You're reading from Effective Threat Investigation for SOC Analysts

Product type Book

Published in Aug 2023

Publisher Packt

ISBN-13 9781837634781

Pages 314 pages

Edition 1st Edition

Languages

Concepts

Cybersecurity

Author (1):

Mostafa Yahia

Table of Contents (22) Chapters

Preface

1. Part 1: Email Investigation Techniques

2. Chapter 1: Investigating Email Threats

3. Chapter 2: Email Flow and Header Analysis

4. Part 2: Investigating Windows Threats by Using Event Logs

5. Chapter 3: Introduction to Windows Event Logs

6. Chapter 4: Tracking Accounts Login and Management

7. Chapter 5: Investigating Suspicious Process Execution Using Windows Event Logs

8. Chapter 6: Investigating PowerShell Event Logs

9. Chapter 7: Investigating Persistence and Lateral Movement Using Windows Event Logs

10. Part 3: Investigating Network Threats by Using Firewall and Proxy Logs

11. Chapter 8: Network Firewall Logs Analysis

12. Chapter 9: Investigating Cyber Threats by Using the Firewall Logs

13. Chapter 10: Web Proxy Logs Analysis

14. Chapter 11: Investigating Suspicious Outbound Communications (C&C Communications) by Using Proxy Logs

15. Part 4: Investigating Other Threats and Leveraging External Sources to Investigate Cyber Threats

16. Chapter 12: Investigating External Threats

17. Chapter 13: Investigating Network Flows and Security Solutions Alerts

18. Chapter 14: Threat Intelligence in a SOC Analyst’s Day

19. Chapter 15: Malware Sandboxing – Building a Malware Sandbox

20. Index

Why subscribe?

21. Other Books You May Enjoy

Investigating PowerShell attacks

In the previous sections, you learned about the PowerShell and Windows event logs that help you investigate suspicious executions with PowerShell. During this section, we will introduce an example of PowerShell attacks and examples of suspicious PowerShell commands and cmdlets, along with their description and purpose, to help you investigate and observe suspicious PowerShell executions.

Fileless PowerShell malware

Fileless malware, also known as memory-based malware, refers to a type of malicious code that runs directly in memory without leaving traces of traditional executable files on the system disk.

An attacker may use a PowerShell cradle to download a malicious PowerShell script and execute it directly in memory to evade writing to the disk and evade being detected by defense mechanisms. The following is an example of a common PowerShell cradle that uses the DownloadString function to download a malicious script from a remote server to...