Fundamentals

CIA triad

The CIA triad is a model for classifying the three main components of information security: confidentiality, integrity, and availability. These three components are often referred to as the "CIA triad" because they represent the core principles of information security.

Confidentiality

Confidentiality refers to the protection of information from unauthorized access or disclosure. It is important to ensure that only authorized individuals or systems can access sensitive information.

Confidentiality can be achieved through:
    • Encryption
    • Strong authentication systems

Integrity

Integrity refers to the accuracy and completeness of information, as well as the protection of information from unauthorized modification. It is important to ensure that information is not corrupted or altered in an unauthorized manner.

Integrity can be achieved through:
    • Hashing
    • Digital Signatures
    • Encryption
    • Digital certificates

Availability

Availability refers to the accessibility of information and systems. It is important to ensure that authorized users can access the information and systems they need when they need them.

Availability can be achieved through:
    • Redundancy
    • Backups

The CIA triad is a useful framework for understanding the key aspects of information security and for developing strategies to protect against various types of threats. By focusing on confidentiality, integrity, and availability, organizations can ensure that their sensitive information and systems are secure and available to authorized users.

Common Ports

Network ports are identified by a number, ranging from 0 to 65535. The most commonly used ports are assigned specific purposes by the Internet Assigned Numbers Authority (IANA). For example, port 80 is used for HTTP traffic, port 443 is used for HTTPS traffic, and port 25 is used for SMTP email traffic.

Cyber Kill Chain

The Cyber Kill Chain is a model that was developed by Lockheed Martin to describe the stages of a typical cyber attack. The model is designed to help organizations understand how an attack progresses, so that they can take steps to prevent or mitigate the attack at each stage.

The seven stages of the Cyber Kill Chain are as follows:

1. Reconnaissance: The attacker gathers information about the target organization and its systems, often through publicly available sources or through social engineering techniques.

2. Weaponization: The attacker prepares the payload (e.g., a malware or exploit) that will be used to attack the target.

3. Delivery: The attacker delivers the payload to the target, often through email attachments, infected websites, or other means of exploiting vulnerabilities.

4. Exploitation: The attacker takes advantage of a vulnerability in the target's systems to execute the payload.

5. Installation: The payload is installed on the target's systems, often in a way that is hidden from the user.

6. Command and control: The attacker establishes a means of communicating with and controlling the payload, often through a network connection.

7. Actions on objectives: The attacker carries out the objectives of the attack, such as stealing data or disrupting services.

Understanding the Cyber Kill Chain can help organizations identify and respond to attacks at each stage, and can help them develop strategies to prevent or mitigate the impact of future attacks.

MITRE ATT&CK

MITRE ATT&CK is a knowledge base that provides a comprehensive framework for understanding the actions and behaviors of cyber adversaries. It covers a wide range of tactics, techniques and procedures (TTPs) employed by attackers based on real-world observations.

ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge. It documents TTPs that advanced persistent threats use. Att&ck organizes techniques into a set of tactics to provide context. It can be used to profile each step of a cyberattack operation.

Understanding MITRE ATT&CK

There are three major components:
    • Tactics (Why?) - The adversary's objective or goal during an attack.
    • Techniques (How?) - The specific methods adversaries use to achieve their goal.
    • Procedures (What?) - Real-world implementations of techniques used by threat actors.

There are 14 tactics in the Enterprise matrix:

The ATT&CK Matrix

The relationship between tactics, techniques, and sub-techniques can be visualized in the ATT&CK Matrix.
Detailed ATT&CK Matrix can be found on Mitre website.

DDoS and Bot Protection

A DDoS (Distributed Denial-of-Service) attack is a cyber attack that overwhelms a target (server, network, or application) with excessive traffic, causing disruptions, slowdowns, or downtime. Attackers use botnets or amplification techniques to flood the target.

Common Types of DDoS & Bot Attacks

How Different Protections Detect & Mitigate Attacks

Sample Layered Security Architecture for Web Applications:

DNS (Domain Name System)

The Domain Name System (DNS) is a hierarchical decentralized naming system for computers, services, or other resources connected to the internet or a private network. It is used to translate human-readable domain names, such as "google.com," into numerical IP addresses that computers can use to communicate with each other.

DNS operates through a hierarchical structure of servers responsible for resolving domain names to IP addresses. The hierarchy consists of:
    • Root Name Servers → Direct traffic to Top-Level Domain (TLD) Name Servers.
    • TLD Name Servers → Direct traffic to Authoritative Name Servers for specific domain names.
    • Authoritative Name Servers → Provide the final resolution of a domain name to an IP address.

DNS is an important infrastructure component of the internet, and it plays a critical role in enabling communication between computers and devices on the internet. Without DNS, users would have to remember the numerical IP addresses of websites and other resources, which would be difficult and inconvenient.

To use DNS, a domain owner must register their domain name and configure it with the appropriate DNS records, which specify the IP addresses and other information about the domain. When a user types a domain name into their web browser or sends an email to an address at a particular domain, the DNS system is used to resolve the domain name to the correct IP address and route the traffic to the appropriate destination.

4 types of DNS servers

1. DNS recursor

The DNS recursor (also known as a recursive resolver) is the first step in DNS query resolution. It is typically operated by an ISP or a public DNS provider (e.g. Google Public DNS 8.8.8[.]8, Cloudflare 1.1.1[.]1). The resolver:

• Checks its local cache for a stored response.
• If not found, queries a Root Name Server to locate the correct TLD Name Server.
• Continues querying until it reaches an Authoritative Name Server with the requested record.

2. Root nameserver

Root servers are critical components of the DNS hierarchy that manage the root zone of the DNS. They do not store full DNS records but instead direct queries to the correct TLD Name Server based on the requested domain extension (.com, .org, .net, etc.).

• Root servers never resolve full domain names (e.g., google[.]com) but instead redirect the query to the correct TLD nameserver.
• There are 13 logical root name servers, each with a unique lettered name (a.root-servers[.]net to m.root-servers[.]net).

3. TLD nameserver

A TLD Name Server manages the registry of second-level domains under a specific TLD (e.g. .com, .org, .net).

