Thread by @chrissanders88

One of the things I do in my Investigation Theory course, for those willing, is work with students individually to help them learn to ask better investigative questions. For example, one student started with this Suricata rule:

1/

The task here is to start by asking a couple of investigative questions, assuming you have access to any evidence you might want. This student posed these two:

1. How long as this machine been infected?
2. How many beacons has the machine sent?

2/

In this case, the student is making some assumptions that the machine is already infected, but we don’t really know that for certain yet. The first goal should be proving or disproving the infection.

How do you do that? 3/

For malware, the answer usually involves reading a bit about the malware and figuring out other characteristics you can use to confirm infection.

That’s pretty easy with Poison Ivy! So, I recommended that to the student. 4/

The student did some general digging on PI and pulled out some broad capabilities of the malware. They asked:

“Has this malware stolen any sensitive information?”

This still needs some work.

5/

So, PI can be used to steal information, but this isn’t specific or actionable enough to investigate. A good investigative question is something you can answer directly with evidence.

So, I gave some examples from another scenario and encouraged more specific PI research… 6/

They did some digging and found that when PI goes through an auth proxy it may write a registry key where it writes sniffed auth information (the link in the rule mentions this). That’s something we can work with! 7/

With that in mind, they came up with these two questions:

1. Does the proxy use basic authentication?
2. Has a registry key been written to HKEY_LOCAL_MACHINE\SOFTWARE\Classes\BJ\STATIC\MessageFile?
8/

This is good!

Now, even if the answer is no to both, PI might still be on the box and this may not be enough to dismiss the alert.

So, I pushed the student a bit…assuming the answer is no, how else could you prove the existence of PI malware on the system? 9/

Again, the key is specific and actionable. In this case, the student started with, “Are there any suspicious processes running on the system?”

10/

That's not a horrible question, but it's broad and a bit more appropriate to ask when you've run out of other leads.

So, for the student, how can you make this question more specifically relevant to PI?
11/

The key here, again, is the research.

They made quick work of this one and looked up a list of common process names for PI. The question then became: “Is there any evidence of processes launching or running using $list_of_process_names associated Poison Ivy?”

12/

This is great because it’s easily answerable! Running process list, Windows logs, EDR logs, whatever you have.

It’s super actionable, speaks to the validity of the alert, and can identify something critical on the timeline.

13/

These aren’t the only questions you’d ask in this investigation or where you'd likely start, but that’s okay. The point of this exercise is taking a stab and investigative questions and refining. We do this in the first week of the class.

14/

Great analysts ask great questions that leverage existing evidence, are specific, and have a high likelihood of revealing some interesting relationship or part of the investigative timeline. This is a craft we continually develop.

15/

It surprises some folks that I interact with every single student who chooses to in Investigation Theory, but that is what makes it an actual class and not just a bunch of videos. You get the opportunity for feedback and to push yourself.

16/

If you want to learn to ask better investigative questions, I'm accepting new students now. The journey begins here: networkdefense.co/courses/invest….

17/17