And our last episode, we talked about the different network systems associated with malware and indicators
of compromise.
We discovered different perspectives on how those network symptoms could be utilized from an analytic
point of view.
In this course we're going to talk about host symptoms.
We're going to dive a little bit more in depth about the different indicators of compromise, and what
you should know in order to prepare yourself for the signs exam associated with both the windows platform
as well as the Linux platform and the overall direction you should take as an analyst in order to perform
well on this exam.
Host related symptoms are specific symptoms that are associated with the host or the client that the
user most likely sees.
Now, that doesn't just say the user as in the administrative assistant or the operations guy.
It's you as the IT person as well.
You need to understand that as an analyst, a lot of those symptoms that we see, we usually delegate
back to the IT world.
But as a cybersecurity professional, you need to be able to identify those as well.
Remember, as a cybersecurity professional, you're supposed to have a background or a foundational
knowledge in it as well.
And so those host related symptoms that we're going to talk about today really play a role in how you
proceed with your career in cybersecurity.
So the different related host systems that you need to be associated with are unauthorized applications.
Now, this seems pretty cut and dry, right?
We're talking about applications that we didn't authorize as a company or an organization that maybe
an employee put on their device.
Usually this is something simple like, I don't know, minesweeper or Solitaire, and we don't really
authorize those applications usually on our company devices, because employees usually play those games
instead of doing their work, and it comes from high that they shouldn't have them.
Now, while those can be nuisance applications that we need to get rid of, there's other applications
that we should be aware of as well.
There's a licensed applications, i.e. something maybe like Adobe Acrobat, where the individual employee
downloaded it and provided that application for them to do their job better.
But it's a licensed copy, but not licensed to the organization.
This could pose legal issues.
It could also pose issues where we have licenses specifically for an organization, but the employee
decided to download their own version.
This could pose problems with both HR where they're coming in and saying, hey, you're using your own
money to buy company assets, which is not a good thing in to start with.
But also we don't know where that software came from.
There's also unlicensed software if we take that same application.
Yet they didn't pay for it.
They got it off some random website.
That application could potentially have unwanted malware or backdoors associated with it.
So it's better just to cut that off all from the start.
And that's why we don't give admin access to a lot of computer users.
So unauthorized applications can include anything from Facebook.
It could be LinkedIn, it could be solitaire, it could even be proprietary software that we utilize
on a day to day basis.
But it didn't come from us.
It came from an outside vendor.
These are all unauthorized applications that you need to be aware of as a cybersecurity professional.
There's also unauthorized processes.
This is usually indicative to malware or to a application that's behaving abnormally, that maybe was
taken advantage of or updated in a way that we didn't authorize.
When we talk about unauthorized processes, these processes play havoc with our internal systems because
they can actually cause the operating system to crash or cause logs within the system.
That's why we sandbox everything before we roll out the software to the general public.
So again, unauthorized processes, usually an indicator of an unauthorized application, but it could
also be an unauthorized application that's been taken advantage of or fraught with malicious activity.
There's unauthorized privileges.
This usually comes into play where a user or an employee has permissions that they shouldn't normally
have.
Usually, this is indicative of an employee that's moving from one position over to a new position,
usually in promotion or even a lateral transfer.
For instance, in our own world with IT or cybersecurity, if I'm a cybersecurity professional and my
job is cybersecurity, but I only work on host devices, but I may transfer it over to the network portion
i.e. routers, firewalls, IPS, IDs, that sort of thing.
I really don't need to have access to those client based machines anymore, and my permissions should
be stripped so they don't have access to those anymore.
However, a lot of times what will end up happening is I get promoted or laterally transferred over
and I maintain those passed permissions and nobody went through and actually sliced those off.
This happens more outside of it than anywhere else.
Uh, maybe they're an administrative assistant that got moved to HR, but they maintained access to
systems and folders and files and even in finances that they don't really need access to anymore.
You may be thinking to yourself, okay, well, what's the big deal?
They can still utilize it.
They're still proficient in it.
But you have to remember, we're not really worried about our employees.
So much I say that with a grain of salt.
But what happens if that account is taken advantage of or actually hacked?
Somebody has unauthorized access to that account.
We've expanded their network of availability within our own organization, which could play havoc with
our systems.
It's better to just give people permissions for what they need.
This is where least privilege comes into play.
Then there's data exfiltration.
This is where data is leaving machine that was unauthorized.
This can take in the form of the network, where somebody is actually uploading information from their
client computer to a third party website, or maybe they're sending it via email.
It could also be on a USB or even an external drive.
These are all problems with a host related symptoms associated with malware on a device, or malicious
activity on a device that we need to be aware of.
As an analyst, you need to be associated and aware of these different layers and understand that the
rules are the rules or the rules.
There are no special permissions when it comes into play.
Unauthorized privileges, processes, applications and data exfiltration are common problems that you
should expect to see as a data analyst or as a cyber analyst within this role.
Host related systems.
