YT YouTube2Text

YouTube2Text → Transcripts → SOC 101: Real-time Incident Response Walkthrough

SOC 101: Real-time Incident Response Walkthrough — Transcript

by Exabeam · 2,280 words · 376 segments · language en · Watch on YouTube

Open in transcriber Summarize with AI Download SRT/VTT

Full transcript

0:00[Music]
0:09one of the most common questions that i
0:10get when i'm doing incident response or
0:12threat hunting
0:14or more specifically teaching people how
0:16to do threat hunting or incident
0:17response
0:18is how would you know to go look at that
0:20specific machine or how would you know
0:22to take a memory dump or look at that
0:24machine's individual traffic
0:25out of the ten thousand twenty thousand
0:27fifty thousand devices that are on the
0:29network
0:30well the answer to that is because of a
0:32group that we talk about
0:33called the sock or the security
0:35operations center and
0:36you know i say this all the time i think
0:39in our industry
0:40the sock and the sock team are the most
0:43underrated
0:44underappreciated under discussed groups
0:46in all of cyber security
0:48because it's because of that team we're
0:49able to see the things that we need to
0:51see or focus on the things we need to
0:53focus on
0:54but as a part of that and what makes a
0:56sock team work and what
0:58makes instant response and through
0:59hunting and all that works is
1:01having a good sim solution i'm going to
1:04show you how using a sim one of my
1:06favorites
1:06exa beam how this ties together and
1:08we'll go from the very beginning of
1:10where someone in the sock saw through
1:12the sim
1:12a problem and then we'll look at what
1:14the hunting and the incident response
1:16would look like
1:16let's jump right into it now what we
1:19said
1:20is the fact that what you normally see
1:22is the sock is who's responsible for
1:24letting us know where to look
1:26for a specific piece of malware and when
1:28something's wrong
1:29what you see here is kind of my way to
1:31illustrate this you can see the sock up
1:33here at the top these are the the
1:35unsung heroes the people that are in
1:37there daily grinding it out looking for
1:39these
1:40variations and anomalies and then
1:42they're usually plugged into what we
1:44call
1:45a sim or a security information and
1:47event management system and one of my
1:48favorites as i said
1:50in the previous part of this video is
1:52exam
1:53now what you can see is incident
1:55response threat hunting
1:57you know incident detection or intrusion
2:00detection
2:01risk management all of this ties into
2:04these sim solutions and utilizes the
2:06data
2:06let's look at what happens in a scenario
2:09we're going to go quickly from beginning
2:10to end
2:11where something in the sim showed us
2:13that something wasn't quite right and
2:14then we'll dig into the weeds
2:16so you can see how we get into those
2:17weeds kind of counter to what my normal
2:20videos are whereas we pick up right in
2:22the weeds
2:22let's look at that
2:26so i've logged into my xbeam sim console
2:29here
2:30and you know this is one of the best
2:32dashboards most intuitive dashboards
2:35of the sim market you know this is one
2:37of my favorites
2:38so as you can see here we can see all
2:40kinds of things we can see
2:42notable users and by notable we mean
2:44users that
2:45there's been some activity that makes us
2:47notice them you know there's something
2:49about this user's activity
2:50that makes us kind of put them in this
2:52category there's notable assets this
2:54would be
2:55specific servers or desktops or things
2:57like that
2:58that may be doing some behavior that
3:00kind of makes us notice those devices as
3:03well
3:03and you can see we have all different
3:05kinds of categories here
3:06that we look at in our sim to see what's
3:09going on now in this particular instance
3:11we're going to look at barbara salazar
3:13here so if we go look at her
3:15alert and see why she's in the
3:18notable people's list here we can see if
3:20we click on this
3:22incident here now i want you to notice
3:23this is classified as a medium
3:26it's not a critical not a high uh
3:28categorization but if we go look at her
3:31and look at what this report is what we
3:33see and this is november 22nd so this is
3:36like just you know yesterday
3:38what we can see is ms salazar here has
3:41been vpning in from the ukraine and the
3:44reason she got into this
3:46group of notable is because she's never
3:49vpn from the ukraine before
3:51right so that may not be anything but it
3:54could be
3:54everything so that's how we got to focus
3:58on
3:59ms salazar so now we're going to go and
4:01look at our vpn concentrator or our vpn
4:04dropbox or jump box so you know a lot of
4:06these organizations have these really
4:08old boxes
