WEBVTT 1 00:00:00.080 --> 00:00:03.240 Okay, you know that feeling you're staring at this mountain 2 00:00:03.279 --> 00:00:06.879 of articles, research papers, all this stuff about cybersecurity threats 3 00:00:07.480 --> 00:00:11.080 and you just wish someone could cut straight to the 4 00:00:11.119 --> 00:00:16.039 important bits. Well, consider that wish granted. Today we're basically 5 00:00:16.079 --> 00:00:19.120 giving you that shortcut. We want you to really understand 6 00:00:19.160 --> 00:00:25.160 how the leading experts are detecting, deterring, and responding to 7 00:00:25.199 --> 00:00:28.160 security threats, but without grounding you and all the jargon. 8 00:00:28.480 --> 00:00:32.240 That's absolutely our mission for this deep dive. We've poured 9 00:00:32.280 --> 00:00:35.399 through a pretty comprehensive guide from some of the field's 10 00:00:35.479 --> 00:00:39.079 leading experts, and it's packed with insights everything from incident 11 00:00:39.159 --> 00:00:42.719 response fundamentals right up to advanced threat hunting. What really 12 00:00:42.799 --> 00:00:45.560 jumps out, I think is how they demystify these really 13 00:00:45.560 --> 00:00:49.119 complex challenges, break them down into actionable steps exactly. 14 00:00:49.159 --> 00:00:51.000 So our goal today is to pull out the most 15 00:00:51.560 --> 00:00:56.159 important nuggets of knowledge, give you a clear, structured understanding 16 00:00:56.240 --> 00:00:58.759 of what's really cutting edge in cybersecurity right now. So, 17 00:00:58.799 --> 00:01:01.200 whether you're prepping for a meeting, just catching up on 18 00:01:01.240 --> 00:01:03.759 the latest, or maybe you're just you know, super curious 19 00:01:03.759 --> 00:01:07.560 about what keeps our digital world safe, let's dive in 20 00:01:08.400 --> 00:01:11.599 to really build a strong defense. It really helps to 21 00:01:11.680 --> 00:01:13.719 understand how the attacker thinks. 22 00:01:14.519 --> 00:01:16.359 Oh absolutely, So. 23 00:01:16.280 --> 00:01:18.319 We're going to kick things off by looking at their playbook. 24 00:01:18.359 --> 00:01:20.439 Okay. And you know, while a lot of people see 25 00:01:20.439 --> 00:01:25.359 these cyber attacks and think they seem uniquely sophisticated each time, 26 00:01:26.239 --> 00:01:30.359 security researchers have actually uncovered pretty consistent patterns over time, 27 00:01:30.920 --> 00:01:32.680 which kind of makes you wonder, is there like a 28 00:01:32.719 --> 00:01:37.680 standard method, a universal way to analyze and detect these threats. 29 00:01:37.879 --> 00:01:41.159 As it turns out, yes, there absolutely is. We'll start 30 00:01:41.200 --> 00:01:44.760 with a really foundational concept developed by Lockheed Martin. It's 31 00:01:44.799 --> 00:01:46.000 called the cyber kill chain. 32 00:01:46.200 --> 00:01:48.159 Ah, the kill chain, Yeah, yeah. 33 00:01:48.200 --> 00:01:50.400 I think of it as the seven distinct phases, like 34 00:01:50.480 --> 00:01:54.079 stages of a targeted attack. But the real brilliance here 35 00:01:54.159 --> 00:01:57.400 isn't just seeing the attacker steps. It's realizing that every 36 00:01:57.439 --> 00:02:00.519 single one of those stages gives defenders a chance, you know, 37 00:02:01.120 --> 00:02:03.719 a distinct opportunity to interrupt them, even if you miss 38 00:02:03.760 --> 00:02:04.359 something earlier. 39 00:02:04.599 --> 00:02:08.199 That's a great point. Okay, let's walk through these phases. Then. 40 00:02:08.400 --> 00:02:11.360 First up is reconnaissance. This is where the attacker is 41 00:02:11.439 --> 00:02:13.360 just gathering information about a. 42 00:02:13.439 --> 00:02:15.919 Target system, right, intel gathering. 43 00:02:15.719 --> 00:02:20.400 Exactly, harvesting email addresses, maybe identifying employees on social media, 44 00:02:20.439 --> 00:02:24.280 that kind of thing. Your defense here involves, say collecting 45 00:02:24.319 --> 00:02:29.840 website visitor logs or educating employees about social media danger. 46 00:02:29.879 --> 00:02:31.360 Okay, So gathering intel, got it. 47 00:02:31.400 --> 00:02:36.199 Then comes weaponization. So here the intruder actually creates tailored malware, 48 00:02:36.719 --> 00:02:40.199 like a virus or a worm, maybe designed for specific 49 00:02:40.280 --> 00:02:42.520 vulnerabilities they found back in the reconfduce. 50 00:02:42.639 --> 00:02:43.560 Ah, okay, And on. 51 00:02:43.520 --> 00:02:46.000 The defender side, you need to be analyzing this malware, 52 00:02:46.199 --> 00:02:51.520 understanding how it's built, maybe tracking newly registered malicious domains. 