CIT Flashcards
ClamAV
Free open-source cross-platform antivirus software
Mainly CLI tool
False Positive (F/P) Causes
Heuristics: AVs evolve and so do viruses
Behavioral Analysis: Legit apps behaving like malicious apps
Machine Learning: Mistakes in training data fed to software
Zero Day
Undiscovered or newly discovered flaw in a program before the vendor can patch it
What are three ways that anti-virus programs discover viruses
String/Byte Signatures
Hash Signatures
Heuristic Detection
Antivirus Bypass Techniques
Packing and Encryption
Fileless Attacks
Code Mutation
Disable AV updates
Stealth Techniques
Internal Firewall
Blocks incoming/outgoing connections to/from the workstation
HIDS/HIPS
Host Based Intrusion Detection System
Host Based Intrusion Prevention System
Detects, protects, and alerts upon malicious activity
Sandbox
Restricted environment used to run suspicious programs and files
EDR
Endpoint Threat Detection and Response
Focuses on detecting and responding to malicious activity on the host
YARA Signature Types
Body-Based Signature: looks for specific sequences
Hash-Based Signature: Looks for identical hashes
YARA Rules
Way of describing a pattern to identify files
Rules written to meet specific conditions
YARA Rule Signature: Max 64 strings
Honeypot
Decoy devices meant to lure attackers
Honeypot Aims
Analysis: analyze attacker’s movements and gain insight
Collection: Collect forensic data needed to improve security
Honeytokens
Fake IT resources designed to draw the attacker’s attention.
Typically found in public areas
Canary Traps
Used to identify internal data leakers. Changes documents slightly and that is traced.
MHN
Modern Honey Network
Open-source platform for honeypot management
Collects and analyzed honeypot data
Regex
Regular Expressions
Method used to describe a specific pattern of characters
DLP
Data Loss Prevention
OpenDLP
Free open-source server
Able to concurrently scan thousands of OSs
DLP Bypass Techniques
Encoding, Ciphering, and Steganography
DNS Record
Stores info about every site on the web
DNS records tell DNS servers which domain is associated with which IP
Mail Protocols
SMTP (25): Outgoing mail
POP3 (110): Push mail
IMAP (143): Keep mail on server
Email Spoofing
Forging email headers to fool recipients into trusting the message
DNS Spoofing
Creating fake DNS records to redirect traffic to a malicious website
SPF
Sender Policy Framework
Email authentication protocol
Store info about which IPs can send emails from a domain
Doesn’t work when forwarding emails
DKIM
DomainKey Identified Mail
Email validation
Preformed on server level
Uses digital signatures
DMARC
Domain-Based Message Authentication, Reporting, and Conformance
Fails DMARC check: Monitor, Quarantine, Reject
Can generate a report about outgoing emails
MTA
Mail Transfer Agent
Application side
Forwards
MDA
Mail Delivery Agent
Sorting and delivery
SIEM
Security Information and Event Management
Detect security incidents early
SIEM Workflow
Collection, Parsing, Evaluation, Correlation, Inspection
Snort
Open-source IDS/IPS system
Can preform real time network traffic analysis
Splunk
Search Header: Interface used to search and access data
Indexers: Log parsers
Small Components: Collect data to be sent to Splunk
Pipe & Search
Advanced Syntax Queries
Pipe forms a chain of commands
Search is used with Pipe to filter the output
AS & BY
Advanced Syntax Queries
AS renames a column
BY groups by field
Alert Flow
Log Inspection
Rule Definition
Rule Testing
Fine Tuning
Production
Aggregation Alerts
Consolidate logs with identical content
Detects attacks like brute-force and port scanning
Correlation Alerts
Alerts from different events correlated to single event
Indicate similar suspicious behavior among various system products
SOAR
Security Orchestration Automation Response
Designed to reduce need for human intervention
SOAR Features
Security Incident Response: Tools that respond to security-related incidents
Security Operation Automation: Repetitive tasks can be automated
IOT System Components
Edge Components, Smart Gateway, Connectors, Data Processing, User Interface
