Hello and welcome to another
application of the minor attack
framework discussion today
we're going to be looking at cooking
show.
The objectives of today's discussion
are as follows.
So we're going to describe what
hooking is, how it
has been used.
What are some mitigation techniques
and some detection techniques
as well.
So let's jump right in.
So when we talk about cooking
within the MIETEK framework,
the act of leveraging application
programing interface functions to
perform tasks that require
reusable system resources.
So cooking involves redirecting
calls via procedures,
import address, table cooking, in
line cooking as well.
So this is like process injection
threat. Actors can use cooking to
load and execute malicious code
as though it were another
process.
So some use cases and
some ways that this is is done.
So we've got classic diesel
injection via create remote
threat and load library.
And so this malware
writes the path of its malicious
diesel in the virtual address
space of another process.
We've also got portable executable
injection.
Injection doesn't pass the address
of the library, so it makes a copy
of malicious code into an existing
open process and causes it to
execute.
Then we've got thread execution,
highjacking, which is like process
Halloween, where the threat,
execution, hijacking
targets an existing threat
of a process and avoids any noisy
process or threat creation
operations.
And so depending on the types
of tools that we have in place
and what we're doing in the
environment, we may be able to
detect this or it may go
unnoticed. Now, some mitigation
techniques that we can use here,
prevention techniques are difficult
to achieve. So some methods may
include the use of malicious patch
detection or when
there's any hallowing of processes
or changes to those, any
calls that could be used for
hacking, then
we may be able to detect them.
But if a threat actor is trying
to move in a sneaky way,
it may be difficult to pick these
up. Now, some detection techniques
include monitoring
for calls to the set windows,
hook X and set when and then
hook functions and then implement
software specific for rootkit
detection. Any alerts should
be reviewed as a part
of your processes there.
Now let's do a quick
check on learning.
True or false hooking is relatively
easy to prevent and detect.
So if you need some additional time,
please go ahead and pause the video,
but hooking is not
relatively easy to detect
or prevent in these cases.
And so this would be a
false statement.
Now, in summary
of today's discussion, hooking
is essentially when we inject
information into a legitimate
process or take that process
over.
We described how it's been used in
those three areas, mitigation
techniques, as well
as detection techniques.
So with that in mind, I want to
thank you for your time today, and
I look forward to seeing you again
soon.