Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Threat Hunting > Threat Hunting 101 > Flashcards

Threat Hunting 101 Flashcards

1
Q

Prerequisites for Threat Hunting?

A
  • SANS “Top 20” CIS Critical Security Controls is a good place to start
  • Minimum requirements:
    ■ inventory of systems, networks, software
    ■ Baseline before an incident: know what’s “normal” network
    ■ An incident response plan in place BEFORE an incident
    ■ A list of known privileged accounts
    ■ Know where your sensitive data is located
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Threat Hunting Frameworks?

A

MITRE ATTACK
Lockheed Martin’s Cyber Kill Chain
Fireeye’s Attack Lifecycle
Gartner’s Cyber Attack Model

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Should I move from left to right when using the ATT&CK Framework while executing my exercise?

A

there is no specific order
Use the ATT&CK to support your hypothesis.
iIf you don’t have a hypothesis, start your threat-hunting where high-risk and first impact areas are, then work from a top-down.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Threat hunting should be focused, how?

A

■ Logs that matter
■ Common patterns used by attackers
■ Get a tangible result
■ Improving technique with each iteration of the hunt

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What Do You Need to Start Threat Hunting?

A
  • automated blocking and monitoring tools such as firewalls,
  • antivirus, endpoint management
  • network packet capture
  • SIEM
  • Threat intelligence
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Some Threat Hunting Tools?

A
  • Sqrrl - APT detection platform. Combines Link Analysis and UBA
  • Sysmon
  • FireEye-Redline
  • Volatility
  • Malware-Traffic- Analysis.net
  • Windows Event Forwarding
  • Bricata
  • Cortex XDR
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is an effective cyber threat hunting process?

A

non-signature-based detection
anomaly- and behavior-based analytics
external threat intelligence sources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Why an analyst would start to correlate data and determine if there is cause for further investigation?

A

examining various sources of data, such as authentication logs or traffic flow

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are the 5 HMM levels?

A

HM1: Rely on IDS, Collects info from systems, Use Threat Intel feeds, Hunt is manually
-
HM2: Incorporate hunt techniques from external sources, Collect data from systems, Active approach
-
HM3: Analyze different data,, , Machine learning, Publish hunting procedures, Identify patterns in alerts
-
HM4: HM3 capabilities + Automate tactical-level analysis, Scripts and Programs based on intelligence, Analysts can focus on creating new hunt methods

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

The hunting cycle is a four-stage loop ?

A

Hypothesize
Investigate
Uncover
Inform and Enrich

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Examples of a pattern or the attacker’s TTP?

A

specific registry key modifications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

The steps of the Hunt-Uncover stage?

A

Investigate specific IOCs
Link various IOCs
TTPs discovered are shared

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

The steps in the Inform and Enrich stage?

A
  • Use knowledge from Uncover stage to reduce risk and simplify future hunts
  • Document hunting cycle result
  • Automate hunting repeatable tasks
  • Create signatures and rules for threat detection systems using new findings.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What three aspects are vulnerabilities evaluated under?

In CVSS

A
  • Base group: characteristics of a vulnerability that are constant over time
    *
  • Temporal Group: assesses the vulnerability as it changes over time
    *
  • Environmental Group: characteristics of a vulnerability, taking into account the organizational environment.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How scoring works for the Base Group - CVSS?

A

0 - 10

0 the least severe

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

The base group Exploitability matrix?

A
  • Attack Vector - Scope
  • Attack Complexity - Confidentiality
  • Privilege Required - Integrity
  • User Interaction - Availability
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

The temporal group Exploitability matrix?

A
  • Exploit Code Maturity (E)
  • Remediation Level (RL)
  • Report Confidence (RC)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the importance of CVSS?

A 
Reports 
- vulnerability severity
- urgency
- priority of response. 
Note: 
Does not calculate the chances of being attacked, but the chances of being compromised when attacked and potential damage.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How CVSS is used in Threat Hunting?

A
  • prioritize remediation efforts.

- identify how vulnerabilities are used

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Maintenance and Guidance of CVSS?