53 00:02:51.199 --> 00:02:53.680 Right, building the actual weapon okay, and then they have 54 00:02:53.719 --> 00:02:55.280 to get it to you somehow precisely. 55 00:02:55.360 --> 00:02:57.759 That's the delivery phase. This could be you know, the 56 00:02:57.800 --> 00:03:01.840 classic malicious email attachment, maybe a compromised USB sticks someone 57 00:03:01.840 --> 00:03:04.719 plugs in. Oh yeah, social media interactions, or even what 58 00:03:04.759 --> 00:03:07.240 they call a watering hole website right. 59 00:03:07.080 --> 00:03:10.080 Where they compromise a site they know you visit often exactly. 60 00:03:10.199 --> 00:03:13.120 So as a defender, your job is blocking those common 61 00:03:13.199 --> 00:03:16.439 threat vectors, collecting email and weblogs so you can reconstruct 62 00:03:16.439 --> 00:03:17.879 what happened later if you need to. 63 00:03:18.080 --> 00:03:21.520 Okay. So after delivery, it's all about actually getting in. 64 00:03:21.759 --> 00:03:26.439 That's exploitation. The malware triggers it exploits a vulnerability to 65 00:03:26.479 --> 00:03:29.280 gain access. This is often where you might first feel 66 00:03:29.599 --> 00:03:34.800 something's wrong, you know, an anomaly. Defenses here include user 67 00:03:34.840 --> 00:03:39.960 awareness training, physical security scanning for vulnerabilities. Hardening your end 68 00:03:40.000 --> 00:03:43.759 points makes sense once they're in. The next step is installation. 69 00:03:44.639 --> 00:03:47.800 This is where the malware establishes a persistent access point, 70 00:03:47.879 --> 00:03:48.719 like setting. 71 00:03:48.400 --> 00:03:51.039 Up a backdoor ah, so they can come back easily right. 72 00:03:51.319 --> 00:03:55.719 Defenders use things like host intrusion prevention or detection systems 73 00:03:55.919 --> 00:03:59.759 hips or hids to get alerts on say common installation 74 00:04:00.360 --> 00:04:02.960 being used or abnormal files being created, and. 75 00:04:02.919 --> 00:04:04.680 Then they basically take control. 76 00:04:04.879 --> 00:04:08.319 That's command and control or C two. The attacker gets 77 00:04:08.360 --> 00:04:11.840 persistent hands on the keyboard access to your network. They 78 00:04:11.879 --> 00:04:15.159 often use common channels like web, DNS or email protocols 79 00:04:15.159 --> 00:04:15.400 for this. 80 00:04:15.560 --> 00:04:15.919 Okay. 81 00:04:16.160 --> 00:04:19.560 Defenders work to discover the C two infrastructure, maybe through 82 00:04:19.639 --> 00:04:22.480 malware analysis, and they harden the network using things like 83 00:04:22.720 --> 00:04:26.800 proxies or dnsing colling that basically redirects the bad traffic 84 00:04:26.879 --> 00:04:30.480 ut you and finally you have action on objectives. 85 00:04:30.759 --> 00:04:33.000 This is the endgame, the whole reason they did all this. 86 00:04:33.199 --> 00:04:38.120 Exactly, collecting user credentials, escalating their privileges, moving laterally across 87 00:04:38.160 --> 00:04:42.879 the network, exfiltrating data or sometimes even just destroying systems. 88 00:04:43.240 --> 00:04:47.519 And here your incident response playbook. Having restricted admin policies 89 00:04:47.959 --> 00:04:51.920 and media analyst response are absolutely critical. 90 00:04:52.040 --> 00:04:54.879 It's a really comprehensive framework. But even with all these 91 00:04:54.879 --> 00:04:57.879 steps laid out, actually implementing the cyber kil chain for 92 00:04:57.920 --> 00:05:01.319 a security operations center at SC, well it can be quite. 93 00:05:01.160 --> 00:05:03.519 A beast, right absolutely. And that's actually where something called 94 00:05:03.519 --> 00:05:06.199 the Unified cyber kill Chain or UCKC comes in. 95 00:05:06.279 --> 00:05:07.959 Okay, UCKC, how's that different? 96 00:05:08.079 --> 00:05:12.519 Well, unlike the basic CPC, which primarily focuses on successful 97 00:05:12.560 --> 00:05:16.920 external attacks, the UCKC provides a much more granular analysis. 98 00:05:17.240 --> 00:05:20.920 It covers not just attacks from outsiders, but also insider threats, 99 00:05:21.240 --> 00:05:24.480 and it details how an attacker maintains presence and plans 100 00:05:24.639 --> 00:05:27.920 for you know, even larger, more complex attacks down the line. 101 00:05:28.000 --> 00:05:29.920 So it adds more detail, like extra phases. 