WEBVTT

0:00:03.460000 --> 0:00:06.460000
 Hello everyone and welcome to this video.


0:00:06.460000 --> 0:00:10.260000
 In this video we're going to be ending
 this section of the course by taking

0:00:10.260000 --> 0:00:15.260000
 a look at a case study that will sort
 of go over everything that we've

0:00:15.260000 --> 0:00:19.100000
 covered with regards to the, you know,
 SOC processes and workflows that,

0:00:19.100000 --> 0:00:22.640000
 you know, have been really specific
 to instant response.

0:00:22.640000 --> 0:00:27.180000
 And as I said, we're sort of used, we're
 going to use a fictitious example

0:00:27.180000 --> 0:00:30.040000
 of a ransomware infection.

0:00:30.040000 --> 0:00:34.460000
 And the objective is to, you know, sort
 of go over the detection process,

0:00:34.460000 --> 0:00:39.400000
 which we've gone through triage and
 then the instant response workflow

0:00:39.400000 --> 0:00:41.980000
 all the way to lessons learned.

0:00:41.980000 --> 0:00:46.260000
 So I've also, you know, sort of included
 some of my own experience in

0:00:46.260000 --> 0:00:49.080000
 dealing with, you know,
 ransomware infection.

0:00:49.080000 --> 0:00:57.960000
 And now we were sort of in, we're simply
 starting from the point of, you

0:00:57.960000 --> 0:01:02.280000
 know, detecting suspicious activity
 and then, you know, all the way to

0:01:02.280000 --> 0:01:05.800000
 lessons learned and all that good stuff.

0:01:05.800000 --> 0:01:11.120000
 So in this particular case, you know,
 we're using a fictitious, a fictitious

0:01:11.120000 --> 0:01:12.420000
 company and scenario.

0:01:12.420000 --> 0:01:14.620000
 So here's the background.

0:01:14.620000 --> 0:01:19.180000
 So a multinational financial organization
 experiences a ransomware attack

0:01:19.180000 --> 0:01:21.120000
 targeting its internal systems.

0:01:21.120000 --> 0:01:25.740000
 The incident is detected by the organization
 SOC, which employs a combination

0:01:25.740000 --> 0:01:32.340000
 of seem, EBR and SOAR tools to identify,
 contain and respond to the attack.

0:01:32.340000 --> 0:01:35.520000
 So here's some, you know, additional
 background information about the

0:01:35.520000 --> 0:01:40.280000
 company that's a bit more specific
 to, you know, what's interesting or

0:01:40.280000 --> 0:01:41.720000
 important to us.

0:01:41.720000 --> 0:01:46.760000
 So the industry is, you know, financial
 services in terms of the infrastructure,

0:01:46.760000 --> 0:01:48.860000
 primarily Windows based systems.

0:01:48.860000 --> 0:01:52.720000
 They have a centralized active directory
 for authentication in terms of

0:01:52.720000 --> 0:01:53.940000
 their security tools.

0:01:53.940000 --> 0:01:58.540000
 They have EDR, they have an EDR, which
 in this case is CrowdStrike Falcon.

0:01:58.540000 --> 0:02:02.660000
 You know, you can keep the
 jokes to the side for now.

0:02:02.660000 --> 0:02:07.180000
 You have your seam, which in this case
 is Splunk and SOAR, which in this

0:02:07.180000 --> 0:02:10.100000
 case is Palo Alto Cortex X SOAR.

0:02:10.100000 --> 0:02:11.100000
 All right, now don't worry.

0:02:11.100000 --> 0:02:14.520000
 I haven't covered what a SOAR is yet,
 but we'll get to it in the next

0:02:14.520000 --> 0:02:16.380000
 sections of this course.

0:02:16.380000 --> 0:02:19.620000
 In any case, phase one
 detection and alerting.

0:02:19.620000 --> 0:02:23.080000
 So this is the initial detection and
 I've come up with a diagram that

0:02:23.080000 --> 0:02:26.800000
 sort of outlines, you know,
 very basic network topology.

