1 00:00:07,440 --> 00:00:09,760 hello everyone i am glad to be part of 2 00:00:09,760 --> 00:00:11,840 defcon again this year polluting village 3 00:00:11,840 --> 00:00:13,519 thank you very much for the opportunity 4 00:00:13,519 --> 00:00:15,360 and a special thanks to all of you for 5 00:00:15,360 --> 00:00:17,760 making time to attend this session 6 00:00:17,760 --> 00:00:20,000 hunter beast in the shadow before we 7 00:00:20,000 --> 00:00:21,920 dive into the main topic let me quickly 8 00:00:21,920 --> 00:00:24,400 tell you who is this guy speaking i am 9 00:00:24,400 --> 00:00:26,160 assameslari a cyber security 10 00:00:26,160 --> 00:00:28,240 practitioner and consultant at the 11 00:00:28,240 --> 00:00:30,800 moment i'm acting as a senior director 12 00:00:30,800 --> 00:00:33,600 uh with egs ec council global services 13 00:00:33,600 --> 00:00:35,600 for both reactive and proactive cyber 14 00:00:35,600 --> 00:00:38,079 security i'm also a mentor with blue 15 00:00:38,079 --> 00:00:40,079 team village and one of the contributors 16 00:00:40,079 --> 00:00:41,520 for mitre defend 17 00:00:41,520 --> 00:00:43,760 projects in my free time i do some 18 00:00:43,760 --> 00:00:46,000 research and i do some practical 19 00:00:46,000 --> 00:00:48,879 experiments and sharing my finding on 20 00:00:48,879 --> 00:00:51,760 the form of the write up in my blog at 21 00:00:51,760 --> 00:00:53,840 cybermaysammedium.com 22 00:00:53,840 --> 00:00:55,520 or the shorter version in the daily 23 00:00:55,520 --> 00:00:57,680 basis at linkedin and twitter i would be 24 00:00:57,680 --> 00:00:59,199 more than happy to connect to you and 25 00:00:59,199 --> 00:01:00,480 more than happy to have you in my 26 00:01:00,480 --> 00:01:02,960 professional network so here is the 27 00:01:02,960 --> 00:01:05,438 agenda for today we are going to have a 28 00:01:05,438 --> 00:01:07,600 brief discussion about a reactive cyber 29 00:01:07,600 --> 00:01:09,760 security a little bit of the challenges 30 00:01:09,760 --> 00:01:11,920 and why we need proactive cybersecurity 31 00:01:11,920 --> 00:01:13,520 in parallel 32 00:01:13,520 --> 00:01:15,840 we continue with explanation of a 33 00:01:15,840 --> 00:01:18,400 fileless thread that we are going to 34 00:01:18,400 --> 00:01:20,000 hunt in this 35 00:01:20,000 --> 00:01:22,560 trilogy with three different methods 36 00:01:22,560 --> 00:01:25,360 system live analysis memory forensics 37 00:01:25,360 --> 00:01:29,600 and network packet investigations 38 00:01:30,159 --> 00:01:32,240 hunt before getting hunted 39 00:01:32,240 --> 00:01:34,720 reactive cyber security 40 00:01:34,720 --> 00:01:37,040 in this case we expand heavily on the 41 00:01:37,040 --> 00:01:39,040 technology we deploy them in the 42 00:01:39,040 --> 00:01:41,040 multi-layered approach 43 00:01:41,040 --> 00:01:43,119 we assume protection and we keep 44 00:01:43,119 --> 00:01:45,600 monitoring in case cyber security 45 00:01:45,600 --> 00:01:47,840 happened which must probably happen 46 00:01:47,840 --> 00:01:50,000 we trigger the incident response and 47 00:01:50,000 --> 00:01:51,759 following by a digital forensic 48 00:01:51,759 --> 00:01:53,840 investigation nothing wrong with this 49 00:01:53,840 --> 00:01:55,520 approach actually the reactive cyber 50 00:01:55,520 --> 00:01:57,680 security is an integral part of our 51 00:01:57,680 --> 00:01:59,200 strategy 52 00:01:59,200 --> 00:02:02,479 but according to the ibm only 80 percent 53 00:02:02,479 --> 00:02:04,799 of the cyber threat and attacks can be 54 00:02:04,799 --> 00:02:06,960 successfully detected by automated cyber 55 00:02:06,960 --> 00:02:08,399 security solutions 56 00:02:08,399 --> 00:02:11,440 suck tier one and tier two the remaining 57 00:02:11,440 --> 00:02:14,000 are those sophisticated attacks that can 58 00:02:14,000 --> 00:02:16,800 avoid the standard detections 59 00:02:16,800 --> 00:02:19,280 bypass our cyber security solution and 60 00:02:19,280 --> 00:02:21,760 remain undetected in our environment up 61 00:02:21,760 --> 00:02:25,120 to 280 days which is quite a long period 62 00:02:25,120 --> 00:02:27,040 of time for an attacker to play around 63 00:02:27,040 --> 00:02:29,920 in our environment and cause serious 64 00:02:29,920 --> 00:02:32,959 damages so one of those sophistic attack 65 00:02:32,959 --> 00:02:35,200 is fireless threat 66 00:02:35,200 --> 00:02:37,280 so when we talk about a file list thread 67 00:02:37,280 --> 00:02:39,760 it doesn't mean that there is no file 68 00:02:39,760 --> 00:02:41,920 activity involved or there will be no 69 00:02:41,920 --> 00:02:44,959 trace remain on the hard disk yes there 70 00:02:44,959 --> 00:02:48,160 is a there are a rare type of the 71 00:02:48,160 --> 00:02:50,400 files thread which completely without 72 00:02:50,400 --> 00:02:51,440 files 73 00:02:51,440 --> 00:02:54,239 completely operates in the memory and 74 00:02:54,239 --> 00:02:56,000 never touch the hard disk but they are 75 00:02:56,000 --> 00:02:58,400 rare and very difficult to implement it 76 00:02:58,400 --> 00:03:01,360 in general a fileless thread either need 77 00:03:01,360 --> 00:03:04,720 a file to operate or indirectly use a 78 00:03:04,720 --> 00:03:06,640 file on the hard disk 79 00:03:06,640 --> 00:03:09,840 in partially in their life cycle then 80 00:03:09,840 --> 00:03:11,760 why they call it files thread 81 00:03:11,760 --> 00:03:14,080 because the malicious part of the 82 00:03:14,080 --> 00:03:16,560 activity is only conducted in the memory 83 00:03:16,560 --> 00:03:18,800 the malicious part are memory based and 84 00:03:18,800 --> 00:03:21,360 not firebase that's why we call them 85 00:03:21,360 --> 00:03:24,080 fileless threat so and that's why they 86 00:03:24,080 --> 00:03:27,519 can bypass our automated cyber security 87 00:03:27,519 --> 00:03:29,920 so having a reactive cyber security in 88 00:03:29,920 --> 00:03:32,080 our organization is a must but it would 89 00:03:32,080 --> 00:03:35,120 be great idea if in parallel we can add 90 00:03:35,120 --> 00:03:37,840 on a proactive approach 91 00:03:37,840 --> 00:03:40,640 in proactive cyber security 92 00:03:40,640 --> 00:03:43,920 unlike the reactive we assume a breach 93 00:03:43,920 --> 00:03:47,200 we assume that despite the fact that we 94 00:03:47,200 --> 00:03:49,840 spend a lot of time energy and money on 95 00:03:49,840 --> 00:03:52,080 our technology to fine-tuning our 96 00:03:52,080 --> 00:03:55,200 process educate our staff a cyber 97 00:03:55,200 --> 00:03:57,280 security can occur 98 00:03:57,280 --> 00:03:58,799 yes 99 00:03:58,799 --> 00:04:02,959 as explained by the swiss cheese model 100 00:04:02,959 --> 00:04:06,239 a tiny crack like misconfiguration like 101 00:04:06,239 --> 00:04:08,159 human error 102 00:04:08,159 --> 00:04:11,599 like a scope x and blind spot in every 103 00:04:11,599 --> 00:04:13,519 layer in each layer of our cyber 104 00:04:13,519 --> 00:04:16,160 security model could give a way to a 105 00:04:16,160 --> 00:04:18,000 cyber attacker to walk into our 106 00:04:18,000 --> 00:04:20,560 environment and conquer our cyber 107 00:04:20,560 --> 00:04:23,520 our digital wonderland that's why no 108 00:04:23,520 --> 00:04:26,800 harm to assume a bridge keep hunting fix 109 00:04:26,800 --> 00:04:29,360 improve and prevent the things where 110 00:04:29,360 --> 00:04:30,960 it's possible 111 00:04:30,960 --> 00:04:33,040 so 112 00:04:33,040 --> 00:04:35,199 the proactive cyber security help us to 113 00:04:35,199 --> 00:04:37,680 identify the unknowns and 114 00:04:37,680 --> 00:04:38,800 issues 115 00:04:38,800 --> 00:04:41,040 discovering a new attack service of 116 00:04:41,040 --> 00:04:43,280 course effective risk management and 117 00:04:43,280 --> 00:04:45,440 rapid response to the threats most 118 00:04:45,440 --> 00:04:48,720 importantly minimizing cyber 119 00:04:48,720 --> 00:04:52,080 dual time the earlier lvd take the issue 120 00:04:52,080 --> 00:04:54,720 the faster and the better we may able to 121 00:04:54,720 --> 00:04:56,800 respond and during this process of 122 00:04:56,800 --> 00:04:59,040 course we can enhance our capability and 123 00:04:59,040 --> 00:05:01,919 the maturity level reduce the risk and 124 00:05:01,919 --> 00:05:04,400 damage in overall is a main advantage of 125 00:05:04,400 --> 00:05:06,800 the proactive cyber security there are a 126 00:05:06,800 --> 00:05:08,320 lot of proactive cyber security 127 00:05:08,320 --> 00:05:10,160 practices like security awareness for a 128 00:05:10,160 --> 00:05:13,360 staff cyber drill to fine tune other 129 00:05:13,360 --> 00:05:15,440 processes and 130 00:05:15,440 --> 00:05:17,759 one of the technical ones is threat 131 00:05:17,759 --> 00:05:20,560 hunting threat hunting is a human driven 132 00:05:20,560 --> 00:05:23,280 practice to iteratively look for any 133 00:05:23,280 --> 00:05:25,840 cypher any sign of malicious activity in 134 00:05:25,840 --> 00:05:27,199 our environment 135 00:05:27,199 --> 00:05:30,880 in the past and presence so 136 00:05:30,880 --> 00:05:33,360 in third hunting we have two type in 137 00:05:33,360 --> 00:05:36,320 general and structure and a structure 138 00:05:36,320 --> 00:05:38,720 one in this presentation we are focusing 139 00:05:38,720 --> 00:05:40,560 on the structure thread hunting which is 140 00:05:40,560 --> 00:05:42,880 work around educated guess or a 141 00:05:42,880 --> 00:05:45,360 hypothesis the i hope the ipo the 142 00:05:45,360 --> 00:05:47,680 hypothesis is the initial idea that 143 00:05:47,680 --> 00:05:48,960 tells us 144 00:05:48,960 --> 00:05:51,680 what we should look for and how to look 145 00:05:51,680 --> 00:05:54,000 for and a set of steps that turret 146 00:05:54,000 --> 00:05:55,919 hunter can follow 147 00:05:55,919 --> 00:05:59,680 to detect a potential cyber attack the 148 00:05:59,680 --> 00:06:01,919 hypothesis can be formed around an 149 00:06:01,919 --> 00:06:04,400 entity for example the high value assets 150 00:06:04,400 --> 00:06:07,039 or high risk users normally and mainly 151 00:06:07,039 --> 00:06:08,960 we focus on the assets only but we 152 00:06:08,960 --> 00:06:10,639 should keep in mind that behind every 153 00:06:10,639 --> 00:06:13,440 assets there is a human who interact 154 00:06:13,440 --> 00:06:15,680 with that assets own that assets and 155 00:06:15,680 --> 00:06:17,840 control and have access to 156 00:06:17,840 --> 00:06:20,080 data on that assets that's why it's very 157 00:06:20,080 --> 00:06:22,000 important in our hypothesis to consider 158 00:06:22,000 --> 00:06:24,400 the high value assets and high risk 159 00:06:24,400 --> 00:06:27,039 users it could be intel intel driven for 160 00:06:27,039 --> 00:06:29,440 example a new news about some attacks 161 00:06:29,440 --> 00:06:31,919 happen on the particular sector and if 162 00:06:31,919 --> 00:06:33,680 by chance we are in the same sector the 163 00:06:33,680 --> 00:06:35,759 chance that we will be the next target 164 00:06:35,759 --> 00:06:38,560 is there so we can 165 00:06:38,560 --> 00:06:40,960 trigger a hunt on that direction 166 00:06:40,960 --> 00:06:43,600 so uh in this presentation we are 