Lesson 13: Analyze Indicators of Malicious Activity

Question 1

What is the purpose of the preparation phrase in CompTIA’s incident response lifecycle?

Answer 1

Identifies data sources that can support investigation; Tools to aggregate/correlate data; Alerting/identifying.

Question 2

Define ‘Malware’

Answer 2

Software that serves a malicious purpose, typically installed without the user’s consent (or knowledge).

Question 3

What is the purpose of malware classification?

Answer 3

Describes the vector used by the malware; Method by which the malware executes on a computer and potentially spreads to other network hosts.

Question 4

Define a ‘virus’

Answer 4

First types of malware; Spread without any authorization by being concealed within executable code of another processes - the processes are described as being infected with malware.

Question 5

Define a ‘trojan’ malware

Answer 5

A malicious software program hidden within an innocuous-seeming piece of software; Designed to operate discreetly without authorization.

Question 6

Define a ‘Potentially unwanted program (PUP)’ malware

Answer 6

Software that cannot definitively be classed as malicious, but may not have been chosen by or wanted by the user.

Question 7

What are the 4 classifications of malware/viruses?

Answer 7

1. Non-resident/file infector
2. Memory resident
3. Boot
4. Script and macro viruses

Question 8

Define a ‘Non-resident/file infector’ malware/virus

Answer 8

Virus is contained within a host executable file and runs with the host process.

Question 9

Define a ‘Memory resident’ malware/virus

Answer 9

When the payload is executed, the virus creates a new process for itself in memory and remains in memory, even if the host process is terminated.

Question 10

Define a ‘boot’ malware/virus

Answer 10

Virus code is written to the disk boot sector or the partition table of a fixed disk and executes as a memory-resident process when the OS starts or the media is attached to the computer.

Question 11

Define a ‘Script and macro viruses’ malware/virus

Answer 11

Malware uses the programming features available in local scripting engines for the OS and/or browser, such as PowerShell, Windows Management Instrumentation (WMI), JavaScript.

Question 12

Define a ‘multipartite’ malware/virus

Answer 12

Viruses that use multiple vectors.

Question 13

Define a ‘polymorphic’ malware/virus

Answer 13

Viruses that can dynamically change or obfuscate their code to evade detection.

Question 14

What is the common goal of all malware/virus classifications and vectors?

Answer 14

To infect a host file or media.

Question 15

Define a ‘worm’

Answer 15

A type of malware that replicates between processes in system memory and can spread over client/server network connections without user intervention.

Question 16

How is modern malware defined as ‘fileless’

Answer 16

The malware won’t write code to disk; Malware uses memory-resident techniques to run in its own process, within a host process or dynamic link library (DLL), or within a scripting host.

Question 17

How can fileless malware remain persistent in a system without writing code to disk?

Answer 17

By changing registry values that execute if the host computer is restarted.

Question 18

How can fileless malware evade detection and create backdoors?

Answer 18

By using shellcode to exploit a software vulnerability to gain initial access to a victim system.

Question 19

Define a ‘live off the land’ technique that a fileless malware might use to evade detection

Answer 19

If an attacker has sufficient permissions, malware code can use legitimate system scripting tools, notably PowerShell and Windows Management Instrumentation (WMI), to execute payload actions.

Question 20

Define the term ‘advanced persistent threat (APT)’

Answer 20

An attacker’s ability to obtain, maintain, and diversify access to network systems using exploits and malware.

Question 21

How can a cookie be viewed as a malicious file?

Answer 21

Third-party cookies can be used to record web activity, track the user’s IP address, and harvest various other metadata.

Question 22

Define a ‘Supercookie’

Answer 22

A type of tracking cookie stored on a computer indefinitely used to monitor behavior and collect data.

Question 23

Define a ‘beacon’

Answer 23

A single pixel image embedded into a website. While invisible to the user, the browser must make a request to download the pixel to load the site, giving the beacon host the opportunity to collect metadata.

