Incident Response Activities - Detection
Detecting the first signs of a kill chain in action is the most critical step in responding to the attack.
4 slides · 2 min read · Domain 7
This concept challenges you to look in your particular setting for the kinds of tell-tales, alarms, indicators, indicators of compromise, or even precursors that your SOC watch-standers need to know about quickly and effectively.
Start this by focusing on the types of events that the steps in an attacker's kill chain might be trying to accomplish, such as:
1. Input buffer overflows that indicate attempts to inject SQL or other script commands into a webpage or database server
2. Antivirus software detects that a device, such as an endpoint or removable media, has a suspected infection on it
3. Systems administrators, or automated search tools, notice filenames containing unusual or unprintable characters in them
4. Access control systems notice a device attempting to connect, which does not have required software or malware definition updates applied to it
5. A host, server, or an endpoint device does an unplanned restart
6. A new or unmanaged host or endpoint attempts to join the network
7. A host or an endpoint device notices a change to a configuration-controlled element in its baseline configuration
8. An applications platform logs multiple failed login attempts, seemingly from an unfamiliar system or IP address
9. Email systems and administrators notice an increase in the number of bounced, refused, or quarantined emails with suspicious content or ones with unknown addressees
10. Unusual deviations in network traffic flows or systems loading are observed
A number of technologies for detecting incidents have already been discussed, including:
- IDS/IPS systems
- firewalls
- logging systems and others.
These systems need to be used in accordance with the plans and procedures developed by the organization.
The systems also need to be configured to minimize false positives by ensuring they are maintained with current configuration information such as signature files and event thresholds.
This will reduce the analytical burden tremendously, but it must take into account that attacker behavior changes and that they will attempt to mask their malicious behavior so it appears normal.