167 00:06:43,600 --> 00:06:46,240 focusing on the ttp driven which is 168 00:06:46,240 --> 00:06:48,319 based on the attack techniques that used 169 00:06:48,319 --> 00:06:49,520 by the 170 00:06:49,520 --> 00:06:50,560 attack 171 00:06:50,560 --> 00:06:53,680 vectors in order to educate our guests 172 00:06:53,680 --> 00:06:55,919 and form the hypotheses we need a trend 173 00:06:55,919 --> 00:06:58,400 hunt loop which is the entire life cycle 174 00:06:58,400 --> 00:07:00,560 of a tread hunting start with the 175 00:07:00,560 --> 00:07:03,199 initial observation to formulate a 176 00:07:03,199 --> 00:07:05,199 hypothesis to formulate the hypotheses 177 00:07:05,199 --> 00:07:07,440 we can get the aid of the cyber threat 178 00:07:07,440 --> 00:07:10,240 intelligence the other services outcomes 179 00:07:10,240 --> 00:07:12,560 for example if the red team or bully 180 00:07:12,560 --> 00:07:14,479 team practices conducted on our 181 00:07:14,479 --> 00:07:18,000 environment and they find some issue and 182 00:07:18,000 --> 00:07:19,759 and 183 00:07:19,759 --> 00:07:22,319 vulnerabilities we could assume that any 184 00:07:22,319 --> 00:07:24,240 of those issues and vulnerabilities may 185 00:07:24,240 --> 00:07:26,240 be used by the attackers already and 186 00:07:26,240 --> 00:07:28,720 they are in our environment then we know 187 00:07:28,720 --> 00:07:30,960 what we are looking 188 00:07:30,960 --> 00:07:33,840 for so in this presentation we focus on 189 00:07:33,840 --> 00:07:36,160 the knowledge base we will talk about it 190 00:07:36,160 --> 00:07:38,800 shortly once we formulate our hypothesis 191 00:07:38,800 --> 00:07:40,400 we should analyze the requirement 192 00:07:40,400 --> 00:07:42,319 including the source of the data the 193 00:07:42,319 --> 00:07:44,080 tools we need and the technique we need 194 00:07:44,080 --> 00:07:46,800 to collect the data and analyze the data 195 00:07:46,800 --> 00:07:48,639 then we continue with the investigate 196 00:07:48,639 --> 00:07:51,039 and hunt during the investigate and hunt 197 00:07:51,039 --> 00:07:53,199 we may private to the other source of 198 00:07:53,199 --> 00:07:55,680 the data we may actually use a chain of 199 00:07:55,680 --> 00:07:57,759 hypotheses from hypothesis one we may 200 00:07:57,759 --> 00:08:00,080 move to the another educated guesses and 201 00:08:00,080 --> 00:08:02,479 hypotheses so when we come to the 202 00:08:02,479 --> 00:08:04,560 finding we should definitely record them 203 00:08:04,560 --> 00:08:06,879 and validate them three conditions may 204 00:08:06,879 --> 00:08:07,759 happen 205 00:08:07,759 --> 00:08:09,199 either they're 206 00:08:09,199 --> 00:08:12,400 finding a firm so in this case we should 207 00:08:12,400 --> 00:08:13,840 trigger the incident response and 208 00:08:13,840 --> 00:08:15,840 digital forensics we conduct the 209 00:08:15,840 --> 00:08:17,759 compromise assessment for the rest of 210 00:08:17,759 --> 00:08:19,599 assets in our 211 00:08:19,599 --> 00:08:22,160 network of course the enrichment and the 212 00:08:22,160 --> 00:08:25,039 automation and most importantly develop 213 00:08:25,039 --> 00:08:27,599 a new detection content with the future 214 00:08:27,599 --> 00:08:30,639 we don't want to manually hunt every and 215 00:08:30,639 --> 00:08:32,399 each time for the similar cases like 216 00:08:32,399 --> 00:08:34,640 things should be automated once they are 217 00:08:34,640 --> 00:08:35,599 known 218 00:08:35,599 --> 00:08:38,839 so a finding could be rejected or 219 00:08:38,839 --> 00:08:41,519 inconclusive in the case of rejected in 220 00:08:41,519 --> 00:08:42,719 it doesn't mean that we should have 221 00:08:42,719 --> 00:08:44,880 peace of mind maybe this hypothesis 222 00:08:44,880 --> 00:08:46,959 reject we need another 223 00:08:46,959 --> 00:08:49,120 advanced hypothesis to look for another 224 00:08:49,120 --> 00:08:52,080 source of data and so on in in case of 225 00:08:52,080 --> 00:08:54,800 the inconclusive it's maybe because we 226 00:08:54,800 --> 00:08:57,440 have the immature hypothesis that we 227 00:08:57,440 --> 00:09:00,880 need to work around that or we use the 228 00:09:00,880 --> 00:09:02,959 wrong data source and 229 00:09:02,959 --> 00:09:06,399 inappropriate tools 230 00:09:06,399 --> 00:09:08,880 regardless of which loop we are using we 231 00:09:08,880 --> 00:09:11,440 should always repeat review improve 232 00:09:11,440 --> 00:09:13,440 document and update 233 00:09:13,440 --> 00:09:16,880 everything so let's use this thread hunt 234 00:09:16,880 --> 00:09:22,200 loop to hunt a file less threat 235 00:09:24,000 --> 00:09:26,320 an excellent fileless script written by 236 00:09:26,320 --> 00:09:28,399 daniel laurie that enable us to 237 00:09:28,399 --> 00:09:30,880 demonstrate some kind of fileless thread 238 00:09:30,880 --> 00:09:33,120 activities and how to hunt them if you 239 00:09:33,120 --> 00:09:36,000 are keen to know more about it and 240 00:09:36,000 --> 00:09:38,000 having a view of a step-by-step 241 00:09:38,000 --> 00:09:39,839 implementation you can follow his 242 00:09:39,839 --> 00:09:41,839 youtube channel the scripts also 243 00:09:41,839 --> 00:09:43,680 available in his github page you can 244 00:09:43,680 --> 00:09:45,360 easily download them execute them in 245 00:09:45,360 --> 00:09:47,519 your test environment to sharpen your 246 00:09:47,519 --> 00:09:50,160 skills so the life cycle of this attack 247 00:09:50,160 --> 00:09:53,680 starts with a fake update script 248 00:09:53,680 --> 00:09:56,080 which is somehow gets into the victim 249 00:09:56,080 --> 00:09:58,560 machine how it has happened this is not 250 00:09:58,560 --> 00:10:00,800 the case to discuss here because we 251 00:10:00,800 --> 00:10:03,040 assume a breach we assume an attacker 252 00:10:03,040 --> 00:10:04,480 use many techniques like social 253 00:10:04,480 --> 00:10:06,880 engineering on a specific or a special 254 00:10:06,880 --> 00:10:09,920 specific vulnerability to drop that file 255 00:10:09,920 --> 00:10:12,399 in a victim machine and convince user to 256 00:10:12,399 --> 00:10:14,959 click on it once the user execute the 257 00:10:14,959 --> 00:10:17,120 script it pretends that there is some 258 00:10:17,120 --> 00:10:20,480 update related activities ongoing but in 259 00:10:20,480 --> 00:10:23,279 fact it connects to the server which has 260 00:10:23,279 --> 00:10:25,920 a secondary malicious script 261 00:10:25,920 --> 00:10:28,240 download them and execute them directly 262 00:10:28,240 --> 00:10:30,800 into the memory without touching the 263 00:10:30,800 --> 00:10:33,839 hard disk and then give us a reverse tcp 264 00:10:33,839 --> 00:10:36,560 shell and remote access let's have a 265 00:10:36,560 --> 00:10:38,079 quick view 266 00:10:38,079 --> 00:10:41,360 so here i set up a http simple http 267 00:10:41,360 --> 00:10:43,120 server in the kali and then i run my 268 00:10:43,120 --> 00:10:46,399 ncli center on port 443 i execute the 269 00:10:46,399 --> 00:10:48,480 update script as you can see it shows 270 00:10:48,480 --> 00:10:51,760 that some update is going on but in fact 271 00:10:51,760 --> 00:10:53,680 it's downloading the 272 00:10:53,680 --> 00:10:55,120 other scripts 273 00:10:55,120 --> 00:10:57,680 run them and execute them in the memory 274 00:10:57,680 --> 00:10:59,440 and give us a 275 00:10:59,440 --> 00:11:00,399 remote 276 00:11:00,399 --> 00:11:02,800 access 277 00:11:04,560 --> 00:11:06,959 so i run this in the three different 278 00:11:06,959 --> 00:11:09,120 scenarios for the windows live analysis 279 00:11:09,120 --> 00:11:11,600 i use a windows 11 as infected as a 280 00:11:11,600 --> 00:11:13,760 victim machine and i am going to use 281 00:11:13,760 --> 00:11:15,600 this internal and built-in command to 282 00:11:15,600 --> 00:11:18,320 hunt for windows for memory forensic i 283 00:11:18,320 --> 00:11:20,959 use a windows 10 why not 11 this is what 284 00:11:20,959 --> 00:11:22,959 we will discuss at the end of this and 285 00:11:22,959 --> 00:11:24,720 end of this presentation 286 00:11:24,720 --> 00:11:26,720 i used i will use the volatility 287 00:11:26,720 --> 00:11:30,000 framework and bulk extractor and strings 288 00:11:30,000 --> 00:11:32,399 to hunt in the memory for network packet 289 00:11:32,399 --> 00:11:34,959 investigation again i use the windows 11 290 00:11:34,959 --> 00:11:37,200 and i'm going to use wireshark t-sharp 291 00:11:37,200 --> 00:11:39,680 tcp dom and t-sharp extractor kindly 292 00:11:39,680 --> 00:11:41,760 note that i'm not whitelisting any tools 293 00:11:41,760 --> 00:11:43,360 these are simply the tools that i feel 294 00:11:43,360 --> 00:11:45,760 comfortable with and of course all of 295 00:11:45,760 --> 00:11:48,480 them are free and open source so to 296 00:11:48,480 --> 00:11:50,639 generate the hypotheses we are using a 297 00:11:50,639 --> 00:11:52,880 three different knowledge bases by the 298 00:11:52,880 --> 00:11:56,880 miter miter attack miter defend and 299 00:11:56,880 --> 00:12:00,000 cyber analytics repository 300 00:12:00,000 --> 00:12:03,120 let the hunt begins 301 00:12:07,680 --> 00:12:09,760 this time live analysis is a hunt that 302 00:12:09,760 --> 00:12:12,160 we can't really refuse and it simply 303 00:12:12,160 --> 00:12:13,760 refers to the technique in which a 304 00:12:13,760 --> 00:12:15,920 hunter collects the data from a running 305 00:12:15,920 --> 00:12:18,560 system that may provide us a better 306 00:12:18,560 --> 00:12:20,959 understanding of the outgoing events 307 00:12:20,959 --> 00:12:23,040 compared to the 308 00:12:23,040 --> 00:12:25,920 debt forensic or forensic image analysis 309 00:12:25,920 --> 00:12:28,720 there are a lot of data a wide variety 310 00:12:28,720 --> 00:12:30,560 of information to be collected from 311 00:12:30,560 --> 00:12:32,720 system information and configuration 312 00:12:32,720 --> 00:12:35,120 user group and privileges install 313 00:12:35,120 --> 00:12:37,360 application and running services process 314 00:12:37,360 --> 00:12:39,760 dll handles network and internet relay 315 00:12:39,760 --> 00:12:42,560 related data and of course files and 316 00:12:42,560 --> 00:12:44,240 scripts because of the time limit we are 317 00:12:44,240 --> 00:12:46,399 not going to cover all of them here but 318 00:12:46,399 --> 00:12:49,519 i have advanced ongoing series on system 319 00:12:49,519 --> 00:12:51,279 live forensics in my blog 320 00:12:51,279 --> 00:12:53,360 cybermesamedium.com 321 00:12:53,360 --> 00:12:54,800 feel free to 322 00:12:54,800 --> 00:12:57,279 refer to that to having more advanced 323 00:12:57,279 --> 00:12:59,760 write-ups about the system live analysis 324 00:12:59,760 --> 00:13:01,760 so in this presentation we are only 325 00:13:01,760 --> 00:13:04,399 going to focus on the three 326 00:13:04,399 --> 00:13:06,320 source of the data which is process and 327 00:13:06,320 --> 00:13:09,600 handles network connections files and 328 00:13:09,600 --> 00:13:12,320 scripts so i'm going to start with the 329 00:13:12,320 --> 00:13:14,560 three simple steps that works for me in 330 00:13:14,560 --> 