A

FIRTS (Forum for Incident Respoonse and Security Teams)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the conditions for a Hot Thread to be recorded in the database?

A
  • Newly disclosed vulnerability with a CVSS base score of high (7.0 or greater).
    *
  • Intelligence indicating attacks targeted at specific customers (from Talos, open source intel-sharing forums, ISACs and law enforcement)
    *
  • Native intelligence: Growing evidence of a campaign developing on customers’ sites, a surge in reliable and high fidelity security alerts, or due to an opaque priority request to place vigilance in monitoring specific network zones for a specified time period
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Threat Awareness Resources?

A
  • OWASP
  • Spamhaus Project
  • Alexa and the GoatRider tool(Website traffic analysis)
  • Farsight Security’s DNSDB
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Threat Intelligence Sources?

A
  • Malware detection and analysis sites
  • Web content verification sites
  • Network utilities
  • Scripting Decoding Utilities
  • Blogs and Feeds
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What three aspects of an attack should a hunter look into?

A
  • Infection Vector
  • Persistence
  • Lateral Movement
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Open source Threat Hunting tools for smaller organizations or doing it on your own?

A

Host, Network, and Log Data:
GRR, SysMon, Bro, WinBeat

Storage and Analytics:
ELK Stack: Elastic, Logstach, Kibana

Infrastructure:
Puppet, Chef, Docker

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Threat Hunting Skills?

A

Offensive Skills

Network Analysis - Host Analysis

Malware Analysis - Memory Analysis

Most importantly

  • Investigative mind
  • Attacker mindset
  • Patience to work long hours to complete a TH exercise
  • Continuously search for new threats and
  • Open to use new tools or create them.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Attack Scenario - Infection Vector

A

External
Delivery Method: Phishing - External Download
Exploit Method: Office Macro - PDF Vulnerability

Internal
Delivery Method: USB - Network Share
Exploit Method: Native Executable - HTA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Elements of hypotheses for the areas to look into?

i.e Infection vector, Persistence, and Lateral Movement.

A
  • What data I need?
  • How do I get it?
  • How do I hunt through that data?
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q
  • What data I need?
  • How do I get it?
  • How do I hunt through that data?
A

External Vectors / Perimeter Logs

  • Bro logs
  • Email and Proxy logs

Internal Vectors

  • Process Data
  • Registry
  • Windows Events
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Delivery Vector - Phishing - Office Macro Exploit used

What data do I need?

A
  • Process execution data
  • Enhanced Powershell logging
  • Email logs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q
  • Process execution data
  • Enhanced Powershell logging
  • Email logs
    Where do I get the data from?
A
  • Sysmon/OSquery
  • Windows Event logs
  • Email Servers
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q
  • Sysmon/OSquery
  • Windows Event logs
  • Email Servers
    How to hunt through this data?
A
  • Searching Office programs launching Powershell
  • Command arguments w/encoded command
    Then query Kibana for that data to get a visualization for that pattern and attack
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

How do attacker establish Persistence?

A

Traditional
- Run keys - Services - Scheduled Tasks

Creative/Stealthy

  • Office Templates
  • Hijacking Windows features (Applnit DLLs/Accessibility features)

Host Analysis skills

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Persistence example - RUN KEYS
What data is needed?
Where to get the data from?
How to hunt through the data?

A 
What? 
Registry Run Key locations
Run, RunOnce, RunOnceEX
Where? 
Powershell script
Group policy to deploy 
Collect to Elastic
How?
Grouping of executable in run key values
Grouping of executable paths
Command line commands/Arguments
Hashing
First seen/last run
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Lateral Movement

Two key areas to look into for evidence?

A

Recon
DNS Zone Transfers, LDAP Enumeration, Port Scanning

Access
PSExec - RDP - PS Remoting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Recon
DNS Zone Transfers, LDAP Enumeration, Port Scanning

Access
PSExec - RDP - PS Remoting

Where do I find the data?

