5 Host Indicators of Compromise you need to hunt

1. Start with the beachhead. In most situation where there is long term breach, there is a beachhead; the system attackers use to get into and maintain access to the network. This is the primary thing you want to find. Hackers generally install an implant such as a Remote Access Tool (RAT), rootkit, or backdoor on the beachhead system. It’s often the one system in the network that’s not being monitored, due to non-compliance or attacker manipulation, and serves as the attacker’s continuing access point. They then traverse the rest of the network with stolen administrative credentials (aka “living off the land”), to reduce the possibility of being found by defensive monitoring and antivirus. As identifying malicious user behavior can be challenging, it’s often better to search for this beachhead system. A full exam using Forensic State Analysis (FSA) is a quick and scalable way to look for beachheads and the implants on them.
2. Implants, Remote Access Tools and Backdoors. The current malware trend is fileless and does not touch disk, so you need to look in volatile memory for injections and in-memory manipulations of common processes. Finding and analyzing injections and fileless malware in volatile memory is only accomplished using a Forensic State Analysis approach (true FSA includes live volatile memory analysis). While a behavior-based approach can sometimes be effective, it can easily fool an analyst since the behavior and connections will trace back to the injected process (e.g. Internet Explorer), which may be incorrectly categorized as a false positive.
3. Persistence mechanisms. If the implant isn’t active in memory, then it needs to be triggered to run in the future via a persistence mechanism. Examples include an autostart location in the registry, boot process redirection, or scheduled tasks / cronjob. If the malware is dormant, you won’t get any behavior indication or host events, so you will need to enumerate common persistence locations and analyze any commands, code, or files referenced. While there are hundreds of autostart locations in Windows, start your hunt for persistence mechanisms with scheduled tasks and the registry run keys, which are the most common. Understand that most endpoint security software (both legacy and ’next-gen‘) do not analyze persistence mechanisms, instead relying on periodic whole disk scans. Today, not all persistence mechanisms reference files on disk so these legacy approaches are not as effective anymore.
4. Execution artifacts. Look for execution artifacts on the endpoint from Prefetch, Superfetch or Amcache, depending on the version of OS being analyzed. These are copies of executables or a register of executables that have run in the past. While this can be useful to find malware, a good technique to find credential misuse is to identify patterns of common administrative tools like net.exe, wmic.exe, cmd.exe, and powershell.exe.  If you find executables like these ran in quick succession, it’s a good indicator that someone has used admin credentials to enumerate the internal network environment or conduct lateral movement.
5. Manipulation of the Host OS. When an adversary is looking to maintain access to a system, one technique they use is to reduce the security posture of that system. For example, they might disable the endpoint security software, reduce/disable security logging, or even change remote authentication requirements to easily come back to that system at a later time. Hunt for non-compliant systems that don’t have your full security stack enabled as it might be a sign you have an unauthorized user with an all access pass. In addition, a sweep of systems looking at their earliest and last security log entry might find an outlier where logging has been tampered with.
6. Outliers. Because beachheads and malicious user behavior is often aberrant and different from most of the network, identifying outliers is extremely effective in finding beachheads and malicious user behavior that evade automated or signature-based categorization. Data stacking techniques allow you to take a set of data, such as all running executables across every endpoint of a particular OS, and stack them to look for outliers that are unique or have a low occurrence rate. For example, if 900 Windows 7 systems have one version of iexplorer.exe, and one (1) wWndows 7 system has another that doesn’t match the same path or file hash, you should look into why the one is different than the others. Sorting subpages in access logs on a web server by least occurrence might show you that one IP accessing a malicious webshell on your site.  Ultimately, persistent attackers prefer not to propagate through entire networks – they choose only one or two, so they can minimize exposure and remain hidden. Data stacking and outlier identification help us use this fact against them.

Feel free to contact E-SPIN for the solution for your system and operation to reduce risk of your businesses  and organization. We can secure and protect your businesses with our various software security technology include the solution for Indicators of Compromise (IOCs).