Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

SANS FOR578 > 578.3 > Flashcards

578.3 Flashcards

1
Q

HEXANE

A

Identified mid-2018 with activity ongoing. Targeting oil and gas in the Middle East. Has links to other groups but is a unique cluster of tradecraft and victimology.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Malware human fingerprints are?

A

Maps to the Capability / TTP vertices of the Diamond Model. Depending on your requirement, can support all four points of the Diamond Model. Human fingerprints include:

  • Header metadata
  • Code reuse
  • Configuration data
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Malware configuration data - common types are:

A 
PE version info
Mutexes
Text Formatting
Method of persistence
Communication details
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Where do you get malware?

A
  • First party data
  • Partners
  • Sharing Groups
  • Commercial datasets
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Common Malware analysis tools

A

VirusTotal
VT Enterprise
DC3 Malware Configuration Parser
malwareconfig.com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What’s the five major points of data pivoting?

A
  • Critical CTI analyst skills
  • Might seem like common sense, but often overlooked
  • Quickly builds knowledge between automic indicators
  • Historically manual, time-intensive
  • New tools help to automate
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the four steps of data pivoting?

A

Start -> Pivot -> Validate -> Identify

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Basic (most pivotable) indicator types

A
  • IP addresses
  • Domains
  • Accounts
  • Unique Strings
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

C2 Domain registration

A
  • Domains can be moved from IP to IP to allow for dynamic adversary infrastructure
  • Typo-squatted domains can fool targeted users
  • Three classes of C2 domains:
    ° Adversary registered
    ° Dynamic DNS domains (free or paid)
    ° Legitimate but compromised
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

DDNS

A

Dynamic DNS Domains

Originally developed for use with dynamic addressing ISPs such as DSL. Have short Time to Live (TTL) to expedite propagation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

ASN

A

Autonomous System Number. Determines organizational ownership of IP addresses.

Lookup tool: asn.cymru.com

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Passive DNS

A

Collection of DNS domain query responses collected passively.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

PDNS Providers

A 
LookingGlass LGScout
Mnemonic
Farsight
RiskIQ / PassiveTotal
Internet Identity
OpenDNS
DomainTools
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Iris

A

Iris is a powerful engine looking for collocations between domains, IPs, registrars, ASNs, emails ,etc.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

GlassRAT

A

Uncovered in November 2015 by RSA. Previously undetected Trojan targeting Chinese nationals. In operation for at least 3 years.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

TIQ

A

Threat Intelligence Quotient.

The TIQ Test can be used to get an idea of the value of existing threat feeds you are using by evaluating the following:

  • Novelty Test
  • Overlap Test
  • Population Test (by country / ASN)
17
Q

CIV

A

Collective Intelligence Framework is a management system for threat data by CSIRTGadgets.org. Integrates with tools such as: Splunk, ELK, Logstash, ArcSight.

18
Q

Additional OSINT Open-Source Tools

A 
DataSploit
Discover
InfoGo
AlienVault OTX (Threat information feed)
Shodan
GCHQ's Cyber Chef
Recorded Future
19
Q

TLS Certificate

A

A digital certificate used in secure host-to-host network communications. Previously referred to as a SSL certificate. Not to be confused with a code signing certificate used to sign applications.

20
Q

TLS Certificate Scan Providers

A

Censys.io
Shodan.io
Circl.lu
RiskIQ

21
Q

TLS Cert Search Tips

A
  • Start with pivoting between TLS certs and IP adr
  • Then search Subject, Issuer, Not Before, and Not After fields
  • Distinguish between self-signed, free, and paid certificates
22
Q

Maltego

A

Maltego is a link analysis tool that allows analysts to establish and define relationship between different nodes. It has two major concepts:

  • Entities
  • Links
23
Q

Malware maps to which pilar of the diamond model?

A

Capability

24
Q

What is “DC3 Malware Configuration Parser” used for?

A

This framework can be used to develop decoding modules for malware families that your adversaries use to target your users.

25
Q

What are the three classes of C2 domains?

A
  • Adversary registered
  • Dynamic DNS domains (free or paid)
  • Legitimate but compromised

SANS FOR578 (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions