IC/TH Flashcards
Results
THREAT HUNTING DEFINITION
PROACTIVE SEARCH FOR MALICIOUS ACTIVITY THAT HAS EVADED YOUR STATIC DEFENSEs IN PLACE Ex,,,, IDS, IPS, FIREWALLS
THREAT HUNTING GOAL
PREVENT ADVERSARY FROM CONDUCTING INTENDED AO / DEVELOP NOVEL WAYS OF DETECTION / AUTOMATION, YOU CAN ALSO LEARN YOUR ENVIRONMENT
WHAT IS LOCKMARTIN KILL CYCLE
RWD-EIC-AO
RECONNAISSANCE, WEAPONIZATION, DELIVERY, EXPLOITATION, INSTALLATION, COMMAND AND CONTROL, ACTIONS AND OBJECTIVES
RECONNAISSANCE
STEP 1 , HARVEST EMAIL ADDRESSES & CONFERENCE INFO ETC
WEAPONIZATION
STEP 2, CREATING FAKE EMAILS, SOCIAL ENGINEERING
DELIVERY
STEP 3, DELIVER WEAPONIZED BUNDLE TO THE VICTIM VIA EMAIL, USB , WEB , ETC
EXPLOITATION
STEP 4, EXPLOITING A VULNERABILITY TO EXECUTE CODE, SOCIAL ENGINEERING, OR VULNERABILITY IN SYSTEM
INSTALLATION
STEP 5, INSTALLING MALWARE ON ASSETS, GETTING ACCESS TO PASSWORDS,
COMMAND AND CONTROL
STEP 6, PERSISTENT ACCESS TO NETWORK /REMOTE MANIPULATION, MOVING LATERALLY/ HANDS ON KEYBOARD
ACTIONS OR OBJECTIVES
STEP 7 , WITH HANDS ON KEYBOARD ACCESS INTRUDERS ACCOMPLISH ORIGINAL GOALS
WHAT THREAT HUNTING REALLY
ISOLATING LONG INFORMATION AND ANALYZING / MANUAL PROCESS DONE BY PEOPLE
WHERE WAS THREAT HUNTING DONE PREVIOUSLY
ENDPOINTS
SPLUNK THREAT HUNTING
SPLUNK IS AN ANALYTICS SIEM PLATFORM USED FOR IMPORTING AND ANALYZING DATA FROM NETWORK INFRASTRUCTURE LOGS
THREAT HUNTING IN EXCEL
COMPILING DATA/ COUNTING/ HOW MANY TIME AM I SEE THIS ? HOW FEW TIMES HAVE I SEEN THIS
NETWORK THREAT HUNTING DEFINED
PROACTIVE APPROACH TO ANALYSIS THAT ADDRESSES GAPS IN STATIC NETWORK DEFENSES AND ENABLES ADVANCED DETECTION AND TECHNIQUES
STEP 1 THREAT HUNTING
COLLECT DATA, LEVERAGE KNOW ADVERSARY TECHNIQUES, LOOK FOR ACTIVITY, STARTING WITH REPORTS ( USCERT /RECORDED FUTURE)
THREAT HUNTING VS IR
IR IS ALERT DRIVEN / THREAT HUNTING IS AN ASSUMED BREACH MENTALITY FOCUSING ON POST EXPLOITATION ANALYSIS
WHAT IS POST EXPLOITATION
STEPS 5/6/7 INSTALLATION, C2, AOB- PERSISTANCE/PRIV ESCALATION /DEFENSE EVASION, CREDENTIAL ACCESS, LATERAL MOVEMENT
NETWORK ENABLED DETECTION
STEPS 3/4 -WE GET TO SEE MALWARE DELIVERED /TECHNIQUES
WHY THREAT HUNTING
ADDRESSES GAPS/DEFENSE IN DEPTH/METHODICALLY DEVELOPS ATTACKER MINEFIELD
WHAT THREAT HUNTING IS NOT
NOT ANOTHER PRODUCT /NOT A REPLACEMENT FOR NETWORK SECURITY
WHO SHOULD BE DOING THREAT HUNTING
INCIDENT RESPONDER / SOMEONE WITH PROBLEM SOLVING MINDSET WHO CAN ORGANIZE DATA THAT WILL YIELD RESULTS
PRE HUNT STEP 1
PREP ENVIRONMENT / WHAT TOOLS ARE GIVING YOU THE DATA / IPS /IDS / FIREWALLS / WEB PROXY/ WHERE TOOLS ARE PLACED
PRE HUNT STEP 2
UNDERSTAND SUITABILITY OF DATA /
DATA DICTIONARY
SOURCE OF DATA TO WORK WITH FOR PRE HUNT
DATA MODELING
HOW TO MAP DATA COMING FROM DIFFERENT SOURCES INTO MEANINGFUL ANALYSES FRAMEWORK
DATA QUALITY
YOU DON’T WANT ERRONEOUS OR SPAM RESULTS
SELECTION OF MODEL
