CyberOps v1.1 Chapter 12 Exam Answers

A, D. Enterprise Log Search and Archive (ELSA) is an enterprise-level tool for allowing searching and archiving of NSM data that originates from multiple sources. ELSA receives logs over Syslog-NG, stores logs in MySQL databases, and indexes using Sphinx Search.

A. Integrated into the Security Onion, OSSEC is a host-based intrusion detection system (HIDS) that can conduct file integrity monitoring, local log monitoring, system process monitoring, and rootkit detection.

C. NIST describes the digital forensics process as involving the following four steps:
Data collection: The identification of potential sources of forensic data and acquisition, handling, and storage of that data.
Examination: Assessing and extracting relevant information from the collected data. This may involve decompression or decryption of the data.
Analysis: Drawing conclusions from the data. Salient features, such as people, places, times, events, and so on, should be documented.
Reporting: Preparing and presenting information that resulted from the analysis. Reporting should be impartial and alternative explanations should be offered if appropriate.

B, D. Regular expressions allow forensics analysts to search through large quantities of text information for patterns of data. Some common operators used in regular expressions are the following:
$ End of a line
[] Any single value within the square brackets
* Preceding sub-expression zero or more times
[^1] Any character except those bound by the [^ and the ]

A. A false negative classification indicates that a security system has not detected an actual exploit.

B. The primary duty of a cybersecurity analyst is the verification of security alerts. In the Security Onion, the first place that a cybersecurity analyst will go to verify alerts is Sguil because it provides a high-level console for investigating security alerts from a wide variety of sources.

C. With data normalization various sources of data are combined into a common display format, which simplifies the searching for similar or relevant events.

B. Evidence can be classified as follows:
Best evidence: This is evidence that is in its original state. It might be storage devices used by an accused or archives of files that can be proven to be unaltered.
Corroborating evidence: This is evidence that supports a propositionalready supported by initial evidence, therefore confirming the original proposition.
Indirect evidence: This evidence acts in combination with other facts to establish a hypothesis.

When ELSA is used to investigate downloaded files, the hash value of each file is created and stored with other information about the file. If a cybersecurity analyst is suspicious of the file, the hash value can be submitted to an online malware repository site to determine if the file is known malware.

OSSEC is a host-based intrusion detection system (HIDS) that is integrated into Security Onion and actively monitors host system operation.

Corroborating evidence is evidence that supports a proposition already supported by initial evidence, therefore confirming the original proposition. Circumstantial evidence is evidence other than first-hand accounts of events provided by witnesses.

Cisco Talos provides an interactive dashboard that allows investigation of the threat landscape.

For processing log entries, data normalization can organize and convert data values in datasets from difference sources into common format. The normalization makes it easy for further data analysis and reporting.

NIST describes the digital forensics process as involving the following four steps:

• Collection – the identification of potential sources of forensic data and acquisition, handling, and storage of that data.
• Examination – assessing and extracting relevant information from the collected data. This may involve decompression or decryption of the data.
• Analysis – drawing conclusions from the data. Salient features such as people, places, times, events, and so on should be documented.
• Reporting – preparing and presenting information that resulted from the analysis. Reporting should be impartial and alternative explanations should be offered if appropriate.

The firewall iptables uses the concepts of chains and rules to filter traffic:

• INPUT chain – handles traffic entering the firewall and destined to the firewall device itself
• OUTPUT chain – handles traffic originating within the firewall device itself and destined to somewhere else
• FORWARD chain – handles traffic originated somewhere else and passing through the firewall device

Digital forensic investigation is the science of collecting and examining electronic evidence that can evaluate damage to a computer as a result of an electronic attack or that can recover lost information from a system in order to prosecute a criminal. To prevent tampering and alteration of the suspect data, a data forensic analysis should be conducted on a copy of the suspect computer. Furthermore, restarting a computer may change or overwrite files and inadvertently destroy evidence.

PulledPork is a rule management utility included with Security Onion to automatically download rules for Snort.