On the processes side, we can see here a screenshot of a windows processing system where it identifies
very quickly the different processes associated within the confines of a CPU.
You can identify the different CPUs as well as the network related traffic associated with the host.
Now, oftentimes when it comes to network related traffic, we look at the baseline activity as the
network as a whole.
And we identify indicators of compromise like that.
And we talked about that last course.
But what about a single host machine.
If I've got a single host that has all of a sudden producing five times the amount of traffic that it
normally would, that's a problem.
And that's an indicator of compromise we need to be aware of.
This could also be associated with specific processes or even, uh, client traffic that's being utilized
for data exfiltration.
A lot of the systems that you see here, especially in the process of network or memory are indicative
of a machine going and doing, um, different aspects of its applications and ways that we normally
wouldn't see.
For instance, if I'm an administrative assistant, my memory should not be ticking up to overflow maxims,
right?
I'm just using office and email.
I'm not watching YouTube videos.
I'm not playing the latest video games.
I'm not doing all those things that are going to stress out my system.
And so my memory should be at a baseline level of about 50%.
However, in this you can see where we have extenuating circumstances, where our, um, memory is skyrocketing,
meaning that it's utilizing way more Ram than we should.
And we can also see our CPU is at a minimal level, but starting to see a peak right at the end.
These are all indicators of compromise within a machine.
Does it mean that there's a necessarily a problem?
No.
It could be legitimate traffic where a organization is downloading a new piece of software.
Or maybe they're they're profiling a new software that they want to utilize.
And that's causing the machine to override.
We just need to be aware of it and then embark on an investigation to identify is it legitimate traffic
or is it malicious traffic?
And those come from a host related machine.
In both ways, we can also see the different systems associated with it in a client based atmosphere,
abnormal process behavior, which we've already beaten to death.
That comes into play of where is the process is coming play coming into play, and how does it interact
with other processes on our environment?
There's file system changes.
If we have our file systems suddenly moving around and changing, that's a problem.
We expect to see minor influxes in file system changes where somebody goes in and they're like, oh,
well, this this file name isn't something that I like.
So let's change it to this file name.
Or creating a new file within our desktop system to incorporate new, uh, work or new business features
within our environment.
That's all perfectly normal.
But if we start to see the system 230, system 32 within a windows environment suddenly changing its
file names or adding to it.
Or maybe the size is changing dramatically, either for lesser files or more data.
That could be an issue.
Whenever we look at file system changes on a host machine, we really need to concentrate on the fact
of, is this legitimate traffic?
Because 90% of the time it's not not within a file system structure.
And so if we start to see changes within our file system, we need to lock that down fairly quickly
and maybe even have a knee jerk reaction associated with it.
There's registry changes as well.
If we see a registry being changed again, there could be a legitimate purpose for it.
But more often than not, our average everyday user is not going to have that capability.
And so if we see a registry change, we want to lock the system down because that is an indicator of
compromise.
There's unauthorized scheduled chats, usually within a windows environment.
We schedule the task to take place.
We are updating the machines, usually during the maintenance window, if we see unauthorized scheduled
tasks where something comes into play and it's unauthorized, or a task comes into play, say at 10:00
10 p.m. rather than 2 a.m. that could be an indicator of compromise.
The same thing if it happens at 8 a.m. in the morning and our maintenance window is, say, 10 p.m.
to 6 a.m., that could be an indicator of compromise.
Well, it doesn't necessarily mean there's a malicious activity going on.
It could develop towards a trend.
And that one, uh, point could be indicative of a problem within the overarching system.
So we just need to be able to keep an eye on it.
And if we see these changes all taking place simultaneously, that's a big indicator of compromise that
we need to really investigate as soon as possible.
Throughout this course, we talked about the different host related systems and how it interplays with
the networking.
We identified how those hosts and those symptoms that we we utilize an indicator of compromise atmosphere.
We also looked at how the systems as a whole really played with malicious activity, and what we should
keep an eye on.
You have to remember, just like networking, hosts are no different, and sometimes there's traffic
that's legitimate and sometimes there's traffic that obviously is unauthorized.
The important part of an analyst is to understand what permissions does each user have and what's the
normal within that atmosphere.
Obviously, if a normal system behaviour is to change file systems on a regular basis, that's not really
an indicator of compromise.
But if I have a laptop that hasn't been changed in three years and all of a sudden it's doing massive
updates that we're unaware of, that's a big indicator of compromise.
It really comes at a common sense versus technical skill, and that's really where your part comes into
play as an analyst.
You need to be able to mix that common sense theoretical understanding with the technical perspective
of what you're seeing.
Cisa is no different.
You're going to expect exam questions such as, hey, you identified your CPU or memory being high.
What are the next steps?
Should you a investigate?
B lock it down.
C ignore it.
You kind of get the point.
Those different types of test questions you need to be familiar with, and be able to quickly identify
what direction you should be able to go.
Usually those questions are scenario based, and so just take the scenario from a common sense perspective
and you should be fine.