• It does not store the full DNS records of individual domains but instead directs queries to the domain’s Authoritative Name Server.
• For example, if a user searches for google[.]com, after receiving a response from a root nameserver, the recursive resolver sends a query to a .com TLD nameserver, which responds by providing the authoritative nameserver for google[.]com.

4. Authoritative nameserver

An Authoritative Name Server provides the final DNS resolution by storing the actual DNS records for a domain. It directly answers queries with:

• A/AAAA records (IP address mappings).
• MX records (Mail server details).
• CNAME records (Aliases for domain names).
• Other DNS resource records necessary for domain operation.

DNS record

A Domain Name System (DNS) record is a set of instructions stored in the DNS database that maps domain names to IP addresses and other network resources. DNS records help route internet traffic by providing necessary information for resolving domain queries.

There are many different types of DNS records, each serving a specific function. Some of the most commonly used DNS records include:

DNS records are a critical part of internet infrastructure, enabling communication between devices and systems. By configuring DNS records, domain owners can:

• Specify how traffic is routed to their domain.
• Control access and usage policies for their domain.

Email Security

Domain-based Message Authentication Reporting and Conformance (DMARC)

DMARC is an email authentication protocol designed to prevent email spoofing and protect domains from phishing and spam attacks. DMARC enables domain owners to publish policies in DNS that define how receiving mail servers should handle emails failing authentication. When an email is received, the receiving mail server checks the DMARC policy of the sender’s domain. If the email fails SPF or DKIM alignment, the recipient server can:

• Reject the email (block delivery).
• Quarantine the email (send to spam/junk folder).
• Allow but flag the email as potentially suspicious.

Verification with SPF:

• Checks if the sending mail server is authorized by the domain’s SPF record and ensures the Return-Path domain matches the From address.

Verification with DKIM:

• Verifies the digital signature in the email and ensures the DKIM d= domain matches the From address.

If SPF or DKIM fails without proper alignment, DMARC applies the configured policy (Reject, Quarantine, None).

How Does DMARC Work?

DMARC Alignment - Pass Example

DMARC Alignment - Fail Example

Examples:

Sender Policy Framework (SPF)

SPF is an email authentication protocol that prevents email spoofing by allowing domain owners to define authorized mail servers for their domain. When an email is received, the recipient’s mail server checks the SPF record in DNS to verify whether the sending server is authorized to send emails on behalf of the domain. If the email is sent from an unauthorized server, the recipient may:

• Reject the email as fraudulent.
• Quarantine the email as potential spam.
• Flag the email as suspicious for further inspection

Specify SPF version at start of record

              v=spf1
            

Mechanisms for specifying authorised senders

Qualifiers

Modifiers

Examples:

Domain Keys Identified Mail (DKIM)

DKIM is an email authentication protocol that prevents email tampering by using cryptographic signatures to verify the sender’s legitimacy.

• DKIM allows a domain owner to digitally sign outgoing emails using a private key.
• The public key is stored in a DNS TXT record, allowing receiving mail servers to verify the email’s authenticity.
• If the DKIM signature is missing or invalid, the recipient may treat the email as suspicious or forged.

Examples:

HTTP Status Codes

HTTP status codes are standardized numerical codes that are used to communicate the status of a HTTP request. HTTP (Hypertext Transfer Protocol) is a protocol for transferring data over the internet, and HTTP status codes are used to indicate the status of a request made using HTTP.

Some of the most commonly used HTTP status codes include:

• 200 OK: The request was successful and the requested information has been transmitted.

• 301 Moved Permanently: The requested resource has been moved to a new URL.

• 400 Bad Request: The request was invalid or could not be understood by the server.

• 401 Unauthorized: The request requires authentication in order to be processed.

• 404 Not Found: The requested resource could not be found.

IPV4 Subnet

Subnetting is a way to divide a single network into smaller networks, or subnets, in order to increase security and efficiency.

An IPv4 subnet is identified by a network address and a subnet mask. The network address defines the range of IP addresses that are included in the subnet, and the subnet mask defines which portion of the IP address represents the network and which portion represents the host.

For example, consider the following IP address and subnet mask:

IP address: 192.168.1.100
Subnet mask: 255.255.255.0

The subnet mask of 255.255.255.0 indicates that the first three octets (192.168.1) represent the network portion of the IP address, and the fourth octet (100) represents the host portion. In this case, the subnet would include all IP addresses from 192.168.1.0 to 192.168.1.255.

Private IP addresses

Private IP addresses are IP addresses that are used for communication within a private network, such as a home or corporate network. They are not routed on the Internet and are not reachable from the outside. Private IP addresses are used to identify devices within a private network and to route traffic between devices.

Private IP addresses are often used in conjunction with Network Address Translation (NAT), which allows devices within a private network to communicate with the Internet using a single, shared public IP address. This allows multiple devices to share a single Internet connection and helps to conserve the limited pool of publicly routable IP addresses.

Private Information

Private information is any data or personal details that are intended to be kept confidential and are not meant to be shared with others without the owner's consent. Private information can include things like a person's name, address, phone number, date of birth, financial information, medical history, and other sensitive data. It is important to protect private information because it can be used for identity theft or other nefarious purposes if it falls into the wrong hands. It is generally recommended to be cautious about sharing private information online or with anyone you do not know or trust.

Types of private information:

PII stands for "Personally Identifiable Information." It is any information that can be used to identify a specific individual, such as their name, address, phone number, date of birth, social security number, or other personal details. PII is considered to be sensitive information because it can be used to locate, contact, or obtain information about an individual. As a result, it is important to protect PII and handle it with care to prevent it from being accessed or used without the owner's consent. There are also legal requirements in place in many countries that regulate the collection, use, and storage of PII, such as the General Data Protection Regulation (GDPR) in the European Union and the California Consumer Privacy Act (CCPA) in the United States.

PPI stands for "Personally Protected Information". It is a term that is sometimes used to refer to personal data that is considered to be sensitive or confidential, and that requires special protection in order to ensure the privacy and security of individuals. PPI may include information such as a person's name, address, phone number, date of birth, financial information, medical history, and other details that are considered to be private and should not be shared without the owner's consent. It is important to handle PPI with care and to take appropriate measures to protect it from unauthorized access or use. This may include measures such as encrypting data, using secure servers, and implementing other security measures to prevent data breaches or unauthorized access to PPI.