Question 24

Define ‘adware’

Answer 24

A class of PUP/bloatware that performs browser reconfigurations, such as allowing tracking cookies, changing default search providers, opening sponsor’s pages at startup, adding bookmarks, and so on, with the purpose of recording information about the user and its computer.

Question 25

Define 'spyware'

Answer 25

Malware that can perform adware-like tracking, but also monitor local application activity, take screenshots, activate recording devices, and perform DNS redirection.

Question 26

Define a 'keylogger'

Answer 26

Malicious software or hardware that can record user keystrokes.

Question 27

Define a 'backdoor'

Answer 27

Any type of access method to a host that circumvents the usual authentication method and gives the remote user administrative control.

Question 28

Define a 'remote access Trojan (RAT)'

Answer 28

Malware that creates a backdoor remote administration channel to allow a threat actor to access and control the infected host.

Question 29

Define a 'bot'

Answer 29

Automated script or tool that performs some malicious activity.

Question 30

Define a 'botnet'

Answer 30

A group of hosts or devices that has been infected by a bot, which enables attackers to exploit the hosts to mount attacks.

Question 31

How is a botnet controlled?

Answer 31

By a command and control (C2 or C&C) host or network.

Question 32

Define a 'command and control (C2 or C&C)' host/network

Answer 32

Infrastructure of hosts and services with which attackers direct, distribute, and control malware over botnets.

Question 33

Define a 'cover channel'

Answer 33

Subverts network security to transfer data without authorization or detection.

Question 34

Once activated by a user, what permissions do a trojan malware adopt?

Answer 34

Inherits the privileges of that user account.

Question 35

Define a 'rootkit'

Answer 35

Malware that runs with SYSTEM level permissions; Class of malware that modifies system files, often at the kernel level, to conceal its presence.

Question 36

What is the danger of a rootkit that attacks firmware?

Answer 36

Can survive any attempt to remove the rootkit by reformatting a drive or reinstalling OS.

Question 37

Define 'ransomeware'

Answer 37

Malware that tries to extort money from the victim by blocking normal operation of a computer and/or encrypting the victim’s files and demanding payment.

Question 38

What are typical ways ransomware will demand payment to avoid revealing their identity?

Answer 38

Cryptocurrency; wire transfers; premium rate phonelines.

Question 39

Define 'crypto-ransomeware'

Answer 39

Crypto class of ransomware attempts to encrypt data files on any fixed, removable, and network drives.

Question 40

Define 'Cryptojacking malware'

Answer 40

Type of crypto-malware hijacks the resources of the host to perform cryptocurrency mining.

Question 41

Define a 'logic bomb'

Answer 41

A malicious program or script that is set to run under particular circumstances or in response to a defined event.

Question 42

Define a 'tactic' in terms of bad actor behavior

Answer 42

Behaviors such as reconnaissance, persistence, and privilege escalation are examples of tactics.

Question 43

Define a 'technique' in terms of bad actor behavior

Answer 43

Description of how a threat actor progresses a tactic.

Question 44

Define a 'procedure' in terms of bad actor behavior

Answer 44

Description of how a technique is performed.

Question 45

Define an 'indicator of compromise (IoC)'

Answer 45

A sign that an asset or network has been attacked or is currently under attack.

Question 46

Define a 'sheep dip'

Answer 46

An isolated host used to test new software and removable media for malware indicators before it is authorized on the production network.

Question 47

Define 'Impossible travel'

Answer 47

A potential indicator of malicious activity where authentication attempts are made from different geographical locations within a short timeframe.

Question 48

How can concurrent sessions be a sign of malicious activity?

Answer 48

Indicates that the threat actor has obtained the account credentials and is signed in on another workstation or over a remote access connection.

Question 49

Define a 'physical attack' in terms of cybersecuirty

Answer 49

An attack directed against cabling infrastructure, hardware devices, or the environment of the site facilities hosting a network.

Question 50

Define an 'environmental attack'

Answer 50

A physical threat directed against power, cooling, or fire suppression systems.

