Time
8 hours 28 minutes
Difficulty
Beginner
CEU/CPE
10

Video Transcription

00:00
hello and welcome to another application of the minor attack framework discussion today. We're looking at data compressed data compression as a means for moving information outside of the organization. Ex filtration. So
00:16
the objectives of today's discussion are to look at the term data compressed within the context of the matter attack framework,
00:23
some mitigation techniques and some detection techniques as well. So let's go ahead and jump right in. So data compressed in minor is when a threat actor will compress data that is collected prior to ex filtration To minimize the amount of data sent over the network,
00:40
it could be done with custom programs or common compression vintage such a seven zip rar, zip and Z lib.
00:47
All of these you should likely or would likely be aware of in just kind of general use cases. Now, mitigation techniques is what we're jumping right into. From that standpoint,
00:59
we can use that work intrusion prevention, the block specific file types. We can also block those file types, maybe through other means, such as our firewall or our mail gateway,
01:08
and keep them from leaving the network over unencrypted channels. Now a threat actor may use attempts other attempts to bypass that, such as encrypting the channel in which they are sending traffic out unless your devices can decrypt traffic and they have that capability, which is generally painful to set up. But it could be something that you're doing.
01:27
It may not see those final types being sent out of the network.
01:33
Now.
01:34
Detection techniques here are again going back to monitoring from command line arguments and other activities dealing with compression utilities. There is a normal use case for these and day to day business activity, but it never hurts to have some mechanism set up to especially evaluate that from a command line standpoint. Because general users
01:53
day to day users aren't going to be doing that. The command line, they're going to be doing it through
01:57
the utility itself. Now with that, let's do a quick check on learning true or false data. Compression is when the Threat actor encrypts information to make the payload smaller.
02:10
All right, well, if you need additional time, please pause this video so data compression is not. When a threat actor encrypt information to make the payload smaller. It's when they compress the information to make the information smaller to make the data set smaller so that they can more easily send it outside of the network.
02:29
So this is a false statement as it is written.
02:32
So with that in mind, let's jump into our Some referred today's discussion. We described and looked at data compressed as it is written in the minor attack framework. We looked at mitigation techniques and we talked detection techniques. Aziz, Well, again, some of these activities a little bit harder to find and note
02:52
eso really taking
02:53
some controls above and beyond our standard things like antivirus network intrusion, prevention to kind of combat, some of the sneaky ways that threat actress will attempt to remove information from our environment. So with that in mind, I want to thank you for your time today, and I look forward to seeing you again soon.

Up Next

Application of the MITRE ATT&CK Framework

This MITRE ATT&CK training is designed to teach students how to apply the matrix to help mitigate current threats. Students will move through the 12 core areas of the framework to develop a thorough understanding of various access ATT&CK vectors.

Instructed By

Instructor Profile Image
Robert Smith
Director of Security Services at Corsica
Instructor