00:13:16,720 the most of the cases for initial 331 00:13:16,720 --> 00:13:19,040 educated guess and hypotheses which is 332 00:13:19,040 --> 00:13:22,480 collecting the running processes list 333 00:13:22,480 --> 00:13:23,920 the process that's running at that 334 00:13:23,920 --> 00:13:27,040 particular time in the our live system 335 00:13:27,040 --> 00:13:28,560 active network 336 00:13:28,560 --> 00:13:30,959 connection especially the tcp an 337 00:13:30,959 --> 00:13:33,760 established one and the process to port 338 00:13:33,760 --> 00:13:36,399 mapping to identify which process is 339 00:13:36,399 --> 00:13:40,079 behind that particular network uh 340 00:13:40,079 --> 00:13:41,360 connection 341 00:13:41,360 --> 00:13:43,120 uh so 342 00:13:43,120 --> 00:13:45,279 in order to get a list of the processes 343 00:13:45,279 --> 00:13:47,440 there are a lot of tools like 344 00:13:47,440 --> 00:13:49,760 a normal task manager 345 00:13:49,760 --> 00:13:51,519 or a task list which is the building 346 00:13:51,519 --> 00:13:53,680 command of the windows however i prefer 347 00:13:53,680 --> 00:13:55,920 to using the ps list from the microsoft 348 00:13:55,920 --> 00:14:00,240 sys internal because it gives us the 349 00:14:00,240 --> 00:14:03,040 hierarchy of the 350 00:14:03,040 --> 00:14:05,839 processes using the switch t with the ps 351 00:14:05,839 --> 00:14:09,760 list help us to have the process lineage 352 00:14:09,760 --> 00:14:12,320 analysis or process three analyzes which 353 00:14:12,320 --> 00:14:14,800 is suggested by the 354 00:14:14,800 --> 00:14:17,199 defense knowledge base 355 00:14:17,199 --> 00:14:19,680 actually we try to understand who is the 356 00:14:19,680 --> 00:14:21,519 parent of each process who are the 357 00:14:21,519 --> 00:14:23,920 siblings and gather the information on 358 00:14:23,920 --> 00:14:26,800 how a process initiated and that may 359 00:14:26,800 --> 00:14:28,959 help us to determine whether the process 360 00:14:28,959 --> 00:14:29,680 is 361 00:14:29,680 --> 00:14:32,800 malicious or a normal one 362 00:14:32,800 --> 00:14:34,639 so running the ps list on the victim 363 00:14:34,639 --> 00:14:38,240 machine should show us the two instances 364 00:14:38,240 --> 00:14:39,839 of the power shell which is already 365 00:14:39,839 --> 00:14:40,959 alarming 366 00:14:40,959 --> 00:14:44,959 executed with the under the cmd as a 367 00:14:44,959 --> 00:14:48,160 parent so immediately is trigger one of 368 00:14:48,160 --> 00:14:49,279 the 369 00:14:49,279 --> 00:14:52,399 cyber analytics repository detection 370 00:14:52,399 --> 00:14:55,519 cases which is powershell executions and 371 00:14:55,519 --> 00:14:57,839 suggests that a hunter should look for 372 00:14:57,839 --> 00:14:59,839 any version of the 373 00:14:59,839 --> 00:15:01,440 powershell 374 00:15:01,440 --> 00:15:03,839 that will not launch 375 00:15:03,839 --> 00:15:05,279 interactively 376 00:15:05,279 --> 00:15:07,440 interactively technically means that i 377 00:15:07,440 --> 00:15:09,199 am as a user for example let's say 378 00:15:09,199 --> 00:15:11,600 network admin directly 379 00:15:11,600 --> 00:15:13,199 execute the 380 00:15:13,199 --> 00:15:15,600 powershell which in that case 381 00:15:15,600 --> 00:15:18,480 the parent should be explorer as we can 382 00:15:18,480 --> 00:15:21,040 see here the parent here is a cmd means 383 00:15:21,040 --> 00:15:24,399 it's not interactively executed by a 384 00:15:24,399 --> 00:15:26,959 user the good things about the miter 385 00:15:26,959 --> 00:15:28,800 analytics is that for most of the 386 00:15:28,800 --> 00:15:30,880 detection case they provide us the 387 00:15:30,880 --> 00:15:32,959 generic soda code that we can easily 388 00:15:32,959 --> 00:15:34,399 understand how to implement the 389 00:15:34,399 --> 00:15:37,120 detection rule for our automation cyber 390 00:15:37,120 --> 00:15:38,720 security and 391 00:15:38,720 --> 00:15:40,480 solutions so 392 00:15:40,480 --> 00:15:42,800 another detection case that related to 393 00:15:42,800 --> 00:15:43,839 the 394 00:15:43,839 --> 00:15:46,320 process and the process list is the 395 00:15:46,320 --> 00:15:49,199 common windows process names that 396 00:15:49,199 --> 00:15:52,000 misused by the attacker or used by the 397 00:15:52,000 --> 00:15:54,240 attackers to hide their malicious 398 00:15:54,240 --> 00:15:58,320 activities so the attacker use 399 00:15:58,399 --> 00:16:01,199 a standard name to hide their malicious 400 00:16:01,199 --> 00:16:03,839 activity so as a first detection hunt 401 00:16:03,839 --> 00:16:06,000 and detection let's check whether these 402 00:16:06,000 --> 00:16:09,600 processes are fake or the real and 403 00:16:09,600 --> 00:16:12,079 standard windows processes 404 00:16:12,079 --> 00:16:14,399 so again the miter attack knowledge base 405 00:16:14,399 --> 00:16:16,000 give us some 406 00:16:16,000 --> 00:16:18,320 the list of the detection methods on how 407 00:16:18,320 --> 00:16:21,040 to check whether these 408 00:16:21,040 --> 00:16:24,320 files these processes are a standard so 409 00:16:24,320 --> 00:16:26,160 they suggest two 410 00:16:26,160 --> 00:16:29,519 if the file with no names but in unusual 411 00:16:29,519 --> 00:16:32,480 location are suspected or the file 412 00:16:32,480 --> 00:16:33,680 hashes 413 00:16:33,680 --> 00:16:36,560 that do not match what they're supposed 414 00:16:36,560 --> 00:16:39,360 to be actually for this case out of this 415 00:16:39,360 --> 00:16:41,759 long list i'm uh using one of them which 416 00:16:41,759 --> 00:16:44,160 is the much legitimate name or 417 00:16:44,160 --> 00:16:48,079 location so a simple wmic process helped 418 00:16:48,079 --> 00:16:50,480 me to get the process id plus the 419 00:16:50,480 --> 00:16:53,360 executable path and 420 00:16:53,360 --> 00:16:56,240 in order to have a narrow down domain i 421 00:16:56,240 --> 00:16:58,880 just limited the finding only to those 422 00:16:58,880 --> 00:17:01,600 four processes so as we can see here it 423 00:17:01,600 --> 00:17:03,279 seems they are legitimate because they 424 00:17:03,279 --> 00:17:05,640 are executing from the standard windows 425 00:17:05,640 --> 00:17:07,280 system32 426 00:17:07,280 --> 00:17:10,799 folder so let's switch to the 427 00:17:10,799 --> 00:17:12,480 hash values 428 00:17:12,480 --> 00:17:15,679 get file hash function of the powershell 429 00:17:15,679 --> 00:17:18,480 help us to generate the hash value of 430 00:17:18,480 --> 00:17:21,760 those four processes so this had these 431 00:17:21,760 --> 00:17:24,319 hash values can be correlated via our 432 00:17:24,319 --> 00:17:26,640 knowledge base our internal resources 433 00:17:26,640 --> 00:17:29,039 community or simply submit to the 434 00:17:29,039 --> 00:17:31,280 publicly available resources like 435 00:17:31,280 --> 00:17:33,360 various total in this case i submit the 436 00:17:33,360 --> 00:17:35,840 conhast hash value to the various total 437 00:17:35,840 --> 00:17:38,799 which confirm to be a legitimate 438 00:17:38,799 --> 00:17:40,000 can 439 00:17:40,000 --> 00:17:43,760 host so still no peace of mind 440 00:17:43,760 --> 00:17:45,280 even though these processes are 441 00:17:45,280 --> 00:17:47,440 legitimate and standard they are still a 442 00:17:47,440 --> 00:17:49,440 chance that they are misused by the 443 00:17:49,440 --> 00:17:51,840 attacker that's why we go to the another 444 00:17:51,840 --> 00:17:54,400 useful detection case by miter defend 445 00:17:54,400 --> 00:17:57,760 which is a file access pattern analysis 446 00:17:57,760 --> 00:18:00,559 they provide a very handy example for us 447 00:18:00,559 --> 00:18:02,160 how to detect the vipers and the 448 00:18:02,160 --> 00:18:04,880 ransomwares in case a process has access 449 00:18:04,880 --> 00:18:06,880 to the multiple 450 00:18:06,880 --> 00:18:09,360 multiple file types access to the many 451 00:18:09,360 --> 00:18:11,679 files which is located in the multiple 452 00:18:11,679 --> 00:18:15,039 location and directories it could be an 453 00:18:15,039 --> 00:18:16,559 indicator of 454 00:18:16,559 --> 00:18:19,679 wipers or ransomwares another handy 455 00:18:19,679 --> 00:18:21,440 tools of the sys internal which is 456 00:18:21,440 --> 00:18:23,679 handle help us to have 457 00:18:23,679 --> 00:18:25,679 to gain the information 458 00:18:25,679 --> 00:18:27,840 about the what are the files and 459 00:18:27,840 --> 00:18:31,120 resources that access by the particular 460 00:18:31,120 --> 00:18:33,840 process so i'm using the normal one 461 00:18:33,840 --> 00:18:36,559 first without any switch against the cmd 462 00:18:36,559 --> 00:18:39,039 and it shows that it has some access to 463 00:18:39,039 --> 00:18:41,200 the file which is located in the windows 464 00:18:41,200 --> 00:18:43,520 cyber may some download obviously 465 00:18:43,520 --> 00:18:45,200 because as we remember 466 00:18:45,200 --> 00:18:47,760 our dropper executed from the same exact 467 00:18:47,760 --> 00:18:48,960 path 468 00:18:48,960 --> 00:18:50,720 so uh 469 00:18:50,720 --> 00:18:53,360 i continue with having switch a 470 00:18:53,360 --> 00:18:55,840 with the handle because it gives us more 471 00:18:55,840 --> 00:18:57,840 compressive information like the port 472 00:18:57,840 --> 00:19:00,080 registery keys threads and all the 473 00:19:00,080 --> 00:19:02,960 process accessed by a particular process 474 00:19:02,960 --> 00:19:05,120 which is in this case these four 475 00:19:05,120 --> 00:19:07,600 instances and surprisingly i have seen a 476 00:19:07,600 --> 00:19:08,640 lot of 477 00:19:08,640 --> 00:19:10,640 indicators definitely all of them has 478 00:19:10,640 --> 00:19:13,520 access to the cyber mesa and download so 479 00:19:13,520 --> 00:19:15,200 we can see 480 00:19:15,200 --> 00:19:17,360 a powershell has a handle which 481 00:19:17,360 --> 00:19:19,760 technically means access to the 482 00:19:19,760 --> 00:19:22,720 crypt 32 dll which basically used by the 483 00:19:22,720 --> 00:19:26,400 processes in case they want to use some 484 00:19:26,400 --> 00:19:28,400 encryption and decryption 485 00:19:28,400 --> 00:19:30,880 functionalities we can see some sort of 486 00:19:30,880 --> 00:19:33,200 the information related to the network 487 00:19:33,200 --> 00:19:36,000 configuration and tcp which indicates 488 00:19:36,000 --> 00:19:38,320 that somehow this power shelf has to do 489 00:19:38,320 --> 00:19:40,720 what they're doing something related to 490 00:19:40,720 --> 00:19:43,600 the network in generic all of them are 491 00:19:43,600 --> 00:19:44,880 alarming 492 00:19:44,880 --> 00:19:47,520 let's continue with another useful one 493 00:19:47,520 --> 00:19:50,640 which is a command and scriptings so 494 00:19:50,640 --> 00:19:52,880 miter attack 495 00:19:52,880 --> 00:19:55,679 knowledge base suggests that 496 00:19:55,679 --> 00:19:57,440 we should monitor a command line 497 00:19:57,440 --> 00:20:01,520 argument for script executed by the 498 00:20:01,520 --> 00:20:04,559 any any process those commands may give 499 00:20:04,559 --> 00:20:06,559 us some information about what is going 500 