102 00:05:30.120 --> 00:05:34.759 Yeah, exactly, it adds critical phases like defense, evasion, persistence, pivoting, 103 00:05:35.120 --> 00:05:38.879 and lateral movement. So to give you a concrete example, 104 00:05:38.920 --> 00:05:41.839 think about a ransomware attack. Okay, the UCPC would map 105 00:05:41.920 --> 00:05:44.839 out every single step it starts with target reconnaissance, maybe 106 00:05:44.839 --> 00:05:48.959 collecting email info, then target exploitation a user opens a 107 00:05:48.959 --> 00:05:53.120 macro enabled file boom infection. Weaponization is when that malicious 108 00:05:53.120 --> 00:05:55.480 file connects to a C two server to download the 109 00:05:55.519 --> 00:06:00.120 actual ransomware. Then installation. It auto installs, then execution the 110 00:06:00.160 --> 00:06:01.120 files get encrypted. 111 00:06:01.199 --> 00:06:03.319 The part everyone dreads, right, But. 112 00:06:03.279 --> 00:06:08.040 The UCKC goes deeper. It details target recon internally as 113 00:06:08.079 --> 00:06:12.480 the ransomware scans the network, then internal exploitation as it 114 00:06:12.560 --> 00:06:17.519 exploits other systems. It finds privilege escalation, getting higher permissions, 115 00:06:17.600 --> 00:06:22.279 lateral movement, maintaining persistence by say, registering with startup programs, 116 00:06:22.600 --> 00:06:26.399 and finally target manipulation, encrypting and maybe sending valuable data out. 117 00:06:26.480 --> 00:06:29.439 It really paints that complete picture, the whole continuity of 118 00:06:29.480 --> 00:06:29.920 the attack. 119 00:06:30.079 --> 00:06:34.079 Wow. Okay, so beyond just reacting when something happens, the 120 00:06:34.199 --> 00:06:37.360 experts really lean into something called threat hunting. Right. This 121 00:06:37.399 --> 00:06:42.199 isn't just waiting for an alert. It sounds more aggressive, proactive. 122 00:06:42.240 --> 00:06:44.879 Proactive is a great word for it. They describe threat 123 00:06:44.959 --> 00:06:48.879 hunting as both a science and an art form. And 124 00:06:48.920 --> 00:06:51.680 what's truly critical is how human centric it is. You 125 00:06:51.720 --> 00:06:53.879 really need to immerse your hunters and what your company's 126 00:06:53.959 --> 00:06:57.360 normal environment looks like. Train them thoroughly, give them clearer 127 00:06:57.439 --> 00:07:00.279 guidelines on what they should focus on, and crucial you 128 00:07:00.319 --> 00:07:03.639 want to cultivate these skills from within your own sc Okay, that. 129 00:07:03.560 --> 00:07:06.759 Begs the question, then, what actually makes someone an effective 130 00:07:06.800 --> 00:07:07.279 threat hunter? 131 00:07:07.360 --> 00:07:08.160 That's a good question. 132 00:07:08.480 --> 00:07:11.040 From what I've read, it sounds like it's about critical thinking, right, 133 00:07:11.160 --> 00:07:14.560 and learning from everything, even the false positive, like maybe 134 00:07:14.560 --> 00:07:17.639 you spend hours chasing a weird redirect only to find 135 00:07:17.639 --> 00:07:19.319 out it's just an ad Exactly. 136 00:07:19.680 --> 00:07:22.800 That experience is valuable, even if it feels frustrating at 137 00:07:22.800 --> 00:07:26.279 the time. Effective hunters also stay hyper informed on the 138 00:07:26.319 --> 00:07:30.120 latest threats, and they often mix different styles. There's open hunting, 139 00:07:30.199 --> 00:07:33.040 sort of casting a large net with broad search terms 140 00:07:33.240 --> 00:07:35.439 looking for threats that might have been ignored, okay, and 141 00:07:35.480 --> 00:07:38.560 then there's targeted hunting, where you're using specific indicators of 142 00:07:38.600 --> 00:07:42.839 compromise or IOCs that you might have received from intelligence feeds. Right. 143 00:07:43.040 --> 00:07:46.000 So different approaches for different situations. 144 00:07:45.800 --> 00:07:48.759 Absolutely, but no matter the style, you should always approach 145 00:07:48.800 --> 00:07:52.920 it with a plan and a clear hypothesis. For instance, 146 00:07:52.959 --> 00:07:54.800 you might think, okay, if a trojan were to infect 147 00:07:54.800 --> 00:07:57.959 this machine, it would probably need exploit. Let me look 148 00:07:58.000 --> 00:08:01.519 for signs of say CVE twenty eighteen four eight seven 149 00:08:01.600 --> 00:08:05.920 eight by checking downloaded dot SWF files. That kind of 150 00:08:05.959 --> 00:08:08.480 focus thinking saves a ton of valuable time. 151 00:08:08.680 --> 00:08:11.759 Makes sense, And underlying all of this, I guess, are 152 00:08:11.879 --> 00:08:16.680 thoughtful policies like mandatory training, getting hunters to work closely 153 00:08:16.720 --> 00:08:20.319 with other IT folks, and having clear rules for escalating 154 00:08:20.360 --> 00:08:21.439 things and reporting. 