Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Network Forensics > Final Exam > Flashcards

Final Exam Flashcards

1
Q

NetFlow

A

NetFlow is statistical data about traffic flows on network
• Think of a flow as a unique TCP/UDP session
• We clump the packets together!
• It disregards packet data/payload
• Focuses in on the headers (metadata)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

NetFlow Pros

A
  • Takes up less storage space
  • Cheaper to implement on network devices (routers)
  • Encrypted traffic looks same as normal traffic
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

NetFlow Cons

A
  • Harder to analyze/less informative without packet content
  • Creates additional network traffic
  • Infrastructure must be set up BEFORE incident
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

NetFlow Architecture

A
  • NetFlow Sensors – Generates NetFlow data
  • NetFlow Collector – Collects NetFlow from multiple sensors
  • Storage – Database storage for collected NetFlow
  • Analysis Console – User interface to query/export NetFlow
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

NetFlow Analysis

A
  • Top talking IP addresses (foreign?) and ports (weird?)
  • Traffic spikes (malware C2 or data exfiltration?)
  • Anomalous behavior (compared to the “norm”)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Logs vs. PCAPs & NetFlow

A
  • With PCAPs and NetFlow we get insight into all the traffic
  • PCAPs = content, NetFlow = no content
  • Logs only record certain events from the traffic that are “meaningful” to that specific log source
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Log Sources

A 
Some of the most common sources of log files:
• Network Devices
• Network Services
• Hosts
• Security Appliances (IDS/Firewall)
• Web Proxies
• VPN Concentrators
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Network Device Logs

A
  • Routers – Admin Interface/Built-in Firewall

* Switches – Admin Interface/CAM Table Mappings (Mac to Switch Ports)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Network Service Logs

A
  • DNS Server – DNS Requests/Responses

* DHCP Server – DHCP DORA Requests/Responses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Windows Event Logs

A

• End hosts (clients and servers) will have their own operating system specific logs.
• All systems running Windows OS have Windows Event Logs.
• We need specialized tools to parse and
analyze these files
• Windows has one built in: Event Viewer

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Windows Log Types

A

• Two categories of Event Logs: Windows and Applications/Services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Windows Logs (Big 3)

A
  • Application.evtx – Any event logged by running applications
  • System.evtx – Any event logged by Operating System
  • Security.evtx – Any event related to the security of the system
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Applications/Services Logs

A

• There are many!
• DHCP, Internet Explorer, PowerShell, TaskScheduler,
TerminalServices (RDP), WMI, Windows Defender,
Windows Firewall, Winlogon

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Security Logon Events: Event ID 4624

A
  • These events are logged in Security.evtx
  • Event ID 4624 – “An account was successfully logged on”
  • Type 2 – Local Keyboard Logon
  • Type 3 – Network Logon (= remote)
  • Type 7 – Unlock (can sometimes be remote)
  • Type 10 – RemoteInteractive (RDP = remote)
  • These events give us a “Source Network Address”
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Security Logon Events: Event ID 4625

A

• Event ID 4625 – “An account failed to log on”
• Includes Failure Reason (Account locked? Bad
username/password?)
• Does NOT include IP address of the attempt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

TerminalServices Logon Events

A

• These events are located in Microsoft-WindowsTerminalServices-LocalSessionManager%4Operational.evtx
• Event ID 21 – “Remote Desktop Services: Session Logon
Succeeded”
• Event ID 25 – “Remote Desktop Services: Session
reconnection suceeded”
• Both include a source network address as well

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Firewalls

A
  • A type of security appliance that monitors and controls incoming and outgoing network traffic based on rules
  • These rules are Access Control Lists (ACLs)
  • A Firewall is only concerned with blocking/filtering traffic based on ACLs
  • NOT looking for malicious traffic necessarily
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Firewalls: Host & Network

A
  • Host or Network
  • Host – Monitors traffic to/from a single host endpoint
  • Running on our clients and servers themselves
  • Network – Monitors traffic to/from a network chokepoint
  • Think the ones we have been drawing in network diagrams
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Firewalls: Software & Hardware

A
  • Software – Software running on system

* Hardware – Hardware appliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Stateless Firewalls

A
  • Stateless Firewalls block packets based on static header values
  • Monitors individual packets
  • Source/destination addresses and ports
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Stateful Firewalls

A
  • Stateful Firewalls can monitor streams of traffic
  • Monitors the requests and responses
  • Allows traffic that is part of an already established stream
22
Q

IDS

A

An Intrusion Detection System (IDS) is a network security appliance that can detect, log, and alert malicious traffic
• Passively listens on the network and compares traffic against its signatures or heuristics

23
Q

IPS

A

An Intrusion Prevention System (IPS) includes an ability to block or mitigate the malicious traffic threat
• Actively placed inline on the network so it can prevent the traffic from being delivered

24
Q

Network IDS

A
  • Network IDS (NIDS) are placed at strategic point(s) within a network to monitor network traffic for signs of intrusion
  • Examines the packets
  • Online NIDS – examines real-time network traffic
  • Offline NIDS – examines stored PCAP
25
Q

Host IDS

A 
Host IDS (HIDS) run on an individual host and monitors that specific host for signs of intrusion
• Examines modifications to host files
26
Q

IDS Detection Styles: Signature-Based

A

• Detection based on known signatures of malicious traffic
• Signatures can be known domains/addresses/ports,
byte sequences, or attack patterns
• Signatures released by vendor, security community, or yourself
• Indicators of Compromise (IOCs)
• Shortcoming: Detection of Zero-Day threats

