CyberOps Skills Assessment

CCNA Cybersecurity Operations
Open University - Skills Assessment

Introduction
Working as the security analyst for ACME, you notice a number of events on the SGUIL dashboard.
Your task is to analyze these events, learn more about them, and decide if they indicate malicious
activity.
You will have access to the Internet to discover more about the events. Security Onion is the only VM
with Internet access in the Cybersecurity Operations virtual environment. You may use any reasonable
research method at your disposal. The tasks set out in this assessment are designed to provide some
guidance through the analysis process.
You will practice and be assessed on the following skills:

o Evaluating Snort/SGUIL events.
o Using SGUIL as a pivot to launch ELSA, Bro and Wireshark for detailed event
inspection.
o Using independent research to obtain intelligence on a potential exploit.
Content for this assessment was obtained from http://www.malware-traffic-analysis.net/ by Cisco and is
used with permission.
For each stage of this assessment, you must provide evidence - this may be a copy/paste of
file/log information, a screenshot and a short single sentence explanation of how you find the evidence.
You will decide what evidence is appropriate. There are 28 steps that must be completed - not all steps
require evidence. You must download and edit this document.
Addressing Table
The following addresses are preconfigured on the network devices. Addresses are provided for
reference purposes:
Device Interface Network/Address Description
eth0 192.168.0.1/24 Interface connected to the Internal Network

Security Onion VM Interface connected to the External
eth2 209.165.201.21/24 Networks/Internet
© Cisco and/or its affiliates. All rights reserved. This document is Cisco Public - with modifications from Open University Page 1 of 5
Skills Assessment CCNA Cybersecurity Operations
Gathering Basic Information

1. Log into Security Onion VM (saved in the same location as this document) with username analyst and
password cyberops.
2. Open a terminal window. Enter the sudo service nsm status command to verify that all the services and
sensors are ready.
3. When the nsm service is ready, log into SGUIL with the username analyst and password cyberops.
Click Select All to monitor all the networks. Click Start SQUIL to continue.
4. In the SGUIL window, identify the group of events that are associated with exploit(s). This group of events
are related to a single multi-part exploit. How many events were generated by the entire exploit?
11 event messages
5. According to SGUIL, when did the exploit begin? When did it end? Approximately how long did it take?
Start – 2017/09/07 15:31:12,
End – 2017/09/07 15:31:34,
Duration – 22 seconds
6. What is the IP address of the internal computer involved in the events?
192.168.0.12
7. What is the MAC address of the internal computer involved in the events? How did you find it?
____________________________________________________________________________________
8. What are some of the Source IDs of the rules that fire when the exploit occurs? Where are the Source IDs
from?
____________________________________________________________________________________
9. Do the events look suspicious to you? Does it seem like the internal computer was infected or
compromised? Briefly explain.
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
10. What is the operating system running on the internal computer in question?
____________________________________________________________________________________
Learn About the Exploit

11. According to Snort, what is the exploit kit (EK) in use?
____________________________________________________________________________________
12. What is an exploit kit?
____________________________________________________________________________________
13. Do a quick Google search on ‘Angler EK’ to learn a little about the fundamentals the exploit kit.
Summarize your findings and record them here.
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
14. How does this exploit fit the definition on an exploit kit? Give examples from the events you see in SGUIL.
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
15. What are the major stages in exploit kits?
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
Determining the Source of the Malware

16. In the context of the events displayed by SGUIL for this exploit, record below the IP addresses involved.
___________________________________________________________________________________
___________________________________________________________________________________
___________________________________________________________________________________
17. The first new event displayed by SGUIL contains the message “ET Policy Outdated Flash Version M1”.
The event refers to which host? What does that event imply?
___________________________________________________________________________________
18. According to SGUIL, what is the IP address of the host that appears to have delivered the exploit?
____________________________________________________________________________________
19. Pivoting from SGUIL, open the transcript of the transaction. What is the domain name associated with the
IP address of the host that appears to have delivered the exploit?
____________________________________________________________________________________
20. This exploit kit typically targets vulnerabilities in which three software applications?
____________________________________________________________________________________
21. Based on the SGUIL events, what vulnerability seems to have been used by the exploit kit?
____________________________________________________________________________________
22. What is the most common file type that is related to that vulnerable software?
____________________________________________________________________________________
23. Use ELSA to gather more evidence to support the hypothesis that the host you identified above delivered
the malware. Launch ELSA and list all hosts that downloaded the type of file listed above. Remember to
adjust the time frame accordingly.
Were you able to find more evidence? If so, record your findings here.
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
24. At this point you should know, with quite some level of certainty, whether the site listed discovered earlier
delivered the malware. Record your conclusions below.
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
Analyze Details of the Exploit

25. Exploit kits often rely on a landing page used to scan the victim’s system for vulnerabilities and exfiltrate a
list of them. Use ELSA to determine if the exploit kit in question used a landing page. If so, what is the
URL and IP address of it? What is the evidence?
Hint: The first two SGUIL events contain many clues.

____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
26. What is the domain name that delivered the exploit kit and malware payload?
___________________________________________________________________________________
27. What is the IP address that delivered the exploit kit and malware payload?
___________________________________________________________________________________
28. Pivoting from events in SGUIL, launch Wireshark and export the files from the captured packets as was
done in a previous lab. What files or programs are you able to successfully export?
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________
____________________________________________________________________________________

CyberOps Skills Assessment

Uploaded by

Copyright:

Available Formats

CyberOps Skills Assessment

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

CyberOps Skills Assessment

Uploaded by

Copyright:

Available Formats

What type of exploit was used in this incident?

What vulnerability was exploited?

CCNA Cybersecurity Operations

Open University - Skills Assessment

You will practice and be assessed on the following skills:

Device Interface Network/Address Description

eth0 192.168.0.1/24 Interface connected to the Internal Network

Gathering Basic Information

Learn About the Exploit

Determining the Source of the Malware

Analyze Details of the Exploit

Hint: The first two SGUIL events contain many clues.

You might also like