Instructor: In this lesson,
we will learn about behavior and data analysis.
Behavior and data analysis
involves examining patterns and anomalies
in system and user activities
to detect signs of potential threats or malicious behavior.
Behavior and data analysis concepts
include internal intelligence sources,
such as internal reconnaissance,
hypothesis-based searches,
and user behavior analytics.
Internal reconnaissance
enables the identification of attacker efforts
to gather information within a network.
Next, hypothesis-based searches are driven
by specific assumptions or scenarios
about how an attacker might operate within the network.
Finally, user behavior analytics, or UBA,
monitors user actions and flags unusual behavior.
Let's learn more about internal reconnaissance,
hypothesis-based searches,
and user behavior analytics.
First, we have internal reconnaissance.
Internal reconnaissance refers
to the activities an attacker conducts
after gaining initial access to a network,
but before continuing with an attack.
The purpose of internal reconnaissance,
from an attacker's perspective,
is to gather information
about the target's internal network,
such as system vulnerabilities, user privileges,
and critical assets,
in order to map out that attacker's next moves.
This stage of an attack
often includes scanning for open ports,
identifying running services,
and locating sensitive data or resources
that could be exploited.
Overall, threat hunting is a defensive exercise
that assumes a known threat
and assumes that a breach has already occurred,
then defenders search the network
for indicators of attack and compromise.
In threat hunting,
internal reconnaissance is a key indicator
that a network breach has already occurred
because it reveals the attacker's attempt
to gather information
on the internal network infrastructure.
Identifying internal reconnaissance can prevent an attack
from progressing to more damaging stages,
such as data exfiltration or ransomware deployment.
In this effort,
threat hunters aim to identify internal reconnaissance
by analyzing network logs,
looking for unusual scanning activities,
or observing anomalous access to sensitive resources.
For example, if a user account starts accessing areas
of the network it hasn't accessed before,
or if there are many failed login attempts
on different machines,
this could be evidence of reconnaissance activity.
Or if threat hunters notice an unusually high volume
of port scanning from an unknown device,
they may determine that an attacker
is mapping out the internal network
in preparation for continuing an attack.
Identifying this behavior allows security teams
to stop an attack before the intruder escalates their access
or launches additional payloads.
Second, we have hypothesis-based searches.
Hypothesis-based searches in threat hunting
are searches that begin with an assumption or theory
about how an attacker might be operating within the network.
The idea is to use available intelligence
and knowledge of common attack techniques
to guide the search
for indicators of compromise or malicious activity.
For example, a threat hunter may hypothesize
that an attacker is exploiting a known vulnerability
in a web application,
and look for evidence that supports
or disproves this theory.
The importance of hypothesis-based searches
lies in their focused and strategic nature.
Instead of blindly searching through all network data,
threat hunters form educated guesses of attack paths
based on specific scenarios or threat models,
which makes their investigations more efficient
and likely to yield actionable results.
Hypothesis-based searches
can also help detect advanced persistent threats,
where attackers remain in the network
for long periods of time,
using advanced techniques,
without triggering traditional security alerts.
So by formulating specific hypotheses,
security teams can uncover stealthy or sophisticated attacks
that would otherwise go unnoticed.
For instance, imagine a scenario
where a threat hunter receives intelligence
about a recent vulnerability
in a popular database management system.
They may hypothesize
that attackers are exploiting this vulnerability
to gain access to sensitive data in their network.
Then threat hunters might search logs
for evidence of unusual queries,
privilege escalation attempts,
or unauthorized access to the database
around the time the vulnerability was made publicly known.
If the hypothesis is correct,
this targeted search could allow the threat hunter
to identify and mitigate the attack
before significant damage occurs.
At minimum, the threat hunter would identify
their in-place defenses
were either sufficient or not sufficient
to identify indicators of attack or compromise
for the specific hypothesized attack.
Third, and last, we have user behavior analytics, or UBA.
UBA is the process of analyzing user activity
to detect patterns that deviate from normal behavior,
potentially indicating malicious intent.
UBA tracks a user's interactions with systems,
networks and data over time,
creating a baseline of normal day-to-day actions.
When deviations from this baseline occur,
such as accessing sensitive information
outside of regular work hours,
or logging in from unusual geographic locations,
UBA tools raise alerts for further investigation.
So UBA is a powerful tool
for identifying insider threats or compromised accounts.
In threat hunting,
UBA can detect attacks
that traditional signature-based systems might miss.
This is because while signature-based defenses
can recognize known attack patterns,
the UBA can identify subtle indicators of compromise
that suggest an attacker is operating
under the guise of a legitimate user.
This is particularly useful in detecting credential theft
or insider threats,
where malicious activities
might appear legitimate at first glance,
as the activities are being performed
by legitimately issued accounts.
But by flagging unusual behavior,
UBA can provide threat hunters
with valuable leads to investigate further.
For example, suppose an employee's account
suddenly starts downloading large volumes of data
from a sensitive database during the late hours.
This might be normal for some roles,
but if this behavior is out of character
for that specific user,
it could indicate either an insider threat
or a compromised account.
UBA could flag this anomaly,
prompting threat hunters to investigate further
and potentially uncover malicious activity,
such as an attacker using stolen credentials
to exfiltrate data.
So remember, behavior and data analysis
involves examining system and user activity
to detect signs of potential threats or malicious behavior.
Key concepts in this process associated with threat hunting
include discovering internal reconnaissance,
hypothesis-based searches,
and user behavior analytics, or UBA.
Internal reconnaissance refers to an attacker's effort
to gather information within a network
after gaining initial access,
helping threat hunters identify early stages of a breach.
Next, hypothesis-based searches are guided
by specific assumptions about how attackers might operate,
allowing for more focused and efficient investigations.
Finally, user behavior analytics, or UBA,
analyzes user behavior,
identifying deviations from normal activity
to detect insider threats or compromised accounts.