Enterprise Incident Response Flashcards
What percentage of organizations took more than 90 days to detect the intrusion?
64%
What is the median number of days attackers were present on a victim network before detection?
229 days
What is APT?
Advanced Persistent Threat
How do most organizations find out about intrusions?
Third party notifications. In many cases, law enforcement.
What are the steps of incident handling?
Preparation Identification Containment Eradication Recovery Lessons learned
What is the first step of incident response?
Identification of all the systems compromised.
What percentage of compromised systems have malware installed? Implication?
54%
Just because a system doesn’t have malware installed doesn’t mean it isn’t compromised,
What is the difference between remediation and recovery?
Remediation actions are required to be completed in a very short time, often a weekend, and are intended to mitigate the current incident. Recovery is to move the enterprise back to day to day business.
TTP?
Tactics, Techniques, and Procedures
Kill chain?
Aka Attack Progression.
Reconnaissance Weaponization Delivery Compromise/exploit C2 Exfiltration
How is persistence in APT demonstrated?
Maintaining a presence on the network and repeated attempts to gain access to areas where presence is not established.
Why has there been a switch to remotely examining systems rather than imaging?
This has happened because in an Enterprise environment it’s often more important to identify the scope of the intrusion than to preserve every last bit of evidence.
What is rip.pl
RegRipper, an automated HIVE parser for SAM, SECURITY, SYSTEM, SOFTWARE, and NTUSER.DAT HIVES. Also works on restore point registries.
What does pffexport do?
Pffexport accesses PFF (Personal Folder File) and OFF (Offline Folder File) formats.
pffexport options
Page 23, book 1.
Where are compromised images stored on the SIFT workstation?
/cases. Each case should have a separate subdirectory under /cases.
Where are filesystem mount points on the SIFT workstation?
/mnt
How should the SIFT workstation be networked?
SANS recommends it be placed on the air-gapped Host Only network
What is IR?
Incident Response
What are the 6 steps of Incident Response handling?
- Preparation
- Identification
- Containment and Intelligence Gathering
- Remediation
- Recovery
- Follow Up
Where should incident detects come from? Where do they?
They should be found by the security team, but often they’re from a third party, often law enforcement.
What is the first critical step of incident response?
Identifying all the compromised systems.
Why is it critical to identify all compromised systems?
Intruders install malware on 54% of the systems they compromise.
How often is malware installed on a compromised system?
54% of the time.
What is the benefit of intelligence gathering during a compromise?
Learning how the intruders are gaining access to systems may help identify traits of compromised systems. Those traits can be used to identify other compromised systems that hadn’t yet been detected.
What is the difference between remediation and recovery?
Remediation includes the short term actions required to mitigate the current incident. Recovery is the return to day-to-day operations.
What might happen in the follow up stage of IR?
Verification that the mitigation is complete and effective. Possible additional monitoring or scanning.
What is the difference between digital forensics and enterprise forensics?
Digital forensics is the deep dive on specific systems looking at all processes, all timeline activity, all file system analysis. Enterprise forensics takes a broader view typically targeted at identifying systems that might be of interest. Enterprise forensics would look for select processes, specific timeline activity, and specific filesystem artifacts.
What is a vulnerability?
Not well defined on p.40.
What is impact?
Impact is the consequence of exploiting a vulnerability. The damage to confidentiality, integrity, or availability as a result. Often a property of the organization and often difficult to change.
What is a threat?
Not well defined on p.40.
What are the three components of a threat?
Intent, Opportunity, and Capability
What is Intent with regards to threat?
The goal the adversary is trying to accomplish. At a high level, often data theft. Often defined by the industry.
What is Opportunity with regards to a threat?
Timing and knowledge of the target space. Often paired with vulnerability.
What is Capability with regards to a threat?
The ability of adversaries to achieve their goal. Includes skills and resources (financial, human, technical).
What is CND?
p41. Might be Computer Network Defense.
What is TTP?
Tactics, Techniques, and Procedures (p44)
Why might you not block the IP an adversary is known to use?
You can instead monitor activity from the IP and watch for new attack signatures. Using those might enable detecting future attacks even if the adversary changes IPs.
What is the key to security intelligence?
Mapping intent to impact. If the goal is data theft, you probably don’t have to worry about DDoS.
What is “the kill chain”?
The attack progression. p.43.
What are the different types of indicators (of what?)
Atomic, Behavioral Computed
Describe an atomic indicator
Pieces of data, like an IP address, email address, string, FQDN, that indicates adversary activity.
