<\/p>\n\n
Part 1:<\/span> Log to collect<\/span><\/span>\u00a0<\/span><\/strong><\/p>\n\n When considering which logs to collect, you can start by looking at what is required by law (e.g., the Computer Crime Act of 2021). Then, expand to cover the requirements of audits or regulatory bodies, and define the use cases along with the urgency level of each event. <\/p>\n\n Another approach is to choose use cases first (e.g., referencing techniques in MITRE ATT&CK that are commonly used by attackers). Afterward, link the log sources to the relevant techniques and specify indicators to create detection rules. The selection of use cases can be based on several factors, such as activities that are inconsistent with the organization\u2019s IT security policy, alerts from security analytics devices, threat intelligence data, or information from other sources useful for monitoring abnormal events. <\/p>\n\n The selection of indicators to create detection rules can be based on attack vectors and potential impacts on the systems to be monitored. For example, consider how attackers can access the system, which accounts have elevated privileges, and if successful, how malware might be installed or a backdoor created for future access. Additionally, assess whether lateral movement to other systems within the organization is possible, or if sensitive data could be directly transferred from the compromised system. This information can help identify related events for crafting detection rule logic. <\/p>\n\n <\/p>\n\n Part 2: <\/span><\/span>Methods for Analyzing Abnormal Behavior<\/span><\/span>\u00a0<\/span><\/strong><\/p>\n\n After selecting log sources and evaluating indicators based on potential threats, the next step is to define conditions for detecting or searching for abnormal events. This can be divided into four approaches: <\/p>\n\n Methods for detecting abnormalities on hosts generally focus on analyzing data from processes, applications, files, user accounts, and event logs present on the machines. Some abnormalities are clear indicators of an attack, while others may require confirmation from relevant personnel. Examples of detecting abnormalities on a host include: <\/p>\n\n For network-based detection, the focus is on detecting anomalies in DNS traffic, the use of remote access protocols (e.g., RDP, VPN, SSH), file transfer protocols (e.g., FTP, torrent), or other communication channels outside of authorized use. Examples of detecting abnormalities on the network include: <\/p>\n\n <\/p>\n\n Part 3: <\/span><\/span>Recommended Response Actions<\/span><\/span>\u00a0<\/span><\/strong><\/p>\n\n The incident response process, following detection and analysis, moves to containment, eradication, and recovery once confirmation has been made that the endpoint has been successfully compromised. The next step is to limit the damage to prevent the affected system from being used to spread to others. Afterward, malware is removed or any changes made by the attacker are reversed, and the system is restored to normal operations. However, one process that may introduce risks (or further damage) is when taking action too early before transitioning from analysis to containment. <\/p>\n\n The purpose of conducting analysis is to assess the damage, impact, and potentially investigate the attack vector and links to the attack group involved. There are two main points to be cautious about: first, ensuring the preservation of evidence or minimizing interference with volatile data on the compromised system (e.g., avoiding restarting or shutting down the system before evidence collection); and second, preventing the attacker from becoming aware of detection (e.g., avoiding pinging, connecting to IPs, or visiting the attacker\u2019s websites), as the attacker may change tactics or attempt to destroy evidence or further compromise data on the system they control. <\/p>\n\n The purpose of containment is to limit the scope of damage after a system has been compromised by an attacker. There are several approaches for implementation, such as disconnecting the affected system from the organization’s main network, blocking connections to IPs or domains associated with the attack, or suspending access rights to accounts that the attacker has gained unauthorized access to. However, some actions may require careful consideration to ensure thorough verification, as the attacker may change tactics or utilize other undiscovered channels to re-enter the system. For instance, blocking only the attacker\u2019s IP or domain might prompt them to switch to a new IP or domain and launch another attack. Similarly, suspending access to the compromised account may lead the attacker to use another account that hasn’t been detected yet. Therefore, before containment is executed, it’s important to verify that all necessary actions have been taken, and continued monitoring may be required to detect any abnormal activity even after containment is in place. <\/p>\n\n Conclusion<\/span><\/span>\u00a0<\/span><\/strong><\/p>\n\n Detecting and analyzing threats based on malicious behavior, as well as choosing appropriate approaches to limit the scope of damage, are key factors that can help organizations respond to attacks accurately and comprehensively. Whether it’s collecting log, anomaly detection, or selecting a response strategy to address the issue, these tasks require collaboration and information exchange between system administrators and threat analysis teams. This ensures that sufficient information is available to make timely and informed decisions in response to the situation. <\/p>\n\n MFEC is a comprehensive IT consulting and solution development company that plays a vital role in <\/span>establishing<\/span> IT foundations for leading clients across various industries. With over 20 years of experience, the company <\/span>leverages<\/span> its strength in providing Cyber Security services and IT solutions to organizational clients. <\/span>MFEC offers a <\/span><\/span>![\"\"](\"https:\/\/www.mfec.co.th\/wp-content\/uploads\/2024\/02\/image-1.png\")
<\/figure><\/div>\n\n![\"\"](\"https:\/\/www.mfec.co.th\/wp-content\/uploads\/2024\/02\/Incident-Response-01-2-1024x536.jpg\")
<\/figure><\/div>\n\n