffic
- Infrastructure must be set up BEFORE incident
4
Q
NetFlow Architecture
A
- NetFlow Sensors – Generates NetFlow data
- NetFlow Collector – Collects NetFlow from multiple sensors
- Storage – Database storage for collected NetFlow
- Analysis Console – User interface to query/export NetFlow
5
Q
NetFlow Analysis
A
- Top talking IP addresses (foreign?) and ports (weird?)
- Traffic spikes (malware C2 or data exfiltration?)
- Anomalous behavior (compared to the “norm”)
6
Q
Logs vs. PCAPs & NetFlow
A
- With PCAPs and NetFlow we get insight into all the traffic
- PCAPs = content, NetFlow = no content
- Logs only record certain events from the traffic that are “meaningful” to that specific log source
7
Q
Log Sources
A
Some of the most common sources of log files: • Network Devices • Network Services • Hosts • Security Appliances (IDS/Firewall) • Web Proxies • VPN Concentrators
8
Q
Network Device Logs
A
- Routers – Admin Interface/Built-in Firewall
* Switches – Admin Interface/CAM Table Mappings (Mac to Switch Ports)
9
Q
Network Service Logs
A
- DNS Server – DNS Requests/Responses
* DHCP Server – DHCP DORA Requests/Responses
10
Q
Windows Event Logs
A
• End hosts (clients and servers) will have their own operating system specific logs.
• All systems running Windows OS have Windows Event Logs.
• We need specialized tools to parse and
analyze these files
• Windows has one built in: Event Viewer
11
Q
Windows Log Types
A
• Two categories of Event Logs: Windows and Applications/Services.
12
Q
Windows Logs (Big 3)
A
- Application.evtx – Any event logged by running applications
- System.evtx – Any event logged by Operating System
- Security.evtx – Any event related to the security of the system
13
Q
Applications/Services Logs
A
• There are many!
• DHCP, Internet Explorer, PowerShell, TaskScheduler,
TerminalServices (RDP), WMI, Windows Defender,
Windows Firewall, Winlogon
14
Q
Security Logon Events: Event ID 4624
A
- These events are logged in Security.evtx
- Event ID 4624 – “An account was successfully logged on”
- Type 2 – Local Keyboard Logon
- Type 3 – Network Logon (= remote)
- Type 7 – Unlock (can sometimes be remote)
- Type 10 – RemoteInteractive (RDP = remote)
- These events give us a “Source Network Address”
15
Q
Security Logon Events: Event ID 4625
A
• Event ID 4625 – “An account failed to log on”
• Includes Failure Reason (Account locked? Bad
username/password?)
• Does NOT include IP address of the attempt
16
Q
TerminalServices Logon Events
A
• These events are located in Microsoft-WindowsTerminalServices-LocalSessionManager%4Operational.evtx
• Event ID 21 – “Remote Desktop Services: Session Logon
Succeeded”
• Event ID 25 – “Remote Desktop Services: Session
reconnection suceeded”
• Both include a source network address as well
17
Q
Firewalls
A
- A type of security appliance that monitors and controls incoming and outgoing network traffic based on rules
- These rules are Access Control Lists (ACLs)
- A Firewall is only concerned with blocking/filtering traffic based on ACLs
- NOT looking for malicious traffic necessarily
18
Q
Firewalls: Host & Network
A
- Host or Network
- Host – Monitors traffic to/from a single host endpoint
- Running on our clients and servers themselves
- Network – Monitors traffic to/from a network chokepoint
- Think the ones we have been drawing in network diagrams
19
Q
Firewalls: Software & Hardware
A
- Software – Software running on system
* Hardware – Hardware appliance
20
Q
Stateless Firewalls
A
- Stateless Firewalls block packets based on static header values
- Monitors individual packets
- Source/destination addresses and ports
21
Q
Stateful Firewalls
A
- Stateful Firewalls can monitor streams of traffic
- Monitors the requests and responses
- Allows traffic that is part of an already established stream
22
Q
IDS
A
An Intrusion Detection System (IDS) is a network security appliance that can detect, log, and alert malicious traffic
• Passively listens on the network and compares traffic against its signatures or heuristics
23
Q
IPS
A
An Intrusion Prevention System (IPS) includes an ability to block or mitigate the malicious traffic threat
• Actively placed inline on the network so it can prevent the traffic from being delivered
24
Q
Network IDS
A
- Network IDS (NIDS) are placed at strategic point(s) within a network to monitor network traffic for signs of intrusion
- Examines the packets
- Online NIDS – examines real-time network traffic
- Offline NIDS – examines stored PCAP
25
Host IDS
```
Host IDS (HIDS) run on an individual host and monitors that specific host for signs of intrusion
• Examines modifications to host files
```
26
IDS Detection Styles: Signature-Based
• Detection based on known signatures of malicious traffic
• Signatures can be known domains/addresses/ports,
byte sequences, or attack patterns
• Signatures released by vendor, security community, or yourself
• Indicators of Compromise (IOCs)
• Shortcoming: Detection of Zero-Day threats
27
IDS Detection Styles: Anomaly-Based (Heuristic)
* Detection based on machine learning from a baseline of normal network activity
* Shortcoming: False Positives
28
Snort vs. Bro
* Snort/Suricata are signature-based IDS
* Based on known indicators of compromise (IOCs)
* Updating signatures all the time!
