This is module one lesson to
attack mapping process,
finding and researching the
behavior.
This lesson, we have three
objectives
going to discover how to find
behaviors, that's step one
of the attack mapping process
I gave in the previous lesson.
We're going to learn how to research
behaviors.
Let's step two of the mapping
process I gave.
And finally, I'm going to go into
some narrative reporting so that we
can see some example behaviors.
Step one of our process, finding the
behavior
you're going to want to look in your
reporting for what the
adversary or software does
during the steps of the compromise,
as you look through your reporting,
you're going to want to focus on
compromise, initial compromise and
compromise details.
So you're going to want to take a
look at how the adversary
actually behaved through different
parts of their intrusion.
So things like how they gained
their initial access to a system,
how they moved around between
systems and how they actually
did the compromise of the victim
network systems.
Oftentimes, this is going
to be verbs so
used to create
installed things
in our narrative reporting that
describe a behavior in
things that the adversary actually
did.
So this isn't going to be
absolutely everything in a report,
there's information reporting that
may not be useful for attack mapping
information that doesn't describe
details about adversary behavior.
Oftentimes, that's found in places
like static malware analysis.
So talking about hashes
or very specific details
of how a piece of malware
was compiled,
infrastructure, registration
information.
So what IP address an adversary
used is not going to be an attack
behavior.
Industry victim targeting
information, so
the fact that an advisory went
after power, utilities
or educational institutions
that exact who is the targeting
is not a attack behavior.
So let's take an example report,
this comes from a fiery report
called Operation Double Tap.
It's a couple of years old now,
but it's still useful for looking
at behaviors.
So the first thing we're going to be
doing here is starting to look
for those verbs,
looking for those descriptions of
the things that the adversary is
doing for
we're talking about successful
exploitation.
We're talking about uses the Windows
command command to
see who am I.
We're talking about creates
persistence by creating the
following scheduled task,
establishes a sock's five
connection to one nine two one
five seven one nine eight one, two,
three.
Sends the Sox five connection
request, and so each of
these are behaviors, there are
things that the adversary is doing
and they're starting place is for us
to be able to look for attack
tactics and techniques.
Some of these might even be multiple
behaviors, at least as we get
towards the language of attack.
So we don't just have establishes
a connection.
We also have using TCP port.
And each of these are things that,
as we go through our process,
will be able to turn into attack
tactics and techniques.
So once we have identified the
behaviors we've gone through, we
figured out where those verbs are,
where are those things that are
advisory actions,
we need to research the behavior.
We want to understand
what is the adversary's doing.
Now, this may be something that
you can skip. You can cheat.
You know, this may be activity that
you already understand.
You understand, you know, what the
adversary was trying to do.
But if there are unfamiliar
adversary software behaviors,
you need to get into and look at a
little bit more of what the
adversary was doing.
So, for example, you may want
to examine details about network
protocols that were used,
some of attack is leveraging
OSFI models.
So looking at things like
application layer,
looking at capabilities that
things have, what's the
assigned number?
Is it a common service?
Is it an uncommon service?
What does it normally used for?
Or is the adversary going up
against specific tools?
So things like Sambor or remote
desktop?
As you go through this, collaborate
with your own organization,
different people are going to have
understanding of different
behaviors.
People are just going to have
different skill sets and
absolutely leverage external
resources.
Search engines are your friend.
Understanding your behaviors will
help you with these next steps.
But not just that.
It also enhances analytic skills.
It will make you a better analyst.
So let's take a couple the behaviors
we identified in that original
report, we said
the adversary used Sock's
proxy.
OK, so maybe we aren't familiar
with Sock's, you know,
we Google it.
We find it in Wikipedia
and, you know, we find this
information here.
Sock's is an Internet protocol.
OK, go through
it. Sock's performs it.
Layer five of the ISI model,
the session layer that
that's a little bit unusual.
So layer five is
not a layer that most things run
on.
OK, so we see it's a proxy.
We see it's layer five.
So we've got at least a little bit
more information on what
Sox's.
So similarly, we said that they were
using Port 1913
well, you know, we we think we
you know, we know ports, we know TCP
IP, but maybe
we haven't heard of 1913
before.
So, you know, maybe this is not a
port that we've come through another
analysis and so we can
hunt for this as well.
And so this is a database out
there of common ports with
different services called Speed
Guide.
We look up Port nineteen thirteen
and we find that it's for
service called arm ADP.
I've never heard of our ADP.
And you know, when we created this,
I talked to my other instructor,
Katie. She had never heard of arm
ADP.
And so, you know, this is not
this is not a common services, is
not a common port, and
that's going to be useful knowledge
for us as we go forward.
So in summary, I've covered a couple
of things going through this lesson,
I've talked a little bit about what
some of the guidelines are for
places where you're likely to be
able to do useful mapping
and looked at tips for finding
behaviors.
I talked about why it's a little bit
important to understand these
behaviors and some
of how you can start doing research
on behaviors themselves.
We also took a look at a negative
report and some of the behaviors
that are coming out of even just a
small piece of text.