Question 51

Define 'RFID cloning'

Answer 51

Making a copy of a contactless RIFD access card.

Question 52

Define 'RIFD skimming'

Answer 52

Using a counterfeit reader to capture card or badge details, which are then used to program a duplicate.

Question 53

Define a 'network attack'

Answer 53

General category for a number of strategies and techniques that used to disrupt or gain access to systems via a network vector.

Question 54

List types of network attacks

Answer 54

Reconnaissance; Credential harvesting; DoS; C&C; Lateral movement; Data exfiltration.

Question 55

Define a 'denial of service (DoS)' attack

Answer 55

Any type of physical, application, or network attack that affects the availability of a managed resource.

Question 56

How is a denial of service attack described when the target is a network host or gateway?

Answer 56

distributed DoS (DDoS).

Question 57

Define 'distributed DoS (DDoS)'

Answer 57

Use of a botnet to disrupt the normal flow of traffic of a server or service by overwhelming the target with traffic.

Question 58

What is the typical outcome of an individual client host being affected by a malware based denial of service (DoS) attack?

Answer 58

Might destroy a file system or engineer excessive CPU, memory, storage, or network bandwidth consumption.

Question 59

Define a 'SYN flood attack'

Answer 59

DoS attack where the malicious client's ACK packet is withheld from the 3-way handshake, causing a router/firewall/server to build a queue of pending connections to overwhelm the host by causing it to wait for an acknowledgement of SYN/ACK from the malicious client.

Question 60

Define a 'distributed reflected DoS (DRDoS)'

Answer 60

A DoS attack where the attacker sends outing packets to random third party servers using the IP address of the intended target with the goal to flood it with DNS or other traffic from the devices that were manipulated to communicate with it.

Question 61

Define an 'amplification attack'

Answer 61

UDP based reflection attack that exploits the way the protocols function and causing them to return network information to the attacker.

Question 62

What is a typical indicator of a Distributed Denial of Service (DDoS) attack?

Answer 62

Traffic spikes that have no legitimate explanation.

Question 63

How can a Distributed Denial of Service (DDoS) attack be mitigated?

Answer 63

High availability services, such as load balancing and cluster services.

Question 64

Define an 'on-path/man-in-the-middle' attack

Answer 64

An attack where the threat actor makes an independent connection between two victims and is able to read and possibly modify traffic.

Question 65

Define 'arp poisoning'

Answer 65

Attacker with network access redirects an IP address to the MAC address of a computer that is not the intended recipient.

Question 66

What two types of attacks could use ARP poisoning as a technique?

Answer 66

DoS and on-path/man-in-the-middle.

Question 67

Define 'DNS poisoning'

Answer 67

An attack where a threat actor injects false resource records into a client or server cache to redirect a domain name to an IP address of the attacker's choosing.

Question 68

What are the 3 types of DNS poisoning?

Answer 68

1. DNS-Based On-Path Attacks 2. DNS Client Cache Poisoning 3. DNS Server Cache Poisoning

Question 69

What technique/attack method is used to perform DNS-Based On-Path Attacks when the attacker and victim are on the same network?

Answer 69

ARP poisoning or a rouge DHCP server.

Question 70

How is a DNS Client Cache Poisoning performed?

Answer 70

Attacker must place a spoofed DNS mapping in the clients host file.

Question 71

Where is the windows host file?

Answer 71

%SystemRoot%\System32\Drivers\etc\hosts

Question 72

Where is the Linux host file?

Answer 72

/etc/hosts

Question 73

Define a 'rouge access point'

Answer 73

One that has been installed on the network without authorization, that creates a backdoor to the network.

Question 74

Define an 'evil twin'

Answer 74

A rogue access point masquerading as a legitimate one.

Question 75

Define a 'disassociation' attack

Answer 75

Spoofing frames to disconnect a wireless station to try to obtain authentication data to crack by exploiting the lack of encryption in management frame traffic to send spoofed frames.

