Search

Home > The Incident Response Podcast > Getting back to basics, IR 101 - Episode 013
Podcast: The Incident Response Podcast
Episode:

Getting back to basics, IR 101 - Episode 013
Category: Technology
Duration: 00:50:36
Publish Date: 2020-06-03 15:22:42
Description:

Recorded May 2020

TOPIC: Getting back to basics, IR 101

OUR SPONSORS:

LOG-MD-Discover_it_300.jpg

NEWS-WORTHY:

Best EDR Security Services In 2020 for Endpoint Protection

How to Avoid Spam—Using Disposable Contact Information

Shiny new Azure login attracts shiny new phishing attacks

Upgrading from EDR to MDR is Critical but Easier than You Think

The ransomware that attacks you from inside a virtual machine

SITE-WORTHY:

Malware Archaeology - Cheat Sheets

TOOL-WORTHY:

LOG-MD - The Log anD Malicious Discovery tool

MALWARE OF THE MONTH:

Qakbot

  • Typical delivery via a Office doc or URL

  • Created a folder in C:\Users

Key Detection points

  • Enable better logging AutoRuns - Uses Run key and Scheduled Task

  • WMIPrvSe launch binary in C:\Users

  • Binary in root of \Username directory C:\Users\\.exe

  • C:\Users\\AppData\Roaming\Microsoft\ Syswow64\Explorer.exe used Parent of Explorer.exe is NEVER a binary in C:\Users

  • Process injection of Syswow64\Explorer.exe

  • Ping 127.0.0.1

  • Scheduled Task created by a binary in C:\Users

  • Syswow64\Explorer,exe opening all the browsers

  • Binary in C:\User calling out to foreign country

PREVENTION

  • Block Office macros

  • Don’t allow uncategorized websites

  • EDR Software

  • Whitelisting C:\Users

TOPIC OF THE DAY:

Getting back to basics, IR 101

What is getting back to basics - IR 101

  • This will likely be multiple episodes

  • We will start with Windows

Why is this important?

  1. WHEN you have an incident, data we, and you need will be available

  2. This is probably the #1 finding and recommendation we have made to organizations we have been involved with over the years

  3. Security tools fail, so other data you collect can help discover what happened where, when, and how

What is the problem we are wanting our listeners to solve? 

  1. To be better prepared in the event of an incident to speed up investigations

  2. Give your SOC, IT, or Security people the data they need to investigate events

  3. Make log management data better if you are collecting all the things

  4. And of course… help your IR Consultancy do a better job FASTER

Other Articles:

-------------------

CIS Benchmarks

DerbyCon talk on EDR

DerbyCon talk on Winnti
Total Play: 0