>> Welcome to Lesson 2.2,
Identifying and Researching Behaviors.
We'll kick off the mapping process
in this lesson by walking through
some examples of how to
>> recognize behaviors in raw data.
>> Next, we'll move on to step 2 in
researching the identified behaviors.
In this stuff,
we're also going to talk about the need for
multiple data sources and the types of
data sources that may contribute to your research.
Step 1, finding the behavior.
Walking through this data,
we see a couple of commands captured by Sysmon that
are being run interactively via
command.exe by an adversary.
Next, we have some data from a couple of flows.
This is from malware being run in a sandbox environment.
Finally, there are some registry keys that we're
seeing being added during an incident.
All of these commands are being run by an adversary,
and each of them is possibly a behavior.
Some of the flows can be behaviors that we're
actually seeing from the piece of software itself,
and the register keys being added,
can be either a behavior coming from
the adversary or the software.
We're going to be researching these potential behaviors
over the next couple of slides.
Our next step in the process is researching the behavior.
Before we start looking into
the potential behaviors that we just
found in the raw data,
I want to go into the analysis process
for raw data a bit more.
Depending on your Intel requirements
at the data you're reviewing,
this step can mirror their approach to
analyzing data in near to reporting,
but it can also present some different aspects.
As we discussed with the pros and cons of mapping
from the two different sources in the last lesson,
raw data can require a deeper level of
expertise in order to follow
what's happening in a specific datatype.
This can require that an analyst has
experience in looking at network packets
and forensic data or understanding
what different Windows commands do.
As you're working with raw data,
you may realize that supplementary
data sources are needed for
you to glean enough context
to understand what the behavior is.
This might require further
queries and leveraging your incident
responders or collaborating with
the analysts that are providing this data.
Also in some cases,
the research can be very straightforward.
You might be able to quickly find
some relevant results and additional insights
on your favorite search engine or you can search
the attack website for a specific command,
and often the description of the command will provide
a good idea of what technique that behavior falls under.
Other times, it might be a little more
difficult to determine a behavior,
especially if a command line is
complex and the contents is sparse.
In this case, unpacking the complexity by pulling in
other data sources is needed.
You might have to use the sandbox,
perform further file analysis,
or leverage a search engine to pull in
that extra insight into the technical details.
As we just discussed,
researching potential behaviors from
raw data on the attack website can often give us
an idea of what the behavior
is and where we can likely map it.
For example, if you start searching through
the attack website for IP config/all,
it appears in one technique,
specifically under a procedure example for
system network configuration discovery.
This provides a description of what's going on and it can
help us gain an understanding of
what the adversary's goal is.
You might have an assessment of
what technique that behavior
is going to map to and what tactic it aligns with,
but it can also be a little more complex.
The other command line that was in the data was running
recycler.exe and there were also some command-line flags.
We see something with a VSDX file,
but there isn't necessarily enough detail right now.
Although we might be able to make
an initial assessment of what one of the behaviors is,
somatic context is required at this step.
We'll pull in and review another data source.
If we put this command into
a sandbox and perform file analysis,
exists the following output.
It's likely looking more familiar.
The output displays a banner that is showing us
that this is a war, so an archiver.
At this point, we'll leverage a search engine for
some additional research on the flags
and to gain more insight into what's occurring.
After researching that -HP,
we can determine that it's being used to
compress and encrypt the file.
Now, for the final piece of the puzzle, that VSDX file.
We're going to leverage a search engine again,
and from the first result,
we can see that it's a Visio file.
We know that a Visio file is
not going to be coming out of a RAR.
This actually provides us with
some valuable contexts to what's potentially happening.
From our research, we can deduce that someone is likely
pretending that this information
is being compressed and encrypted
as a Visio diagram.This
could be an attempt to exfiltrate data,
but some further details would be
beneficial for our analysis.
We'll be discussing that in the next lesson.
In Lesson 2.2, we walked through a couple of
examples of identifying the behaviors in raw data.
We discussed how to research the behaviors,
highlighting that in many cases,
multiple data sources are going to be required.
In the next lesson,
we'll discuss how to translate behaviors into
tactics techniques and sub-techniques.