155 00:08:21.160 --> 00:08:24.319 Findings precisely so when you put it all together, threat 156 00:08:24.399 --> 00:08:27.399 hunting isn't just an add on. It's a vital complement 157 00:08:27.439 --> 00:08:30.240 to your SoC and your automated security tools. But it 158 00:08:30.319 --> 00:08:35.399 really requires intentional team building, dedicated training, and those empowering 159 00:08:35.519 --> 00:08:37.000 policies to make it work well. 160 00:08:37.039 --> 00:08:39.799 All right, So, if that's the attacker's playbook, the kill chain, 161 00:08:40.279 --> 00:08:43.399 what about the digital breadcrumbs they inevitably leave behind once 162 00:08:43.440 --> 00:08:46.600 they found a way in. That's where digital forensics comes in, right, 163 00:08:46.679 --> 00:08:48.360 finding those traces exactly. 164 00:08:48.399 --> 00:08:50.879 We're talking about digging into the digital footprints. 165 00:08:51.000 --> 00:08:52.919 Okay, let's get into the nitty gritty then. 166 00:08:53.159 --> 00:08:56.080 Well, a key place to start is Windows event logs. 167 00:08:56.480 --> 00:09:01.120 These are absolutely essential artifacts for identifying compromise systems. 168 00:09:00.720 --> 00:09:03.519 Right, those logs that record everything pretty much. 169 00:09:03.879 --> 00:09:07.720 The Windows OS logs events based on categories Applications, system 170 00:09:07.799 --> 00:09:11.039 security are the main ones, and these logs record everything 171 00:09:11.120 --> 00:09:15.639 from errors and warnings to simple information successes failures. It 172 00:09:15.679 --> 00:09:17.799 helps you classify how severe an event might be. 173 00:09:17.960 --> 00:09:20.679 Okay, so how do we actually turn these, you know, 174 00:09:21.120 --> 00:09:25.279 potentially millions of log entries into actionable intelligence for hunting. 175 00:09:25.440 --> 00:09:28.399 Yeah, that's the challenge. But what's truly illuminating is how 176 00:09:28.440 --> 00:09:31.919 these Windows event logs capture steps that are really common 177 00:09:31.960 --> 00:09:34.720 to advanced persistent threats apts, like the steps in the 178 00:09:34.799 --> 00:09:40.000 kill chain very similar. Yeah, initial compromise, maintaining presence, escalating privileges, 179 00:09:40.080 --> 00:09:44.799 internal recon lateral movement, and finally mission completion. By correlating 180 00:09:44.879 --> 00:09:48.080 various event IDs, these numerical codes Windows as signs, you 181 00:09:48.120 --> 00:09:50.480 can piece together that entire attack narrative. 182 00:09:50.600 --> 00:09:53.159 Okay, give me an example for that initial conpromise. 183 00:09:53.320 --> 00:09:56.240 Sure, event ID four six eight eight logs and new 184 00:09:56.279 --> 00:09:58.879 process creation. Now you don't need to memorize the number 185 00:09:58.879 --> 00:10:01.919 four six eight eight, but you need to understand that 186 00:10:02.000 --> 00:10:06.000 this specific event is like the attacker's unavoidable digital fingerprint. 187 00:10:06.240 --> 00:10:09.159 It happens every time they run something new. So looking 188 00:10:09.200 --> 00:10:12.600 for unusual process names or paths in these forty six 189 00:10:12.679 --> 00:10:17.159 and eight events can help detect that initial breach. Similarly, 190 00:10:17.360 --> 00:10:20.200 there are event IDs related to object auditing, like four 191 00:10:20.240 --> 00:10:23.759 to six sixty three, which tracks object access. These can 192 00:10:23.799 --> 00:10:26.840 help identify malware being dropped or changed to the registry. 193 00:10:27.399 --> 00:10:30.600 And you know, be wary of attacks on applications seeing 194 00:10:30.639 --> 00:10:32.840 event IDs like one thousand and two, which is an 195 00:10:32.840 --> 00:10:36.360 application hangar crash, or even one thousand, the dreaded blue 196 00:10:36.399 --> 00:10:40.279 screen of death. These could indicate things like buffer overflow attacks. 197 00:10:40.360 --> 00:10:44.600 Even just a malicious application installation will leave traces, maybe 198 00:10:44.600 --> 00:10:46.159 like event ID one oh three three. 199 00:10:46.559 --> 00:10:48.720 So it's not just that something happened, but the type 200 00:10:48.720 --> 00:10:50.519 of event gives you clues about. 