PHI stands for "Protected Health Information." It is any information that relates to a person's health, medical history, or treatment that is collected, used, or disclosed by a healthcare provider, health plan, or other covered entity in the course of providing healthcare services. PHI is considered to be sensitive information because it can reveal intimate details about a person's health and medical history, and it is protected by laws such as the Health Insurance Portability and Accountability Act (HIPAA) in the United States. HIPAA sets strict rules for how PHI can be collected, used, and disclosed, and it requires covered entities to implement appropriate safeguards to protect the privacy and security of PHI. HIPAA also gives individuals certain rights with regard to their PHI, such as the right to access, correct, and request restrictions on the use of their PHI.

PCI stands for "Payment Card Industry." PCI refers to a set of security standards that were developed by the major credit card companies (Visa, Mastercard, American Express, Discover, and JCB) to ensure the secure handling of credit card transactions and protect sensitive financial information. The PCI Data Security Standard (PCI DSS) is a set of requirements that apply to all organizations that accept, process, store, or transmit credit card information. It sets out guidelines for the secure handling of credit card data, including requirements for physical security, network security, access controls, and data protection. The PCI DSS is intended to help reduce the risk of credit card fraud and protect the security of sensitive financial information. Compliance with the PCI DSS is mandatory for all merchants and service providers that accept credit cards as a form of payment.

OSI Model

The OSI (Open Systems Interconnection) model is a framework for understanding how communication occurs between different systems in a network. It is a seven-layer model that represents the different stages of communication, from the physical connection between devices to the application layer where the actual communication takes place.

The OSI model is a useful tool for understanding how communication occurs in a network, and it helps to define the roles and responsibilities of the different layers of a networked system.

Types of Cyber Attacks on Each Layer of the OSI Model:

Layer architecture (wikipedia)

Active Directory Basics

What is Active Directory?

Microsoft Active Directory is both a database and a directory service, simplifying identity and access management for efficient network administration. Enterprises rely on Active Directory to define and regulate user permissions within their networks.

As a database, Active Directory stores essential user information, including emails, phone numbers, and passwords. As a directory service, it enables user authentication for accessing resources and authorizes network-wide access based on defined permissions.

Active Directory Services Overview:

AD is made up of a number of different directory services

• Active Directory Domain Services (AD DS): The core service managing users and resources.
• Active Directory Lightweight Directory Services (AD LDS): Provides only a subset of the capabilities of AD DS. This makes it a leaner and more independent directory service that we can run as a stand-alone directory without integration with an existing AD.
• Active Directory Certificate Services (AD CS): Deals with issuing and managing digital security certificates.
• Active Directory Federation Services (AD FS): Facilitates sharing identity and access management information across organizations.
• Active Directory Rights Management Services (AD RMS): Focuses on information rights management, controlling access permissions to documents, workbooks, presentations, etc.

Active Directory Domain Services (AD DS) Overview:

Active Directory Domain Services (AD DS) serves as the primary Active Directory service. It plays a pivotal role in authenticating users and controlling access to network resources. A server running AD DS is referred to as a domain controller.

Most Windows domain networks incorporate two or more domain controllers, including a primary domain controller and one or more backup domain controllers to ensure resiliency. During the login process, users authenticate to a domain controller and gain access to specific resources based on administratively defined policies.

AD Data Structures:

Active Directory stores information about network users (names, phone numbers, passwords, etc.) and resources (servers, storage volumes, printers, etc.) in a hierarchical structure consisting of domains, trees, and forests.

Domain:

• A collection of objects (e.g. users, devices) that share the same Active Directory database. A domain is identified by a DNS name like company.com.
• Think of a domain as a labeled section in a library where books related to a specific topic are neatly organized, helping users easily find and access relevant information.

Tree:

• A collection of one or more domains with a contiguous namespace (they have a common DNS root name like marketing.company.com, engineering.company.com, and sales.company.com).
• Imagine a family tree where everyone is connected. In a network, a tree is a structure of domains that are related, like branches of a big family.

Forest:

• A collection of one or more trees that share a common schema, global catalog, and directory configuration—but aren’t part of a contiguous namespace. The forest typically serves as the security boundary for an enterprise network.
• A forest is like a big park with many trees. Each tree (domain) might have its own family, but they all share the same overall environment, rules, and even a map (global catalog).

Objects within a domain can be grouped into organizational units (OUs) to simplify administration and policy management. Administrators can create arbitrary organizational units to mirror functional, geographical, or business structures, and then apply group policies to OUs to simplify administration. OUs also make it easier to delegate control over resources to various administrators.

Machine Account vs User Account

Machine accounts: Represent computers or devices, authenticate the computer to the domain, and are associated with a specific computer.

User accounts: Represent individual users, authenticate users to the domain, and are associated with specific individuals. They control access, permissions, and settings for individual users.

Both machine accounts and user accounts play crucial roles in Active Directory, contributing to the secure and efficient functioning of the network.

Group Policies and GPO:

• Group Policies: Configuration settings that define how computers and users operate in the AD environment.
• Group Policy Objects (GPO): Containers for group policies, applied to sites, domains, or OUs. Used to manage security settings, software deployment, and more.

GPO Distribution via SYSVOL:

• SYSVOL: A shared folder on DCs that stores system files, including Group Policy objects. Facilitates GPO distribution across the network.
• GPOs are distributed to the network via a network share called SYSVOL, which is stored in the DC. All users in a domain should typically have access to this share over the network to sync their GPOs periodically. By default, the SYSVOL share is directed to the C:\Windows\SYSVOL\sysvol\ directory on each of the DCs in our network.

