Introduction to Cybersecurity Operations

Tier 3 Security Operations Center (SOC)

• Primary Function: Handles complex incidents requiring deep technical expertise and investigations.
• Focus: Advanced threat analysis, malware analysis, incident response planning, and incident containment.
• Responsibilities: Investigate high-profile incidents, collaborate with other teams, and drive incident response procedures.
• Expert Level: Tier 3 SOC analysts are highly skilled cybersecurity professionals.

Incident Response Lifecycle: Preparation

• Phase: Preparation
• Objective: Prepare tools and resources for prompt incident response.
• Key Activities: Develop and maintain up-to-date response plans, ensure tool availability and functionality, conduct regular drills, create templates for incident documentation, and establish communication channels.

SOAR

• Stands for Security Orchestration, Automation, and Response.
• Purpose: Automates and streamlines repetitive tasks in security operations.
• Benefits: Enhanced incident response efficiency, reduces human error, and frees up security professionals for more complex tasks.

Containment, Eradication, & Recovery Phase

• Goal: Isolate the compromised system or network to prevent further spread, remove malware from affected devices, and restore systems to their pre-incident state.
• Key Activities: Disconnecting compromised systems, isolating infected devices, removing malware, restoring data from backups, and hardening systems to prevent future attacks.

Tier 2 Security Operations Center (SOC)

• Function: Investigates and analyzes alerts generated by security tools and investigates potential incidents.
• Responsibilities: Analyze alerts, correlate events, determine the severity and scope of incidents, and escalate incidents to Tier 3 when necessary.
• Technical Skills: Tier 2 analysts possess strong security knowledge and understanding of common attack techniques.

Incident Detection & Analysis

• Sources: Security tools logs, intrusion detection systems (IDS), security information and event management (SIEM) systems, network traffic analysis, endpoint monitoring tools, and threat intelligence feeds.
• Process: Analyzing data from various sources to identify suspicious activity, correlating multiple events, and determining the nature and scope of potential incidents.

Detection & Analysis Phase

• Focus: Identifying and analyzing incidents, correlating events, and determining the scope and severity of the incident.
• Key Activities: Analyzing security alerts, investigating suspicious activity, gathering evidence, and determining the root cause of the incident.

Post-Incident Activity Phase

• Outcome: Documenting the incident, analyzing the incident to identify weaknesses, implementing corrective actions, and updating security policies and procedures to prevent future incidents.
• Key Activities: Documenting the incident response process, conducting a post-mortem analysis, implementing remediation measures, updating security policies, training teams, and reporting incident details to stakeholders.

Command and Control (C2) Server

• Function: In malware infections, a C2 server serves as a communication point between infected systems and attackers.
• Purpose: Receives commands from attackers, sends updates, and relays stolen data.

VirusTotal

• Not Advisable: Uploading entire hard drives to VirusTotal, as it can violate privacy policies and overload the system.
• Best Practices: Use it for suspicious files, analyzing malware samples, and verifying the legitimacy of software.

Trickbot Malware

• Indicator of Compromise: Commonly utilizes domain generation algorithms (DGAs) to generate a vast number of random domains for its C2 servers, making detection difficult.
• Behavior: Trickbot is known for credential harvesting, banking trojan activity, and spreading to other vulnerable systems.

Dridex Malware

• Digital Certificate Properties: While Dridex often uses SSL/TLS encryption for communication, the digital certificates used for encryption might not conform to industry standards or have suspicious origins.

Symmetric Encryption

• Characteristic: Uses the same key for both encryption and decryption.
• Example: AES (Advanced Encryption Standard)

Trickbot TCP Port

• Uncommon Port: Trickbot typically avoids commonly used ports but can use port 4444 for communication.

TCP Stream Analysis

• Sequence: Open a TCP stream, select the relevant session, go to the "Follow" menu, and choose "TCP Stream".

Identifying HTTP Client

• Method: Analyze HTTP requests in network traffic for unique identifiers like User-Agent strings, IP addresses, or cookies.

Malware Analysis: File Behavior

• Information: Process calls, file modifications, network connections, registry changes, and interaction with other systems.

DNS Record: NS

• Significance: An NS record maps a domain name to a name server that holds its DNS records.

Wireshark Packet Identification

• Method: Wireshark displays packets by their protocol, source IP address, destination IP address, and packet number.

Wireshark Filtering: Subnet

• Filter: ip.addr == 192.168.20.0/24

Exporting Data from Wireshark

• Option: Export the data as a "PCAP file".

DNS Record: CNAME

• Information: A CNAME record provides an alias for a canonical name, mapping a domain name to a different domain name.

Command-line Checksum Utility

• Utility: Use the "md5sum" command to compute the MD5 checksum for files.

Wireshark Built-in Functionality

• Allows: Packet dissection, filtering, traffic analysis, and export of data.

OSI Model: Transport Layer

• Responsibility: Data transmission reliability, error control, and flow control.

TCP/IP Model: Session Layer

• Equivalent: The Transport Layer in the TCP/IP model.

OSI Model: Presentation Layer

• Function: Handles data formatting, encryption, and decryption, ensuring data is transmitted in a compatible format for the receiving application.

OSI Model: Network Layer

• Addressing and Routing: Responsible for addressing and routing data packets across networks.

OSI Model: Transport Layer Data Units

• Data Units: Segments

OSI Model: Physical Layer

• Purpose: Transmits data over physical media like cables or wireless signals.

TCP/IP Model: Non-Included Protocol

• Protocol: IPX (Internet Packet Exchange)

OSI Model: Application Layer

• Interaction: Interacts directly with end-user applications.

Explore the various threat actors in cybersecurity, including amateurs, hacktivists, financially motivated criminals, and nation-state actors. Understand their distinct motivations and techniques used in cyber operations. This quiz will enhance your knowledge of the cybersecurity landscape.