Hello and welcome to another
application of the modern tech
framework discussion today
we're going to be looking at data
from local systems.
So today's objectives are
as follows.
We're going to describe for you what
data from local system is within the
context of the minor tech framework.
We're going to look at a piece of
malware that we can use in between
the two.
We're going to talk mitigation
techniques and detection techniques
as well.
Now, per the modern tech framework
kind of paraphrasing here, we do
a third act or will attempt to
collect data from the file
system or database of information
residing on systems prior to
exfiltration that actors
will use the command line interface
to look for sensitive information
typically. And they do this with
either automated means, the
scripting or maybe do some
manual investigation.
Now, a tool in this particular
category that has some functionality
is cosmic Duke.
Many Duke, a.k.a.
some other names malware
here has been used by APTN.
Twenty nine from twenty ten to
twenty fifteen.
It's got different capability.
So it's got a persistence mechanism
that includes starting a Windows
task scheduler and it has
a mechanism that looks for file
extensions such as in three
Dots Excel OSX.
So you've got audio, some
word documents, spreadsheets,
things of that nature, and
implements several network
connectors to exfiltrate data like
uploading via FTP
and HTTP mechanisms.
But we've seen that there are some
craftier ways that actors can do
that as well.
Now, with respect to
mitigation techniques and how
that is working, so again, back
to end user awareness training being
a primary method here, trying
to prevent infection and
keep these things off the network
prior to them becoming
a problem.
And then with respect to detection
techniques, again, we get into
monitoring for the use of command
line arguments that could be actions
that represent data collection
activity.
Now, again, some organizations,
depending on the size and
capability, may use some scripting
to do certain data collection
activities.
So you do need to make sure that
these things are either legitimate
business activities or could
be related to threat
actor manipulation of data sets.
Now let's do a quick check on
learning.
True or false data collection
on local systems is where a threat
actor is looking to steal files or
database information.
So if you need additional time,
please pause the video.
So data collection on local system
is where a threat actor is
looking to steal files or
database information.
This is a true
statement in this case.
Now, let's go ahead and pop into
our summary for today's discussion.
It was pretty quick, but really,
you know, it's pretty
straightforward stuff with respect
to data from local systems, which we
described and looking at one
of many tools that can be used here
for data collection.
They can do it, threat actors to
malware through automated means,
through scripts, through through
any type of collection that you can
do via command line.
They can automate that, use those
mitigation techniques, focusing on
the end user awareness training
and detection techniques, falling
into the category of watching
command line activity commonly
associated with data gathering
techniques, again, wanting to make
sure that we differentiate between
business appropriate
activity versus activity that could
be that of a threat actor.
So with that in mind, I want to
thank you for your time today, and
I look forward to seeing you again
soon.