Authentication Methods:

In Windows domains, user credentials are stored in Domain Controllers. When someone logs in or accesses a service using their domain username and password, the service checks with the Domain Controller to confirm if the login details are correct. This process of double-checking happens centrally to ensure security and access control in a Windows domain setup. There are two common protocols which are utilized for network authentication:

• Kerberos: A secure authentication protocol that uses tickets for verifying the identity of users and services within the domain. It provides strong security features and is the primary authentication method in Windows environments.
• NTLM (NT LAN Manager): An older authentication protocol used for backward compatibility purposes. While less secure than Kerberos, NTLM is still employed in certain scenarios, especially in mixed or legacy environments.

Advantages of Active Directory:

1. Centralized Management:

• User and Resource Management: Enables centralized management of user accounts, computers, printers, and other network resources, streamlining administration.

2. Authentication and Authorization:

• Secure Authentication: Utilizes robust authentication protocols like Kerberos, enhancing the security of user logins and network access.
• Authorization: Manages access control through security groups, ensuring users have appropriate permissions.

3. Single Sign-On (SSO):

• Unified Credentials: Users can access multiple network resources using a single set of credentials, enhancing user experience and reducing password fatigue.

4. Group Policies:

• Policy Enforcement: Group Policy Objects (GPOs) allow administrators to enforce security settings, configurations, and restrictions across the network, ensuring consistency.

5. Scalability:

• Supports Large Environments: Scales effectively to accommodate the growth of users, devices, and resources in large and complex network infrastructures.

6. Redundancy and Fault Tolerance:

• Multiple Domain Controllers: Supports the deployment of multiple Domain Controllers, ensuring redundancy and fault tolerance. If one Domain Controller fails, others can continue to provide services.

7. Integration with Other Microsoft Services:

• Exchange, SharePoint, and More: Seamless integration with other Microsoft services such as Exchange for email, SharePoint for collaboration, and more.

8. Directory Replication:

• Replication Services: Utilizes directory replication services to ensure consistent data across multiple Domain Controllers, supporting distributed environments.

9. Security Features:

• Secure LDAP: Supports LDAP over SSL (LDAPS) for secure directory access.
• Auditing and Logging: Provides auditing capabilities to track changes, log events, and enhance security.

10. Dynamic Access Control:

• Fine-Grained Access Control: Allows for the implementation of dynamic access control policies, enabling granular control over resource access based on attributes.

11. Support for Multi-Forest Environments:

• Forest Trusts: Enables secure collaboration between different Active Directory forests through trust relationships.

12. Resource Location Services:

• Global Catalog: The Global Catalog provides a searchable index of objects across the entire forest, facilitating efficient resource location.

Common Attacks Against Active Directory

NTLM

NTLM (NT LAN Manager) is a Microsoft authentication protocol that is used to provide secure network communication and to authenticate users in a Windows network environment. It is a challenge-response protocol that allows a client to prove its identity to a server, and it is typically used to authenticate users on a Windows domain.

NTLM uses hashed passwords and encrypted challenge-response exchanges to authenticate users, and it can also provide authentication for other protocols such as HTTP, FTP, and SMTP. NTLM is generally considered to be less secure than more modern authentication protocols, such as Kerberos, and it is generally recommended to use these newer protocols whenever possible.

The following examples show how the NTLM flow works.

Kerberos

Kerberos is a network authentication protocol that is designed to provide secure communication over a non-secure network, such as the internet. It is named after the three-headed dog of Greek mythology that guarded the gates of the underworld.

In a Kerberos system, a client authenticates itself to a trusted third-party server known as the Key Distribution Center (KDC). The KDC issues a ticket-granting ticket (TGT) to the client, which the client can then use to request access to other resources on the network. These requests are made using service tickets, which are issued by the KDC and contain a cryptographic key that can be used to securely access the desired resource.

Kerberos is widely used in Windows and Linux operating systems, as well as in other networked systems such as Apache and OpenVPN. It is generally considered to be more secure than other authentication protocols, such as NTLM, because it uses strong encryption and does not transmit plaintext passwords over the network.

Kerberos Error Codes

Windows event log entries often contain Kerberos failure codes

TCP vs UDP

Computer Networking Basics

The Internet is a network of connecting devices. Each device, whether it's your smartphone or a server, communicate through the internet protocol suite. The internet protocol suite is a collection of different protocols, or methods, for devices to communicate with each other. Both TCP and UDP are major protocols within the internet protocol suite:

TCP: connection oriented, header file: 20 bytes, speed is less than UDP, used in high reliability services. TCP is heavy-weight. Require three packets to set up a socket connection (Three way handshake: SYN- Synchronize, SYN-ACK, ACK). TCP handles reliability and congestion control, have Acknowledgement segments.

UDP: connectionless oriented, header file: 8 bytes, more speed than TCP, used in real-time services, UDP is lightweight. There is no ordering message, no tracking connection, UDP does not have an option for flow control (Does not have three way handshake), No Acknowledge.

A three-way handshake

A three-way handshake is a method used in a TCP/IP network to create a connection between a local host/client and server.
A three-way handshake is also known as a TCP handshake or SYN-SYN-ACK, which requires both the client and server to exchange SYN (synchronization) and ACK (acknowledgment) packets before actual data communication begins.

Step 1: A connection between server and client is established
Step 2: The server receives the SYN packet from the client node
Step 3: Client node receives the SYN/ACK from the server and responds with an ACK packet

For UDP, no three-way handshake is necessary before transmitting data to the intended recipient. So, all or some of the data might arrive — and it may (or may not) arrive in the order as intended. As such, it’s often described as a “best effort.”

When does DNS use TCP?

DNS uses TCP port 53 for Zone transfer (ensure zone data is consistent across DNS servers) and UDP for name, and queries either regular (primary) or reverse. UDP can be used to exchange small information whereas TCP must be used to exchange information larger than 512 bytes.

Cyber Attack Techniques

Cyber attacks encompass a diverse array of malicious strategies employed by cybercriminals to exploit vulnerabilities in computer systems, networks, and individuals. These techniques range from the deployment of malicious software (malware) and denial-of-service attacks to social engineering tactics such as phishing, vishing, and smishing. The objective is to compromise the confidentiality, integrity, or availability of digital assets, often leading to unauthorized access, data breaches, financial losses, or disruption of services.