00:20:06,559 --> 00:20:09,520 on and what each process try to do 501 00:20:09,520 --> 00:20:12,640 so a simple wmic process 502 00:20:12,640 --> 00:20:13,440 get 503 00:20:13,440 --> 00:20:15,840 helped us enable us to get the process 504 00:20:15,840 --> 00:20:18,480 id name and the command line and again 505 00:20:18,480 --> 00:20:20,799 limited to only those four 506 00:20:20,799 --> 00:20:21,840 so 507 00:20:21,840 --> 00:20:24,559 the command executed by the cmd is 508 00:20:24,559 --> 00:20:26,559 interesting because it shows a batch 509 00:20:26,559 --> 00:20:29,360 file with that that cmd extension is 510 00:20:29,360 --> 00:20:32,320 executed from a download folder download 511 00:20:32,320 --> 00:20:36,159 folder alone is alarming indicator 512 00:20:36,159 --> 00:20:38,320 because it shows that something may 513 00:20:38,320 --> 00:20:40,720 download by the user in the download 514 00:20:40,720 --> 00:20:43,200 folder and execute it 515 00:20:43,200 --> 00:20:44,559 accordingly 516 00:20:44,559 --> 00:20:46,880 so there are another interesting uh 517 00:20:46,880 --> 00:20:48,799 finding that i try to match them with 518 00:20:48,799 --> 00:20:49,840 the 519 00:20:49,840 --> 00:20:51,520 miter knowledge bases as much as 520 00:20:51,520 --> 00:20:53,360 possible for example 521 00:20:53,360 --> 00:20:55,760 cyber analytics again says that 522 00:20:55,760 --> 00:20:59,120 unusually long command line strings 523 00:20:59,120 --> 00:21:00,400 normally 524 00:21:00,400 --> 00:21:01,840 is the indicator of the malevolent 525 00:21:01,840 --> 00:21:04,400 activity however they didn't define the 526 00:21:04,400 --> 00:21:06,480 long how long it should be 527 00:21:06,480 --> 00:21:08,320 but in this case as you can see we have 528 00:21:08,320 --> 00:21:10,720 a very long one that indicate the use of 529 00:21:10,720 --> 00:21:12,640 the download string the function of the 530 00:21:12,640 --> 00:21:14,640 powershell that used to directly 531 00:21:14,640 --> 00:21:17,679 download and execute the scripts into 532 00:21:17,679 --> 00:21:20,240 the memory video touching a file and in 533 00:21:20,240 --> 00:21:22,000 this case as you can see the vin 534 00:21:22,000 --> 00:21:24,640 security update is a script that 535 00:21:24,640 --> 00:21:27,360 download it by using the same technique 536 00:21:27,360 --> 00:21:29,120 and function after 537 00:21:29,120 --> 00:21:31,600 powershell so another thing is a hide 538 00:21:31,600 --> 00:21:33,760 artifacts normally attackers try to hide 539 00:21:33,760 --> 00:21:36,559 their activity yes and in this case you 540 00:21:36,559 --> 00:21:38,960 can see the use of the nop and windows 541 00:21:38,960 --> 00:21:41,280 style hidden to hide the windows related 542 00:21:41,280 --> 00:21:44,000 to the script running on the victim 543 00:21:44,000 --> 00:21:45,520 machine 544 00:21:45,520 --> 00:21:46,720 and so 545 00:21:46,720 --> 00:21:48,799 let's focus on the download file because 546 00:21:48,799 --> 00:21:51,120 this file downloaded and directly run in 547 00:21:51,120 --> 00:21:51,840 the 548 00:21:51,840 --> 00:21:53,520 memory the first thing we try to 549 00:21:53,520 --> 00:21:56,159 understand about this file and the cmd 550 00:21:56,159 --> 00:21:59,039 the script with the cmd extension is 551 00:21:59,039 --> 00:22:01,440 what is this file and who owns it this 552 00:22:01,440 --> 00:22:03,280 is what we call it a file and resource 553 00:22:03,280 --> 00:22:04,400 ownership 554 00:22:04,400 --> 00:22:06,080 so we can easily navigate to the 555 00:22:06,080 --> 00:22:08,960 download folder and use a dir 556 00:22:08,960 --> 00:22:10,480 with the q 557 00:22:10,480 --> 00:22:15,120 switch to shows the username behind that 558 00:22:15,120 --> 00:22:16,000 file 559 00:22:16,000 --> 00:22:17,919 here we can see the update script is 560 00:22:17,919 --> 00:22:20,080 still there and is owned by the user 561 00:22:20,080 --> 00:22:21,760 called cyber mesa 562 00:22:21,760 --> 00:22:24,000 if it's possible we should go and check 563 00:22:24,000 --> 00:22:26,400 the content of the file in this case you 564 00:22:26,400 --> 00:22:28,880 can see 565 00:22:29,520 --> 00:22:32,559 the command line which is executed and 566 00:22:32,559 --> 00:22:34,559 we observe it in the 567 00:22:34,559 --> 00:22:36,159 findings here 568 00:22:36,159 --> 00:22:39,200 it shows again the download of the win 569 00:22:39,200 --> 00:22:41,200 security update 570 00:22:41,200 --> 00:22:43,200 so what is this mean security object 571 00:22:43,200 --> 00:22:44,159 doing 572 00:22:44,159 --> 00:22:46,159 if there is a possibility 573 00:22:46,159 --> 00:22:47,600 we could you 574 00:22:47,600 --> 00:22:50,720 refer to the same url or ip and download 575 00:22:50,720 --> 00:22:53,520 the script in the isolated system for 576 00:22:53,520 --> 00:22:55,679 further analysis but it's not made 577 00:22:55,679 --> 00:22:57,840 possible all the time 578 00:22:57,840 --> 00:23:00,960 and if it's possible it may alert the 579 00:23:00,960 --> 00:23:04,000 attacker because if we are downloading 580 00:23:04,000 --> 00:23:06,159 from another location we technically 581 00:23:06,159 --> 00:23:07,760 tell the attacker hey buddy we are 582 00:23:07,760 --> 00:23:09,520 downloading your script and we are going 583 00:23:09,520 --> 00:23:12,240 to analyze it so in this case we are 584 00:23:12,240 --> 00:23:13,600 getting the 585 00:23:13,600 --> 00:23:16,320 win security update and we check the 586 00:23:16,320 --> 00:23:18,240 content and we can see 587 00:23:18,240 --> 00:23:19,679 uh 588 00:23:19,679 --> 00:23:22,799 encoded the 589 00:23:22,799 --> 00:23:25,840 encoded information no makes sense why 590 00:23:25,840 --> 00:23:29,039 the power shell has act has had access 591 00:23:29,039 --> 00:23:31,760 to the crypt 32 dll because it's using 592 00:23:31,760 --> 00:23:32,640 the 593 00:23:32,640 --> 00:23:35,520 some sort after decode and encode the 594 00:23:35,520 --> 00:23:36,400 data 595 00:23:36,400 --> 00:23:37,440 so 596 00:23:37,440 --> 00:23:40,559 it is the simple base64 we technically 597 00:23:40,559 --> 00:23:43,360 can use the echo and the decode 598 00:23:43,360 --> 00:23:44,960 extension in the 599 00:23:44,960 --> 00:23:47,919 kali linux to decode the data which 600 00:23:47,919 --> 00:23:51,200 indicate another attempt to download the 601 00:23:51,200 --> 00:23:52,880 secondary 602 00:23:52,880 --> 00:23:54,720 scripts so 603 00:23:54,720 --> 00:23:58,159 having the having the view of the r1 604 00:23:58,159 --> 00:23:59,440 shows that 605 00:23:59,440 --> 00:24:02,960 a sucre tcp client used to establish a 606 00:24:02,960 --> 00:24:05,520 tcp 607 00:24:05,520 --> 00:24:07,679 connection to a 608 00:24:07,679 --> 00:24:09,679 potentially attacker machine via the 609 00:24:09,679 --> 00:24:12,960 port 443 which is a reverse 610 00:24:12,960 --> 00:24:15,840 shell so when we talk about a reverse 611 00:24:15,840 --> 00:24:18,880 shell means a network activity is there 612 00:24:18,880 --> 00:24:20,840 the miter attack 613 00:24:20,840 --> 00:24:24,640 t1049 suggests that attackers normally 614 00:24:24,640 --> 00:24:26,960 upend the initial access to the victim 615 00:24:26,960 --> 00:24:28,960 machine try to discover the network 616 00:24:28,960 --> 00:24:31,600 connection to evaluate the possibility 617 00:24:31,600 --> 00:24:34,480 of the finding another vulnerable system 618 00:24:34,480 --> 00:24:36,480 or the connectivity 619 00:24:36,480 --> 00:24:38,640 let's think if the attacker can use this 620 00:24:38,640 --> 00:24:40,640 technique for the bad 621 00:24:40,640 --> 00:24:42,320 intentions 622 00:24:42,320 --> 00:24:46,240 we as a hunters can use it for good so 623 00:24:46,240 --> 00:24:47,919 we can have the list of network 624 00:24:47,919 --> 00:24:50,159 connections to see what is going on a 625 00:24:50,159 --> 00:24:52,799 simple net state dash a and o help us to 626 00:24:52,799 --> 00:24:54,480 have the list of all the network 627 00:24:54,480 --> 00:24:56,640 connections especially the established 628 00:24:56,640 --> 00:25:00,400 tcp one as we can see here the network 629 00:25:00,400 --> 00:25:02,480 connection is still there which is 630 00:25:02,480 --> 00:25:05,480 established by the process id 631 00:25:05,480 --> 00:25:07,120 9392 632 00:25:07,120 --> 00:25:08,640 to the 633 00:25:08,640 --> 00:25:12,159 attacker machine so here 634 00:25:12,159 --> 00:25:14,400 this is where we need a simple process 635 00:25:14,400 --> 00:25:16,960 to port mapping i'm using a task list 636 00:25:16,960 --> 00:25:19,760 and find the name behind the process id 637 00:25:19,760 --> 00:25:23,279 9392 which is powershell technically 638 00:25:23,279 --> 00:25:25,600 means we have a script which run the 639 00:25:25,600 --> 00:25:27,679 powershell and that powershell give a 640 00:25:27,679 --> 00:25:30,720 reverse tcp shell to the 641 00:25:30,720 --> 00:25:33,760 attacker so confirm case this is the 642 00:25:33,760 --> 00:25:36,880 time that we can start generating the 643 00:25:36,880 --> 00:25:40,000 ioc and update our automated tools as 644 00:25:40,000 --> 00:25:42,559 it's well said by my friend josh threat 645 00:25:42,559 --> 00:25:45,679 hunting does not use the ioc it makes 646 00:25:45,679 --> 00:25:46,559 them 647 00:25:46,559 --> 00:25:48,960 now we know the rules let's use a free 648 00:25:48,960 --> 00:25:51,360 tool one of my favorite tools a process 649 00:25:51,360 --> 00:25:53,200 explorer 650 00:25:53,200 --> 00:25:56,000 which can be used to have all these 651 00:25:56,000 --> 00:25:57,760 wonder analyses 652 00:25:57,760 --> 00:25:58,480 to 653 00:25:58,480 --> 00:25:59,200 to 654 00:25:59,200 --> 00:26:01,760 together so just please keep in mind 655 00:26:01,760 --> 00:26:04,080 that we should not install anything on 656 00:26:04,080 --> 00:26:06,799 the victim machine and avoid copy or 657 00:26:06,799 --> 00:26:09,120 installing anything as much as possible 658 00:26:09,120 --> 00:26:11,679 technically we should have external 659 00:26:11,679 --> 00:26:14,480 storage copy the file on that attach it 660 00:26:14,480 --> 00:26:17,760 to the live system and then execute 661 00:26:17,760 --> 00:26:20,640 the applications and another script from 662 00:26:20,640 --> 00:26:22,320 the external 663 00:26:22,320 --> 00:26:24,960 storage so up in the execution of the 664 00:26:24,960 --> 00:26:27,279 process explorers we can immediately see 665 00:26:27,279 --> 00:26:28,960 a very nice view of the process 666 00:26:28,960 --> 00:26:32,240 hierarchy that shows the again our cmd 667 00:26:32,240 --> 00:26:33,760 and the power shelf 668 00:26:33,760 --> 00:26:35,039 if you just 669 00:26:35,039 --> 00:26:37,440 move your cursor slowly to each process 670 00:26:37,440 --> 00:26:39,840 you can see the comments that 671 00:26:39,840 --> 00:26:41,760 the command line executed by that 672 00:26:41,760 --> 00:26:44,400 particular process however if we right 673 00:26:44,400 --> 00:26:46,320 click on each portal in each process and 674 00:26:46,320 --> 00:26:48,320 go to the properties we have a tabs with 675 00:26:48,320 --> 00:26:50,960 many fantastic