Chapter 6 Analyzing Symptoms for Incident Response

Question 1

Tool developed to monitor LANs and operates at layers 1- 4 of the network stack
Operates a client-server model and uses monitoring devices (probes) to gather data

Answer 1

RMON

Question 2

Gathers data about availability, routes, packets delay or loss, and bandwidth

Answer 2

Active monitoring

Question 3

A tool that measures the maximum bandwidth that an IP network can handle

Answer 3

iPerf

Question 4

• Relies on capturing information about the network as traffic passes a location on a network link
• ie network monitoring device connects to a span port on a switch meaning a copy of all traffic on the network is sent to this network monitoring device

Answer 4

Passive monitoring

Question 5

Tool that combines four types of monitoring to provide a more accurate picture of bandwidth utilization

Answer 5

PRTG

Question 6

What types of monitoring is utilized by PRTG ?

Answer 6

1. Packet Sniffing
2. Flows
3. SNMP
4. WMI

Question 7

• Only monitors the headers of packets this is to determine what type of traffic is being sent
• An encrypted session may not reveal much

Answer 7

Packet Sniffing

Question 8

Data that is sent with information about all connections or sample dataset

Answer 8

Flows

Question 9

A protocol that allows network devices to send information about important events

Answer 9

SNMP

Question 10

Provides an interface that allows script and application access for automation of administrative tasks, as well as a means of assessing management data for the operating system, and can provide reports to tools like system center operations manager for window systems

Answer 10

WMI

Question 11

An open source tool that uses SNMP polling to poll network devices for status information and provides graphical views of network and device status

Answer 11

Cacti

Question 12

• Activity sent to a control and command system as part of a botnet or malware remote control system and is typically sent as either HTTP or HTTPS
• Can request commands, provide status, download additional malware, or perform other actions.

Answer 12

Beaconing activity

Question 13

Attacks that come from many systems or networks at the same time

Answer 13

Distributed denial-of-service (DDOS)

Question 14

• Program doesn’t release memory after it no longer needs it
• Over time the application will consume more and more memory until the application fails or the OS runs out of available memory

Answer 14

Memory leaks

Question 15

Provides an easy visibility into the CPU, memory, disc, and network utilization for a system

Answer 15

Resource monitor

Question 16

Provides much more detailed information, with counters ranging from energy usage to disk and network activity

Answer 16

Performance monitor

Question 17

• Provides information about CPU and memory utilization, the time that the process was started, and how long it has run, as well as the command that started each process
• Linux command

Answer 17

ps

Question 18

• Provides CPU utilization under CPU stats and also shows memory usage as well as other details about processes
• Linux command

Answer 18

top

Question 19

• Displays a report of the system’s disk usage, with various flags providing additional details or formatting
• Linux command

Answer 19

df

Question 20

• Shows which accounts are logged in
• May be useful when determining who may be running a process
• Linux command

Answer 20

w

Question 21

• Can validate the access that a specific user or group has to objects like files, registry keys, and services
• Part of Sysinternals

Answer 21

AccessChk

Question 22

Command used to check services on a Linux system

Answer 22

Service command

Question 23

• Activity that does not match the applications typical behavior, is often the first indicator of an attack or compromise
• Log analysis, behavior baselines and file integrity checking can all help detect this behavior

Answer 23

Anomalous activity

Question 24

This particularly with administrative rights is often a sign of a compromise

Answer 24

New accounts

Question 25

• Can take many forms, from improper output or garbled data to errors and other signs have an underlying application issue
• Server-based applications that provide file or API output

Answer 25

Unexpected Behavior

Question 26

Examples include beaconing, and outbound file transfers

Answer 26

Unexpected outbound communication

Question 27

Can indicate a simple application problem that requires a service or server restart that can also indicate a security issue like a DDOS attack or a compromised application

Answer 27

Service interruption

Question 28

• May result in operating system errors in crashes making a crash dump reporting important
• Logging reboots and service restart can help but may not detect a properly executed attacks

Answer 28

Memory overflows