EXPLANATION
HYPOTHESIS GENERATION TEMPLATE
RESEARCHING / SCOPING TEMPLATE
THE HUNT STEP 1
GATHER DATA/ FILTER & SIFT/ GARNER INSIGHT/RINSE AND REPEAT
THE HUNT STEP 2
COLLECT ARTIFACT/ REFINE HYPOTHESIS / TEST TO CONCLUSION
POST HUNT STEP 1
MEMORIALIZE THE HUNT/ ENRICH KNOWLEDGE BASE / TRAIN TEAM/ IMPROVE DETECTION/ TUNE HUNT
WHAT IS INSTRUMENTATION OF NETWORK
TECHNOLOGIES TO BRING YOU QUALITY DATA
WHAT IS NETFLOW ANALYZER
UNIFIED SOLUTION THAT COLLECTS ANALYZES AND REPORTS ABOUT NETWORK BANDWIDTH/ PORTS PROTOCOLS AND SERVICES
WHAT ARE DNS SERVER LOGS
RESOLVES ALPHANUMERIC DNS NAMES TO IP ADDRESSES
WHAT ARE PROXY LOGS
COMPUTER SYSTEM OR APPPLICATION LOGS THATS ACTS AS INTERMEDIARY FOR REQUESTS FROM CLIENT SEEKING SERVICES FROM OTHER SERVERS ( MIDDLE MAN)
WHAT IS VPN
EXTENDS A PRIVATE NETWORK ACROSS A PUBLIC NETWORK AND ENABLES USERS TO SEND AND RECEIVE ACROSS SHARED NETWORKS AS IF DEVICES WERE CONNECTED
FIREWALLS
NETWORK SEC SYSTEM THAT MONITORS AND CONTROLS INCOMING AND OUTGOING NETWORK TRAFFIC BASED ON PREDETERMINED RULES. ITS A BARRIER BETWEEN TRUSTED INTERNAL AND THE WILD
LOAD BALANCER
IMPROVES THE DISTRIBUTION OF WORKLOADS ACROSS MULTIPLE COMPUTING RESOURCES
PACKET CAPTURE
PACKET ANALYZER THAT CAN INTERCEPT LOG TRAFFIC
INTEL SOURCE FEEDS
FEEDS THAT UPDATE AND INFORM ON INDICATORS OF COMPROMISE / DOMAINS/ IPS/
ISACS
INFORMATION SHARING AND ANALYSIS CENTERS
WHY ARE INTERNAL INTEL SOURCES IMPORTANT
PREVIOUS HUNTS CAN BE USED, WHAT ARE YOUR ORGS SPECIFIC LINES OF BUSINESS./ WHERE ARE THE CROWN JEWELS
WHAT IS SNORT
ALERT DRIVEN NETWORK INTRUSION DETECTION SYSTEM / ALARM SYSTEM
BRO / ZEEK
ANALYZES NETWORK TRAFFIC MOST COMMONLY USED FOR DETECTING BEHAVIORAL ANOMALIES./ PERFORMS INCIDENT RESPONSE / FORENSICS/ FILE EXTRACTION / HASHING
BRO / ZEEK
ANALYZES NETWORK TRAFFIC MOST COMMONLY USED FOR DETECTING BEHAVIORAL ANOMALIES./ PERFORMS INCIDENT RESPONSE / FORENSICS/ FILE EXTRACTION / HASHING ( /nsm/bro/logs0
WIRESHARK
NETWORK PROTOCOL ANALYZER ( MICROSCOPIC LEVEL MONITORING )
SECURITY ONION
DISTRIBUTION FOR INTRUSION DETECTION ENTERPRISE SECURITY MONITORING AND LOG MANAGEMENT/ INCLUDES BRO / SNORT /SQUIL
SQUIL
GUI THAT PROVIDES ACCESS TO REALTIME EVENTS /SESSION DATA / RAW PACKET CAPTURES
MITRE ATTACK ( FRAMEWORK FOR THREAT HUNTING )
ADVERSARIAL TACTIC TECHNIQUES AND COMMON KNOWLEDGE BASE AND MODEL FOR ADVERSARY BEHAVIOR, REFLECTING VARIOUS PHASES OF ATTACK LIFE CYCLE AND PLATFORMS THEY ARE KNOWN TO TARGET
MITRE ENTERPRISE MATRIX
EXPLAINS SUB PHASES OF ATTACK AND TECHNIQUES FOUND IN THE WILD/ SHOWS WHICH ADVERSARIES HAVE USED WHICH ATTACK TECHNIQUES
TTP
Tactics, Techniques, Procedures
NSA /CSS Technical Cyber Threat Framework (NTCTF) v2
Provides Baseline Of Standard Definitions to be used as reference for the collaboration with partners and stakeholders discussing adversary activities throughout the lifecycle.