A
  • WVT logs
  • Bro/Network logs
  • Enumeration artefacts
  • IDS log parsing
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Four Primary Threat Hunting Techniques?

A

Searching
Clustering
Grouping
Stack Counting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Datasets - Endpoint Data?

A 
Process execution metadata
Registry access data
File data
Network data
File prevalence
39
Q

Datasets - Network Data?

A 
Network session data 
Bro logs
Proxy logs 
DNS logs
Firewall logs 
Switch and Router logs
40
Q

Datasets - Security Data?

A

Threat Intelligence
Alerts
Friendly Intelligence

41
Q

Lateral Movement - Attack Scenario
What data do I need?
Where to get it from?
How to hunt through it?

A

What?
WVT
Bro logs

Where?
WinBeat parsing
Collect to Elastic

How? 
• Anomalous user/service logins
• High count ‘one to many’ connections
• Traffic on LDAP ports 
• Session types/privileges
42
Q

How Do You Know What to Look For?

A

Set some prioritized intelligence requirements (PIRs)

43
Q

What is threat hunting?

A

“the process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security solutions”

Sqrrl defined

44
Q

Examples of Fileless Malware and Techniques?

A

Code injection

API Hooking

45
Q

How to deal with huge data sets?

A

Machine Learning

ex. Lateral Movement Data Sets

46
Q

What is so interesting in the Threat Hunter role?

A

It builds, maintains, and improves defensive and offensive skills.
Gets involved in Machine Learning and scripting

47
Q

What is Atomic Red Team?

A

Red Team tests are small, highly portable detection tests mapped to the MITRE ATT&CK Framework.

48
Q

MITRE ATTACK ?

A

MITRE ATTACK™ is a knowledge base

  • model cyber adversaries’ tactics and techniques
  • shows how to detect or stop them
49
Q

Threat Hunting Use Cases?

A

Anomaly-based detection as a good first start. Identifying interesting or unaccountable items in a SEIM
- ssh logins at 1 am
- Consistent ICMP traffic to unknown IPs
This will help give a good starting point to hunt for threats,

Additionally

  • Anonymizing VPNs/Tor from inside the network
  • Logins from strange locations
  • More than one remote connection at the same time for the same user or being logged in locally and remotely at the same time.
50
Q

What is the primary difference between threat hunting and penetration testing?

A

Penetration testing, you are taking an outside-in approach. But with threat hunting, this is much more of an inside-out approach.

  • the assumption (or more specifically, the hypothesis) that an adversary could already be inside your IT Infrastructure. Thus, you are taking steps to ascertain that. If your hypothesis is indeed confirmed, you then will try to mitigate them so that they can’t get in again.
51
Q

What happens if I don’t find anything in the threat-hunting exercise that I have just engaged in?

A

There is a very good chance that you will discover other kinds of security vulnerabilities which you thought never existed before.

52
Q

Should I just pick any random area of the ATT&CK framework to start my threat-hunting exercise?

A
  • First analyze the log files and the respective warnings/ alerts to see what trouble points exist.
  • You also need to make sure that you have access permissions for resources which you need for hunting .
    example: Don’t search for account manipulation adversaries if the access permissions and tools are not in place first.
53
Q

Should I move from left to right when using the ATT&CK Framework while executing my exercise?

A

Don’t have to address each and every cyber-related issue in the framework, and don’t feel overwhelmed by it.

Use the ATT&CK as a support for hypothesis and start from there. If you don’t have a hypothesis at first, start threat-hunting where high-risk and first impact areas are then work from a top-down approach from there.

54
Q

privilege escalation. What should a threat hunter look for in these instances?

A
  • look into any known gaps or weaknesses that currently exist
  • an EDR solution would be the most beneficial technique.
  • File Integrity Monitoring
    If there are any suspicious changes to files, a history of employee logins must be examined for any types of anomalous behaviors.
  • misconfiguration, as this is another backdoor for the cyberattacker.
55
Q

What are the two primary types of threat-hunting exercises?

