In this chapter, we're going to cover the various tools and detection methodologies to analyze malicious
activity on your network.
We're going to talk about network scanners, the DNS URL identification tools, strings and of course
hashing utilities.
We're going to demonstrate some different tools and show you how to actually use those tools to run
tests on your own systems or networks to better prepare you for the Cisa exam.
In this episode, we're going to talk about packet captures and how to utilize them to identify different
malware or malicious activity on your network.
Specifically, we're going to use a tool called Wireshark to go through those specific packet captures
and identify the process to look at those different malicious activities that could be utilized by an
attacker on your own network.
While the book covers Tshark as well as Berkeley, we're not going to cover this in this episode as
they're not part of the Cisa requirements.
And honestly, they're kind of outdated.
We really don't use them that often.
Packet capture is the idea of taking information that's crossing through your network and collecting
that information in such a way that it logs everything.
We can see different ports where it's going from from IP address to IP address, and we can look at
it from the reverse perspective.
So not only can you see the packet of information going away from your computer system, you can see
everything coming into it.
You can also view other information across the network depending on where you have your sniffer put
into place.
That means I can sniff information at a switch and see the different aspects of traffic going both from
the switch and away from the switch.
If I have it set up correctly, we call this packet analysis, where we can go through and look at the
different packets of information and trace not only the information that's going from and to it and
from the device, but also the information that's passing through it.
In the next chapter, we're actually going to go through Wireshark and show you how to set up Wireshark.
So it's easier to read and how to identify the different information tidbits that you need to be aware
of to properly read the tool.
Now, obviously we can't go through Wireshark and take 20 hours to go through every single aspect of
it, but our hope is to give you a high level overview of it so that you can identify the basic principles
of how Wireshark functions in order to pass the Cisa exam.
Wireshark is a packet capture and analysis tool.
It allows you to view and capture data as it's moving throughout the network, so that you can actually
view it and see what's going on.
Now, we talked about some of the basic principles of how you can identify IP addresses and where it's
going to, as well as where it's going from, but you can identify as well malware signatures if you
have it set up properly.
You can also look at protocol analysis means you can identify what protocol it's using, whether it's
TCP or UDP, FTP or HTTP.
You kind of get the point, but it goes through and actually identifies those different protocols that
allows you to identify where it's coming from and what services it's most likely trying to utilize or
address throughout the traffic patterns.
We can also do a domain name system analysis, which pinpoints the IP address and links it to the name
in which the user input.
For instance, if you put in something like Amazon.com, it will not only show you that the user tried
to go to Amazon.com, but the associated IP address that's linked to it.
This helps you to identify if maybe some DNS poisoning is going on, or some other DNS spoofing technology,
that it would allow you to succinctly identify those processes through malware activity.
We can also identify the payload.
If somebody sends a picture through Wireshark or excuse me, through the network, Wireshark can identify
it and you can actually pull that picture out exactly how the user had processed that, that picture
we can go through and identify different behaviors through the different processes.
We can identify.
If the user went through one website and clicked on another website or a link for that website, we
can identify what the user typed in and the different IP addresses that the user may have visited.
Throughout this episode, we talked briefly about Wireshark and everything that comes in play with it.
We talked about the different features and the tools that you can utilize within Wireshark to make your
life a little bit better as an analyst.
We talked about packet capture and how Wireshark, along with other tools, can capture files called
pcap files.
Wireshark is a phenomenal tool that you're going to use throughout your career.
You should expect to see tidbits of Wireshark captures in your psych exam.
Now, don't worry, they're not going to have you going through at a very deep level that you may need
to take a 40 hour course for, but what you can expect to see is small snippets or packet captures that
have identified through a screenshot exactly what we're looking for.
You should be able to identify whether something is a dictionary attack a brute force attack.
You should be able to identify what IP address the traffic came from, as well as where it's going to
the timestamp associated with it, as well as the other features associated with Wireshark.
Don't worry, we're going to go through those in chapter ten and show you not only how to set that up,
but how to read the Wireshark as well.