201 00:10:50.279 --> 00:10:53.879 What happened exactly. And for maintaining access and lateral movement, 202 00:10:53.919 --> 00:10:56.559 attackers often use things like scheduled tasks, or they install 203 00:10:56.559 --> 00:10:58.639 themselves as services to persist. 204 00:10:58.279 --> 00:10:59.799 Right, so they stick around yep. 205 00:11:00.279 --> 00:11:03.360 So if you suddenly see a service terminate unexpectedly, that's 206 00:11:03.440 --> 00:11:06.279 event ID seven zero three four, or a brand new 207 00:11:06.320 --> 00:11:08.879 service gets installed, that's a huge red flag. 208 00:11:08.960 --> 00:11:10.559 Absolutely, those would definitely stick out. 209 00:11:10.759 --> 00:11:13.840 Account usage is another gold mine. We all know about 210 00:11:13.840 --> 00:11:16.440 event ID four six twenty four for successful logans and 211 00:11:16.480 --> 00:11:18.279 four to six to twenty five for failed logans. Those 212 00:11:18.279 --> 00:11:20.559 are foundational, sure, but you also want to look for 213 00:11:20.639 --> 00:11:23.120 things like four to six seventy two, which is special 214 00:11:23.120 --> 00:11:26.799 privileges assigned to new logan or account lockouts, maybe a 215 00:11:26.960 --> 00:11:30.960 NID five thirty nine. What's particularly insightful, though, is the 216 00:11:31.000 --> 00:11:33.279 logan type field within these logan events. 217 00:11:33.360 --> 00:11:34.799 Logan type what does that tell you? 218 00:11:34.879 --> 00:11:37.639 It tells you how the logan happened. For example, a 219 00:11:37.720 --> 00:11:41.159 type three is a network logan like accessing a file share, 220 00:11:41.600 --> 00:11:45.000 a type ten is a remote RDP logan someone connecting remotely, 221 00:11:45.279 --> 00:11:47.679 and a type four is a batch slogan often used 222 00:11:47.679 --> 00:11:48.600 by scheduled tasks. 223 00:11:48.840 --> 00:11:51.240 Wow, that's powerful. So you can see the actual method 224 00:11:51.279 --> 00:11:52.159 of entry, not just that. 225 00:11:52.120 --> 00:11:54.519 Someone got in precisely. It gives you much more context 226 00:11:55.080 --> 00:11:58.200 network share usage. Event ID fifty one forty can show 227 00:11:58.200 --> 00:12:01.679 attackers mounting file shares to move move laterally. And finally, 228 00:12:01.720 --> 00:12:05.000 attackers often attempt covering tracks. They try to clear the logs. 229 00:12:05.279 --> 00:12:07.960 Ah they're bracing their footprints exactly. 230 00:12:08.360 --> 00:12:11.200 Event ID eleven oh two is for clearing the security 231 00:12:11.240 --> 00:12:14.000 log one oh four for the application log Seeing those 232 00:12:14.039 --> 00:12:18.000 as highly suspicious. And that's exactly why forwarding your logs 233 00:12:18.039 --> 00:12:22.399 to a central simim a security information and event management 234 00:12:22.399 --> 00:12:23.840 system is so crucial. 235 00:12:23.919 --> 00:12:27.159 Because the logs are already off the compromised machine. 236 00:12:26.879 --> 00:12:29.759 Right, it makes covering tracks much much harder for them. 237 00:12:29.840 --> 00:12:32.080 It really sounds like Windows event logs if you know 238 00:12:32.120 --> 00:12:35.360 how to read them, let threadhunters track and attackers every 239 00:12:35.399 --> 00:12:38.519 single move. It offers some hope in a battle that 240 00:12:38.720 --> 00:12:40.840 often seems kind of stacked against the defenders. 241 00:12:40.919 --> 00:12:43.600 It definitely does. And you know, something that's often overlooked 242 00:12:43.600 --> 00:12:46.919 is how attackers frequently leverage legitimate tools that are already 243 00:12:46.919 --> 00:12:49.759 present in your environment. PowerShell is a prime example. 244 00:12:50.039 --> 00:12:53.120 PowerShell. Yeah, it's incredibly powerful for administrators. 245 00:12:52.759 --> 00:12:54.039 Equally so for adversaries. 246 00:12:54.120 --> 00:12:54.240 Right. 247 00:12:54.279 --> 00:12:58.480 They use it for data exfiltration, privileged escalation, lateral movement, 248 00:12:58.600 --> 00:12:59.360 all that stuff. 249 00:12:59.559 --> 00:13:02.240 That's the paradox of PowerShell, isn't it. It's supposed to 250 00:13:02.240 --> 00:13:04.840 be there. It's powerful, it's legitimate, but it's also a 251 00:13:04.840 --> 00:13:10.039 prime tool for attackers. So how do defenders possibly untangle 252 00:13:10.120 --> 00:13:14.440 with malicious use from just routine admin activity that seems 253 00:13:14.480 --> 00:13:16.600 like it would generate constant false positives. 