|
término |
definición |
|
empezar lección
|
|
|
|
|
|
empezar lección
|
|
|
|
|
|
empezar lección
|
|
|
|
|
Netstat all executable files running running processes empezar lección
|
|
|
|
|
basic info about processes empezar lección
|
|
|
|
|
|
empezar lección
|
|
|
|
|
chcek service for any malicious programm installed empezar lección
|
|
|
|
|
|
empezar lección
|
|
net sessions; logonsessions
|
|
|
|
empezar lección
|
|
|
|
|
|
empezar lección
|
|
|
|
|
netstat TCP and UDP including ports empezar lección
|
|
|
|
|
|
empezar lección
|
|
|
|
|
|
empezar lección
|
|
icmp. type==8; icmp. type==0; tcp. dstport==7; udp. dstport==7
|
|
|
|
empezar lección
|
|
|
|
|
|
empezar lección
|
|
|
|
|
|
empezar lección
|
|
|
|
|
|
empezar lección
|
|
C\users\user_name\AppData\local\Mozilla\Firefox\Profiles\XXXdefault\cache: cookies. sqllite, fomhistory. sqllite
|
|
|
|
empezar lección
|
|
C\users\user_name\AppData\local\google\chrome\user data\default\cache: Profile 1(cookies): Default(history)
|
|
|
|
empezar lección
|
|
C\users\Admin\AppData\local\microsoft\windows\INetCache:\AC\MsEdge(cookies): History
|
|
|
|
empezar lección
|
|
c: programfiles\MSsqlServer\MSsql12...\MSSQL\LOG\EROR LOG: log_n. trc (open with notepad)
|
|
|
function that allows retrival of the active portion of the transaction log file empezar lección
|
|
|
|
|
|
empezar lección
|
|
SENDMAIL - log - /var/log/maillog - most linux. /var/adm/maillog Solaris. /var/log/mail. log Debian/Ubuntu
|
|
|
Microsoft Exchange Email Server Log empezar lección
|
|
Microsoft Exchange Email Server Log -. edb database files,. stm, checkpoint files, temp files
|
|
|
|
empezar lección
|
|
access locate times - dir command, ls command
|
|
|
Collecting volatile info: open files empezar lección
|
|
Collecting volatile info: open files - "net file", psFile utility, OpenFiles command
|
|
|
Collecting volatile info: clopboard empezar lección
|
|
Collecting volatile info: clopboard - Free Clopboard Viewer
|
|
|
Collecting volatile info: Service/Driver info empezar lección
|
|
Collecting volatile info: Service/Driver info - tasklist, wmic
|
|
|
Collecting volatile info: logged on users empezar lección
|
|
Collecting volatile info: logged on users - PsLoggedOn, netsessions, LogonSessions
|
|
|
Logged on users PsLoggedOn empezar lección
|
|
Logged on users PsLoggedOn - "-l"-only local logons, "-x"-doesnt display times
|
|
|
Logged on users LogonSessions empezar lección
|
|
Logged on users LogonSessions: "-c"-CSV, "-ct"-prints as tab, "-p"-processes list
|
|
|
Collecting volatile info: DLL and shared libraries empezar lección
|
|
Collecting volatile info: DLL and shared libraries: ListDLL(win) "-r"-relocated "-u"-unsigned DLL, "-r"-DLL version. Ldd/ls(linux)
|
|
|
|
empezar lección
|
|
Nbstat: "-c"-NetBIOS name-to-IP mapping, "-n"-names registered locally, "-r"-names resolved by broadcast and querying, "-s"-current NetBIOS sessions and statuses
|
|
|
netstat listening connections empezar lección
|
|
|
|
|
netstat ethernet statistics - number of bytes, packets empezar lección
|
|
|
|
|
|
empezar lección
|
|
Malware is the most common threat
|
|
|
port monitoring command and tool empezar lección
|
|
port monitoring command and tool - netstat, TCPView
|
|
|
|
empezar lección
|
|
registry monitoring tool - jv16 Power tools 2017
|
|
|
windows service monitoring empezar lección
|
|
windows service monitoring - windows server manager (SrvMan)
|
|
|
startup programs monitoring empezar lección
|
|
startup programs monitoring - Autoruns for Windows
|
|
|
Perform string search tool empezar lección
|
|
Perform string search tool - BinText
|
|
|
identyfing packing/obfuscation methotds tool empezar lección
|
|
identifying packing/obfuscation methotds tool - PEiD
|
|
|
intrusion analysis: covert communication tools: empezar lección
|
|
intrusion analysis: covert communication tools: SSDT View, ReKall, RougeKiller
|
|
|
Detect packet sniffing: MAC flooding empezar lección
|
|
Detect packet sniffing: MAC flooding - from various IP to single with same TTL (malformed packets)
|
|
|
Detect packet sniffing: ARP poisoning empezar lección
|
|
Detect packet sniffing: ARP poisoning - filter: arp. duplicate-address-detected, Xarp tool
|
|
|
Machine generating ... will be most likely running a sniffer empezar lección
|
|
Machine generating REVERSE DNS LOOKUP TRAFFIC will be most likely running a sniffer
|
|
|
check if host has its network card in promiscuos mode empezar lección
|
|
check if host has its network card in promiscuous mode - nmap -script = sniffer-detect [IP]
|
|
|
Detects potentially malicious elements within HTML: empezar lección
|
|
Detects potentially malicious elements within HTML: tags like <FK>, , <BR>, <DIV> and background-image, <script>, <object>, <applet>, <enabled>
|
|
|
|
empezar lección
|
|
Apache web server logs: /var/log/'apache2/access. log - useful with Local File Injection LFI detection
|
|
|
command line tool to locate connected devices empezar lección
|
|
command line tool to locate connected devices: DevCon(windows)
|
|
|
|
empezar lección
|
|
Behavioral analysis: 1) extract behavioral patterns 2) compare to other users 3) generated clusters based on behav simmilarity 4) build profiles of each group 5) discover outliners of each group
|
|
|