4:09or really old infrastructures where when
4:11you vpn in you jump off into that box
4:13and then from that box
4:14you can move horizontally inside the
4:16environment so now let's jump over to
4:18that
4:18based on what we saw in this great
4:21dashboard here
4:22uh to get us to that point to where we
4:24knew that barbara salazar was having an
4:26issue
4:26or there could have been an issue and
4:28this could be the impetus
4:30for where we might start something like
4:32a cyber threat hunt
4:33based on just this medium thing here we
4:35don't know that there's anything wrong
4:37but the dashboard can quickly get us to
4:39the point remember we started here
4:42it can quickly get us to the point to
4:44where we can kind of see that okay
4:46there's vpn from a geo location that
4:48she's never done before
4:50uh we don't have any evidence of malware
4:52or anything like that
4:53it's a medium priority thing but you
4:55know what let's let's create a threat
4:57hunting hypothesis
4:59and assume that maybe there is an issue
5:01because there's a vpn from the ukraine
5:03this gives us all that so let's go now
5:05and look and see what we would see
5:07on her vpn session or the previous
5:10sessions that she's generated
5:13so now as we get to the vpn junction
5:15point you can see the vpn profiles here
5:17and if we go look at those
5:19we look in her profile and we don't see
5:21anything weird there
5:23but we're forming an hypothesis here
5:25because we understand
5:26that the whole purpose of these
5:29advanced persistent threats is they
5:31don't want you to see evidence of
5:32anything going on
5:34so just out of curiosity here we're just
5:36gonna run
5:39i'm going to run a task list
5:42and get a list of running processes
5:46and i'm also going to run
5:49these are just built-in windows commands
5:51i'm going to do netstat
5:55and look at current connections
5:59and i'm going to write that to the same
6:00file all right
6:02now this is a common little triage that
6:04i'll do when i think something's wrong
6:06and i'm going to copy
6:08this file somewhere that i can get to it
6:10remotely
6:11all right so we don't know that
6:13anything's wrong but we just did a
6:14little triage we copied that file over
6:16uh took a a list of you know what was
6:19running and just to show you what that
6:20file looks like
6:24it's just a little file looks like that
6:25shows us running processes
6:28and connections now notice here's a list
6:30of all the running processes and they're
6:32all legitimate when this process is
6:33nothing looks
6:34out of whack there here's um
6:37you know connections there's no weird
6:40connections there's actually no
6:41connections just listening ports
6:43they all look legit so nothing to see
6:45there uh
6:46on this jump box now because we
6:50saw got that hint from barbara salazar's
6:53vpn from the ukraine we knew it came
6:54into this box we're gonna just as a
6:57precautionary measure
6:58out of an abundance of caution we're
7:00gonna take a memory dump anyway
7:02of this machine and we always talk about
7:04the order of volatility and why
7:06um that's such an important thing so
7:08we're going to write
7:10just write right onto the c drive here
7:13and we're just going to write a memory
7:14dump out
7:16and i'm using this old machine because
7:17it's got a really really tiny amount of
7:19memory
7:19so this this demo can go quicker uh with
7:22me just taking like a 256 meg memory
7:25dump
7:26but you get the point you don't have to
7:27sit here and watch me
7:29uh you know wait for a memory dump from
7:31a 32 gig memory machine
7:33to take 45 minutes for you to get the
7:35point of what's going on here
7:36so i'm going to take that memory dump
7:38now and we're going to put it
7:40onto a server all right it's transferred
7:44so now we're going to go to our
7:46investigative machine
7:47we're going to bring that memory dump
7:49over and then with that dump
7:51we're going to just do a comparative
7:52analysis here so remember
7:54we wrote out this file so we wrote out
7:57this hacked file right that showed us
7:59everything that's going on on the
8:00machine
8:03and we can see there's our running
8:05processes and then we can see random
8:07data our connections
8:08i want you to pay attention to the fact
8:09that there's a listening session
8:12on port 80 and port 110 but nothing on
8:15port 100 and here's again the running
8:16processes
8:18now taking that memory dump that we just
8:20bought over so let's look at that i'm
8:22going to use a tool called volatility
8:26this is just a memory dump tool and
8:28we're going to point at that barb dot
8:29raw file here all right and just
8:33i'm not trying to teach you volatility
8:35here so i'm not going to go into
8:36all the things i'm doing with the
8:38commands here and we're going to get a