Types of Malware

Malware is short for "malicious software," and it refers to any software that is designed to harm or exploit a computer system. Malware can take many forms, including viruses, worms, trojan horses, ransomware, spyware, and adware.

Malware can be spread through a variety of means, including email attachments, infected websites, malicious software downloads, and infected removable media such as USB drives. Once it is installed on a computer, malware can perform a variety of malicious actions, such as deleting files, stealing sensitive information, corrupting data, and using the infected computer to attack other systems.

Utilities

Clear Network Cache

This will clear your DNS cache on Windows, release your IP address, and renew it.

ipconfig /flushdns
ipconfig /release
ipconfig /renew

Active Directory PowerShell Commands

Retrieve information about an Active Directory user

Get-ADUser -Identity $username -Properties *
Get-ADUser -Identity $username -Server $domain_controller -Properties *

Retrieve information about an Active Directory computer

Get-ADComputer -Identity $hostname -Properties *

Check Secure Channel for Domain-Joined Computer / Check whether the computer is domain-joined or not

Test-ComputerSecureChannel -ComputerName $hostname | Write-Host "The computer $hostname is $($? -as [bool]) domain-joined."

Regex Cheat Sheet

Regex (short for "Regular Expression") is a special syntax or notation used to match patterns of characters in text. Regular expressions are often used in text processing and data manipulation tasks, such as search and replace operations, data validation, and data scraping.

A regular expression is a sequence of characters that defines a search pattern. It can be used to search for and match specific patterns in text, or to extract specific pieces of information from a larger body of text.

A quick reference guide for regular expressions (regex)

^\w+

\w+$

\i+

...

.*

This|string

https?

https??

? - non lazy
?? - lazy

\bis\b

(https?|ftp):\/\/([^\/\r\n]+)(\/[^\r\n]*)?

Group 1: "https"
Group 2: "owlify.xyz"
Group 3: "/test"

(?:https?|ftp):\/\/([^\/\r\n]+)(\/[^\r\n]*)?

Group 1: "owlify.xyz"
Group 2: "/test"

[0-9]+

[a-zA-Z]+

[^a-zA-Z]+

\b\d{6}\b

[a-f0-9]{32}

[a-f0-9]{5,10}

.*(?=string)

(?<=This).*

(?<=This).*(?=string)

a(?!b)

Match all "a" that are not followed by a "b"

(?<!a)b

Match all "b" that are not preceded by an "a"

Useful Linux Commands

Useful Linux command-line utilities

Useful Windows Commands

Useful Windows command-line utilities

FINDSTR

findstr is a built-in tool of the Windows operating system that you may run from the command line to find text in files or in command-line outputs.

For example:

netstat | findstr "8.8.4.4"

findstr /c:"windows 10" file.txt -- Searches the document file.txt for the string "windows 10"

findstr "windows" c:\documents\*.* -- Searches any file under c:\documents for the string "windows"

findstr /s /i Windows *.* -- Searches every file in the current directory and all subdirectories for the word Windows ignoring letter case

findstr /g:criteria.txt /f:filelist.txt > results.out -- search criteria in criteria.txt to search the files listed in filelist.txt

findstr /g:"test.txt" "test2.txt" -- Compare contents of two files and print out their commonalities

Vim text editor

Threat Hunt

Default Windows Processes

Knowing what’s normal on a Windows host helps cut through the noise to quickly locate potential malware. Use the information below as a reference to know what’s normal in Windows and to focus your attention on the outliers.
When searching for malicious processes, look for any of these anomalous characteristics:
    • Started with the wrong parent process
    • Image executable is located in the wrong path
    • Misspelled processes
    • Processes that are running under the wrong account (incorrect SID)
    • Processes with unusual start times (i.e., starts minutes or hours after boot when it should be within seconds of boot)
    • Unusual command-line arguments
    • Packed executables

Process view on a Windows 10 machine

Ransomware Encrypted File Extensions List

svchost

Svchost.exe (Service Host) is a generic host process name for services that run on Windows operating systems. It is responsible for running many of the background services that are necessary for the operating system and other programs to function properly.

There can be multiple instances of the Service Host process running at the same time, each one hosting one or more services.

Why are there so many Service Host processes running?

When you start a Windows computer, multiple instances of Svchost.exe are usually launched, each one hosting one or more services. This allows the operating system to manage the services more efficiently by running them in a separate process, rather than as individual programs.

It is normal for there to be multiple Service Host processes running on a Windows computer. These processes are responsible for running many of the background services that are necessary for the operating system and other programs to function properly. Some examples of services that might be hosted by a Service Host process include the Windows Update service, the Network Location Awareness service, and the Remote Procedure Call (RPC) service.

Since it is normal to see many svchost.exe processes in the background, some malicious programs make use of the confusion and masquerade as a legitimate svchost.exe process. svchost.exe is located in C:\Windows\System32 folder. Any file named “svchost.exe” located in another folder can be considered malware. Determining the image path of a process, and its invoking command line, can help identify software masquerading in this way, and help locate the actual program file which is running under the assumed process name of “svchost.exe” (Windows allows multiple processes to all display the same name). Some malware injects a .dll file into the authentic svchost process, for example, Win32/Conficker worm.

If we take a look at one of the running “svchost.exe” instance and check its command line, we’ll see something similar to the following:

This instance is hosting four services.

The "-k" flag

In this example, the “svchost.exe” process used the "-k UnistackSvcGroup" parameter. This request will be made to the following registry location:

					 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
					 

It locates the key which matches the parameter entry "UnistackSvcGroup" and reads it. This string contains the names of the services it will load and run within the context of that svchost.exe instance.

The "-s" flag

The “svchost.exe” process can also be used with the “-s” flag.

When the “-s” flag is used with the "-k" flag, it will tell the “svchost.exe” process to only load a specific service from the specified group. In this example, only the "WpnUserService" will be loaded from the "UnistackSvcGroup".

SIGMA Rule

Sigma is a tool that allows you to create rules to identify patterns in log events. It is named after the Greek letter Sigma (Σ), which is often used to represent the sum of a series of numbers or the standard deviation of a set of data in statistics. Sigma is designed to be used with a variety of different log sources, including system logs, network logs, and security logs.

