Cyberstudy
PDF p.359 In progress

Malicious Code Indicators

Open PDF at p.359 13 flashcards

Summary

PDF p.359

Malicious code can compromise hosts and launch network attacks. Indicators of such code execution are detected by endpoint protection software or discovered in logs showing how the malware interacted with the network, file system, and registry.

Detailed explanation

PDF p.359
  • Shellcode
    • Definition: Minimal program exploiting OS or app vulnerabilities to gain privileges or drop a backdoor.
    • Follow-up: Network connection to download additional tools.
  • Credential Dumping
    • Definition: Malware accessing credentials file (e.g., SAM) or sniffing credentials in memory (e.g., lsass.exe).
    • DCSync Attack: Tricks domain controller into replicating user list and credentials to a rogue host.
  • Pivoting/Lateral Movement/Insider Attack
    • Definition: Using a foothold to execute processes remotely (e.g., PsExec, PowerShell).
    • Objectives: Seeking data assets or widening access by changing security configurations (e.g., opening firewall ports, creating accounts).
    • Detection: Commands may blend with ordinary operations but could be anomalous for the compromised account.
  • Persistence
    • Definition: Mechanisms allowing backdoor to restart after reboot or user logoff.
    • Methods: Using AutoRun keys in the registry, adding scheduled tasks, or using WMI event subscriptions.

Important terms

taken from the text above
Shellcode
Minimal program exploiting OS or app vulnerabilities to gain privileges or drop a backdoor.
Follow-up
Network connection to download additional tools.
Credential Dumping
Malware accessing credentials file (e.g., SAM) or sniffing credentials in memory (e.g., lsass.exe).
DCSync Attack
Tricks domain controller into replicating user list and credentials to a rogue host.
Pivoting/Lateral Movement/Insider Attack
Using a foothold to execute processes remotely (e.g., PsExec, PowerShell).
Persistence
Mechanisms allowing backdoor to restart after reboot or user logoff.

What I should remember

Key Points PDF p.359
  • Shellcode
    • Exploits Vulnerabilities: Gains privileges or drops backdoors.
    • Follow-up: Downloads additional tools.
  • Credential Dumping
    • Accesses Credentials: From files or memory.
    • DCSync Attack: Replicates user list and credentials.
  • Pivoting/Lateral Movement/Insider Attack
    • Remote Execution: Using tools like PsExec, PowerShell.
    • Objectives: Data assets, security configuration changes.
    • Detection: Anomalous commands.
  • Persistence
    • Restarts Backdoor: After reboot or logoff.
    • Methods: AutoRun keys, scheduled tasks, WMI subscriptions.