Now, one of the great things that we're going to find, in addition to indicators of compromise, is
we're going to be able to categorize attacks against us.
And we'll be very good at this, by the way, when we're through this entire ultimate guide.
And what we discover is that there are going to be some classic adversary, behavioral identifications.
And it's important to know these because, of course, these can really help you to catch that thief.
What are some of the most common adversarial behavioral identifications?
Well, we catch the computer criminals doing that initial reconnaissance.
Think about how easy it would be, relatively easy it would be to catch these interesting types of scans
and other reconnaissance attempts against our network.
As a matter of fact, at the perimeter of your network, you're probably not even permitting some of
these protocols.
So they're going to show up pretty easily.
How about monitoring carefully for any use of PowerShell?
This would be in the Windows environment.
Remember, PowerShell is the Windows Scripting Engine one of them, one of the scripting engines that
we can use for Windows.
But it's very, very particular to Windows.
It was invented by Microsoft for Microsoft and all that good stuff.
So in that environment, the use of PowerShell may indicate that there is some trickery, some blackout
work afoot, unspecified proxy activities.
This is always bad when we have a machine proxy for users or groups or even just moving traffic through
a certain system.
We typically want to be very deterministic about where our traffic goes and we would expect to know
exactly what systems are being hit.
How about the use of a command line interface?
Yeah.
So if we have some kind of a Linux box, if we notice that there are terminal sessions that are being
fired up so that the CLIA can be used, this often could be an indication of some type of adversary
that is behaving in a way we don't want them to in our environment.
There's the HTP user agent field.
This is one to watch out for.
This is how a client is identified to the web server.
So we want to watch out for any manipulations of the HTTP user agent setting.
And we also have to monitor our network carefully to make sure there is no command and control server
that some adversary is using.
Again, this is often discovered through very bizarre patterns that some server is emitting when it
comes to data traffic.
And how about the use of DNS tunneling?
Yeah, tunneling is when we are going to take, you know, everyday protocols like DNS and we are going
to hide in the payload of the packets for DNS information.
Maybe that's destined for a command and control server.
Think about that.
So the DNS traffic is just flowing normally through our system as DNS traffic would, but embedded inside
it tunneled inside.
It is instructions that are going to be processed and understood by a command and control server.
Yikes.
How about the use of a web shell?
Oftentimes there's built in web shells that can be taken advantage of to manipulate the settings of
a system.
But don't forget, sophisticated attackers can set up their own little pocket inside of your web server
and build a web shell from which to launch further types of attacks.
And many organizations tell us that one of the ways in which they saw that they were under attack and
they knew to set off the alarm bells and they knew to approach the network very carefully as if it was
under attack based on the fact that data was being staged.
That's right.
They noticed maybe data being copied to a certain location.
They noticed access control lists being removed.
They notice these preparations and staging of data as part of the attack.
Boy, this is something to watch out for and notice, just like with our indicators of compromise,
these type behaviors really require a careful monitoring approach so we can quickly detect them and
quickly respond.
Thanks so much for watching.