27
Q

IDS Detection Styles: Anomaly-Based (Heuristic)

A
  • Detection based on machine learning from a baseline of normal network activity
  • Shortcoming: False Positives
28
Q

Snort vs. Bro

A
  • Snort/Suricata are signature-based IDS
  • Based on known indicators of compromise (IOCs)
  • Updating signatures all the time!
  • Bro is better for anomaly-based IDS
  • But is also signature-based
29
Q

Snort

A
  • Snort is one of the main players in the NIDS game
  • A strength of Snort is it is highly configurable to the needs of the specific network
  • Snort uses rules!
30
Q

Snort Preprocessors

A
  • Help Snort to interpret the packets meaningfully
  • Provides ability to examine multiple packets
  • Think of these as equivalent to Wireshark dissectors
31
Q

Snort Configuration File

A
  • Allows us to tweak Snort to our exact needs

* More is not better!

32
Q

About Snort Rules

A
  • Defines IOCs regarding a particular threat or attack on a vulnerability that trigger an alert when those conditions are met in the traffic
  • IOCs from headers OR data in packets
  • Those alerts are logged…that’s what is of use to us!
  • The rules are mostly created by the security community
33
Q

Suricata

A

Suricata is similar to Snort as it’s signature/rule based
• Alert when the conditions of an alert are triggered
• Multi-threaded initially gave it better execution than Snort (but now Snort is too).
• Smaller community updating it.

34
Q

Bro

A
  • Whereas Snort/Suricata are rule driven, Bro is event driven
  • Bro converts a series of network traffic into an event
  • Events can be used to learn/record detailed network behavior for Anomaly-Based detection
35
Q

Bro Scripting Language

A
  • Bro includes its own scripting language
  • A full fledged programming language
  • Can execute scripts in response to malicious/anomalous events (IPS)
36
Q

Bro Frameworks

A
  • Bro also has frameworks
  • Can do signature matching like Snort rules
  • Can perform logging/alerting
37
Q

Forensic Importance of IDS Logs

A

• All of these IDSs can create logs of alerts
We can use these logs to steer our investigation
• Helps us locate evidence in PCAPs, NetFlow, and other Logs
• Give us IOCs to investigate such as IPs and Domains
• They also help security staff discover and repair
vulnerabilities faster

38
Q

Tripwire and OSSEC

A

Tripwire and OSSEC are host-based IDS
• The others we have discussed were network-based
• They monitor and alert on changes to files on the host by comparing hashes
• These IDSs monitor the results of malicious traffic
• The goal of malicious network traffic is to “do something” on the end system – which means “changing things”

39
Q

Proxies

A
  • A proxy is a system that acts on behalf of another system
  • A common type is a Web Proxy
  • A client sends all their web requests to the proxy and it sends the requests as though it is the original requester and forwards responses back to the real requester
40
Q

VPN Concentrators

A
  • VPN = Virtual Private Network
  • VPN Concentrators are secure network proxies
  • All client traffic is routed through the VPN to mask the original source
  • All transmission is encrypted
  • VPN Concentrators can also create logs
41
Q

Log Aggregation

A
  • Process of collecting multiple log sources in a single centralized log server
  • Automatically pull together all these different sources so a human doesn’t have to do it manually.
42
Q

Windows Event Forwarding

A

Event Viewer includes a feature called Subscriptions
• Used to forward events from a local system to a collector
• Can use a filter to only forward certain events
• Those events get stored in the Forwarded Events log

43
Q

SPLUNK Short List

A 
Used for Log Aggregation.
• Commercial
• “Google for Logs”
• Splunk Forwarders
• Splunk Querying Language
• Splunk Web UI
44
Q

ELK Stack Short List

A 
Used for Log Aggregation.
• Free, Open-Source
• Log Analytics/Visualization
• Logstash Collectors
• Elasticsearch Querying
• Kibana user GUI
45
Q

SPLUNK

A

• Often called the “Google of Logs” because of its
great querying ability.
• Splunk has been the dominate player in log aggregation.
• Splunk consists of Forwarders to forward their logs/data to Indexers who store and index them in a database that the analyst can query against using the Splunk web user interface

46
Q

ELK Stack

A
  • ELK, also known as Elastic Stack, is another option for log aggregation and querying
  • Made up of three open source tools:
  • Elasticsearch (search and analyze)
  • Logstash (collect and transform)
  • Kibana (visualize and manage)
47
Q

Log Correlation

A

• Log Correlation is the process of creating a timeline of
relevant events to an incident/investigation from multiple evidence sources
• Not just logs…can be Artifact Correlation
• Goal is to tell a chronological story of the incident

48
Q

Plaso

A
  • Plaso is a collection of Python scripts that provide a tool to parse various logs and forensic artifacts to automatically produce a single correlated timeline
  • Plaso calls this a “Super Timeline”
  • It consists of events from multiple sources all sorted chronologically
  • Helps an analyst see events that occurred near each other in time
49
Q

Log2Timeline

A
  • Log2Timeline is the command line tool used in Plaso
  • Run at the command line
  • Usage is typically simple: just give it a timezone, input, and output timeline.
  • Inputs can be specific logs and artifacts that it can parse or an image
  • Output can be appended to an existing timeline
50
Q

Super Timeline

A

• The Super Timeline can be chronologically sorted and give insight into actions of multiple artifacts at the same time

Network Forensics (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions