Hello and welcome to
another application of the minor
attack framework discussion today,
we're going to be looking at
uncommonly used ports
within the command and control phase
of the attack framework.
So with that, let's go ahead and
jump into our objectives.
So today's objectives are pretty
straightforward. We're going to
describe uncommonly used ports
as it's defined in the attack
framework.
We'll look at a piece of spyware,
malware, and here we're going
to look at some mitigation
techniques and detection techniques
as well.
So minor define some
commonly used ports is
when a threat actor conducts command
and control attacks over nonstandard
ports to bypass proxies
in firewalls that are not properly
configured. And so in this case,
we're looking to take advantage of
poor configuration or improper
configuration of these device
types or software types.
Now, there is a particular
piece of spyware that we're going to
mention today. It's a spyware Trojan
written in visual basic.
It is known as Agent Tesla.
So that sounds pretty cool.
Capabilities for this include
account discovery, data encryption
prior to sending input capture,
remote file copy, video capture.
And it has TCP Port five
eighty seven enabled for command
and control communications.
So again, using a nonstandard
port in an attempt to bypass
controls, using
data encryption in here, maybe
attempting to bypass data
control where it looks for data
sets being sent out of the network,
or a system that may be looking for
sensitive information and blocking
it. Whatever the case may be,
some of those capabilities are a
part of this malware and
what it can do.
Now, let's talk about mitigation
techniques and a high level
pretty similar to the last bit
network intrusion prevention, again,
to block common signatures and
known attack types, network
segmentation to limit outgoing
traffic and reduce the capabilities
that threat actors have to easily
traverse your network and steal
information detection techniques,
coming back to analyzing data
flows and looking for uncommon
patterns. So things like high data
to and from a system, maybe
again, if we're monitoring system
activity, we have this initial
review and we look
at data and we say, OK, it spikes
here and it goes stable and then it
goes back down and we create this
baseline.
And so our baseline
lives here and everything
below it is normal
traffic. And so our system and
its activities sit on that plane.
Now, when the new
activity.
Let's say it's here and
then this happens.
OK, suddenly
we have activity that is in excess
of the baseline.
What was this?
Why did it happen?
What's going on here?
We have to know when
activity gets to that threshold,
where it was at, for how long
and from what systems.
And then we have to have the
capability to go back and
review that activity
to ensure that if it was legit,
we identified it.
So and if it was not legitimate,
we have a way to address
it and see if we had something
going on that shouldn't have been.
So with that, let's go ahead and do
a quick check on learning.
True or false?
Uncommonly, U.S.
ports are used by threat actors to
avoid or bypass poorly configured
devices like firewalls.
So if you need additional time,
please pass the video.
So in this case, uncommonly, use
ports are used by threat actors
to avoid or bypass poorly configured
devices like firewalls.
And so in this instance, we have a
true statement.
Now, let's go ahead and jump over
to our discussion summary
for the day.
We discussed the definition
perimeter of uncommonly used
ports.
We looked at a piece of malware
within this that could be used to
bypass controls and do
a number of other things.
Agent Tesla was its name.
We looked at mitigation techniques
still running true with network
intrusion, prevention techniques and
segmentation and
then detection techniques again,
network baseline understanding
our traffic types and patterns and
ensuring when we have anomalous
traffic types are patterns that we
investigate that and we determine
whether or not it was legit.
So with that, I want to thank you
for your time today and I look
forward to seeing you again
soon.