SIGN IN YOUR ACCOUNT TO HAVE ACCESS TO DIFFERENT FEATURES

FORGOT YOUR PASSWORD?

FORGOT YOUR DETAILS?

AAH, WAIT, I REMEMBER NOW!
Need Help? Email [email protected]
  • LOGIN

E-SPIN Group

CONTACT US / GET A QUOTE
  • No products in cart.
  • HOME
  • PROFILE
    • Corporate Profile
    • About us
    • Customer Overview
    • Investor Relations
    • Procurement
  • GLOBAL THEMES
    • Artificial Intelligence (AI)
    • Big Data
    • Blockchain
    • Cloud Computing
    • Cognitive Computing
    • Cyber Security
    • DevSecOps
    • Digital Transformation (DT)
    • Modern Workplace
    • Internet of Things (IoT)
    • Quantum Computing
  • SOLUTIONS
    • Application Security
    • DevSecOps
    • Digital Forensics
    • IT Operations Management (ITOM)
    • Malware Analysis and Reverse Engineering
    • Network Management System (NMS)
    • Network Operation (NetOps)
    • Network Performance Monitoring and Diagnostics (NPMD)
    • Penetration Testing
    • Secure Development
    • Security Information & Event Management (SIEM)
  • INDUSTRIES
    • Aerospace & Defense
    • Automotive
    • Banking & Financial Markets
    • Chemical & Petroleum
    • Commercial and Professional Services
    • Construction & Real Estate
    • Consumer Products
    • Education
    • Electronics
    • Energy & Utilities
    • Food & Beverage
    • Information Technology
    • Insurance
    • Healthcare
    • Goverment
    • Telecommunications
    • Transportation
    • Travel
    • Manufacturing
    • Media & Entertainment
    • Mining & Natural Resources
    • Life Sciences
    • Retail
  • PRODUCTS
    • Brand Overview
      • Acunetix
      • E-Lock
      • Hex-Rays
      • Immunity
      • Progress | Ipswitch
      • Metageek
      • Qualys
      • Parasoft
      • Tenable
      • Titania
      • Veracode
    • Rest of Brands
      • Adobe
      • BeyondTrust
      • Core Security
      • DefenseCode
      • HCL
      • ImmuniWeb
      • LiveAction
      • McAfee
      • Micro Focus
      • Microsoft
        • Microsoft Surface
      • Netsparker
      • Nutanix
      • Paessler
      • PECB
      • Portswigger
      • Red Hat
      • Riverbed
      • RSA
      • Solarwinds
      • TamoSoft
      • Trend Micro
      • TSFactory
      • Trustwave
      • VMware
      • VanDyke
      • Visiwave
    • Services Overview
    • Line Card
  • e-STORE
    • e-STORE
    • eSTORE Guide
    • SUPPORT
  • CAREERS
    • Careers
    • Culture, Values and CSR
    • How We Hire
    • Job Openings
  • BLOG / NEWS
    • Blogs and News
    • Resources Library
    • Calendar of Events
  • CONTACT
  • Home
  • Global Themes and Feature Topics
  • 5 Host Indicators of Compromise you need to hunt
0
E-SPIN
Tuesday, 21 August 2018 / Published in Global Themes and Feature Topics

5 Host Indicators of Compromise you need to hunt

Today we going to through about main 5 host indicators of compromise you need to hunt.