254 00:13:16.679 --> 00:13:19.720 It's definitely tricky. Yeah, but the guide points out some 255 00:13:19.799 --> 00:13:24.200 key tells, some giveaways. Attackers often have to bypass PowerShell's 256 00:13:24.240 --> 00:13:28.919 execution policies, those things designed to prevent accidental script execution. 257 00:13:29.240 --> 00:13:31.159 Okay, how do they do that? Well? 258 00:13:31.240 --> 00:13:34.519 They might pipe scripts directly into the PowerShell executable itself, 259 00:13:34.919 --> 00:13:37.480 or use a Base sixty four encoded command to hide 260 00:13:37.480 --> 00:13:40.960 the actual code, or simply pass the execution policy bypass 261 00:13:41.039 --> 00:13:43.759 argument when they run it. Sneaky, very and in most 262 00:13:43.799 --> 00:13:46.919 malicious cases, these PowerShell scripts are just acting as downloaders 263 00:13:46.919 --> 00:13:50.320 for additional payloads. They often use arguments like monarch no 264 00:13:50.440 --> 00:13:53.679 P which means no profile, or enw hidden to hide 265 00:13:53.720 --> 00:13:56.559 the window, or ENSDN for that encoded command we mentioned. 266 00:13:56.799 --> 00:13:59.360 These are all about stealth, trying to fly under the radar. 267 00:13:59.600 --> 00:14:01.840 Okay, So what are some of the key command line 268 00:14:01.879 --> 00:14:04.600 functions or bits of code that if you see them 269 00:14:04.600 --> 00:14:07.960 in a PowerShell command should instantly raise a red flag? 270 00:14:08.159 --> 00:14:12.000 Right? The guide highlights some common ones used in malicious scripts, 271 00:14:12.320 --> 00:14:17.320 things like newobjectsystem, dot net, dot web client, download string, 272 00:14:17.679 --> 00:14:19.279 or maybe download file. 273 00:14:19.480 --> 00:14:21.919 Okay, so commands for downloading things exactly. 274 00:14:22.320 --> 00:14:26.679 These download content from remote locations, sometimes directly into memory 275 00:14:26.720 --> 00:14:30.240 to avoid touching the disc They also frequently use commands 276 00:14:30.240 --> 00:14:33.279 like invoke expression or start process to actually run that 277 00:14:33.360 --> 00:14:34.320 downloaded code. 278 00:14:34.440 --> 00:14:36.639 And to hunt for these kinds of activities, you need 279 00:14:36.720 --> 00:14:39.679 specific data sources, right, It's not just the command line 280 00:14:39.720 --> 00:14:40.759 itself exactly. 281 00:14:41.279 --> 00:14:44.799 PowerShell itself can actually log highly relevant details. There are 282 00:14:44.840 --> 00:14:48.759 three main mechanisms defenders should know about. First, there's module logging. 283 00:14:49.360 --> 00:14:51.559 This gives you a sort of high level audit trail 284 00:14:51.639 --> 00:14:55.759 of PowerShell activity showing which commands were executed. The experts 285 00:14:55.840 --> 00:14:59.360 generally recommend enabling it for all modules using a wildcard 286 00:14:59.559 --> 00:15:03.600 got it us. Second is script block logging. This one 287 00:15:03.639 --> 00:15:05.919 is much more for a BOSE. It gives you more context, 288 00:15:05.960 --> 00:15:09.759 includes the actual script block content, especially when functions are invoked. 289 00:15:09.960 --> 00:15:12.039 It's highly recommended to turn this on too, although you 290 00:15:12.120 --> 00:15:14.360 might need to customize it if it generates, you know, 291 00:15:14.480 --> 00:15:16.200 too much data for your environment. 292 00:15:16.320 --> 00:15:17.879 Tide the balance and the third. 293 00:15:18.159 --> 00:15:22.639 The third is PowerShell transcription. This offers a full log 294 00:15:22.720 --> 00:15:26.039 of basically all input and output, like a transcript of 295 00:15:26.080 --> 00:15:29.960 the session. It stores these transcript files on the file system. 296 00:15:30.360 --> 00:15:33.679 Because these files can contain sensitive information, This is typically 297 00:15:33.679 --> 00:15:36.200 reserved for high security environments where you can really lock 298 00:15:36.240 --> 00:15:38.639 down access to those transcript files. 299 00:15:38.720 --> 00:15:42.600 Okay, so module logging, script block logging, and transcription. Yeah, 300 00:15:42.639 --> 00:15:46.279 but beyond those internal powershow logs, you can also look 301 00:15:46.279 --> 00:15:49.840 at network data sources, right like NetFlow packet captures. 