Sigma rules are written in a specialized language that allows you to specify the patterns that you want to identify in log events. Once you have created your Sigma rules, you can use them to scan log files for specific patterns or to generate alerts when certain patterns are detected.

Sigma is often used in conjunction with other security tools, such as Snort, which is a network intrusion detection and prevention system. Snort can be used to analyze network traffic for signs of malicious activity and to trigger alerts when suspicious activity is detected. By combining Sigma and Snort, you can create a more comprehensive security system that can help protect against a wide range of cyber threats.

YARA Rule

Yara is a tool that allows you to create, analyze, and identify malware and other malicious software. A Yara rule is a set of criteria used to identify and classify malware. Yara rules are written in a specialized language that allows you to specify the characteristics of the malware you are looking for, such as specific strings of text, patterns of code, or other identifying features.

Yara rules are used by cybersecurity professionals to identify and classify malware, and to help protect against cyber threats. Yara rules can be used to scan files, network traffic, and other sources for signs of malware, and can be used in conjunction with other security tools and techniques to help defend against cyber attacks.

Yara rules are typically used to identify specific types of malware, such as viruses, worms, trojans, and other malicious software. They can be used to identify both known and unknown malware, and can be updated and modified as new threats emerge.

Windows Privilege

What is Windows privilege?

In the context of Windows operating systems, a privilege refers to a specific right or permission granted to a user account, allowing it to perform certain actions or access particular resources on the system. Privileges are essential for controlling and managing user interactions with the operating system, and they are often associated with security-related tasks.

Windows privileges are defined in the security policy settings and can include actions such as the ability to shut down the system, modify system time, debug programs, or manage user rights. These privileges help ensure proper system functionality, maintain security, and control access to sensitive operations.

Common examples of Windows privileges include the SeShutdownPrivilege for shutting down the system and the SeDebugPrivilege for debugging programs. Users or groups with specific privileges have elevated rights beyond the standard user, and the assignment of privileges is typically managed through Group Policy settings.

For more details, please visit Microsoft documentation on User Rights Assignment.

Windows Built-in Service Accounts

Network Service Account:

• Has a relatively low level of privileges.
• Accesses network resources as a machine account.
• Mainly used for running Windows services and processes that require network access.
• E.g. Database Server, File Sharing Service, Print Spooler Service, Web Proxy Service.

Local Service Account:

• Similar to the Network Service account but has fewer privileges.
• Mainly used for running Windows services with reduced privileges and do not require extensive network access.
• E.g. Windows Update Service, Task Scheduler Service (tasks that don't require extensive system privileges), Print Spooler Service (when network access is not required).

Local System Account:

• Has extensive privileges, often used for running critical system services.
• Operates with the highest level of access rights on the local system.
• E.g. Core Windows Services (Windows Event Log service, Plug and Play, Task Scheduler), Anti-Virus or Security Software, Device Drivers.

These accounts are managed by the operating system, and their passwords are handled internally, reducing the risk associated with password management for services. They are designed to follow the principle of least privilege, ensuring that services run with the minimum necessary permissions to perform their tasks securely.

Windows User Accounts

Built-in Administrator Account:

• The default administrative account created during Windows installation.
• Has full control over the system and can make system-wide changes.
• Users may set a password during installation, and it can be disabled or have its password changed later.

Standard User Account:

• A user account with standard privileges.
• Requires a user-set password for authentication.
• Best practice for regular users who do not need elevated system access.

Default Rights and Privileges

Windows Registry

The Windows Registry is a database that stores configuration settings and options for the Microsoft Windows operating system and for applications that run on Windows. It contains information about hardware and software configuration, user preferences, and other data that is used by the operating system and by applications.

The Windows Registry is an important source of information for forensic investigations because it can provide valuable evidence about the activities that have taken place on a computer. For example, the Registry can reveal information about:

• Installed software and hardware: The Registry can contain information about the software and hardware that has been installed on a computer, including the version numbers and installation dates. This can be useful for determining what programs and devices were in use on a computer at a particular time.

• User activity: The Registry can contain information about the user accounts that have been created on a computer and the actions that have been taken by those users. This can include information about file and folder access, network connections, and other activities.

• System configuration: The Registry can contain information about the configuration of the operating system and other software, including the settings and options that have been selected. This can be useful for understanding how a computer was set up and how it was being used.

Windows Registry Structure

The Registry is organized into a tree-like structure. The top-level keys in the Registry are called hives.

HKEY_CLASSES_ROOT (HKCR): This hive contains information about file associations and COM object classes. It is used to associate files with the applications that can open them and to register COM objects so that they can be used by other applications.

HKEY_CURRENT_USER (HKCU): This hive contains information about the current user's preferences and settings. It is used to store settings for the desktop, start menu, taskbar, and other elements of the user interface, as well as settings for applications that are specific to the current user.

HKEY_LOCAL_MACHINE (HKLM): This hive contains information about the hardware, software, and security settings of the computer. It also contains information about the user profiles and groups on the computer.

HKEY_USERS (HKU): This hive contains information about all the user profiles on the computer. It is used to store settings for the desktop, start menu, taskbar, and other elements of the user interface, as well as settings for applications that are specific to each user.

HKEY_CURRENT_CONFIG (HKCC): This hive contains information about the hardware configuration of the computer. It is used to store information about the devices that are installed on the computer, as well as the configuration settings for those devices.

Wireshark

Wireshark is a free and open-source packet analyzer. It is a tool that allows you to capture and analyze network traffic in order to troubleshoot network problems, examine security issues, and learn more about how networks work.

Wireshark uses a network protocol analyzer to capture and display packets in real-time. It supports a wide range of protocols and can decode and display the contents of the packets in a variety of formats. Wireshark also includes a wide range of filters and display options that allow you to focus on specific packets or types of traffic, and to view the data in a variety of formats.

Enumeration

System Enumeration

Check system information

Displays a list of details about the operating system, computer hardware and software components.

					 systeminfo
systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type"
					 

Check installed updates

Displays all installed Windows and software updates applied to that computer.

					 wmic qfe
wmic qfe get Caption, Description, HotFixID, InstalledOn
					 

List all drives in the machine

					 wmic logicaldisk get Caption
fsutil fsinfo drives
wmic logicaldisk get caption,description,providername
[Powershell] Get-PSDrive | where {$_.Provider -like "Microsoft.PowerShell.Core\FileSystem"}| ft Name,Root
					 

List all env variables

Displays the current environment variable settings.

					 set
[Powershell] Get-ChildItem Env: | ft Key,Value
					 

List Architecture

					 ver
wmic os get osarchitecture
echo %PROCESSOR_ARCHITECTURE%
					 

List installed apps

					 wmic product get name, version, vendor
					 

List scheduled tasks

					 Schtasks /query /fo LIST /v
					 

List running services

					 net start
					 

List running processes

					 tasklist /SVC
					 

List installed device drivers

					 driverquery
					 

Query the registry for specific keys, values and/or data

Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.

					 reg query [Root]
Root:
    • HKLM = HKey_Local_machine (default)
    • HKCU = HKey_current_user
    • HKU  = HKey_users
    • HKCR = HKey_classes_root

					 
Scanning registry hives for the value password.
Internal recon, hunting for passwords in Windows registry. 
The Windows registry often stores clear-text or encoded passwords used by various applications.
					 reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s
					 

List GPO settings (Group Policy Discovery)

					 gpresult /Z
					 

User Enumeration

List current username

Displays a user name associated with the effective user ID.

					 whoami
hostname
set computername
echo %USERNAME%
[Powershell] $env:username
					 

Check current user privileges/groups

					 whoami /priv
whoami /groups
					 

List all users

					 net users
whoami /all
[Powershell] Get-LocalUser | ft Name,Enabled,LastLogon
[Powershell] Get-ChildItem C:\Users -Force | select Name
					 

Check account policies and password policies

					 net accounts
					 

View user information

Displays user account information.

					 net users %username%
					 

List all groups

Displays the name of the server and the names of local groups on the computer.

					 net localgroup
net localgroup Administrators
net group “Domain Controllers” /domain
net group “Domain Admins” /domain
net group “Enterprise Admins” /domain
net user /domain <UserName>
[Powershell] Get-LocalGroup | ft Name
[Powershell] Get-LocalGroupMember Administrators | ft Name, PrincipalSource
					 

View user domain

					 set userdomain
					 

List information about the configuration of the Server or Workstation

					 net config server
net config workstation
					 

Network Enumeration

List all network interfaces, IP, and DNS

Displays the full TCP/IP configuration for all adapters.

					 ipconfig /all
wmic nicconfig get description,IPAddress,MACaddress
[Powershell] Get-NetIPConfiguration | ft InterfaceAlias,InterfaceDescription,IPv4Address
[Powershell] Get-DnsClientServerAddress -AddressFamily IPv4 | ft
					 

List Routing Table

Displays the entire contents of the IP routing table.

					 route print
netstat -nr
[Powershell] Get-NetRoute -AddressFamily IPv4 | ft DestinationPrefix,NextHop,RouteMetric,ifIndex
					 

List ARP table

Displays all ARP mapping entries.

					 arp -a
[Powershell] Get-NetNeighbor -AddressFamily IPv4 | ft ifIndex,IPAddress,LinkLayerAddress,State
					 

List Network status

Displays active TCP connections, ports on which the computer is listening.

					 netstat -ano
					 

List network shares

Displays information about all of the resources that are shared on the local computer.

					 net share
					 

List all shared resources

Displays detailed information about the currently mapped drives and devices.

					net use
					

List Wi-Fi Credentials

					 
List available AP SSID
					 netsh wlan show profile
					 
Get the clear-text password use
					 netsh wlan show profile  key=clear
					 

Windows Firewall Enumeration

Displays Windows Firewall Rules

					netsh advfirewall firewall show rule name=all
					

Displays Current Profile Status

					netsh advfirewall show currentprofile
					

Displays programs that are allowed by the host

					netsh firewall show allowedprogram
				        

Displays status of firewall configurataions

					netsh firewall show config
					

Displays the location of the firewall logs

					netsh firewall show logging
					

List firewall's blocked ports

					[Powershell] $f=New-object -comObject HNetCfg.FwPolicy2;$f.rules |  where {$_.action -eq "0"} | select name,applicationname,localports
					

Defense Evasion

Windows Firewall Defense Evasion

Disable Windows firewall

Windows firewall can be enabled/disabled from command line using netsh command.

							 netsh firewall set opmode mode=DISABLE
netsh advfirewall set allprofiles state off
netsh advfirewall set currentprofile state off
							 

Delete Firewall Rules

							 netsh advfirewall firewall delete rule name=""
netsh advfirewall firewall delete rule name="Block Ports"
							 

Web Proxy Defense Evasion

Disable proxy for browsers

Overrides any proxy settings that are provided.

							 start chrome --no-proxy-server
start msedge --no-proxy-server
							 

Obfuscation

Base64

Base64 encoding is traditionally used to convert binary data to printable text characters. The Base64 encoding scheme is often used to hide the plaintext elements in the early stages of an attack that can't be concealed under the veil of encryption.

Common Base64 Encodings

btoa() and atob() Method

The atob (ASCII to binary) and btoa (binary to ASCII) methods transform content to and from the base64 encoding.
The atob() function decodes a string of data which has been encoded using Base64 encoding.
The btoa() function creates a Base64-encoded ASCII string from a binary string.

							 atob('aHR0cHM6Ly9vd2xpZnkueHl6')
btoa('owlify.xyz')
							 

HTML Entities

Adversary take advantage of HTML encoding to obfuscate payloads for client-side attacks, hiding them from any server-side defences that are in place.

Example

Powershell encoded command

Adversary commonly hide commands by encoding them using Base64.

							 powershell.exe -EncodedCommand %redacted base64%
cmd /c powershell.exe -nop -w hidden -encodedcommand %redacted base64%
							 

Example UTF-16 encoding

Example Gunzip

Commandline Obfuscation

Command obfuscation may render rule-based detection useless and can make both static and dynamic detection more difficult.