8:40list
8:41of running processes so that's going to
8:42be the first comparative analysis we're
8:44going to do
8:45so we're going to look at the processes
8:47that are currently running per the
8:48memory dump and compare that to what we
8:50see
8:51when we run task list or task manager
8:54from the victim itself which is what we
8:55see over here
8:56and right away we see two processes
9:00right there that we don't see
9:04running on the other side over here so
9:06the machine itself is lying to us and
9:08telling us that
9:09you know this is all the processes we
9:11have and there's no weird connections
9:13but also if we looked at connections
9:20we'll see that there's a connection on
9:22port 100
9:23that doesn't show up over here right
9:26when we looked at the listening ports
9:28from the machine itself it says look we
9:29don't have any connections
9:31and this is what's all it's listening so
9:33clearly there's something wrong
9:34you know what it ends up being is that
9:38weird process
9:39is actually a root kit that you saw
9:41there
9:43so that's actually a root kit that's
9:45running
9:46and if we extract that root kit we would
9:48find that it's something very very bad
9:50as a matter of fact let's go ahead and
9:51do that
9:52so let's get it get the process name for
9:54that rootkit
9:56and it's and it's pid all right so that
9:59rootkit
10:02that thing that we think is a root kit
10:04which is right here
10:05all right that's running as a pid of
10:083148
10:09so what i'm going to do is make a
10:10directory name barb and i'm going to
10:12extract that root kit
10:14out to that directory and we'll use
10:18something called proc dump to do that
10:20from volatility
10:24we're going to dump it right to barb
10:32and that process is 31.48
10:40oh we forgot to do our dash d here my
10:44bad
10:47all right so it dumped it out i'm just
10:48going to go right out to now
10:50now in practice we don't use virus total
10:53for
10:54real work because you know there could
10:56in this root kit there could be
10:58you know customer information exposed or
11:00something like that
11:01so but just for this demo i'm going to
11:03show you that that root kit is really
11:05bad it is something bad
11:06and it doesn't show up on any scans or
11:09anything like that that you do
11:11so we had to actually do the memory dump
11:13to get to this
11:15and then there's the binary so we go
11:17ahead and upload it to virustotal and
11:18let virustotal tell us what it thinks
11:20and of course it comes back and says
11:22backdoor backdoor root kit root kit root
11:24kit
11:24bad bad bad so the point of this is
11:28generally we start in the weeds here but
11:29we knew to do a memory dump we knew to
11:31look for
11:32disparities or differences based on what
11:34the memory said versus what the machine
11:36said itself
11:37all because in the beginning
11:42when we looked at our sim we knew that
11:44something was up
11:45with barbara lazar's vpn sessions
11:48because why
11:49she was doing vpn sessions from
11:51somewhere she'd never done them before
11:54in this case the ukraine and that is
11:56what led us to go take that memory done
11:58so for all of you that always ask me
12:00well how would you know to go to that
12:01machine in the first place
12:03sim sim solutions specifically ones that
12:06are really really good and have great
12:08dashboards that are intuitive like
12:09exit beam is what makes us able to do
12:11that and again
12:13can't take my hats off enough to uh
12:16these sock teams
12:17that actually manage these things and
12:19put these dashboards together
12:20and make it easier for us to shine and
12:22look like the heroes in this industry
12:24so that's what i wanted you to take a
12:25look at thank you hope you enjoyed this
12:27little educational session

About this transcript

This page contains the full transcript of SOC 101: Real-time Incident Response Walkthrough by Exabeam, generated from the public captions YouTube serves with the video. The transcript has 2,280 words across 376 segments, with the original timestamps preserved so you can click any line to jump to that moment in the embedded player.

What you can do with it

Use the transcript to take notes, quote the speaker, build a study guide, generate a summary with ChatGPT or Claude via the YouTube Summary tool, or export it as a timed subtitle file with YouTube to SRT. You can also re-open it in the transcriber to translate the transcript into 100+ languages.

Free YouTube transcript tool

YouTube2Text is a free YouTube transcript generator — no signup, no daily limit. Paste any YouTube link and get the full transcript instantly, with timestamps, click-to-jump, translation to 100+ languages, AI prompts for ChatGPT, Claude, and Gemini, and exports to TXT, SRT, VTT, or Markdown.