302 00:15:49.480 --> 00:15:55.600 Absolutely, NetFlow full packet captures, PC copies, proxy logs, firewall logs. 303 00:15:55.679 --> 00:15:58.759 They all provide valuable context. For example, if you see 304 00:15:58.799 --> 00:16:01.919 powershells suddenly making unusual web request out to the Internet, 305 00:16:01.960 --> 00:16:04.000 that would be weird, yeah, or worse, if you see 306 00:16:04.000 --> 00:16:07.279 it uploading data via HTTP, that's a major red flag. 307 00:16:07.720 --> 00:16:10.960 While attackers can change things like user agent strings to 308 00:16:11.000 --> 00:16:15.000 try and blend in doing a frequency analyssis of HTTP 309 00:16:15.200 --> 00:16:18.240 pot methods, which are often used for uploading entire files, 310 00:16:18.600 --> 00:16:21.639 can be a really strong indicator of data ex filtration. 311 00:16:21.799 --> 00:16:24.159 Okay, that makes sense. So we've talked quite a bit 312 00:16:24.159 --> 00:16:28.200 about the attacks themselves and the digital breadcrumbs they leave. Yeah, 313 00:16:28.200 --> 00:16:30.639 but who are the actual people on the front lines, 314 00:16:30.879 --> 00:16:34.679 you know, doing this complex work of defending our digital landscape. 315 00:16:34.840 --> 00:16:37.919 Yeah, the human element is critical, and it's fascinating to 316 00:16:37.919 --> 00:16:41.120 see the sheer variety of incident response teams out there. 317 00:16:41.519 --> 00:16:44.919 You hear terms like c SERTs computer Security Incident Response 318 00:16:44.960 --> 00:16:49.840 teams psrts for product security incident response teams focusing on 319 00:16:49.960 --> 00:16:53.759 vulnerabilities in a company's own products, and even national CERTs 320 00:16:53.879 --> 00:16:55.480 like us SERT here in the States. 321 00:16:55.679 --> 00:16:57.919 Lots of different flavors, definitely. 322 00:16:57.519 --> 00:17:00.279 And establishing a c SERT is a major undertaking for 323 00:17:00.320 --> 00:17:04.599 any organization. You have to define its constituency, who does 324 00:17:04.599 --> 00:17:07.640 it serve. You need management, buy in budget. Of course, 325 00:17:07.880 --> 00:17:09.440 you have to decide where it fits in the org 326 00:17:09.519 --> 00:17:12.680 chart and develop crystal clear processes for everything. 327 00:17:12.880 --> 00:17:15.519 To give FLIKS a practical example, the guide shares how 328 00:17:15.559 --> 00:17:19.160 one medium sized software as a service company structures its response. 329 00:17:19.599 --> 00:17:23.079 They actually have two distinct groups. First, there's the Incident 330 00:17:23.079 --> 00:17:27.119 Response Team or IRT. Oh, this is the dedicated internal staff. 331 00:17:27.119 --> 00:17:30.079 They're really on the front lines, reviewing alerts from the 332 00:17:30.119 --> 00:17:34.680 SIM from their managed security service provider, validating endpoint alerts, 333 00:17:34.759 --> 00:17:37.160 doing that threat hunting we talked about, and managing the 334 00:17:37.200 --> 00:17:40.039 whole incident triosh and post mortem process. 335 00:17:39.759 --> 00:17:41.519 Right the day to day defenders exactly. 336 00:17:41.759 --> 00:17:45.160 But then complementing them is this security Incident Response team. 337 00:17:45.160 --> 00:17:49.400 Or cerch okayc circ part. How's that different? This team 338 00:17:49.440 --> 00:17:52.880 steps in for what they call executive declared security incidents, 339 00:17:53.200 --> 00:17:56.440 So the bigger stuff. They provide the management direction during 340 00:17:56.440 --> 00:18:00.480 a major crisis, and crucially they manage all the external communitys, 341 00:18:00.559 --> 00:18:03.400 talking to investors, dealing with law enforcement, that kind of thing. 342 00:18:03.880 --> 00:18:07.200 This team operates two four seven on call, and it 343 00:18:07.279 --> 00:18:11.279 includes cross functional leaders like the Chief Information Officer, maybe 344 00:18:11.359 --> 00:18:12.680 the Corporate Privacy. 345 00:18:12.240 --> 00:18:17.000 Council ah okay. So IRT handles the Technical Response CERT 346 00:18:17.079 --> 00:18:20.799 handles the management and communication for major incidents pretty much. Yeah. 347 00:18:20.839 --> 00:18:23.720 That makes me wonder though, how do these distinct teams 348 00:18:23.759 --> 00:18:29.119 coordinate effectively, especially during really high stress, rapidly evolving situations. 349 00:18:29.200 --> 00:18:32.279 That's a critical question absolutely. The experts in the guide 350 00:18:32.359 --> 00:18:36.240 highlight adapting something called the Incident Command System or ICs. 351 00:18:37.000 --> 00:18:40.160 Isn't it used for like firefighters and emergency management exactly? 