Environment variables:

Static detection could be bypassed.

							 set a=/c & set b=calc
cmd %a% %b%
							 

Double quotes:

Static and dynamic detection could be bypassed.

							 c""m"d"
							 

Carets:

Static detection could be bypassed.

							 n^e^t u^s^er
							 

Comma/semicolon:

Static and dynamic detection could be bypassed.

							 cmd,/c;hostname
							 

Incident Response

Frameworks - NIST vs SANS

The difference between the NIST and SANS frameworks lies in how they approach the phases of containment, eradication, and recovery in incident response:

NIST Perspective:

NIST considers containment, eradication, and recovery as interconnected components within a single step. Unlike SANS, NIST doesn't insist on containment before eradication. This approach could be advantageous for organizations with a lower tolerance for threats, where the immediate removal of threats is prioritized over understanding and containing them beforehand.

SANS Perspective:

SANS treats containment, eradication, and recovery as distinct and independent steps. According to SANS, containment should come before eradication. This methodology allows for a more structured approach to isolating the threat and preventing its spread before focusing on eliminating it.

In summary, NIST's approach integrates containment, eradication, and recovery as interconnected actions, potentially suited for organizations prioritizing threat removal. SANS, on the other hand, treats these steps separately, advocating for containment before eradication to ensure controlled response to threats. The choice between these perspectives depends on an organization's risk tolerance and preferred incident response strategy.

Incident Response Guide

1. Preparation:

• Employee Training: Ensuring staff are trained in their incident response roles and responsibilities in the event of a data breach. Well-prepared employees are less likely to make critical errors during an incident.

• Tabletop Exercises: Developing incident response tabletop exercises and conducting mock data breaches periodically to assess the effectiveness of the response plan. These exercises help identify gaps and refine the plan.

• Thorough Documentation: Creating a comprehensive incident response plan that thoroughly outlines the roles and responsibilities of all involved parties. This documentation serves as a guide during real incidents.

Testing and Training: Regularly testing the incident response plan through simulations to ensure that the team understands their roles and the necessary notifications to be made.

2. Identification:

• Incident Confirmation: Determine if a breach or incident has taken place, understanding that they can stem from diverse origins.

• Timing and Discovery: Establish the timing of the event and how it was detected. Identify who found it and through which means.

• Extent of Impact: Investigate whether other areas or systems have been affected and gauge the overall scope of the compromise.

• Operational Impact: Assess whether the incident is impacting regular operations.

• Source Identification: Strive to determine the source or point of entry through which the event occurred.

3. Containment:

• Preserving Evidence: Refrain from deleting data to maintain valuable evidence for understanding the breach origin and prevention planning.

• Preventing Spread: Isolate the breach to prevent further damage. Disconnect affected devices from the Internet if possible.

• Short-term and Long-term Strategies: Have both short-term and long-term containment strategies ready. A redundant system backup can aid in data restoration.

• Backup Strategies: Maintain redundant backups to facilitate data recovery and ensure compromised data isn't permanently lost.

• Enhanced Security Measures: Update and patch systems, review remote access protocols with mandatory multi-factor authentication, and strengthen all access credentials and passwords.

4. Eradication:

• Root Cause Elimination: Identify and eliminate the source of the breach, including securely removing all malware and traces of malicious activity.

• System Refortification: Harden the affected systems by implementing security measures, and apply necessary patches and updates to minimize vulnerabilities.

• Thoroughness: Whether conducted internally or by a third party, the eradication process must be meticulous. Leaving remnants of malware or vulnerabilities can lead to data loss and increased liability.

5. Recovery:

• System Restoration: Return affected systems and devices to production in a timely manner, prioritizing a secure and efficient restoration process.

• Security Measures: Ensure systems are patched, hardened, and thoroughly tested before they are brought back into the operational environment.

• Backup Restoration: Consider restoring systems from trusted backups to a known, clean state, reducing the risk of persistent malware.

• Monitoring and Safeguards: Define a monitoring period for affected systems, observing for any signs of anomalous activity or breaches. Implement tools like file integrity monitoring and intrusion detection/protection systems to prevent future occurrences.

6. Lessons Learned:

• After-Action Meeting: Convene an after-action meeting involving all Incident Response Team members to discuss insights gained from the data breach incident.

• Analysis and Documentation: Thoroughly analyze and document the incident details, identifying successes and areas needing improvement. These insights stem from both actual incidents and tabletop exercises.

• Plan Refinement: Identify strengths and weaknesses in the incident response plan and the organization's security posture. Utilize these findings to refine the response plan and address vulnerabilities.

• Enhanced Training and Security: Determine necessary changes to security measures and employee training based on lessons learned. Focus on rectifying weaknesses exploited by the breach.

• Prevention Strategies: Develop strategies to prevent a recurrence of a similar breach by implementing corrective actions and enhancing preventive measures.

Ransomware Incident Response Guide

1. Preparation:

• Develop an incident response plan that includes specific procedures for ransomware incidents.

• Implement security measures like regular patching, network segmentation, and user training.

• Establish a backup strategy to ensure critical data and systems are regularly backed up and stored offline.

2. Identification:

• Monitor network traffic, system logs, and endpoint behavior.

• Quickly assess incoming alerts and prioritize them based on severity.

• Detect signs of potential ransomware activity, such as unusual encryption patterns or file changes.

• Analyze the attack vector and vulnerabilities exploited by the ransomware.

• Determine the ransomware variant to understand its behavior and capabilities.

3. Containment:

• Isolate affected systems from the network to prevent further ransomware spread.

• Identify the extent of the infection and determine which systems have been compromised.

• Reset passwords for compromised accounts to prevent unauthorized access and hinder the attacker's movement.

4. Eradication:

• Eliminate the source of the ransomware.

• Patch and update systems to prevent future infections through known vulnerabilities.

5. Recovery:

• Restore data and systems from clean backups, ensuring backups are free from malware.

• Implement additional security measures to reinforce the resilience of recovered systems.

6. Lessons Learned:

• Conduct a post-incident review to identify strengths and weaknesses in the response process.

• Update the incident response plan based on lessons learned from the incident.