* Bro is better for anomaly-based IDS
* But is also signature-based
29
Snort
* Snort is one of the main players in the NIDS game
* A strength of Snort is it is highly configurable to the needs of the specific network
* Snort uses rules!
30
Snort Preprocessors
* Help Snort to interpret the packets meaningfully
* Provides ability to examine multiple packets
* Think of these as equivalent to Wireshark dissectors
31
Snort Configuration File
* Allows us to tweak Snort to our exact needs
| * More is not better!
32
About Snort Rules
* Defines IOCs regarding a particular threat or attack on a vulnerability that trigger an alert when those conditions are met in the traffic
* IOCs from headers OR data in packets
* Those alerts are logged…that’s what is of use to us!
* The rules are mostly created by the security community
33
Suricata
Suricata is similar to Snort as it's signature/rule based
• Alert when the conditions of an alert are triggered
• Multi-threaded initially gave it better execution than Snort (but now Snort is too).
• Smaller community updating it.
34
Bro
* Whereas Snort/Suricata are rule driven, Bro is event driven
* Bro converts a series of network traffic into an event
* Events can be used to learn/record detailed network behavior for Anomaly-Based detection
35
Bro Scripting Language
* Bro includes its own scripting language
* A full fledged programming language
* Can execute scripts in response to malicious/anomalous events (IPS)
36
Bro Frameworks
* Bro also has frameworks
* Can do signature matching like Snort rules
* Can perform logging/alerting
37
Forensic Importance of IDS Logs
• All of these IDSs can create logs of alerts
We can use these logs to steer our investigation
• Helps us locate evidence in PCAPs, NetFlow, and other Logs
• Give us IOCs to investigate such as IPs and Domains
• They also help security staff discover and repair
vulnerabilities faster
38
Tripwire and OSSEC
Tripwire and OSSEC are host-based IDS
• The others we have discussed were network-based
• They monitor and alert on changes to files on the host by comparing hashes
• These IDSs monitor the results of malicious traffic
• The goal of malicious network traffic is to “do something” on the end system – which means “changing things”
39
Proxies
* A proxy is a system that acts on behalf of another system
* A common type is a Web Proxy
* A client sends all their web requests to the proxy and it sends the requests as though it is the original requester and forwards responses back to the real requester
40
VPN Concentrators
* VPN = Virtual Private Network
* VPN Concentrators are secure network proxies
* All client traffic is routed through the VPN to mask the original source
* All transmission is encrypted
* VPN Concentrators can also create logs
41
Log Aggregation
* Process of collecting multiple log sources in a single centralized log server
* Automatically pull together all these different sources so a human doesn’t have to do it manually.
42
Windows Event Forwarding
Event Viewer includes a feature called Subscriptions
• Used to forward events from a local system to a collector
• Can use a filter to only forward certain events
• Those events get stored in the Forwarded Events log
43
SPLUNK Short List
```
Used for Log Aggregation.
• Commercial
• “Google for Logs”
• Splunk Forwarders
• Splunk Querying Language
• Splunk Web UI
```
44
ELK Stack Short List
```
Used for Log Aggregation.
• Free, Open-Source
• Log Analytics/Visualization
• Logstash Collectors
• Elasticsearch Querying
• Kibana user GUI
```
45
SPLUNK
• Often called the “Google of Logs” because of its
great querying ability.
• Splunk has been the dominate player in log aggregation.
• Splunk consists of Forwarders to forward their logs/data to Indexers who store and index them in a database that the analyst can query against using the Splunk web user interface
46
ELK Stack
* ELK, also known as Elastic Stack, is another option for log aggregation and querying
* Made up of three open source tools:
* Elasticsearch (search and analyze)
* Logstash (collect and transform)
* Kibana (visualize and manage)
47
Log Correlation
• Log Correlation is the process of creating a timeline of
relevant events to an incident/investigation from multiple evidence sources
• Not just logs…can be Artifact Correlation
• Goal is to tell a chronological story of the incident
48
Plaso
* Plaso is a collection of Python scripts that provide a tool to parse various logs and forensic artifacts to automatically produce a single correlated timeline
* Plaso calls this a “Super Timeline”
* It consists of events from multiple sources all sorted chronologically
* Helps an analyst see events that occurred near each other in time
49
Log2Timeline
* Log2Timeline is the command line tool used in Plaso
* Run at the command line
* Usage is typically simple: just give it a timezone, input, and output timeline.
* Inputs can be specific logs and artifacts that it can parse or an image
* Output can be appended to an existing timeline
50
Super Timeline
• The Super Timeline can be chronologically sorted and give insight into actions of multiple artifacts at the same time
