Host-based Analysis and Network Intrusion Analysis Flashcards
What is a process made up of?
A process is made up of one or more threads
What is a thread?
the basic units an operating system allocates process time to
What is a Job Object?
Processes grouped together and managed as a unit
A thread pool ?
a group of worker threads that efficiently
execute asynchronous callbacks for the application
What is a Fiber?
is unit of execution that is manually scheduled by an application
What is CreateProcessWithTokenW function?
Using tokens to specify the current security context for a process by Windows.
Static memory allocation?
is when a program allocates memory at compile time
Dynamic memory allocation?
is when a program allocates memory at runtime
A heap
is memory set aside for dynamic allocation.
A stack ?
is the memory set aside as spare space for a thread of execution
A virtual address space?
is the virtual memory used by processes.
A virtual address ?
is a reference to the physical location of an object in memory
HKEY_CLASSES_ROOT (HKCR): ?
HKCR information ensures that the correct program
opens when it is executed in Windows Explorer. HKCR also contains further details on
drag-and-drop rules, shortcuts, and information on the user interface. The reference location is HKLM\Software\Classes.
HKEY_CURRENT_CONFIG (HCU): ?
HCU stores information about the system’s current
configuration. The reference for HCU is HKLM\Config\profile.
HKEY_LOCAL_MACHINE (HKLM): ?
HKLM contains machine hardware-specific information that the operating system runs on. This includes a list of drives mounted on the
system and generic configurations of installed hardware and applications. HKLM is a hive
that isn’t referenced from within another hive.
HKEY_USERS (HKU): ?
HKU contains configuration information of all user profiles on
the system. This includes application configurations and visual settings. HKU is a hive
that isn’t referenced from within another hive.
What are some of the Registry functions?
Some functions of the registry are to load device drivers, run startup programs, set environment variables, and store user settings and operating system parameters.
What is WMI ?
is a scalable system management infrastructure built around a single, consistent, standards-based, extensible, object-oriented interface.
How does WMI get the data?
pulled in with scripting or tools because WMI by itself doesn’t show data.
A handle ?
A handle is an abstract reference value to a resource.
A handle leak ?
A handle leak can occur if a handle is not released after being used.
How Windows administrators can manage services?
using the Services snap-in, Sc.exe, or
Windows PowerShell.
What is A log parser ?
A log parser is a tool that provides universal query access to text-based data such
as event logs, the registry, the file system, XML files, CVE files, and so on.
types of processes can run in UNIX?
■ Child process ■ Init process ■ Orphan process ■ Zombie process ■ Daemon process
What are the two methods for starting a process ?
starting it in the foreground and starting it in
the background.
An orphan process results when ?
when a parent process is terminated and the child process is permitted to continue on its own.
A zombie process ?
is a process that releases its associated memory and resources but remains in the entry table .
What are the common Security Event Artifacts?
IP Addresses Hostnames and Domain Names URI / URL Client and Server Port Identity Process (File or Registry) System API Calls Hashes
What are common evasion techniques against traditional IDS and IPS ?
■ Fragmentation: ■ Using low-bandwidth attacks: ■ Address spoofing/proxying: ■ Pattern change evasion: ■ Encryption:
what is a regular expression (sometimes referred to as “regex”) ?
is a text string for describing a search pattern.
What is regex used for ?
To create intrusion detection signatures and search patterns.
What does the regular expression ^o do in
cyberOps$ ls -1 | grep ^o ?
list all files that start with the letter o
Using regex display any transactions of the host with IP address 192.168.78.8 that took place at 15:46:15.
in a log file.
cat packets.txt | grep ^15:46:15.*78.8
What are the benefits of Protocol header analysis ?
- better detection of both known and unknown attacks. by alerting and blocking traffic on anomalies within the
protocol transactions - more difficult for threat actors to evade.
What is an advantage for using Packet Captures for Intrusion Analysis?
- used for security event research and analysis.
- confirm false positives and true positives.
- to follow a TCP stream and see all the packets in that stream or session
