Classifying Threats Section 4 Flashcards
Name Some Threat Classifications
known threats, malware, documented exploits, unknown threats, 0-day exploits, obfuscated malware code, behavior-based detection (heuristics), recycled threats, known knowns, unknown known, known unknowns, unknown unknowns
Unknown Unknowns
A classification of malware that contains completely new attack vectors and exploits. Things that we don’t know, and we just don’t have any way to know about it yet. We must experiment more and more, and we have to do a lot more research, and try to figure these things out.
Ex of Unknown Unknowns
if there is a zero-day, we’ve never seen it before, and it’s doing something that we never thought was malicious behavior, this is an unknown unknown. Eventually we might find out ‘that thing they’re doing’ when you put them together, that’s a bad thing. Then it becomes a known unknown and if eventually we can get a signature for it, it will become a known known.
Known Unknowns
A classification of malware that contains obfuscation techniques to circumvent signature-matching and detection. We don’t have a matching signature for this and that we can’t predict; we must research it to start reducing the uncertainty we have around this thing.
● We know that it is bad (that’s the known part) but we don’t know any signatures that are related with it, so we don’t have an easy way to block it. This is generally where you’re going to see a lot of behavior-based analysis done.
Unknown Known
▪ Something that is known to other people, but it may be known to you.
Ex of Unknown Known
● EX: There may be a signature out there inside the McAfee FW but there’s not one inside your firewall. So McAfee knows about it and they can stop it but we don’t know about it and we can’t stop it.
Recycled Threats
Refers to the process of combining and modifying parts of existing exploit code to create new threats that are not as easily identified by automated scanning.
● If we take different pieces and parts of different malware code and we put them together we can now bypass the signature-based detection of a known threat because it is now something new that we may be able to get through the system and by the anti-malware scans.
Behavior-based Detection (heuristics)
▪ A malware detection method that evaluates an object based on its intended actions before it can actually execute that behavior.
Ex of Behavior-based Detection (heuristics)
if you send an email with an attachment in it, that attachment may be opened in a sandbox first, evaluated based on its behavior, see if it’s malicious or not and if it isn’t malicious then be sent into my inbox and if it is malicious, it can be sent out and destroyed.
Obfuscated Malware Code
Malicious code whose execution the malware author has attempted to hide through various techniques such as compression, encryption, or encoding to severely limit attempts to statically analyze the malware.
● Scramming or changing the code slightly randomly at different intervals essentially making it unknow. You’re making the signatures inaccurate so it can no longer be detected.
Zero-day Exploits
An unknown exploit in the wild that exposes a vulnerability in software or hardware and can create complicated problems well before anyone realizes something is wrong.
●Something someone found out in the wild to break into something that analysts don’t have a way to protect against.
Unknown threats
A threat that cannot be identified using basic signature or pattern. Much more dangerous for analyst.
Ex of unknown threats:
Zero-day exploits, obfuscated malware code, behavior-based detection, recycled threats, known unknowns and unknown unknowns.
Documented Exploits
A piece of software, data or sequence of commands that takes advantage of a vulnerability to cause unintended behavior or to gain unauthorized access to sensitive data.
Ex of Documented Exploits
Static threats that are easily detected using signatures or hash values.
Malware
Any software intentionally designed to cause damage to a computer, server, client, or computer network.
● Viruses, rootkits, trojans and botnets.
Name some activities hackers perform
Social media profiling, social engineering, network scanning, fingerprinting, service discovery and packet capture.
What is fingerprinting and service discovery used for
to identify vulnerable services that they can exploit and attack.
Name the 8 main types of threat actors
Script kiddies, insider threats, competitor, organized crime, hacktivist, nation-state, APT, Supply chain threats
Script kiddie
Someone who has the least amount skill when it comes to being an attacker. They use other people’s tools as they don’t have the skill to make their own and they often don’t understand what they are doing and what kind of damage they may cause.
Insider threat
People who have authorized access to an organization’s network, policies, procedures, and business practices. This can be an employee or a former employee who has knowledge of the organization’s network, policies, procedures, and business practices.
What are they two types of insider threats? Describe each
Skilled: someone who is able to elevate their own user account permissions so they can now access data from across the entire network as a sys admin and then try to grab everything they can and sell it to a willing buyer.
Unskilled: may try to copy the org’s files onto a thumb drive and walk out the front door with them. Even though they were authorized to access those files, they may not have been authorized to remove them from the network or post them online and this results in some kind of data breach.
What enforcement technologies should organizations have in place to defend against insider threats
DLP, SIEM search (systems need to be properly configured to search through the SIEM to ID patterns of abuse in order to catch the malicious insider.)
it is important to have a solid cybersecurity strategy to counter Insider Threats including:
● Employee Education and Training
● Access Controls
● Incident Response Plans – helps to quickly detect, contain and deal with any kind of insider threat you may encounter.
● Regular Monitoring to detect unusual behavior
competitor
● A rogue business attempting to conduct cyber espionage against an organization. They are focused on stealing your proprietary data, disrupting your business, or damaging your reputation.
Often competitors will..
seek to use an employee as an insider threat in your organization to steal the data from you or they may try to break into your network via the internet.
Organized crime
● Focused on hacking and computer fraud to achieve financial gains. Organized crime gangs often run different schemes of scams using social engineering or conducting more technical attacks using ransomware to steal money from their victims.
T or F
Organized crime is typically well-funded and they use sophisticated attacks and tools
T
Hacktivist
● Politically-motivated hacker who targets governments or individuals to advance their political ideologies.
Nation State actors have..
with exceptional capability, funding, and organization with an intent to hack a network or system. They do not pick a network at random to attack but instead, they determine specific targets to achieve their political motives.
Not all ____ are ________ but almost all _______ are going to be considered ____
● Not all APT are nation-states, but almost all nation-states are going to be considered an APT.
How long are Nation States or an APT inside of a victimized network before defenders discover an intrusion?
At least 6-9 months but they can go longer.
Many nation-states tried to present themselves as…
a threat actor inside of the other groups, so they can maintain a plausible deniability. Often times, a Nation State might use the TTPs of a different Nation State as well in order to implicate them inside of an attack; this is called a false flag attack
A nation-state actor refers to a…
government or government affiliated group that conducts cyber-attacks.
Advanced persistent threat (APT)
●An attacker that establishes a long-term presence on a network in order to gather sensitive information
What is the main goal of an APT
to harvest sensitive data, intellectual property, and other sensitive information
What is the key difference between a Nation State and APT
▪Nation-state is affiliated with the government.
▪APT is a generic type of cyber-attack that establishes long-term presence on a network to gather sensitive information.