informations for example 676 00:26:50,960 --> 00:26:53,600 the image tab give us the build time the 677 00:26:53,600 --> 00:26:55,760 path the command line executed and the 678 00:26:55,760 --> 00:26:57,360 current directory 679 00:26:57,360 --> 00:26:59,440 and most interestingly 680 00:26:59,440 --> 00:27:01,360 the tcp tab 681 00:27:01,360 --> 00:27:03,840 show us the connections established by 682 00:27:03,840 --> 00:27:05,200 that 683 00:27:05,200 --> 00:27:07,760 process so as you can see the system 684 00:27:07,760 --> 00:27:11,600 live analysis give us a very good uh 685 00:27:11,600 --> 00:27:13,520 point of view about what is happening in 686 00:27:13,520 --> 00:27:15,600 the system however there are a lot of 687 00:27:15,600 --> 00:27:17,919 challenges that we will discuss about it 688 00:27:17,919 --> 00:27:18,720 in 689 00:27:18,720 --> 00:27:21,039 in the last slides in details just to 690 00:27:21,039 --> 00:27:24,480 name a few when we deal with the windows 691 00:27:24,480 --> 00:27:27,120 live analysis or system live analysis 692 00:27:27,120 --> 00:27:29,679 there is always a chance to have an 693 00:27:29,679 --> 00:27:32,080 unintentional 694 00:27:32,080 --> 00:27:35,279 changes which is really risky if we 695 00:27:35,279 --> 00:27:37,919 change the digital fantasy artifact or 696 00:27:37,919 --> 00:27:40,720 we change even the system state that's 697 00:27:40,720 --> 00:27:42,399 why no we are going to focus on the 698 00:27:42,399 --> 00:27:44,880 memory forensic which more or less give 699 00:27:44,880 --> 00:27:47,760 us the same information 700 00:27:47,760 --> 00:27:51,679 but in a very safe way 701 00:27:54,880 --> 00:27:57,039 we are in the second part of our third 702 00:27:57,039 --> 00:28:00,000 hand trilogy which is memory forensics 703 00:28:00,000 --> 00:28:02,720 let's dive into the past the first step 704 00:28:02,720 --> 00:28:04,399 in the thread hunting via memory 705 00:28:04,399 --> 00:28:07,760 forensics is to create a forensic image 706 00:28:07,760 --> 00:28:11,360 of a memory or simply a bit by bit copy 707 00:28:11,360 --> 00:28:13,200 of the memory of a machine under 708 00:28:13,200 --> 00:28:15,600 investigation instead of talking about 709 00:28:15,600 --> 00:28:18,240 the tools let's talk about a few rules 710 00:28:18,240 --> 00:28:20,080 as we discussed earlier we should not 711 00:28:20,080 --> 00:28:22,000 copy or install anything on the victim 712 00:28:22,000 --> 00:28:23,760 machine because forensically we should 713 00:28:23,760 --> 00:28:25,120 avoid 714 00:28:25,120 --> 00:28:27,440 any intentional and unintentional 715 00:28:27,440 --> 00:28:29,679 changes that may happen to the system 716 00:28:29,679 --> 00:28:32,559 estate or the digital artifact during a 717 00:28:32,559 --> 00:28:34,720 threat hand root cause analysis threat 718 00:28:34,720 --> 00:28:37,760 detection and digital forensics we need 719 00:28:37,760 --> 00:28:40,880 to have a forensically clean external 720 00:28:40,880 --> 00:28:42,320 storage 721 00:28:42,320 --> 00:28:44,159 which we copy all the necessary files 722 00:28:44,159 --> 00:28:45,840 and application on it attach it to the 723 00:28:45,840 --> 00:28:47,919 victim machine execute the file from 724 00:28:47,919 --> 00:28:50,799 there and save the result into the 725 00:28:50,799 --> 00:28:55,679 external storage as well so i created a 726 00:28:55,679 --> 00:28:58,320 forensic image of the memory of the 727 00:28:58,320 --> 00:29:01,520 infected system and copy it to my 728 00:29:01,520 --> 00:29:03,760 investigation system which is a version 729 00:29:03,760 --> 00:29:06,480 of kali linux utilized with the latest 730 00:29:06,480 --> 00:29:08,080 version of the 731 00:29:08,080 --> 00:29:10,480 volatility which is volatility framework 732 00:29:10,480 --> 00:29:13,440 three at this particular moment 733 00:29:13,440 --> 00:29:15,760 so we can easily refer to the help of 734 00:29:15,760 --> 00:29:17,600 the volatility 735 00:29:17,600 --> 00:29:20,159 framework to get a list of all the 736 00:29:20,159 --> 00:29:22,320 current available 737 00:29:22,320 --> 00:29:24,559 plugins to retrieve the information from 738 00:29:24,559 --> 00:29:27,200 the memory taken from the windows 739 00:29:27,200 --> 00:29:28,399 operating 740 00:29:28,399 --> 00:29:29,600 system 741 00:29:29,600 --> 00:29:31,679 they make look a little bit limited at 742 00:29:31,679 --> 00:29:33,200 the moment because the window the 743 00:29:33,200 --> 00:29:35,760 volatility framework it is still new and 744 00:29:35,760 --> 00:29:37,440 it takes a little bit time for the 745 00:29:37,440 --> 00:29:38,799 community 746 00:29:38,799 --> 00:29:41,600 to improve it and make it more mature 747 00:29:41,600 --> 00:29:42,799 and develop 748 00:29:42,799 --> 00:29:44,880 more 749 00:29:44,880 --> 00:29:48,159 profiles and plugins 750 00:29:48,159 --> 00:29:51,440 so let's continue with the first step in 751 00:29:51,440 --> 00:29:54,159 detection which is similar to the what 752 00:29:54,159 --> 00:29:57,120 we did for the system live analysis 753 00:29:57,120 --> 00:29:59,679 process lineage analyzes 754 00:29:59,679 --> 00:30:02,880 so the volatility command windows ps3 755 00:30:02,880 --> 00:30:04,960 give us opportunity to have a list of 756 00:30:04,960 --> 00:30:07,200 the processes along with their parents 757 00:30:07,200 --> 00:30:10,799 and siblings as we expected we can see 758 00:30:10,799 --> 00:30:13,120 two instances of the powershell which is 759 00:30:13,120 --> 00:30:16,159 run under cmd if you may notice the 760 00:30:16,159 --> 00:30:18,880 process ids here are different from what 761 00:30:18,880 --> 00:30:20,799 we observed during the system live 762 00:30:20,799 --> 00:30:22,960 analysis is simply because 763 00:30:22,960 --> 00:30:25,279 i run these two practices in the two 764 00:30:25,279 --> 00:30:28,320 different testbed in two different 765 00:30:28,320 --> 00:30:29,840 uh time 766 00:30:29,840 --> 00:30:30,960 two different 767 00:30:30,960 --> 00:30:32,559 time slot 768 00:30:32,559 --> 00:30:34,480 so 769 00:30:34,480 --> 00:30:36,880 again the power shell is not 770 00:30:36,880 --> 00:30:38,720 interactively 771 00:30:38,720 --> 00:30:40,799 executed by a user 772 00:30:40,799 --> 00:30:44,960 instead is run under a cmd process 773 00:30:44,960 --> 00:30:48,480 let's have a view of the handles to see 774 00:30:48,480 --> 00:30:51,039 each of these processes access to any 775 00:30:51,039 --> 00:30:52,080 file 776 00:30:52,080 --> 00:30:54,399 registry key or any other 777 00:30:54,399 --> 00:30:55,440 process 778 00:30:55,440 --> 00:30:58,399 so in this case i am i used 779 00:30:58,399 --> 00:31:01,760 the volatility the windows handle and i 780 00:31:01,760 --> 00:31:05,039 limited the finding to only those three 781 00:31:05,039 --> 00:31:07,360 suspicious 782 00:31:07,360 --> 00:31:09,200 processes which is the two instances of 783 00:31:09,200 --> 00:31:11,840 the powershell and the cmd and i use a 784 00:31:11,840 --> 00:31:13,919 grab to only look for 785 00:31:13,919 --> 00:31:17,120 anything match with the file key and 786 00:31:17,120 --> 00:31:20,080 process so as we can see here 787 00:31:20,080 --> 00:31:22,799 we can have access to the file by the 788 00:31:22,799 --> 00:31:26,000 cmd process which is located to the 789 00:31:26,000 --> 00:31:29,120 user cyber mason download again access 790 00:31:29,120 --> 00:31:32,080 to a file in the download folder is so 791 00:31:32,080 --> 00:31:33,600 suspicious 792 00:31:33,600 --> 00:31:36,559 and we can see here the handle created 793 00:31:36,559 --> 00:31:39,919 from the cmd to handle another process 794 00:31:39,919 --> 00:31:41,080 which is 795 00:31:41,080 --> 00:31:44,480 9460 the referring here is the instance 796 00:31:44,480 --> 00:31:45,679 of the 797 00:31:45,679 --> 00:31:48,000 powershell getting the handle for these 798 00:31:48,000 --> 00:31:50,880 two powershell again indicate the access 799 00:31:50,880 --> 00:31:51,720 to the 800 00:31:51,720 --> 00:31:53,840 crypt32dll which is used for the 801 00:31:53,840 --> 00:31:56,559 decoding encoding and encryption 802 00:31:56,559 --> 00:31:59,360 and some network and tcp related 803 00:31:59,360 --> 00:32:01,360 settings and information which indicates 804 00:32:01,360 --> 00:32:04,399 that this power shell doing something 805 00:32:04,399 --> 00:32:06,799 via network 806 00:32:06,799 --> 00:32:07,679 so 807 00:32:07,679 --> 00:32:09,880 the command line scripting is pretty 808 00:32:09,880 --> 00:32:12,000 straightforward to extract from the 809 00:32:12,000 --> 00:32:15,200 memory image we have a built-in 810 00:32:15,200 --> 00:32:18,559 plugin called cmd line again we can 811 00:32:18,559 --> 00:32:21,120 limit it only to those 812 00:32:21,120 --> 00:32:23,679 three suspicious processes and we can 813 00:32:23,679 --> 00:32:24,799 clearly 814 00:32:24,799 --> 00:32:27,360 see the process id here followed by the 815 00:32:27,360 --> 00:32:30,880 command executed by that particular 816 00:32:30,880 --> 00:32:32,320 process 817 00:32:32,320 --> 00:32:34,320 here we can see again 818 00:32:34,320 --> 00:32:37,200 the cmd executed 819 00:32:37,200 --> 00:32:40,559 update underscore script batch file with 820 00:32:40,559 --> 00:32:42,480 the cmd extension 821 00:32:42,480 --> 00:32:44,720 and one of the instances of the 822 00:32:44,720 --> 00:32:47,039 powershell use the download string to 823 00:32:47,039 --> 00:32:50,559 download a secondary and potentially 824 00:32:50,559 --> 00:32:53,039 malicious script from the 825 00:32:53,039 --> 00:32:56,480 this particular ipv via the port 8000 826 00:32:56,480 --> 00:32:59,120 and download strings give opportunity to 827 00:32:59,120 --> 00:33:01,440 this powershell to download directly to 828 00:33:01,440 --> 00:33:04,559 the memory and execute it via from there 829 00:33:04,559 --> 00:33:09,679 video touching the hard disk so 830 00:33:09,679 --> 00:33:10,960 at the moment we are using the 831 00:33:10,960 --> 00:33:13,039 volatility but besides i would like to 832 00:33:13,039 --> 00:33:15,679 introduce another two handy techniques 833 00:33:15,679 --> 00:33:18,159 one is one of my favorite tools which is 834 00:33:18,159 --> 00:33:20,799 bulk extractor is an open source tool 835 00:33:20,799 --> 00:33:23,279 that can scan any hard disk image and 836 00:33:23,279 --> 00:33:25,760 memory image and extract a wide variety 837 00:33:25,760 --> 00:33:28,240 of the data you can easily refer to the 838 00:33:28,240 --> 00:33:30,399 official github page 839 00:33:30,399 --> 00:33:32,240 to check what are those data which is 840 00:33:32,240 --> 00:33:34,480 available to extract 841 00:33:34,480 --> 00:33:37,440 here i just run it against other 842 00:33:37,440 --> 00:33:38,640 memory for 843 00:33:38,640 --> 00:33:42,640 memory image and extracted various data 844 00:33:42,640 --> 00:33:45,200 so because we are aware of this 845 00:33:45,200 --> 00:33:48,240 suspicious ip i use a simple graph to 846 00:33:48,240 --> 00:33:49,039 look 847 00:33:49,039 --> 00:33:51,600 for any things match with this ip 848 00:33:51,600 --> 00:33:53,760 amongst all