Question 76

Define a 'KRACK' attack

Answer 76

Uses a replay mechanism that targets the WPA and WPA2 4-way handshake to capture the hashes used when a wireless station associates with an access point.

Question 77

Define a 'password' attack

Answer 77

Any attack where the attacker tries to gain unauthorized access to and use of passwords.

Question 78

Define a 'brute force' password attack

Answer 78

Attacker uses an application to try every possible alphanumeric combination to crack encrypted passwords.

Question 79

Define a 'dictionary' password attack

Answer 79

Compares encrypted passwords against a predetermined list of possible password hash values.

Question 80

Define 'password spraying'

Answer 80

A brute force attack in which multiple user accounts are tested with a dictionary of common passwords.

Question 81

Define a 'credential replay' attack

Answer 81

An attack that uses a captured authentication token to start an unauthorized session without having to discover the plaintext password for an account.

Question 82

Define a 'downgrade' attack

Answer 82

Cryptographic attack where the attacker exploits the need for backward compatibility to force a computer system to abandon the use of encrypted messages in favor of plaintext messages.

Question 83

How can a downplay attack be detected?

Answer 83

In server logs, WAF/load balancer logs, IDS.

Question 84

Define a 'collision' attack

Answer 84

Exploiting a weak cryptographic hashing function allowing generation of the same digest value for two different input files/data to forge a digital signature.

Question 85

Define a 'birthday' attack

Answer 85

Password based collision attack taking advantage of the probability that different input can produce the same digest value for a different unknown encrypted password.

Question 86

Define 'Shellcode'

Answer 86

Minimal program designed to exploit a vulnerability in the OS or in a legitimate app to gain privileges.

Question 87

Define 'credential dumping'

Answer 87

The act of using malware to access a credential file or sniff credentials held in memory.

Question 88

Define an 'application attack'

Answer 88

Targets a vulnerability in OS or application software.

Question 89

What is an indicator of an application attack?

Answer 89

Increased numbers of application crashes and errors; Anomalous CPU, memory, storage, or network utilization.

Question 90

What is the purpose of most application attacks?

Answer 90

Arbitrary code execution; To allow the threat actor to run their own code on the system.

Question 91

Define 'arbitrary code execution'

Answer 91

A vulnerability that allows an attacker to run their own code or a module that exploits such a vulnerability.

Question 92

Define 'remote code execution'

Answer 92

A vulnerability that allows an attacker to transmit code from a remote host for execution on a target host.

Question 93

Define 'privilege escalation'

Answer 93

Practice of exploiting flaws in an OS or application to gain a greater level of access than was initially intended for the user or application.

Question 94

What are the two type of privilege escalation?

Answer 94

1. Vertical privilege escalation 2. Horizontal privilege escalation

Question 95

Define 'Vertical privilege escalation'

Answer 95

When an attacker can access functionality or data that should not be available to them.

Question 96

Define 'Horizontal privilege escalation'

Answer 96

When an attacker accesses or modifies specific resources that they are not entitled to or is intended for someone else.

Question 97

How can privilege escalation be detected?

Answer 97

Detailed analysis of code or process execution in real time or application logging as well as endpoint protection.

Question 98

Define an applicaiton 'buffer'

Answer 98

An area of memory that an application reserves to store some value.

Question 99

Define a 'buffer overflow' attack

Answer 99

Attacker passes data that deliberately fills the buffer to its end and then overwrites data at its start.

Question 100

Define a 'replay attack'

Answer 100

Attacker intercepts a session token from a cookie used to authenticate a user and reuses it to try to reestablish an illegitimate session.

Question 101

How can an attacker capture HTTP cookies?

Answer 101

Sniffing network traffic via an on-path attack or when they are sent over an unsecured network; Malware infecting a host; cross-site scripting (XSS).

Question 102

Define a 'forgery' attack

Answer 102

exploits weak authenticated sessions to perform an unauthorized request via a hijacked session.