  1. Start with the beachhead. In most situation where there is long term breach, there is a beachhead; the system attackers use to get into and maintain access to the network. This is the primary thing you want to find. Hackers generally install an implant such as a Remote Access Tool (RAT), rootkit, or backdoor on the beachhead system. It’s often the one system in the network that’s not being monitored, due to non-compliance or attacker manipulation, and serves as the attacker’s continuing access point. They then traverse the rest of the network with stolen administrative credentials (aka “living off the land”), to reduce the possibility of being found by defensive monitoring and antivirus. As identifying malicious user behavior can be challenging, it’s often better to search for this beachhead system. A full exam using Forensic State Analysis (FSA) is a quick and scalable way to look for beachheads and the implants on them.
  2. Implants, Remote Access Tools and Backdoors. The current malware trend is fileless and does not touch disk, so you need to look in volatile memory for injections and in-memory manipulations of common processes. Finding and analyzing injections and fileless malware in volatile memory is only accomplished using a Forensic State Analysis approach (true FSA includes live volatile memory analysis). While a behavior-based approach can sometimes be effective, it can easily fool an analyst since the behavior and connections will trace back to the injected process (e.g. Internet Explorer), which may be incorrectly categorized as a false positive.
  3. Persistence mechanisms. If the implant isn’t active in memory, then it needs to be triggered to run in the future via a persistence mechanism. Examples include an autostart location in the registry, boot process redirection, or scheduled tasks / cronjob. If the malware is dormant, you won’t get any behavior indication or host events, so you will need to enumerate common persistence locations and analyze any commands, code, or files referenced. While there are hundreds of autostart locations in Windows, start your hunt for persistence mechanisms with scheduled tasks and the registry run keys, which are the most common. Understand that most endpoint security software (both legacy and ’next-gen‘) do not analyze persistence mechanisms, instead relying on periodic whole disk scans. Today, not all persistence mechanisms reference files on disk so these legacy approaches are not as effective anymore.
  4. Execution artifacts. Look for execution artifacts on the endpoint from Prefetch, Superfetch or Amcache, depending on the version of OS being analyzed. These are copies of executables or a register of executables that have run in the past. While this can be useful to find malware, a good technique to find credential misuse is to identify patterns of common administrative tools like net.exe, wmic.exe, cmd.exe, and powershell.exe.  If you find executables like these ran in quick succession, it’s a good indicator that someone has used admin credentials to enumerate the internal network environment or conduct lateral movement.
  5. Manipulation of the Host OS. When an adversary is looking to maintain access to a system, one technique they use is to reduce the security posture of that system. For example, they might disable the endpoint security software, reduce/disable security logging, or even change remote authentication requirements to easily come back to that system at a later time. Hunt for non-compliant systems that don’t have your full security stack enabled as it might be a sign you have an unauthorized user with an all access pass. In addition, a sweep of systems looking at their earliest and last security log entry might find an outlier where logging has been tampered with.
  6. Outliers. Because beachheads and malicious user behavior is often aberrant and different from most of the network, identifying outliers is extremely effective in finding beachheads and malicious user behavior that evade automated or signature-based categorization. Data stacking techniques allow you to take a set of data, such as all running executables across every endpoint of a particular OS, and stack them to look for outliers that are unique or have a low occurrence rate. For example, if 900 Windows 7 systems have one version of iexplorer.exe, and one (1) wWndows 7 system has another that doesn’t match the same path or file hash, you should look into why the one is different than the others. Sorting subpages in access logs on a web server by least occurrence might show you that one IP accessing a malicious webshell on your site.  Ultimately, persistent attackers prefer not to propagate through entire networks – they choose only one or two, so they can minimize exposure and remain hidden. Data stacking and outlier identification help us use this fact against them.

Feel free to contact E-SPIN for the solution for your system and operation to reduce risk of your businesses  and organization. We can secure and protect your businesses with our various software security technology include the solution for Indicators of Compromise (IOCs).

Tagged under: Indicators of compromise, IOC

What you can read next

Types Of Performance Testing
The Benefits Single Sign-On(SSO)
The Benefits Single Sign-On(SSO)
How a quantum computer works
How a Quantum Computer Working

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Recent Posts

  • Webinar Veracode Static Analysis (SAST)

    This is routine hour long technical overview, h...
  • World at the speed of light toward Digital Transformation

    The whole world is impacted by COVID-19 pandemi...
  • Trends make DevSecOps in the mainstream adoption

    World is changing rapidly, despite COVID-19 pan...
  • Cloud’s power and potential in the next normal

    Cloud is the next Internet, if you are at the p...
  • IT Services Executive

    IT Services Executive

    IT Services Executive Responsibilities: assist ...