the data which is the drive 849 00:33:53,760 --> 00:33:56,880 by the bulk extractor and we can see 850 00:33:56,880 --> 00:34:00,320 here another three 851 00:34:00,320 --> 00:34:04,080 ip which is add another three scripts 852 00:34:04,080 --> 00:34:07,360 downloaded and access from the same 853 00:34:07,360 --> 00:34:10,239 ip so apart from the bulk extractor we 854 00:34:10,239 --> 00:34:11,280 can use 855 00:34:11,280 --> 00:34:14,159 built-in command strings so we can use 856 00:34:14,159 --> 00:34:16,480 the cat to open the memory file and then 857 00:34:16,480 --> 00:34:19,760 use the string to look for any strings 858 00:34:19,760 --> 00:34:22,000 in the memory image that 859 00:34:22,000 --> 00:34:26,159 match to our ip again here we can see 860 00:34:26,159 --> 00:34:28,399 the indicator of the download of the 861 00:34:28,399 --> 00:34:29,599 three 862 00:34:29,599 --> 00:34:32,480 additional scripts so we are not going 863 00:34:32,480 --> 00:34:35,440 to repeat the same process as we did it 864 00:34:35,440 --> 00:34:38,079 just for the system drive analysis if 865 00:34:38,079 --> 00:34:41,760 it's possible we download all these 866 00:34:41,760 --> 00:34:44,239 scripts into the isolated machine for 867 00:34:44,239 --> 00:34:46,320 the further investigations 868 00:34:46,320 --> 00:34:48,079 so if you remember we discussed two 869 00:34:48,079 --> 00:34:50,320 challenges they are may not available at 870 00:34:50,320 --> 00:34:52,560 this point of the time and even if they 871 00:34:52,560 --> 00:34:55,599 are available downloading them may alert 872 00:34:55,599 --> 00:34:58,160 the attacker another real challenges in 873 00:34:58,160 --> 00:35:00,560 the memory forensic because 874 00:35:00,560 --> 00:35:05,200 this memory image taken in the past 875 00:35:05,200 --> 00:35:07,440 so means at the moment that we are 876 00:35:07,440 --> 00:35:10,880 analyzing those links may not accessible 877 00:35:10,880 --> 00:35:13,680 anymore or may not even available but 878 00:35:13,680 --> 00:35:16,880 again third hunting is all about 879 00:35:16,880 --> 00:35:18,240 evaluating 880 00:35:18,240 --> 00:35:20,320 and exploring the different 881 00:35:20,320 --> 00:35:21,760 opportunities 882 00:35:21,760 --> 00:35:23,599 if it's 883 00:35:23,599 --> 00:35:26,160 possible we download all the script in 884 00:35:26,160 --> 00:35:28,079 the isolated environment 885 00:35:28,079 --> 00:35:30,240 see the content for further 886 00:35:30,240 --> 00:35:33,920 investigations just to recall the r1 uh 887 00:35:33,920 --> 00:35:34,720 the 888 00:35:34,720 --> 00:35:36,720 said the vin security update is the one 889 00:35:36,720 --> 00:35:37,920 who have 890 00:35:37,920 --> 00:35:43,640 who has two different uh base64 891 00:35:43,839 --> 00:35:47,680 encoded strings when we decoded it is 892 00:35:47,680 --> 00:35:49,760 relieved that they are it's downloading 893 00:35:49,760 --> 00:35:53,440 another 2 file a1 and r1 and r1 is the 894 00:35:53,440 --> 00:35:54,960 one who make 895 00:35:54,960 --> 00:35:56,880 a reverse tcp 896 00:35:56,880 --> 00:35:58,720 connection so when the reverse tcp 897 00:35:58,720 --> 00:36:01,680 connection is there the last step 898 00:36:01,680 --> 00:36:03,280 would be checking the established 899 00:36:03,280 --> 00:36:05,760 network connections which is can be done 900 00:36:05,760 --> 00:36:08,640 by the net state plug-in of the 901 00:36:08,640 --> 00:36:11,760 volatility framework 3. the good things 902 00:36:11,760 --> 00:36:14,079 about this plugin is that we no need to 903 00:36:14,079 --> 00:36:15,839 do the 904 00:36:15,839 --> 00:36:18,480 process to port mapping individually 905 00:36:18,480 --> 00:36:21,599 because once we obtain the data it shows 906 00:36:21,599 --> 00:36:25,520 the owner of each established 907 00:36:25,520 --> 00:36:26,560 connection 908 00:36:26,560 --> 00:36:29,280 in this case we can see an active tcp 909 00:36:29,280 --> 00:36:32,160 connection to the suspicious ip 910 00:36:32,160 --> 00:36:34,560 which is made by 911 00:36:34,560 --> 00:36:36,320 powershell 912 00:36:36,320 --> 00:36:37,599 instance 913 00:36:37,599 --> 00:36:38,800 so 914 00:36:38,800 --> 00:36:41,599 now we can confirm that 915 00:36:41,599 --> 00:36:44,160 our script download another additional 916 00:36:44,160 --> 00:36:47,119 script execute them from the memory and 917 00:36:47,119 --> 00:36:49,119 give the reverse 918 00:36:49,119 --> 00:36:53,200 shell access to the potential attacker 919 00:36:53,200 --> 00:36:55,839 remotely 920 00:36:58,400 --> 00:37:00,480 in the network packet investigation we 921 00:37:00,480 --> 00:37:03,040 may deal with the huge volume of the 922 00:37:03,040 --> 00:37:05,920 data that's why i call it hunt in the 923 00:37:05,920 --> 00:37:08,880 ocean 924 00:37:08,880 --> 00:37:11,680 so both might air defend and miter 925 00:37:11,680 --> 00:37:14,960 attack give us a list of the techniques 926 00:37:14,960 --> 00:37:16,800 uh to look for the 927 00:37:16,800 --> 00:37:19,680 suspensions as and malicious activities 928 00:37:19,680 --> 00:37:22,320 in the network traffic by analyzing the 929 00:37:22,320 --> 00:37:24,800 network connection creation content and 930 00:37:24,800 --> 00:37:27,119 flow but in general all of the 931 00:37:27,119 --> 00:37:29,440 techniques talk about how we should look 932 00:37:29,440 --> 00:37:31,760 for the uncommon unknown and abnormal 933 00:37:31,760 --> 00:37:34,839 and untrusted ips port and 934 00:37:34,839 --> 00:37:38,160 communications uh so in this uh 935 00:37:38,160 --> 00:37:41,119 section i'm using the wire shark to open 936 00:37:41,119 --> 00:37:44,000 and pick up uh file which is capture 937 00:37:44,000 --> 00:37:46,560 traffic from the hust which is infected 938 00:37:46,560 --> 00:37:47,920 by the 939 00:37:47,920 --> 00:37:51,040 fileless thread so 940 00:37:51,040 --> 00:37:52,800 in the statistics we can have a 941 00:37:52,800 --> 00:37:55,200 conversation and we can have a list of 942 00:37:55,200 --> 00:37:57,280 the endpoints technically the wireshark 943 00:37:57,280 --> 00:37:59,440 statistics give us a good idea about 944 00:37:59,440 --> 00:38:01,440 what is happening 945 00:38:01,440 --> 00:38:04,640 in the network in term of the protocol 946 00:38:04,640 --> 00:38:06,800 hierarchy which will be covered uh 947 00:38:06,800 --> 00:38:07,920 shortly 948 00:38:07,920 --> 00:38:10,400 the packet lens or endpoint and 949 00:38:10,400 --> 00:38:13,520 conversation uh simply the endpoint list 950 00:38:13,520 --> 00:38:14,240 i 951 00:38:14,240 --> 00:38:16,880 list all the endpoints and ip addresses 952 00:38:16,880 --> 00:38:18,960 which shows some sort of activities on 953 00:38:18,960 --> 00:38:21,440 the time that we collect the data while 954 00:38:21,440 --> 00:38:23,599 the conversation specifically shows the 955 00:38:23,599 --> 00:38:26,960 list of the packets send and receive 956 00:38:26,960 --> 00:38:29,680 between two different 957 00:38:29,680 --> 00:38:31,200 endpoints 958 00:38:31,200 --> 00:38:33,440 so there are a few challenges where we 959 00:38:33,440 --> 00:38:35,760 are dealing with this kind of the data 960 00:38:35,760 --> 00:38:38,560 if we don't have a baseline 961 00:38:38,560 --> 00:38:41,119 for the s standard and normal things in 962 00:38:41,119 --> 00:38:43,359 our environment it could be difficult to 963 00:38:43,359 --> 00:38:45,359 define the uncommon to define the 964 00:38:45,359 --> 00:38:48,320 unknowns and to define the untrusted 965 00:38:48,320 --> 00:38:50,560 sometimes even if we have 966 00:38:50,560 --> 00:38:52,960 the baseline we may deal with the large 967 00:38:52,960 --> 00:38:54,800 volume of the data which are high 968 00:38:54,800 --> 00:38:58,079 diversity dynamic nature and complexity 969 00:38:58,079 --> 00:39:00,400 which make a life a little bit hard for 970 00:39:00,400 --> 00:39:02,800 a threat hunter and the poor data 971 00:39:02,800 --> 00:39:05,280 management analysis could 972 00:39:05,280 --> 00:39:08,480 lead our threat hunt to a failure 973 00:39:08,480 --> 00:39:10,880 so that's why apart from the data 974 00:39:10,880 --> 00:39:13,920 collection a proper data classification 975 00:39:13,920 --> 00:39:16,480 filtering and unwanted data reduction 976 00:39:16,480 --> 00:39:19,200 plays an important role for example here 977 00:39:19,200 --> 00:39:21,760 i just use a very simple data filtering 978 00:39:21,760 --> 00:39:24,160 to filter only traffic to 979 00:39:24,160 --> 00:39:25,599 or from 980 00:39:25,599 --> 00:39:27,599 a victim machine which is in this case 981 00:39:27,599 --> 00:39:30,400 is 192.168.182. 982 00:39:30,400 --> 00:39:32,560 uh one four 983 00:39:32,560 --> 00:39:36,160 zero so this simple data filtering 984 00:39:36,160 --> 00:39:39,599 effectively reduced 20 percent of 985 00:39:39,599 --> 00:39:40,960 unwanted 986 00:39:40,960 --> 00:39:42,720 data 987 00:39:42,720 --> 00:39:44,720 when we talking about the huge volume of 988 00:39:44,720 --> 00:39:47,200 the data 20 percent could be a time 989 00:39:47,200 --> 00:39:50,160 saver and even a life saver 990 00:39:50,160 --> 00:39:50,880 so 991 00:39:50,880 --> 00:39:53,200 the miter defend network traffic 992 00:39:53,200 --> 00:39:56,640 community deviation suggests that 993 00:39:56,640 --> 00:39:59,440 once we collect a data of the network 994 00:39:59,440 --> 00:40:01,920 and the packet we should look for any 995 00:40:01,920 --> 00:40:04,720 deviation from what it's supposed to be 996 00:40:04,720 --> 00:40:07,440 a routine of our network again if we 997 00:40:07,440 --> 00:40:10,480 don't have the baseline 998 00:40:10,480 --> 00:40:11,760 we cannot do 999 00:40:11,760 --> 00:40:14,319 anything so in this example i try to 1000 00:40:14,319 --> 00:40:16,800 just understand who is who i use a very 1001 00:40:16,800 --> 00:40:19,680 simple command of the tcp dump 1002 00:40:19,680 --> 00:40:22,560 to extract all the ip addresses exist on 1003 00:40:22,560 --> 00:40:23,440 that 1004 00:40:23,440 --> 00:40:27,359 packet capture file and then i 1005 00:40:27,359 --> 00:40:29,760 i write a very simple script to run the 1006 00:40:29,760 --> 00:40:32,000 who is for the public eyepiece so 1007 00:40:32,000 --> 00:40:33,760 technically we can have the list of the 1008 00:40:33,760 --> 00:40:36,560 ips exist on that pickup file plus there 1009 00:40:36,560 --> 00:40:37,440 the 1010 00:40:37,440 --> 00:40:40,160 name of the organizations so 1011 00:40:40,160 --> 00:40:42,400 in this example all look normal but we 1012 00:40:42,400 --> 00:40:44,319 should keep in mind not all the knowns 1013 00:40:44,319 --> 00:40:46,720 are good because a legitimate service 1014 00:40:46,720 --> 00:40:49,359 may be uh abused by the attacker to 1015 00:40:49,359 --> 00:40:51,040 conduct the malicious activities is 1016 00:40:51,040 --> 00:40:52,800 always good to validate the finding 1017 00:40:52,800 --> 00:40:54,720 based on the ipa reputation system 1018 00:40:54,720 --> 00:40:59,200 non-iocs and threat intel feeds or 1019 00:40:59,200 --> 00:41:02,400 a few extra 1020 00:41:02,400 --> 00:41:05,200 factors that we are going to explain no 1021 00:41:05,200 --> 00:41:07,200 top protocol 1022 00:41:07,200 --> 00:41:10,240 simply means that 1023 00:41:10,319 --> 00:41:12,319 the highest 1024 00:41:12,319 --> 00:41:14,160 the top protocol that used in the 1025 00:41:14,160 --> 00:41:17,359 conversation on the network top hust 1026 00:41:17,359 --> 00:41:20,079 means all the hearts that shows more 1027 00:41:20,079 --> 00:41:21,839 activity 1028 00:41:21,839 --> 00:41:24,720 accordingly the top conversations is or 1029 00:41:24,720 --> 00:41:27,200 is a pair of their hearts that talk to 1030 00:41:27,200 --> 00:41:29,200 each other um 1031 00:41:29,200 --> 00:41:31,280 more compared to the others the two 1032 00:41:31,280 --> 00:41:34,079 interesting things are top listeners and 1033 00:41:34,079 --> 00:41:35,520 top attackers 1034 00:41:35,520 --> 00:41:38,240 tablet sellers are those who receive 1035 00:41:38,240 --> 00:41:41,359 data more than what they send and top 1036 00:41:41,359 --> 00:41:44,480 talkers are those who send more data 1037 00:41:44,480 --> 00:41:46,800 compared to what they 1038 00:41:46,800 --> 00:41:49,200 receive so let's have a quick example 1039 00:41:49,200 --> 00:41:52,160 about these terms 1040 00:41:52,160 --> 00:41:56,480 i limited our finding our packets only 1041 00:41:56,480 --> 00:41:59,599 for the ip address related to the victim 1042 00:41:59,599 --> 00:42:00,800 machine 1043 00:42:00,800 --> 00:42:03,280 so going to the statistics and endpoint 1044 00:42:03,280 --> 00:42:06,960 tab ip version 4 sorted by the bytes we 1045 00:42:06,960 --> 00:42:10,560 can have all the list of the 1046 00:42:10,560 --> 00:42:14,240 top hust which shows more activity 1047 00:42:14,240 --> 00:42:16,720 on the time that we captured the traffic 1048 00:42:16,720 --> 00:42:18,319 so as we can see 1049 00:42:18,319 --> 00:42:21,520 there is a one private ip which is 1050 00:42:21,520 --> 00:42:23,280 belong to same 1051 00:42:23,280 --> 00:42:26,079 network of our victim machine and it 1052 00:42:26,079 --> 00:42:28,079 appears in the 1053 00:42:28,079 --> 00:42:31,359 top host list going to the statistics 1054 00:42:31,359 --> 00:42:33,200 and conversation and repeat the same 1055 00:42:33,200 --> 00:42:35,760 sorted by the bytes and surprisingly we 1056 00:42:35,760 --> 00:42:38,240 have the same ip appear in the top 1057 00:42:38,240 --> 00:42:41,200 conversations means it shows uh one of 1058 00:42:41,200 --> 00:42:43,359 the highest activity in the network and 1059 00:42:43,359 --> 00:42:44,480 it has 1060 00:42:44,480 --> 00:42:47,200 one of the highest rate of conversation 1061 00:42:47,200 --> 00:42:48,480 with our 1062 00:42:48,480 --> 00:42:52,400 victim so i i use a tcp dump again to 1063 00:42:52,400 --> 00:42:55,200 extract the list of the top attackers in 1064 00:42:55,200 --> 00:42:57,920 other networks and 1065 00:42:57,920 --> 00:43:02,079 our suspected ip it appears there again 1066 00:43:02,079 --> 00:43:04,720 so means this is it was one of the top 1067 00:43:04,720 --> 00:43:07,440 tackers we talk more with the end points 1068 00:43:07,440 --> 00:43:10,720 in the system but we may need more 1069 00:43:10,720 --> 00:43:13,119 details to validate the finding because 1070 00:43:13,119 --> 00:43:15,440 the devil 1071 00:43:15,440 --> 00:43:16,720 is in the 1072 00:43:16,720 --> 00:43:19,920 details so even though this ip is among 1073 00:43:19,920 --> 00:43:22,000 the top attackers then we 1074 00:43:22,000 --> 00:43:24,319 dig more and go for further 1075 00:43:24,319 --> 00:43:26,400 investigation specifically for the 1076 00:43:26,400 --> 00:43:28,640 conversation between this ip and our 1077 00:43:28,640 --> 00:43:32,800 victim we noticed that this ip receive 1078 00:43:32,800 --> 00:43:34,480 more data 1079 00:43:34,480 --> 00:43:38,880 than sending so it received 1080 00:43:38,880 --> 00:43:40,960 more data 1081 00:43:40,960 --> 00:43:44,560 than sending data to the victim machine 1082 00:43:44,560 --> 00:43:45,440 so 1083 00:43:45,440 --> 00:43:47,240 the miter 1084 00:43:47,240 --> 00:43:50,319 ds029 network traffic as a 1085 00:43:50,319 --> 00:43:53,119 as a source of as a data source suggests 1086 00:43:53,119 --> 00:43:55,440 to monitor network data for uncommon 1087 00:43:55,440 --> 00:43:59,119 data flows for example a client sending 1088 00:43:59,119 --> 00:44:01,920 significantly more data than it received 1089 00:44:01,920 --> 00:44:05,200 from the server which is this case let's 1090 00:44:05,200 --> 00:44:08,079 focus on that particular conversation 1091 00:44:08,079 --> 00:44:10,640 and extract the protocols that mainly 1092 00:44:10,640 --> 00:44:13,119 use in this conversation 1093 00:44:13,119 --> 00:44:15,680 so we apply that a specific conversation 1094 00:44:15,680 --> 00:44:18,480 as a filter to limited the data only for 1095 00:44:18,480 --> 00:44:20,480 that conversation 1096 00:44:20,480 --> 00:44:23,839 so the filter the i the the traffic is 1097 00:44:23,839 --> 00:44:26,720 already filtered based on the victim ip 1098 00:44:26,720 --> 00:44:28,800 and the suspect ip 1099 00:44:28,800 --> 00:44:31,280 so again from the statistics menu we can 1100 00:44:31,280 --> 00:44:34,079 go to the protocol hierarchy and based 1101 00:44:34,079 --> 00:44:36,720 on what we can observe here the tcp 1102 00:44:36,720 --> 00:44:39,200 involved we have some http traffic and 1103 00:44:39,200 --> 00:44:42,880 we have some uh data so again miter 1104 00:44:42,880 --> 00:44:44,560 suggests to focus on the application 1105 00:44:44,560 --> 00:44:46,160 layer protocols because the web 1106 00:44:46,160 --> 00:44:47,599 protocols 1107 00:44:47,599 --> 00:44:50,240 are widely used by the cyber attackers 1108 00:44:50,240 --> 00:44:52,160 to hide their activity amongst the 1109 00:44:52,160 --> 00:44:54,400 normal web traffic 1110 00:44:54,400 --> 00:44:55,440 so 1111 00:44:55,440 --> 00:44:58,319 in the left side i added 1112 00:44:58,319 --> 00:44:59,599 one more 1113 00:44:59,599 --> 00:45:03,440 filter as http to not only limited the 1114 00:45:03,440 --> 00:45:06,319 finding to this conversation but only 1115 00:45:06,319 --> 00:45:07,520 give us 1116 00:45:07,520 --> 00:45:10,480 the http related traffic because we have 1117 00:45:10,480 --> 00:45:12,640 seen the http traffic exist in the 1118 00:45:12,640 --> 00:45:15,520 protocol hierarchy so interestingly we 1119 00:45:15,520 --> 00:45:19,520 can see a get method used to download a 1120 00:45:19,520 --> 00:45:20,800 few 1121 00:45:20,800 --> 00:45:22,800 files 1122 00:45:22,800 --> 00:45:24,160 so again 1123 00:45:24,160 --> 00:45:26,480 we can't focus on these files which is 1124 00:45:26,480 --> 00:45:29,440 downloaded via the http get right click 1125 00:45:29,440 --> 00:45:31,200 on any of them and follow the stream 1126 00:45:31,200 --> 00:45:33,760 either the tcp or http may give us 1127 00:45:33,760 --> 00:45:36,000 opportunity to see the content in this 1128 00:45:36,000 --> 00:45:38,880 case we are using the follow http stream 1129 00:45:38,880 --> 00:45:41,040 to see the content of the 1130 00:45:41,040 --> 00:45:43,680 vin security update which i believe this 1131 00:45:43,680 --> 00:45:45,760 is familiar to you and ring a bell for 1132 00:45:45,760 --> 00:45:48,400 you because this is the same encoded 1133 00:45:48,400 --> 00:45:52,520 database 64. 1134 00:45:52,640 --> 00:45:55,680 so when we can see a few files involved 1135 00:45:55,680 --> 00:45:58,319 in the traffic is immediately triggered 1136 00:45:58,319 --> 00:46:00,960 a file carving 1137 00:46:00,960 --> 00:46:03,520 detection method by the miter defense 1138 00:46:03,520 --> 00:46:05,920 which says we should identify an 1139 00:46:05,920 --> 00:46:09,440 extracting file from network application 1140 00:46:09,440 --> 00:46:11,280 protocol so 1141 00:46:11,280 --> 00:46:13,440 in this filter i only 1142 00:46:13,440 --> 00:46:15,440 focus on the file 1143 00:46:15,440 --> 00:46:17,760 and the hosts 1144 00:46:17,760 --> 00:46:20,400 for that particular conversation here i 1145 00:46:20,400 --> 00:46:23,280 demonstrate a tcp thump example that 1146 00:46:23,280 --> 00:46:26,000 help us to extract all the hast field 1147 00:46:26,000 --> 00:46:28,800 from the request header for entire ip 1148 00:46:28,800 --> 00:46:32,800 and entire conversation within a packet 1149 00:46:32,800 --> 00:46:33,839 capture 1150 00:46:33,839 --> 00:46:36,640 file let's get back to the file 1151 00:46:36,640 --> 00:46:38,880 carving if we want to extract those 1152 00:46:38,880 --> 00:46:40,880 files from the network traffic packet 1153 00:46:40,880 --> 00:46:43,599 capture we have a few options i just 1154 00:46:43,599 --> 00:46:44,880 listed two 1155 00:46:44,880 --> 00:46:46,480 one is the built-in option of the 1156 00:46:46,480 --> 00:46:49,760 wireshark export object that we can 1157 00:46:49,760 --> 00:46:51,520 select the conversation 1158 00:46:51,520 --> 00:46:54,079 and go to the file menu and select 1159 00:46:54,079 --> 00:46:56,880 export object we can see the list of the 1160 00:46:56,880 --> 00:46:59,520 extracted objects from that conversation 1161 00:46:59,520 --> 00:47:02,160 and we can select and save them all 1162 00:47:02,160 --> 00:47:04,640 another interesting tool is the t-shark 1163 00:47:04,640 --> 00:47:07,040 extractor again the open source tools 1164 00:47:07,040 --> 00:47:09,040 you know that i'm a big fan of the open 1165 00:47:09,040 --> 00:47:11,280 source and the free tools 1166 00:47:11,280 --> 00:47:12,960 so if we run 1167 00:47:12,960 --> 00:47:16,960 the t-shirt extra extractor against our 1168 00:47:16,960 --> 00:47:20,079 pickup file it automatically extracts 1169 00:47:20,079 --> 00:47:22,720 all the potential file exists in that 1170 00:47:22,720 --> 00:47:25,119 conversation however they are saved 1171 00:47:25,119 --> 00:47:28,240 based on the stream number a simple 1172 00:47:28,240 --> 00:47:29,440 t-shark 1173 00:47:29,440 --> 00:47:31,520 command help us to find 1174 00:47:31,520 --> 00:47:34,640 the tcp stream index for the http 1175 00:47:34,640 --> 00:47:37,280 get methods for example here i have the 1176 00:47:37,280 --> 00:47:40,720 stream index of 22 for the vin security 1177 00:47:40,720 --> 00:47:45,839 update 23 for the a1 and 24 for the r1 1178 00:47:45,839 --> 00:47:48,079 let's take a look on the 1179 00:47:48,079 --> 00:47:50,640 r1 which is the 1180 00:47:50,640 --> 00:47:54,160 which has a tcpa stream index of the 24 1181 00:47:54,160 --> 00:47:57,119 so i refer to the finding of the t-shirt 1182 00:47:57,119 --> 00:48:00,800 extractor and open the httpstream24 1183 00:48:00,800 --> 00:48:02,800 and if you remember the content from the 1184 00:48:02,800 --> 00:48:05,359 previous investigations we can have the 1185 00:48:05,359 --> 00:48:06,800 evidence of 1186 00:48:06,800 --> 00:48:10,640 establishing a reverse tcp via the port 1187 00:48:10,640 --> 00:48:13,440 443 which is according to the another 1188 00:48:13,440 --> 00:48:16,400 miter uh knowledge base information is a 1189 00:48:16,400 --> 00:48:19,359 commonly used port by attacker to hide 1190 00:48:19,359 --> 00:48:21,680 their activities 1191 00:48:21,680 --> 00:48:23,920 so let's