Question 103

Define 'cross-site request forgery (CSRF)'

Answer 103

A malicious script hosted on the attacker's site that can exploit a session started on another site in the same browser.

Question 104

What is the function of performing cross-site request forgery (CSRF)?

Answer 104

Exploit applications that use cookies to authenticate users and track sessions.

Question 105

How is cross-site request forgery (CSRF) accomplished?

Answer 105

Attacker must convince the victim to start a session with the target site, then pass an HTTP request to the victim's browser that spoofs an action on the target site, such as changing a password or an email address.

Question 106

Define 'server-side request forgery (SSRF)'

Answer 106

Exploits the lack of authentication between the internal servers and services and lack of input validation - causing a server application to process an arbitrary request that targets another service.

Question 107

Define a 'server-side' attack

Answer 107

Typically and injection attack; Causes the server to do some processing or run a script or query in a way that is not authorized by the application design.

Question 108

Define an 'injection attack'

Answer 108

An attack that exploits weak request handling or input validation to run arbitrary code in a client browser or on a server.

Question 109

Along with SQL, what other protocols/languages are susceptible to injection attacks?

Answer 109

LDAP, XML.

Question 110

Define a 'Directory traversal'

Answer 110

Web application attack that allows access to commands, files, and directories that may or may not be connected to the web document root directory.

Question 111

How is a directory transversal performed?

Answer 111

Threat actor submits a request for a file outside the web server's root directory by submitting a path to navigate to the parent directory.

Question 112

How is a directory transversal mitigated?

Answer 112

Input validation and proper access permissions.

Question 113

Define a 'canonicalization attack' and how it is executed

Answer 113

Attack method where input characters are encoded in such a way as to evade vulnerable input validation measures.

Question 114

What is the purpose of utilizing a canonicalization attack?

Answer 114

To disguise the nature of the malicious input.

Question 115

Define a 'command injection'

Answer 115

Threat actor is able to execute arbitrary shell commands on a host via a vulnerable web application.

Question 116

What level of privilege should a webserver give a client to prevent any type of injection attack?

Answer 116

Guest

Question 117

What are the typical areas/mechanisms used to initially detect a high-jacking/replay, forgery, and injection attack?

Answer 117

URL analysis and the web server's access log.

Question 118

How can a URL be manipulated to be an attack vector?

Answer 118

By being encoded with some type of action or data to submit to the host server.

Question 119

What are the 5 components of an HTTP request?

Answer 119

1. Method 2. Resource (URL path) 3. Version number 4. Headers 5. Body

Question 120

What are the 3 types of HTTP requests methods?

Answer 120

1. HTTP Get 2. HTTP Post 3. HTTP Put

Question 121

Define a 'HTTP get' request method

Answer 121

Used to retrieve a resource.

Question 122

Define a 'HTTP post' request method

Answer 122

Used to data to the server for processing by the requested resource.

Question 123

Define a 'HTTP put' request method

Answer 123

Used to create or replace the resource.

Question 124

What ways can data be submitted to a server?

Answer 124

Post/Put methods, HTTP headers/body, or by encoding the data within the URL used to access the resource.

Question 125

What character is used to identify data submitted via URL?

Answer 125

Data submitted via a URL is delimited by the '?' character, which follows the resource path.

Question 126

How is a query defined in a URL?

Answer 126

The query string begins after the question mark (?); Query parameters are represented as a unique key-value pair or two linked data items with an (=) separating each value.

Question 127

Define a HTTP response code

Answer 127

The header value returned by a server when a client requests a URL.

Question 128

What is the purpose of a reserved character in a URL?

Answer 128

Used as delimiters within the URL syntax.

Question 129

Define 'percent encoding'

Answer 129

A mechanism for encoding characters as hexadecimal values delimited by the percent sign.

Question 130

What do HTTP response codes in the 400 range indicate?

Answer 130

Indicate client-based errors.

Question 131

What do HTTP response codes in the 500 range indicate?

Answer 131

Indicate server-based errors.