Chapter 6 Analyzing Symptoms for Incident Response Flashcards
Tool developed to monitor LANs and operates at layers 1- 4 of the network stack
Operates a client-server model and uses monitoring devices (probes) to gather data
RMON
Gathers data about availability, routes, packets delay or loss, and bandwidth
Active monitoring
A tool that measures the maximum bandwidth that an IP network can handle
iPerf
- Relies on capturing information about the network as traffic passes a location on a network link
- ie network monitoring device connects to a span port on a switch meaning a copy of all traffic on the network is sent to this network monitoring device
Passive monitoring
Tool that combines four types of monitoring to provide a more accurate picture of bandwidth utilization
PRTG
What types of monitoring is utilized by PRTG ?
- Packet Sniffing
- Flows
- SNMP
- WMI
- Only monitors the headers of packets this is to determine what type of traffic is being sent
- An encrypted session may not reveal much
Packet Sniffing
Data that is sent with information about all connections or sample dataset
Flows
A protocol that allows network devices to send information about important events
SNMP
Provides an interface that allows script and application access for automation of administrative tasks, as well as a means of assessing management data for the operating system, and can provide reports to tools like system center operations manager for window systems
WMI
An open source tool that uses SNMP polling to poll network devices for status information and provides graphical views of network and device status
Cacti
- Activity sent to a control and command system as part of a botnet or malware remote control system and is typically sent as either HTTP or HTTPS
- Can request commands, provide status, download additional malware, or perform other actions.
Beaconing activity
Attacks that come from many systems or networks at the same time
Distributed denial-of-service (DDOS)
- Program doesn’t release memory after it no longer needs it
- Over time the application will consume more and more memory until the application fails or the OS runs out of available memory
Memory leaks
Provides an easy visibility into the CPU, memory, disc, and network utilization for a system
Resource monitor
Provides much more detailed information, with counters ranging from energy usage to disk and network activity
Performance monitor
- Provides information about CPU and memory utilization, the time that the process was started, and how long it has run, as well as the command that started each process
- Linux command
ps
- Provides CPU utilization under CPU stats and also shows memory usage as well as other details about processes
- Linux command
top
- Displays a report of the system’s disk usage, with various flags providing additional details or formatting
- Linux command
df
- Shows which accounts are logged in
- May be useful when determining who may be running a process
- Linux command
w
- Can validate the access that a specific user or group has to objects like files, registry keys, and services
- Part of Sysinternals
AccessChk
Command used to check services on a Linux system
Service command
- Activity that does not match the applications typical behavior, is often the first indicator of an attack or compromise
- Log analysis, behavior baselines and file integrity checking can all help detect this behavior
Anomalous activity
This particularly with administrative rights is often a sign of a compromise
New accounts
- Can take many forms, from improper output or garbled data to errors and other signs have an underlying application issue
- Server-based applications that provide file or API output
Unexpected Behavior
Examples include beaconing, and outbound file transfers
Unexpected outbound communication
Can indicate a simple application problem that requires a service or server restart that can also indicate a security issue like a DDOS attack or a compromised application
Service interruption
- May result in operating system errors in crashes making a crash dump reporting important
- Logging reboots and service restart can help but may not detect a properly executed attacks
Memory overflows