0:02:26.800000 --> 0:02:31.420000
 So right away, we have the target
 network and we have an NDR.

0:02:31.420000 --> 0:02:34.980000
 So, you know, network detection response
 tool, we have a seam and then

0:02:34.980000 --> 0:02:36.100000
 the SOC right over here.

0:02:36.100000 --> 0:02:40.040000
 So, you know, the next sort of slides,
 we will further elaborate and add

0:02:40.040000 --> 0:02:41.800000
 to this diagram.

0:02:41.800000 --> 0:02:46.620000
 But we can see that point one here,
 part one involves the trigger.

0:02:46.620000 --> 0:02:49.040000
 So, you know, what triggers the alert.

0:02:49.040000 --> 0:02:53.280000
 So, an unusual spike in network traffic
 is detected and also switch into

0:02:53.280000 --> 0:02:57.100000
 full screen is detected by the NDR tool.

0:02:57.100000 --> 0:03:02.440000
 The EDR that's installed on each of
 these five workstations identifies

0:03:02.440000 --> 0:03:06.300000
 unauthorized partial execution
 on multiple endpoints.

0:03:06.300000 --> 0:03:09.040000
 Okay, so, you know, this
 is quite serious.

0:03:09.040000 --> 0:03:15.060000
 And point two here, or the second step,
 you can see over here that the

0:03:15.060000 --> 0:03:19.860000
 seam correlates these alerts and generates
 a high severity alert for potential

0:03:19.860000 --> 0:03:21.420000
 ransomware activity.

0:03:21.420000 --> 0:03:25.420000
 So, you, I'm pretty sure you can guess
 what's coming next is triage, right?

0:03:25.420000 --> 0:03:30.340000
 So this goes to a SOC analyst, most likely
 SOC tier one, and then it goes

0:03:30.340000 --> 0:03:32.400000
 through the triage and prioritization.

0:03:32.400000 --> 0:03:36.480000
 And then it's escalated to the incident
 responder or the incident response

0:03:36.480000 --> 0:03:40.900000
 team, or generally speaking,
 the SOC tier two analyst.

0:03:40.900000 --> 0:03:45.400000
 But before we proceed, we have a few
 indicators of compromised A, you

0:03:45.400000 --> 0:03:49.500000
 know, unauthorized partial scripts
 executing on several machines, you

0:03:49.500000 --> 0:03:54.360000
 know, at the same time, we have multiple
 files renamed with the dot locked

0:03:54.360000 --> 0:03:59.620000
 extension. So, you know, that's a dead,
 deadringer for some form of encryption

0:03:59.620000 --> 0:04:01.780000
 or manipulation of files.

0:04:01.780000 --> 0:04:07.000000
 And we also have outbound connections
 to suspicious IP addresses.

0:04:07.000000 --> 0:04:10.680000
 So that brings us to phase two, which
 is triage and analysis, which we

0:04:10.680000 --> 0:04:13.380000
 already covered in a previous video
 in terms of how it works.

0:04:13.380000 --> 0:04:16.640000
 But we can see that I've added
 a bit more to the diagram.

0:04:16.640000 --> 0:04:22.040000
 So within the SOC, we have the tier one
 analyst and the tier two the first,

0:04:22.040000 --> 0:04:26.160000
 you know, action here with regards
 to this phase is that the tier one

0:04:26.160000 --> 0:04:30.020000
 analyst validates the alert because
 they get it from the seem.

0:04:30.020000 --> 0:04:34.280000
 They determine the scope and they
 assess the impact of the attack.

0:04:34.280000 --> 0:04:38.200000
 And this is these are the actions
 taken by the SOC tier one analyst.

0:04:38.200000 --> 0:04:41.520000
 So they review the seem alerts and logs.

0:04:41.520000 --> 0:04:45.920000
 The tier one analyst identifies the
 source of the partial execution.

0:04:45.920000 --> 0:04:51.420000
 They confirm multiple endpoints are indeed
 affected with similar symptoms.

0:04:51.420000 --> 0:04:55.960000
 And they, the SOC tier one analyst checks
 EDR telemetry to identify the

0:04:55.960000 --> 0:04:57.120000
 origin of the infection.

