Investigating External Threats

An attacker may gain initial access to the target environment by exploiting one of the published web applications or by using valid credentials such as an RDP, VPN, mailbox, and web services credentials. After successful exploitation, the threat actor will have the opportunity to control the whole environment and achieve their objectives, such as disrupting the digital life, espionage, or exfiltrating the data. As an SOC analyst, you should be aware of this and take advantage of the logs provided by the Web Application Firewall (WAF), firewalls, IPS logs, and custom applications logs to investigate such threats.

The objective of this chapter is to learn about some of the most common web attacks, such as code injection, SQL injection, path traversal, and cross-site scripting attacks, and how to investigate web application threats by analyzing the WAF logs. We will also learn how to detect and investigate suspicious external access to remote services...

Investigating web attacks

To gain initial access to a victim’s environment, the attacker may exploit a web application flaw or vulnerability such as command injection, SQL injection, Cross-Site Scripting (XSS), and path traversal vulnerabilities. We’ll look at all four vulnerabilities in this section.

The command injection vulnerability

Some web applications are designed to take input from users and then process it by invoking a shell to run a program to handle the input. An attacker may take advantage of this process and inject a command in their web request inputs to be executed on a vulnerable application. To do so, attackers usually use the ; character at the end of the normal input to be able to add their own injected command (see Figure 12.1):

Figure 12.1 – Command injection flaw exploitation

To exploit and validate a command injection flaw in a web application, attackers often employ commands designed to redirect traffic...

Investigating suspicious external access to the remote services

An attacker may gain initial access to a victim’s environment by exploiting an external-facing remote service, such as the Virtual Private Network (VPN), Remote Desktop Protocol (RDP), and Outlook on the Web (OWA), or even by obtaining valid credentials to customer services such as an Internet Banking (IB) service. To do so, attackers usually obtain valid account credentials in several ways, such as the following:

• Purchasing legitimate credentials from another attacker, via underground channels, who had previously compromised the same victim. These attackers are called initial access brokers. In this case, the attackers (the initial access brokers) will first compromise a victim’s computer using a variety of methods, such as phishing emails or drive-by downloads. Once they have access to the victim’s computer, they will steal the victim’s RDP or VPN credentials, including their username...

Summary

In this chapter, we discussed some of the most common web attacks, such as code injection, SQL injection, path traversal, and XSS attacks, and how to investigate web application threats by analyzing WAF logs. Also, we discussed how to detect and investigate suspicious external access to remote services such as the VPN, RDP, mailboxes, and web services.

In the next chapter, we will learn how to investigate network device flows and security solutions alerts.