#19: Detecting Signs of APT and Malware

Update: 2011-10-17

Description

In all of the cases that I've worked where a malware infection, suspected APT or other security breach had occurred, detectable file remnants were left behind. How can you find them? Can IT audit techniques help?
In this episode we take a look at a super easy technique that allows you to find any type of file or any specific file anywhere within your domain. The script can also be modified to allow you to create an inventory of any other type of file you need to.
For a copy of the script and a longer discussion, please be sure to check the show notes: http://it-audit.sans.org/blog/2011/10/17/detecting-malware-apt-like-threats-domain-wide-file-finder/

Comments

In Channel

#35: Course Notes - 507

2014-07-21--:--

#34: Heartbleed Creates Heartburn

2014-04-1413:45

#33: Analyzing Layer 2 with Wireshark

2014-02-1424:10

#32: Auditing the Cloud!

2013-10-1934:39

#31: Parent Process IDs

2013-10-1413:47

#30: Baselining Services

2013-10-1410:46

#29: Automating Tripwire

2013-10-1420:27

#28: Basic UNIX Scripting

2013-10-1414:53

#27: UNIX: Basic Commands and Usage

2013-10-0817:22

#26: Using the VI Editor

2013-10-0810:40

#25: Building Powershell Modules - Extracting Arbitrary Objects out of Active Directory

2012-03-1520:21

#24: Extracting Last Logon Times from Active Directory using Powershell

2012-03-0528:55

#23: Exploitation Step By Step

2011-11-1601:04:57

#22: Man in the Middle with DNS Spoofing and WPAD - How To

2011-11-0911:36

#21: VisualSniffPerms

2011-11-0804:11

#20: DNS Sinkhole for Malware Defense and Policy Enforcement

2011-11-0210:54

#19: Detecting Signs of APT and Malware

2011-10-1711:01

#18: Detecting APT and Malware through Baseline Auditing

2011-10-1113:14

#17: Man in the middle Web attacks using WPAD

2011-09-3010:41

#16: Hacking Windows User Accounts with Powershell

2011-09-2111:05

00:00

#19: Detecting Signs of APT and Malware

#box-pro-ellipsis-176136303212254{-webkit-line-clamp:2;}#19: Detecting Signs of APT and Malware

#19: Detecting Signs of APT and Malware

david hoelzer

#19: Detecting Signs of APT and Malware