0:04:57.120000 --> 0:05:01.660000
 In this case, a phishing email
 delivering a malicious payload.

0:05:01.660000 --> 0:05:06.120000
 And the second step, which is now escalation,
 you can see that this is

0:05:06.120000 --> 0:05:08.240000
 now escalated to the incident responder.

0:05:08.240000 --> 0:05:12.260000
 Because again, this is something that
 is of, you know, quite, I would

0:05:12.260000 --> 0:05:14.480000
 say high or critical severity.

0:05:14.480000 --> 0:05:18.160000
 So that brings us to phase three, which
 is, you know, containment and

0:05:18.160000 --> 0:05:23.780000
 eradication. But really, this is the
 response, you know, this is incident

0:05:23.780000 --> 0:05:29.080000
 response now. So now the tier one analyst
 no longer is in the diagram,

0:05:29.080000 --> 0:05:32.900000
 not because they don't exist, but you
 know, because the focus is now with

0:05:32.900000 --> 0:05:41.300000
 the tier two so what we covered in the
 previous video, when we're talking

0:05:41.300000 --> 0:05:47.000000
 about containment and eradication, they,
 the tier two analyst or the incident

0:05:47.000000 --> 0:05:51.420000
 responder is the unknown, then
 blocks communication channels.

0:05:51.420000 --> 0:05:56.700000
 They then disable compromised accounts,
 if any, and step four, they remove

0:05:56.700000 --> 0:06:01.460000
 any malware. Okay, so containment
 and eradication very simple.

0:06:01.460000 --> 0:06:04.940000
 We've already gone through this
 so fairly standardized.

0:06:04.940000 --> 0:06:08.540000
 We then have phase four,
 which is recovery.

0:06:08.540000 --> 0:06:11.260000
 So that's restoration and validation.

0:06:11.260000 --> 0:06:14.760000
 So in this case, again, still being
 performed by the incident responder

0:06:14.760000 --> 0:06:16.420000
 or the tier two analyst.

0:06:16.420000 --> 0:06:19.300000
 The first thing they do
 is restore from backup.

0:06:19.300000 --> 0:06:22.240000
 So they restore the system from backups.

0:06:22.240000 --> 0:06:27.260000
 So, you know, clean, clean restore, and
 then they apply security patches,

0:06:27.260000 --> 0:06:30.140000
 you know, depend, you know, if required.

0:06:30.140000 --> 0:06:34.700000
 Step three, they perform a full system
 scan to, you know, sort of ensure

0:06:34.700000 --> 0:06:40.100000
 that there's that there's no malware
 or reinfection, and then they enable

0:06:40.100000 --> 0:06:43.900000
 or implement or enforce multi
-factor authentication.

0:06:43.900000 --> 0:06:48.640000
 So again, hopefully this is all starting
 to come together with regards

0:06:48.640000 --> 0:06:50.980000
 to the incident response lifecycle.

0:06:50.980000 --> 0:06:54.800000
 We then have phase five, which we haven't
 covered, you know, technically

0:06:54.800000 --> 0:07:00.480000
 speaking, I hope to cover right now using
 the example as sort of a foundation,

0:07:00.480000 --> 0:07:02.260000
 which is the post incident activity.

0:07:02.260000 --> 0:07:06.800000
 So this includes lessons learned
 and the improvements.

0:07:06.800000 --> 0:07:10.900000
 So the objective here is to review
 the incident, identify the gaps and

0:07:10.900000 --> 0:07:12.480000
 enhance defenses.

0:07:12.480000 --> 0:07:14.400000
 So what are the actions taken?

0:07:14.400000 --> 0:07:16.280000
 A, conduct a post-mortem review.

0:07:16.280000 --> 0:07:21.460000
 So this involves analyzing what detection
 mechanisms worked and what failed

0:07:21.460000 --> 0:07:26.060000
 and identify areas for improvement in
 detection and response processes.

0:07:26.060000 --> 0:07:28.040000
 B, update playbooks.