Sguil is a GUI-based application used by security analysts to analyze network security events.

Snort is an open source network intrusion prevention system (NIPS) and network intrusion detection system (NIDS) developed by Sourcefire. It has the ability to perform real time traffic analysis and packet logging on Internet Protocol (IP) networks and can also be used to detect probes or attacks.

Application programs interact with an operating system through system calls to the OS application programming interface (API). These system calls allow access to many aspects of system operation such as software process control, file management, device management, and network access.

A false negative is where no alert exists and exploits are not being detected by the security systems that are in place.

Explanation: Amateur or script kiddies use common existing tools found on the internet to launch attacks. Hacktivists disrupt services in protest against organizations or governments for a particular political or social idea. State-sponsored threat actors use cyberspace for industrial espionage or interfering with another country in some way. Terrorist groups attack for a specific cause.

Explanation: Evidence is classified as direct or indirect. Direct evidence is that the accused was caught in the act, there is an eyewitness, or the evidence is indisputable. Three other types of evidence are best, corroborating, and indirect. Best is evidence in its original state. Corroborating evidence supports an assertion developed from best evidence. Indirect evidence provides support for a hypothesis.

Explanation: A denial-of-service attack results in an interruption of service to users, devices, or applications or all three. A direct DoS attack uses zombies and bots in order to have a coordinated attack from a multitude of sources. An access attack exploit known vulnerabilities in servers. Social engineering is a specific type of access attack toward an individual in an effort to get that individual to divulge information.

Explanation: Threat attribution refers to determining the individual, organization, or nation responsible for a successful intrusion or attack incident. The security investigation team correlates all the evidence in order to identify commonalities between tactics, techniques, and procedures (TPPs) for known and unknown threat actors.

Explanation: Three tools used to carry out this type of attack are TCP SYN flood, buffer overflow, and smurf attack. All three attacks send data in order to overwhelm another network device. A ping sweep is used in reconnaissance. Man-in-the middle occurs when the threat actor collects data in order to read, modify, or redirect that data. IP, MAC, and DHCP spoofing attacks are used to falsify address data.

The ampersand symbol tells the Linux shell to execute tcpdump in the background.

The CNT column, between the ST and Sensor columns, displays the frequency of alerts. By sorting with frequency, the analyst will get a better sense of what has happened on the network.

Sguil is a tool for addressing alerts. Three tasks can be completed in Sguil to manage alerts:

Alerts that have been found to be false positives can be expired.

An alert can be escalated if the cybersecurity analyst is uncertain how to handle it.

Events that have been identified as true positives can be categorized.

Regular expressions allow forensics analysts to search through large quantities of text information for patterns of data. Some common operators used in regular expressions are as follows:

$ End of a line.
[] Any single value within the square brackets.
* Preceding sub-expression zero or more times.
[^1] Any character except those bound by the [^ and the].

Security Onion is a Linux distro for intrusion detection, network security monitoring, and log management. It contains many security tools like Snort, Suricata, Bro, and ELSA.

Security Onion is an open source suite of Network Security Monitoring (NSM) tools for evaluating cybersecurity alerts. For cybersecurity analysts the Security Onion provides full packet capture, network-based and host-based intrusion detection systems, and alert analysis tools.

The host is downloading W32.Nimda.Amm.exe, a binary file. Wireshark does not know how to represent it. The displayed symbols are the best guess at making sense of the binary data while decoding it as text.

The Enterprise Log Search and Archive (ELSA) is an enterprise-level tool for allowing searching and archiving of NSM data. Searches can be executed by pivoting from Sguil to ELSA as its search functionality is directly linked to Sguil alert records.

During the TCP three-way handshake process, the output shows that the host uses source port 48598 to initiate the connection and request the download.

To reduce the huge amount of data collected so that cybersecurity analysts can focus on critical threats, some less important or unusable data could be eliminated from the datasets. For example, encrypted data, such as IPsec and SSL traffic, could be eliminated because it is unreadable in a reasonable time frame.