352 00:18:40.240 --> 00:18:43.119 It's a proven system developed originally by the US Office 353 00:18:43.119 --> 00:18:47.240 of Emergency Management for managing everything from forest fires to 354 00:18:47.759 --> 00:18:51.400 you know, major disaster incidents. The idea is it overlays 355 00:18:51.440 --> 00:18:56.400 functional watch rolls like command, operations, planning intelligence onto the situation. 356 00:18:56.519 --> 00:19:00.480 This allows for really clear responsibilities, regardless of who reports 357 00:19:00.480 --> 00:19:03.559 to whom in their normal day job. It's all about 358 00:19:03.640 --> 00:19:05.000 clarity under pressure. 359 00:19:05.279 --> 00:19:07.680 Interesting applying that emergency response model to. 360 00:19:07.680 --> 00:19:11.200 Cyber Yeah, now shifting here is a bit. Let's connect 361 00:19:11.200 --> 00:19:14.759 this to the bigger picture of industrial control systems or ICs. 362 00:19:14.839 --> 00:19:17.960 Right, the systems that run power plants, water treatment, manufacturing 363 00:19:18.480 --> 00:19:19.880 really critical stuff. 364 00:19:19.640 --> 00:19:23.039 Absolutely critical, and historically the resources dedicated to their cyber 365 00:19:23.039 --> 00:19:26.119 defense lags significantly behind standard IT systems. 366 00:19:26.240 --> 00:19:26.839 Why was that? 367 00:19:27.240 --> 00:19:32.440 It's largely because IT traditionally prioritizes the CIA triad confidentiality, 368 00:19:32.559 --> 00:19:39.559 integrity and availability of data, whereas ICs prioritizes SRP operational safety, reliability, 369 00:19:39.559 --> 00:19:45.200 and productivity. The people running ICs are understandably inherently conservative. 370 00:19:45.759 --> 00:19:49.160 They resist any change that might jeopardize safety or interrupt 371 00:19:49.160 --> 00:19:50.039 the physical process. 372 00:19:50.119 --> 00:19:51.880 Yeah, it's easy to see why they be cautious. I mean, 373 00:19:51.920 --> 00:19:55.559 an active vulnerability scan, which is totally standard practice in 374 00:19:55.640 --> 00:19:59.519 it could literally cause an ICs operation to fail, maybe 375 00:19:59.519 --> 00:20:01.920 even result in severe physical damage, your injury. 376 00:20:02.119 --> 00:20:05.480 Indeed, and for years, some ICs managers operated under this 377 00:20:05.839 --> 00:20:09.200 well illusion that their systems were air gapped, totally isolated 378 00:20:09.200 --> 00:20:12.599 from other networks and therefore safe the air gap myth exactly. 379 00:20:12.960 --> 00:20:15.519 But the stocks net attag back in twenty ten really 380 00:20:15.599 --> 00:20:18.960 shattered that notion. It definitively proved that sophisticated malware could 381 00:20:19.000 --> 00:20:22.839 penetrate even supposedly isolated networks, often via things like infected 382 00:20:22.920 --> 00:20:25.720 USB drives. This whole incident led to a much greater 383 00:20:25.799 --> 00:20:29.039 push for connecting ICs and IT systems more securely, and 384 00:20:29.119 --> 00:20:32.599 with that the evolution of vital standards like an ERRCCIP, 385 00:20:32.880 --> 00:20:36.079 especially for the power grid and IEC six x two 386 00:20:36.119 --> 00:20:37.559 four four three, which is more general. 387 00:20:37.799 --> 00:20:41.119 So, given that unique environment and the high stakes, how 388 00:20:41.160 --> 00:20:44.839 do we actually go about protecting these vital systems effectively? 389 00:20:44.880 --> 00:20:45.960 What does the guide suggest? 390 00:20:46.160 --> 00:20:50.759 It really demands a threefold approach. First, comprehensive cyberrisk awareness 391 00:20:50.799 --> 00:20:54.920 training for all employees, not just IT. Second, clear procedures 392 00:20:54.960 --> 00:20:58.359 and policies specifically for the secured integration of IT and 393 00:20:58.599 --> 00:21:03.680 ICs networks. And third, deploying security technologies that are specifically 394 00:21:03.720 --> 00:21:07.680 adapted for ICs environments, making absolutely sure they don't introduce 395 00:21:07.720 --> 00:21:09.240 new safety risks themselves. 396 00:21:09.519 --> 00:21:11.039 So no one size fits all. 397 00:21:11.039 --> 00:21:14.359 Solutions, definitely not. It's about integrating a comprehensive set of 398 00:21:14.359 --> 00:21:19.240 measures that respects their unique operational requirements. Safety first always. 399 00:21:19.400 --> 00:21:23.119 Okay, that makes me ask can traditional intrusion prevention systems 400 00:21:23.599 --> 00:21:26.759 you know IPS be safely used in these ICs environments. 401 00:21:26.920 --> 00:21:28.200