-: Service and application events.
So we talk about service and application events,
we need to monitor all of our services and our applications
per our good IT service management processes.
So this is not necessarily the instant response
side of things, but when things go wrong,
instant response may be brought in to help.
So we need to ask questions like:
Are they services up or down?
Are they responding properly?
Are they functioning properly?
Are they conducting their transactions properly?
And are they logging those transactions properly?
All of these things are things that we
as instant responders would care about
once we have been called in from the ITSM perspective.
Now, we look at service anomalies;
these can be non-security issues,
so they may not even be an incident.
These can be things like: authentication errors,
permission issues, services that won't boot up,
and services failures.
But all of these things need to be investigated first
and determined if they are security related
because these same things that may not
be security related can turn around very quickly
and become security related.
So usually the IT service management side
will start this process and when they start
getting a funny feeling or they've detected
that it may be a security issue,
they'll call in for instant response.
Now, you can use things like antivirus, antimalware,
file integrity checking, and whitelisting to verify
that these things are or are not security related.
Now, how do you check the service status
to see if a service is up or down?
Well, in Windows, you'll just go to services.msc
which is the GUI version, or you could type sc
at the command line and get a list of what the
running services are, when they were started,
when they were stopped, when they have been restarted,
all of those kind of things.
If you're using Linux, you can use
services-status-all and you'll get that
from the command prompt, gives you a very
similar thing to what sc does in Windows.
Now, when you start looking at the logs
for these services and applications, there's two
different places you'll find them.
If you're in a Windows system, you're going to do it
through the Event Manager or Event Viewer
to view the application logs.
If you're on Linux, they're going to be kept in the
/var/log directory, so you'll just CD into the
/var/log directory and if you use the command tail,
it will show you the last couple of lines
of that particular log file since these logs
are continually being read and written to.
Now, when we talk about the application's behavior
itself, you have to understand what normal is
to see what abnormal is.
And we've talked about that a lot in this course.
If you don't have a good baseline and you don't know
what normal looks like, it's hard to know
what is not normal.
So when you look at the behavior, you want it to log
or alert anything that is outside the baseline.
And again, going back, and you can use things like
host intrusion detection systems, or server-based
intrusion detection systems to determine this.
In this case, on the screen I have an example
from a McAfee product, which is a host intrusion
prevention system, or a HIPS.
And you can see that it has a lot of things
that were being blocked on TCP, that's that red there.
And now we can go and look at that.
Why are we getting these connections
and why are they being blocked?
Well, it's because they were outside
of the normal baseline.
So now I can go look and go, are those valid?
Should they have not been blocked?
Or, were those malicious and should be blocked?
And that's where we're going to go with that based
on the behavior and the analysis
that we're going to perform on it.
Now, when we look at the attacks against a server,
a service or an application,
there are a lot of different ways that we can attack things.
One of the ways is anomalous activity.
This is anything that just doesn't match typical behavior.
And what we want to do with this is we want to investigate
the activity, and solve it.
Either classify it as known good or known bad.
But until we do, we want to block that activity
and figure it out.
The next thing we want to look at is new accounts.
Were the accounts created authorized?
Do they have the proper permissions?
Do they have excessive permissions?
Did I create a new user that's called XYZ123
and give it admin rights?
If so, there's something wrong there, right?
We need to look into that.
And then we want to look at unexpected output.
Anytime a service or an application gives you
unexpected output or garbage output,
that is something that we have to consider
and see is there something malicious there.
This is where user and admin training becomes essential
to understand their software so they know
what things are good and what things are bad.
Now, when we look at the unexpected outbound communications,
why is an application talking and sending data
out of our system?
Is this consistent with the way it should perform,
going back to our last attack, right?
Or is this something that is wrong?
Again, we can detect this based on the
host intrusion prevention system,
as you saw with the McAfee product I showed
a couple of slides ago,
or we can detect this with network monitoring and our
intrusion detection and intrusion protection systems
on the network.
Services that are interrupted.
This can be a simple issue like a misconfiguration,
or it could be an attack, like a DDoS attack.
Monitoring tools again can help us determine the reason
behind it and if it was malicious or not.
And finally, we have memory overflows.
So memory overflows are going to cause
operating system errors and crashes.
Monitoring for them is very, very difficult though
because most of the monitoring is done by the server itself.
And so, usually you're going to detect these
after a crash has occurred.
They're gonna write their contents of memory
to the hard disc and you can analyze those contents.
Doing realtime forensics on memory is difficult
but we will talk about that a little bit
when we get into our forensics section
of this course later on.