0:07:28.040000 --> 0:07:32.740000
 So enhance the saw playbooks to better
 detect and respond to similar threats.

0:07:32.740000 --> 0:07:34.520000
 C, improve detection rules.

0:07:34.520000 --> 0:07:38.640000
 So you refine the seem and EDR detection
 rules for identifying ransomware

0:07:38.640000 --> 0:07:43.980000
 activity. And then you enhance user
 awareness training, which is point

0:07:43.980000 --> 0:07:48.620000
 D, you educate the employees on
 identifying phishing attempts.

0:07:48.620000 --> 0:07:51.340000
 And finally, update the backup policies.

0:07:51.340000 --> 0:07:55.980000
 So ensure regular backups are
 performed and stored securely.

0:07:55.980000 --> 0:08:00.540000
 So this brings us to, you know,
 what this actually looks like.

0:08:00.540000 --> 0:08:02.820000
 You know, this is the post
 incident activity.

0:08:02.820000 --> 0:08:05.800000
 So still lessons learned and improved.

0:08:05.800000 --> 0:08:11.640000
 But now we've sort of classified, you
 know, the lessons learned and what

0:08:11.640000 --> 0:08:14.040000
 needs to be done.

0:08:14.040000 --> 0:08:17.900000
 So we have a lot of the incident response
 phases, you know, that are part

0:08:17.900000 --> 0:08:21.120000
 of the larger life cycle.

0:08:21.120000 --> 0:08:25.080000
 So we have detection, containment, eradication,
 recovery, and post incident.

0:08:25.080000 --> 0:08:27.700000
 So what worked with regards to detection?


0:08:27.700000 --> 0:08:31.580000
 Well, the EDR and seem as we saw with
 the diagrams, quickly detected,

0:08:31.580000 --> 0:08:33.160000
 you know, suspicious activity.

0:08:33.160000 --> 0:08:37.880000
 But in this case, the seem actually
 correlated to ransomware activity

0:08:37.880000 --> 0:08:40.400000
 or a ransomware infection.

0:08:40.400000 --> 0:08:42.340000
 So what needs to be improved?

0:08:42.340000 --> 0:08:48.460000
 Well, we really didn't get any correlation
 with regards to lateral movements.

0:08:48.460000 --> 0:08:52.860000
 So we need to improve visibility
 into lateral movement.

0:08:52.860000 --> 0:08:58.740000
 Moving on to containment, what worked
 was, you know, the automated isolation

0:08:58.740000 --> 0:09:02.140000
 of infected systems was effective.

0:09:02.140000 --> 0:09:07.680000
 What needs improvement, you know, some endpoints
 were not isolated immediately.

0:09:07.680000 --> 0:09:12.080000
 Eradication, malware was successfully
 removed using the automated playbook.

0:09:12.080000 --> 0:09:17.480000
 So we have, and again, remember, this
 is not, this is essentially based

0:09:17.480000 --> 0:09:22.120000
 on the the fixed, the fictional
 example that we're using here.

0:09:22.120000 --> 0:09:26.360000
 But, you know, in terms of eradication,
 what needs to be improved?

0:09:26.360000 --> 0:09:30.400000
 Better correlation between
 the C many D R is required.

0:09:30.400000 --> 0:09:32.200000
 We then move on to recovery.

0:09:32.200000 --> 0:09:35.540000
 What worked, you know, the backup
 restoration was successful.

0:09:35.540000 --> 0:09:39.400000
 However, what needs to be improved is,
 you know, we need to have faster

0:09:39.400000 --> 0:09:42.240000
 backup validation processes.

0:09:42.240000 --> 0:09:44.540000
 And then post incident.

0:09:44.540000 --> 0:09:48.280000
 What worked was, you know, the lessons
 learned were well documented.

0:09:48.280000 --> 0:09:52.560000
 What needs improvement is we need to improve
 training for phishing detection,

0:09:52.560000 --> 0:09:58.800000
 you know, for employees and, you know,
 the SOC analysts, more specifically,

0:09:58.800000 --> 0:10:00.080000
 or generally speaking.