narrow down our information 1192 00:48:23,920 --> 00:48:26,319 this time to the http 1193 00:48:26,319 --> 00:48:30,000 to the tcp port 443 1194 00:48:30,000 --> 00:48:32,640 for the same conversation we can see a 1195 00:48:32,640 --> 00:48:34,960 few 1196 00:48:34,960 --> 00:48:37,760 a few first row are the 1197 00:48:37,760 --> 00:48:40,000 typical standard 1198 00:48:40,000 --> 00:48:43,760 tree had the three-way tcp handshake we 1199 00:48:43,760 --> 00:48:45,440 can see some evidence of the push 1200 00:48:45,440 --> 00:48:47,200 acknowledge acknowledge with indicate 1201 00:48:47,200 --> 00:48:48,559 that some data 1202 00:48:48,559 --> 00:48:51,520 the transfer so based on the miter again 1203 00:48:51,520 --> 00:48:53,280 the network traffic we should analyze 1204 00:48:53,280 --> 00:48:55,200 the network traffic content when it's 1205 00:48:55,200 --> 00:48:57,760 not encrypted or the encryption is the 1206 00:48:57,760 --> 00:48:59,760 way that we can decrypt it or is plain 1207 00:48:59,760 --> 00:49:01,119 text in 1208 00:49:01,119 --> 00:49:02,640 our case 1209 00:49:02,640 --> 00:49:04,160 so 1210 00:49:04,160 --> 00:49:06,559 right click on any of these data and 1211 00:49:06,559 --> 00:49:08,640 follow the tcps stream show us the 1212 00:49:08,640 --> 00:49:11,440 command executed by the advisory and 1213 00:49:11,440 --> 00:49:14,880 extracted again by the follow tcp stream 1214 00:49:14,880 --> 00:49:18,640 so we can see a few commands 1215 00:49:18,640 --> 00:49:21,119 executed which indicate of the system 1216 00:49:21,119 --> 00:49:24,000 information discovery normally the the 1217 00:49:24,000 --> 00:49:26,559 attackers do the system information 1218 00:49:26,559 --> 00:49:28,880 discovery up and the initial access to 1219 00:49:28,880 --> 00:49:30,480 get a better understanding of the 1220 00:49:30,480 --> 00:49:32,880 current state of the machine if there is 1221 00:49:32,880 --> 00:49:35,119 any chance for privilege escalation 1222 00:49:35,119 --> 00:49:37,200 identify another vulnerable connection 1223 00:49:37,200 --> 00:49:39,119 and resource in the network for the 1224 00:49:39,119 --> 00:49:41,119 lateral 1225 00:49:41,119 --> 00:49:44,119 movement 1226 00:49:44,160 --> 00:49:46,079 system live analysis give us a better 1227 00:49:46,079 --> 00:49:48,079 understanding of ongoing immense because 1228 00:49:48,079 --> 00:49:49,599 we are doing the threat hunting while 1229 00:49:49,599 --> 00:49:52,400 the system is still running uh in some 1230 00:49:52,400 --> 00:49:54,960 cases where making the forensic er 1231 00:49:54,960 --> 00:49:57,440 images are difficult or challenging like 1232 00:49:57,440 --> 00:49:59,599 when we are dealing with a huge volume 1233 00:49:59,599 --> 00:50:01,599 of their 1234 00:50:01,599 --> 00:50:04,319 storage or sometimes based on the sla 1235 00:50:04,319 --> 00:50:06,160 then we are renting the services from 1236 00:50:06,160 --> 00:50:07,839 the vendors we may not even have an 1237 00:50:07,839 --> 00:50:10,240 opportunity to touch their storages the 1238 00:50:10,240 --> 00:50:12,240 system live analysis could be a good 1239 00:50:12,240 --> 00:50:13,280 option 1240 00:50:13,280 --> 00:50:14,960 another example is where the some 1241 00:50:14,960 --> 00:50:18,000 sophisticated attacks may not leave any 1242 00:50:18,000 --> 00:50:20,240 traces on the hard disk the system lab 1243 00:50:20,240 --> 00:50:22,480 analyzes again could be a big help 1244 00:50:22,480 --> 00:50:25,040 however there are a few risks associated 1245 00:50:25,040 --> 00:50:27,440 with this technique for example the risk 1246 00:50:27,440 --> 00:50:29,680 of unintentional changes is always there 1247 00:50:29,680 --> 00:50:32,480 because we are dealing interactively 1248 00:50:32,480 --> 00:50:35,440 with the running system and if by chance 1249 00:50:35,440 --> 00:50:37,920 the attack is still ongoing at the same 1250 00:50:37,920 --> 00:50:39,839 time with the threat hunting activities 1251 00:50:39,839 --> 00:50:42,640 we may have a conflict and we may alert 1252 00:50:42,640 --> 00:50:45,200 the attacker and the main important one 1253 00:50:45,200 --> 00:50:47,440 the procedure may not be repeatable 1254 00:50:47,440 --> 00:50:50,079 because the state of the system keep 1255 00:50:50,079 --> 00:50:52,720 changing memory forensic give us a good 1256 00:50:52,720 --> 00:50:54,960 insight about a running system activity 1257 00:50:54,960 --> 00:50:56,880 and one point and we may have access to 1258 00:50:56,880 --> 00:50:59,520 the system volatile data 1259 00:50:59,520 --> 00:51:01,920 video risk of evidence changes which is 1260 00:51:01,920 --> 00:51:04,640 very important 1261 00:51:04,640 --> 00:51:07,200 because here we don't touch the 1262 00:51:07,200 --> 00:51:09,520 live system and we are conducting the 1263 00:51:09,520 --> 00:51:12,079 threat hunt on the forensic image of a 1264 00:51:12,079 --> 00:51:14,240 memory it may also give us a more 1265 00:51:14,240 --> 00:51:16,240 opportunity for threat analyzes because 1266 00:51:16,240 --> 00:51:18,160 we may have access to the data which is 1267 00:51:18,160 --> 00:51:20,880 only exist on the memory talking about 1268 00:51:20,880 --> 00:51:22,880 the challenges apart from the forensic 1269 00:51:22,880 --> 00:51:25,119 imaging challenges that we may always 1270 00:51:25,119 --> 00:51:27,359 face the main challenge is a limitation 1271 00:51:27,359 --> 00:51:30,079 of the current available framework and 1272 00:51:30,079 --> 00:51:32,240 tools talking about the open source we 1273 00:51:32,240 --> 00:51:34,000 have a very limited number of the tools 1274 00:51:34,000 --> 00:51:36,559 like volatility and they may not fully 1275 00:51:36,559 --> 00:51:39,280 compatible all the time with the latest 1276 00:51:39,280 --> 00:51:41,760 version of the operating system these 1277 00:51:41,760 --> 00:51:44,000 tools are community based we may need to 1278 00:51:44,000 --> 00:51:45,920 be a little bit patient and wait for the 1279 00:51:45,920 --> 00:51:48,079 community and for the developers to come 1280 00:51:48,079 --> 00:51:50,640 up with more plugins that enable us to 1281 00:51:50,640 --> 00:51:52,640 retrieve the data 1282 00:51:52,640 --> 00:51:54,800 accurately from the latest 1283 00:51:54,800 --> 00:51:57,200 version of the operating system network 1284 00:51:57,200 --> 00:52:00,000 packet in investigation give us a 1285 00:52:00,000 --> 00:52:01,920 visibility to the 1286 00:52:01,920 --> 00:52:03,920 network activities 1287 00:52:03,920 --> 00:52:05,839 not only tell us about what is happening 1288 00:52:05,839 --> 00:52:07,680 on our network from the security point 1289 00:52:07,680 --> 00:52:10,160 of view but issues in the network 1290 00:52:10,160 --> 00:52:13,040 infrastructure as well and we may not 1291 00:52:13,040 --> 00:52:14,800 require the local access to the 1292 00:52:14,800 --> 00:52:16,400 endpoints if we are not directly 1293 00:52:16,400 --> 00:52:18,960 collecting the packets from the 1294 00:52:18,960 --> 00:52:20,079 the host 1295 00:52:20,079 --> 00:52:22,160 which give us a 1296 00:52:22,160 --> 00:52:24,240 opportunity to 1297 00:52:24,240 --> 00:52:26,640 expand the scale of the investigation 1298 00:52:26,640 --> 00:52:29,680 rapidly however there are a few serious 1299 00:52:29,680 --> 00:52:32,079 challenges with the network packet 1300 00:52:32,079 --> 00:52:34,559 investigation apart from the limited 1301 00:52:34,559 --> 00:52:36,079 data that we have about the highest 1302 00:52:36,079 --> 00:52:37,680 level and local 1303 00:52:37,680 --> 00:52:39,920 user activities the encrypted data 1304 00:52:39,920 --> 00:52:42,000 analysis challenges the main challenge 1305 00:52:42,000 --> 00:52:43,839 is about 1306 00:52:43,839 --> 00:52:47,040 how we strategize the network packet 1307 00:52:47,040 --> 00:52:49,040 collection 1308 00:52:49,040 --> 00:52:51,440 it must be placed before an incident 1309 00:52:51,440 --> 00:52:53,440 happen in the system drive analysis and 1310 00:52:53,440 --> 00:52:56,240 memory forensics we may still have a 1311 00:52:56,240 --> 00:52:58,240 chance to get back to the traces and 1312 00:52:58,240 --> 00:53:00,400 collect the data that belong to the past 1313 00:53:00,400 --> 00:53:02,319 and remain on the 1314 00:53:02,319 --> 00:53:04,240 hardest during the live analysis and 1315 00:53:04,240 --> 00:53:06,720 resides in the memory but in the network 1316 00:53:06,720 --> 00:53:07,599 packet 1317 00:53:07,599 --> 00:53:11,440 collection uh some things happen ongoing 1318 00:53:11,440 --> 00:53:14,000 and gone and the data will be erased 1319 00:53:14,000 --> 00:53:16,160 forever so if we miss a chance to 1320 00:53:16,160 --> 00:53:18,559 collect the data we have no visibility 1321 00:53:18,559 --> 00:53:20,880 to what has happened in that particular 1322 00:53:20,880 --> 00:53:22,880 time another challenge is the data 1323 00:53:22,880 --> 00:53:25,280 volume capturing and 1324 00:53:25,280 --> 00:53:28,000 storing that's why capturing the network 1325 00:53:28,000 --> 00:53:30,640 packets is not applicable most of the 1326 00:53:30,640 --> 00:53:33,200 time as a full-time strategy 1327 00:53:33,200 --> 00:53:36,559 for the security solutions if we run 1328 00:53:36,559 --> 00:53:38,720 about one hour of the network capture 1329 00:53:38,720 --> 00:53:42,160 for the small to medium size of the 1330 00:53:42,160 --> 00:53:45,200 network we may deal with a really huge 1331 00:53:45,200 --> 00:53:48,400 volume of data so i'm not going to write 1332 00:53:48,400 --> 00:53:50,480 list any of those any of these 1333 00:53:50,480 --> 00:53:52,319 techniques all of them each of them have 1334 00:53:52,319 --> 00:53:56,240 their own advantage and disadvantage if 1335 00:53:56,240 --> 00:53:58,640 there is possible they actually work 1336 00:53:58,640 --> 00:54:01,760 better together so i would like to say 1337 00:54:01,760 --> 00:54:04,079 the special thanks to my team for all 1338 00:54:04,079 --> 00:54:05,599 the brainstorm 1339 00:54:05,599 --> 00:54:08,400 storming and the support especially joko 1340 00:54:08,400 --> 00:54:12,240 tan the man the me the mountain and my 1341 00:54:12,240 --> 00:54:14,720 other lovely team members that known as 1342 00:54:14,720 --> 00:54:16,319 a team born 1343 00:54:16,319 --> 00:54:19,440 ready feel free to connect to me via the 1344 00:54:19,440 --> 00:54:22,160 linkedin or twitter if you have any 1345 00:54:22,160 --> 00:54:24,640 additional clarification 1346 00:54:24,640 --> 00:54:27,280 or question about this presentation or 1347 00:54:27,280 --> 00:54:29,599 if you are willing to have a productive 1348 00:54:29,599 --> 00:54:32,000 conversation about any cyber security 1349 00:54:32,000 --> 00:54:35,760 related topic this tax ends here but 1350 00:54:35,760 --> 00:54:38,480 threat hunting is a never-ending battle 1351 00:54:38,480 --> 00:54:41,200 explore your scope x and unknowns be 1352 00:54:41,200 --> 00:54:44,160 proactive dive into the beats and hunt 1353 00:54:44,160 --> 00:54:47,520 the beats especially those who hides in 1354 00:54:47,520 --> 00:54:52,920 shadows hope you all enjoy this session