What is a behavioral indicator?
A combination of other indicators that form a profile. These can include other behaviors, like “targets sales force”. Broadly, how does the adversary do their job.
What is a computed indicator?
Computed indicators include hashes and complex IDS signatures.
What are the stages of the kill chain?
- Reconnaissance
- Weaponization
- Delivery
- Compromise / Exploit
- C2
- Exfiltration
Describe the reconnaissance portion of the kill chain.
Recon consists of passive research such as examining web sites, reading PDFs, learning about the organization. Often indistinguishable from normal activity.
Describe the weaponization portion of the kill chain.
The act of placing malicious payload in a delivery vehicle, such as a trojan in a document.
Describe the delivery phase of the kill chain.
Straightforward. The payload is delivered to the target. For example, though email, HTTP, etc.
Describe the compromise or exploit phase of the kill chain.
Either a multi-phase or straightforward attack that might have software, hardware, and/or human components (aka social engineering). This typically provokes the classic incident response. Compromise doesn’t guarantee that C2 is established.
Describe the C2 phase of the kill chain.
Command and Control (C2) is the period following the compromise where the adversary has control over the system. C2 may be established after compromise, but not always. For example, if an adversary inserts malware that isn’t compatible with the system, or if you’ve studied the adversary and have mitigated the attack that would have established C2.
This also includes lateral movement inside the organization, file system enumeration, additional tool dropping.
Describe the exfiltration phase of the kill chain.
Exfiltration is the phase where data is takenby the adversary. This doesn’t include data taken for the purpose of furthering the attack. Such data movement happens during the C2 phase. Exfiltration removes the actual target data.
How is the P in APT manifested?
In two ways: maintaining a presence on the network and making repeated attempts to gain access to areas that are not yet compromised.
Why is it important to reconstruct the entire kill chain?
Failure to reconstruct the entire kill chain may result in detections only at the compromise stage, which leaves the organization continually vulnerable to intrusions.
What is an “Indicator of compromise”?
A combination of boolean expressions that can be used to identify general characteristics of malware. These can be host or network based.
How do you identify indicators of compromise?
Through malware reverse engineering and application footprinting.
What is IOC?
Indicator of Compromise
What is Cybox?
A Mitre project: Cyber Observable eXpression. A standardized schema for the specification, capture, characterization, and communications of events or stateful properties that are observable in the operational domain.
What is STIX?
Structured Threat Information eXpression. Also by Mitre. Community driven effort to define and develop a standardized language t represent structured cyber threat information.
CRITS?
p.51.
YARA?
p51
OpenIOC?
Originally for MANDIANT’s products, now standardized and open sourced.
Describe IOC Editor
Part of OpenIOC, this GUI editor edits XML documents that capture attributes of malicious files, registry changes, memory artifacts, etc. Also supports detailed descriptions of attributes.
Add content on psexec.
.
How has the default “image anything” policy changed?
It’s become more triage oriented, using remote and automated tools to identify indicators of compromise. Once found, those systems can be examined in more depth.
What does a Remote Access Agent do?
Provides a connector to raw disk and memory only.
What does a Remote Analysis Agent do?
Contains code to perform system analysis in addition or instead of a connector to raw disk and memory.
Pros of a Remote Access Agent compared to a Remote Analysis Agent?
Good for targeted analysis, file querying, quick artifact examination, and it’s cheap.
Pros of a Remote Analysis Agent compared to a Remote Access Agent?
Great for targeted or deep analysis, registry, file querying and scanning, quick or deep artifact analysis, and memory analysis.
Cons of Remote Access Agent compared to a Remote Analysis Agent?
Poor for file carving, stream extraction, memory analysis since the data has to traverse the network for local processing.
Cons of Remote Analysis Agent compared to a Remote Access Agent?
Often a resource hog. Usually have to scan when the systems aren’t being utilized. Expensive, and requires a separate controller.
F-Response stuff
p64
What is dc3dd?
?
Does malware have to be present on a system for it to be compromised?
No. Compromise a system and add an account. It’s compromised, but no malware present.
If you have a compromised system that’s malware free, what might you look for?
Unusual OS artifacts that wouldn’t normally be present.
How do you analyze prefetch?
.
How do you analyze shimcache?
.
How do you analyze userassist registry keys?
.
How do you analyze jump lists?
.
What binary is used for command line access in Windows?
cmd.exe
