Malicious Software

Users with administrator rights on servers and/or workstations

Malware techniques and classification

Malicious and suspicious software actions and signs

Heuristic analysis basics

Malware may exist in any place on the computer

Malware is able to steal data in multiple non-trivial ways

It is mandatory
to report all suspicious potential incidents
to Security team

Verification
of existence
or absence of incident related to malware

Using tools ProcessHacker, Autoruns, Fiddler, Gmer for detecting malware

Potentially Unwanted programs
and files (PuPs)

Users with the rights to install additional software, and users who actively evaluate/ open files received from the outside

The basics of statistical and dynamic analysis of the software samples and suspicious documents

Documents (pdf, docx) can contain exploits

Unsigned files can contain malware or riskware

All unsigned executables should be checked for possible infection

Digital signature does not guarantee that the file does not contain malicious functionality

Working with event monitors of systems and sandboxes

Using statistical engines

Removing PuPs

Static (signature) and statistical (virustotal) analysis of the software samples

Using procmon,
to search
for exploits and malicious behavior of software

File analysis with Cuckoo sandbox

Creating scripts malware removal scripts using AVZ

Investigation basics

IT employees involved in the forensic
or incident response activities led

by Security team

Incident Response process, methods of log analysis, specifics of storing digital information

If you suspect a cyber security incident, immediately report
to security team and collect digital evidence

Analysis should be done under supervision of the security team and in co-operation with them

Collecting digital evidence

Netflow traffic analysis

Timeline analysis

Event log analysis

Collecting volatile and non-volatile data (FTK-imager)

Log analysis to find the source and the links of the attack (eventlogexplorer)

Lateral movement investigation by netflow analysis (ntop)

Disk analysis using Autopsy

Phishing and Open source intelligence (OSINT)

IT employees involved in forensic or incident response activities

Modern phishing methods

Methods of email headers analysis

Phishing can be very sophisticated
to discover. Phishing can always be detected by manual investigation

Phishing emails need
to be deleted from user mailboxes

Phishing email analysis and deleting obfuscated phishing emails from users mailboxes

Open source intelligence for understanding what hackers know about your company

Exchange Mailbox Search and removal of the phishing emails

Using Recon-ng for web reconnaissance