0:10:00.080000 --> 0:10:04.480000
 So I've sort of, sort of, summarized
 the lessons learned, because I didn't

0:10:04.480000 --> 0:10:08.380000
 cover them before that, but they're
 essentially based on improving the

0:10:08.380000 --> 0:10:11.800000
 endpoint monitoring, so enhancing detection
 rules for unusual processes

0:10:11.800000 --> 0:10:13.380000
 like PowerShell execution.

0:10:13.380000 --> 0:10:16.220000
 This is actually what lessons
 learned looked like.

0:10:16.220000 --> 0:10:20.700000
 And you can see they're very actionable,
 because the analysts or the security,

0:10:20.700000 --> 0:10:25.520000
 the security engineers can easily start
 implementing detections for, you

0:10:25.520000 --> 0:10:29.760000
 know, PowerShell execution.

0:10:29.760000 --> 0:10:35.180000
 And coming up with alerts that are triggered
 when PowerShell is executed.

0:10:35.180000 --> 0:10:37.540000
 Secondly, better network segmentation.

0:10:37.540000 --> 0:10:41.580000
 So we need to limit exposure of critical
 assets to unauthorized network

0:10:41.580000 --> 0:10:44.920000
 access. We then need to
 refine our playbook.

0:10:44.920000 --> 0:10:49.440000
 So update the SOA playbooks to include
 the most, to include more robust

0:10:49.440000 --> 0:10:52.360000
 malware detection procedures.

0:10:52.360000 --> 0:10:55.140000
 We then, we also need to
 enhance user training.

0:10:55.140000 --> 0:10:59.180000
 So increase awareness of phishing tactics
 through periodic training, and

0:10:59.180000 --> 0:11:03.060000
 sort of ad hoc, you know,
 phishing simulations.

0:11:03.060000 --> 0:11:08.160000
 And you then have not simulations,
 phishing campaigns, I should say.

0:11:08.160000 --> 0:11:11.020000
 And finally, we need to improve
 our backup strategy.

0:11:11.020000 --> 0:11:14.760000
 So we ensure that backups are stored
 securely and regularly tested for

0:11:14.760000 --> 0:11:18.560000
 integrity. What that means is that you
 can just say I've taken a backup,

0:11:18.560000 --> 0:11:22.720000
 which means you've just copied files
 from one disk onto another, you need

0:11:22.720000 --> 0:11:27.580000
 to, you know, have a robust backup
 solution that for lack of a better

0:11:27.580000 --> 0:11:32.040000
 word or, you know, to use the correct
 word, images, the system so that

0:11:32.040000 --> 0:11:35.100000
 you can easily restore
 it back with no issues.

0:11:35.100000 --> 0:11:38.400000
 Restoration is sort of the key here,
 because there's no point taking a

0:11:38.400000 --> 0:11:42.660000
 backup that you cannot restore
 fully or 100% right.

0:11:42.660000 --> 0:11:44.140000
 And there we have it.

0:11:44.140000 --> 0:11:46.640000
 So that brings us to the
 end of this video.

0:11:46.640000 --> 0:11:51.840000
 Hopefully this example or this case
 study gave you a better solidified

0:11:51.840000 --> 0:11:58.420000
 understanding of, you know, what the
 incident response incident detection

0:11:58.420000 --> 0:12:01.220000
 and response process looks
 like within a SOC.

0:12:01.220000 --> 0:12:07.080000
 Of course, we had a specific focus on
 the incident response phase or phases,

0:12:07.080000 --> 0:12:11.320000
 I should say. But hopefully the latter
 sections where we talked about,

0:12:11.320000 --> 0:12:15.260000
 you know, the post incident review and
 lessons learned sort of gave you

0:12:15.260000 --> 0:12:19.800000
 an understanding as to, you know, the
 final phases or, you know, what

0:12:19.800000 --> 0:12:22.720000
 usually comes after the exciting stuff.

0:12:22.720000 --> 0:12:26.060000
 But with that being said, that is
 going to be it for this video.

0:12:26.060000 --> 0:12:28.260000
 And I will be seeing you
 in the next video.