A
  • On-Demand Investigation Mode: used by security teams to investigate any suspicious or anomalous activities after they have been detected.
  • Continuous Monitoring or Testing Mode: continuously monitoring and/or testing their security posture to proactively identify and investigate any suspicious events.
56
Q

How would you specifically describe data leakage?

A

the departure of a data packet from the place where it was intended to be stored.

57
Q

top sources of data leakage?

A
  • Users
  • misconfigurations
  • Web-based application developed using insecure source code
  • Inadequate security controls
58
Q

How to detect Privilege Escalation?

A
  • EDR solution
  • File Integrity Monitoring (or FIM for short)
  • Employee logins must be examined for any types of anomalous behaviors.
  • Misconfigured systems
59
Q

Should threat hunting be conducted in one part of an infrastructure, or multiple areas?

A

Multiple areas for a comprehensive results.

60
Q

Where are the Visibility Points?
Where/what are the detection points?
Where to setup sensors?

A

Traffic at all major points
(CoreSwitch-Where VLANS are trunked, Firewalls and their ports, InternetPorts, EdgeRouters)

System logs that control access

  • VPN
  • 2FA
  • O365/Azure

Security Tools
AV, Firewalls, IPS

61
Q

Logging Sources?

A

NGFW, WAF

Entry Points
- VPN, RemoteAccess, EdgeRouters, Wi-Fi

DirectoryAuthenticationServices
- ActiveDirectory, Azure/O365, IM, 2FA

Protection/Detection Tools

  • IPS/IDS
  • AV/HIPS
  • Network Sensors

Email

62
Q

Network bandwidth/traffic monitoring tools?

A
  • PRTG
  • TCPdump
  • NTOP
  • Nagios

Note: Used for anomaly detection

63
Q

The Components of a Hypothesis Template

A
  • Tactic and Technique
  • Procedure
  • Collection Requirements
  • Scope
  • Exclusions
  • Analysis Plan
64
Q

SIEM use for Threat Hunting?

A

Anomaly Detection uses

  • anomalous login activity
  • Anomalous blocking by firewalls
  • Anomalous denied access events
65
Q

How to tell if a Windows Core Process is legitimate ?

A
  • expected parent process spawn it?
  • running out of the expected path?
  • spelled correctly?
  • running under the proper SID?
  • signed by Microsoft?
66
Q

What is SMSS.EXE is known as the Session Manager.

A

Responsible for creating new sessions.

67
Q

smss. exe
- Executable path?
- Parent Process?
- Username?
- Base Priority?
- Time of Execution?

A

Executable Path: %SystemRoot%\System32\smss.exe
Parent Process: System
Username: NT AUTHORITY\SYSTEM (S-1-5-18)
Base Priority: 11
Time of Execution: For Session 0, within seconds of boot time

68
Q

What’s the function of CSRSS.EXE (Client/Server Run Subsystem Process)?

A
  • managing processes and threads
  • making Windows API available for other processes
  • mapping drive letters, create temp files,
  • handles the shutdown process
69
Q

CSRSS.exe

  • Executable path?
  • Parent Process?
  • Username?
  • Base Priority?
  • Time of Execution?
A

Executable Path: %SystemRoot%\System32\csrss.exe
Parent Process: Created by child instance of SMSS.EXE but that process will exist so will appear as no parent
Username: NT AUTHORITY\SYSTEM (S-1-5-18)
Base Priority: 13
Time of Execution: For Sessions 0 & 1, within seconds of boot time

70
Q

What is Baselining?

A

A file that will be used for comparisons against current settings and/or configurations.
Compare the current state of a machine, file system, etc. against the baseline to determine anything out of place.

71
Q

Tools for monitoring unauthorized changes to files?

A 
TripWire
SolarWinds
AlienVault
TrustWave
LogRhythm
72
Q

Baselining Tools ?

A
  • System Center Configuration Manager (SCCM)
    • Powershell (Desired State Configuration feature)
      • cmdlet: (Compar-Object. Get-Service, Get-Process)
    • Microsoft Security Compliance Manager (SCM)

Same as Puppet, Ansible, or Chef

73
Q

What shoudl be baselined?

