(Aaron) We talked about a bunch of things about TrickBot,
where it came from, what it is, why it's dangerous.
We detonated it in a live environment,
we definitely tricked TrickBot into thinking it was on a real system,
and we were able to leverage that behavior,
it actually really performed really well for us,
kind of better than it does in other live demos.
As far as live demos goes, that was pretty good.
And then we also extracted from that behavior a ton of
indicators on the host and indicators on the network that can
be used to identify a new environment.
(Tyler) The security industry has definitely shifted from thinking that,
not necessarily away from prevention,
but understanding that prevention is only one piece of it,
you kind of have to move into the mindset that
eventually you are going to get compromised.
And so with TrickBot,
eventually somebody is going to click on that link or
download that document and run it.
Eventually, TrickBot will get installed.
(Aaron) Right.
(Tyler) So, you definitely want to be looking out for it.
You know,
we looked at a number of different indicators on both the host
and the network on how you can detect it.
You know, it throws things into very specific directories.
We talked about the grabber_temp file that it kind of leaves
as an artifact when a specific plugin runs.
(Aaron) Yeah, absolutely.
(Tyler) With all these,
if you have the ability to search across your host for something like
that or write some type of signature around that,
then that's going to help detect it.
You know, when you were looking at the network piece,
the JA3 signatures that you developed, well,
one of them was unique, the server one was not.
(Aaron) Right.
(Tyler) And it was already known to be related to TrickBot.
So we can definitely look at that,
look for like the user agent that we saw and the server name,
and just all those types of things.
You know, we kind of take those steps to do the analysis on the malware,
like we did,
and get these indicators and then search for them within your network.
(Aaron) Yeah, absolutely.
And hopefully the users gain some of the capability and really benefited from
the wealth of knowledge and capability you bring to the table.
So, thank you so much for that,
really thankful to have you not only respond in the field,
which we are all lucky to have,
but also to have you here and take the time like you
have experienced with these infections,
you have the experience to be able to do this analysis in a safe way,
kind of not like me where I detonated it on the plane on my live
box and then have to like cover that real quick.
And then really for the users,
we're going to make available all of the indicators that
we've identified in the demo content.
We have some Sigma signatures that we're going to develop based on some
Sysmon activity that we'll upload to the project as well.
And we're just really happy to hopefully have you back again soon.
(Tyler) Oh, yeah.
(Aaron) I mean, I guess it's like a good and a bad thing.
If you're back soon,
it means another really bad malware outbreak has happened and we
need to figure out what's going on with it.
(Tyler) Yeah, but you know what, this is the fun stuff.
Doing the analysis, this is what I find enjoyable and I think a lot of people do.
And so,
there're all these different techniques and tools that we can use
to help others who don't either have these skills or have the
time to go and do this on their own.
So absolutely, I'm looking forward to anything else that we analyze.
(Aaron) Excellent.
Well, I can't wait for the next one,
and thanks for joining us for Malware Analysis and
Detection with our focus on TrickBot, at Pluralsight.