Recent Comments

  • Dorai M on 5 Common ML Challenges Data Scientists Face

Archives

  • January 2021
  • December 2020
  • November 2020
  • October 2020
  • September 2020
  • August 2020
  • July 2020
  • June 2020
  • May 2020
  • April 2020
  • March 2020
  • February 2020
  • January 2020
  • December 2019
  • November 2019
  • October 2019
  • September 2019
  • August 2019
  • July 2019
  • June 2019
  • May 2019
  • April 2019
  • March 2019
  • February 2019
  • January 2019
  • December 2018
  • November 2018
  • October 2018
  • September 2018
  • August 2018
  • July 2018
  • June 2018
  • May 2018
  • April 2018
  • March 2018
  • February 2018
  • January 2018
  • December 2017
  • November 2017
  • October 2017
  • September 2017
  • August 2017
  • July 2017
  • June 2017
  • May 2017
  • March 2017
  • January 2017
  • December 2016
  • November 2016
  • October 2016
  • September 2016
  • August 2016
  • July 2016
  • June 2016
  • May 2016
  • April 2016
  • March 2016
  • February 2016
  • January 2016
  • December 2015
  • November 2015
  • October 2015
  • September 2015
  • August 2015
  • July 2015
  • June 2015
  • January 2015
  • December 2014
  • October 2014
  • September 2014
  • July 2014
  • June 2014
  • May 2014
  • April 2014
  • March 2014
  • February 2014
  • January 2014
  • December 2013
  • November 2013
  • October 2013
  • September 2013
  • July 2013
  • June 2013
  • May 2013
  • April 2013
  • March 2013
  • February 2013
  • January 2013
  • December 2012
  • November 2012
  • October 2012
  • September 2012
  • August 2012
  • July 2012
  • June 2012
  • May 2012
  • February 2012
  • July 2011
  • June 2011
  • February 2009
  • July 2008

Categories

  • Acunetix
  • Adobe
  • Aerospace and Defence
  • AppSec Labs
  • Automotive
  • Banking and Financial Markets
  • BeyondTrust
  • Brand
  • Chemical and petroleum
  • Codified Security
  • Commercial and Professional Services
  • Construction and Real Estate
  • Consumer products
  • Contact Us
  • Core Impact
  • Core Security
  • DefenseCode
  • E-Lock
  • Education
  • Electronics
  • Energy and utilities
  • FAQ
  • Food and Beverage (F&B)
  • GFI
  • Global Themes and Feature Topics
  • Government
  • HCL
  • Healthcare
  • Hex-Rays
  • IBM
  • Immunity
  • ImmuniWeb
  • Industries
  • Information Technology
  • Insurance
  • Ipswitch
  • Job
  • Life Science
  • LiveAction
  • Logpoint
  • Manufacturing
  • McAfee
  • Media and Entertainment
  • Metageek
  • Micro Focus
  • Microsoft
  • Mining and Natural Resources
  • Nessus
  • Netsparker
  • News
  • Nutanix
  • Paessler
  • Parasoft
  • PECB
  • PortSwigger
  • Pradeo
  • Product
  • Qualys
  • Rapid7
  • RedHat
  • Retail
  • Retina
  • Riverbed
  • RSA
  • Security Innovation
  • Security Roots
  • Services
  • SILICA
  • Smart City
  • Soft Activity
  • SolarWinds
  • Solution
  • Symantec
  • TamoSoft
  • Telecommunications
  • Tenable
  • Titania
  • Transportation
  • Travel
  • Trend Micro
  • Trustwave
  • TSFactory
  • Uncategorized
  • Vandyke
  • Veracode
  • Videos
  • VisiWave
  • VMware
  • Webinar Archive

Meta

  • Log in
  • Entries feed
  • Comments feed
  • WordPress.org

CORPORATE

  • Profile
  • About us
  • Careers
  • Investor Relations
  • Procurement

SOLUTIONS & PRODUCTS

  • Industries
  • Solutions
  • Products
  • Brand Overview
  • Services

STORE & SUPPORT

  • Shop
  • Cart
  • Checkout
  • My Account
  • Support

PRODUCTS & SERVICES

  • Industries
  • Solutions
  • Products
  • Brand Overview
  • Services

FOLLOW US

  • Facebook
  • Twitter
  • Pinterest
  • LinkedIn
  • Google+
  • YouTube
  • WordPress Blog
© 2005 - 2020 E-SPIN Group of Companies | All rights reserved.
  • Contact
  • Privacy
  • Terms of use
TOP