A

• Accounts on a system (user or service)
• Local administrators on a system
• Folder permissions
• Folders contents
– Tasks folder (scheduled tasks)
– Network folders containing internal install executables & files

74
Q

How is Malware Delivered ?

A 
Physical media
    Email (attachments)
    URL links
    Drive-by downloads
    Web advertising
    Social media
    File shares
    Software vulnerabilities
75
Q

What are the Malware Evasion Techniques?

A

Alternate Data Streams

Injections

Masquerading 

Packing/Compression (Yoda Packer and UPX)

Recompiling

Obfuscation

Anti-reversing Techniques
76
Q

How are Alternate Data Streams created and viewed?

A

Create Streams by:

  • CreateFile Windows API
  • WriteFile Windows API

To View ADS
Streams-Sysinternals OR PowerShell’s cmdlet Get-Item

77
Q

Examples of Injections and how they work?

A 
DLL Injection 
(Windows API CreateRemoteThread()) + others 
Reflective DLL Injection
(Metasploit, PowershellEmpire, C/C++) 
PE Injection
Thread Hijacking
78
Q

What is Anti-reversing Techniques and how they work?

A
  • Detect that malware is being run in a virtual machine
  • Detect that a debugger is attached to the malware
  • Junk code can be inserted into the malware as misdirection
79
Q

Examples of Maleware Persistance?

A 
Autostarts 
    Scheduled Task
    COM Hijacking
    DLL Hijacking 
    Windows Services
80
Q

Autostart Locations ?

A
  • HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  • HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\ Explorer\Run
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\ Explorer\Run

To find Autostart locations: AutoRuns - SysInternals

81
Q

Examples of DLL Hijacking?

A
  • Search Order
    • Phantom DLL
    • Side Loading
82
Q

Examples of Windows Services?

A
  • Service Creation (Created by “sc” command
    • Service Replacement
    • Service Recovery
83
Q

Malware Detection Tools?

A

PE Capture
ProcScan
Meterpreter Payload Detection
Reflective Injection Detection

84
Q

Detection Techniques?

A
  • Fuzzy Hashing (Used by VirusTotal)
    • Import Hashing (Used by VirusTotal)
    • Execution Tracing
85
Q

Memory Aanlysis Tools?

A
  • Mandiant’s (FireEye) Redline

* Volatility

86
Q

Windows Event Logs path?

A

%SYSTEMROOT%\System32\Winevt\Logs

87
Q

Event log location in the registry?

A

HKLM\SYSTEM\CurrentControlset\Services\Eventlog

88
Q

Why are event logs important?

A

• logons that failed or that were successful.
• changes to user permissions.
• system services that were created, started, or stopped.
• changes to the audit policy.
• specific application usage.
• events generated by installed applications, such as
AV.

89
Q

What is done If the the Event information is not clear?

A

Events and Errors Message Center

90
Q

Windows Event IDs that should be

monitored ?

A

Hunting Suspicious Accounts - Event ID 4720 (Account Created)
• 4624 (successful logon)
• 4648 (logon using explicit credentials)
• 4625 (failed logon)
• 4634 (successful logoff)
• 4647 (user initiated logoff)

91
Q

Windows Event Logs Hunting Events?

A 
Suspicious Account Events
Password Attacks
Golden Ticket (Kerberos)
RDP Sessions
Scheduled Tasks
Service Creation
Log Rotation Clearing 
Psexec
92
Q

Windows Event Logs logging tools?

A
  • Sysmon
    (sysmonconfig-export.xml - SwiftOnSecurity)
  • SIEM
93
Q

Tasks?

A
  • conduct basic static analysis using Merterpreter Reverse Shell (binwalk, ExifTool, and MD5deep) - Kali Linux on some malware found on the internal network ( Analyze and Classify Malware)
94
Q

Where Behavioral Detection and Machine Learning fails?

A

When trusting/benchmarking an already compromised environment .

Threat Hunting (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions