Reference no: EM133793909

IOC Exercise

Overview:

In the exercise you will review several artifacts provided to you that are suspicious and could be IOCS. You need to analyze each artifact and determine if it should be isolated or cleared for general use by your organization.

Be sure you have completed the previous exercises using Alient Vault OTX, Cisco Talos, Nmap, Maltego, Virus Total and Google Dorks as you should use one of more of these tools to address and analyze each of the artifacts and questions.

Use the Advanced Cyber Threat Intelligence Report Template to record your results. Note, your results will most likely be different from other students and from the screenshots shown in this document.

Exercise Steps:

1. Answer the questions found in section 4 of the Advanced Cyber Threat Intelligence Report

A department in your organization has asked permission to have access to several web sites that currently appear to be blocked. The sites include: mars.umgc.edu, linuxhint.com, financereports.co, creativebookmark.com. Use Threat Intelligence tools to make a recommendation for each site. Be sure to justify using data and screenshots from the tools your decision.

An employee in your organization has had issues with their computer and is concerned if they may have a virus. Several files were uploaded to a safe sandbox for processing and analysis. The following SHA-256 hashes were submitted. Use appropriate tools to determine if any of the files should be quarantined.

For any hashes that are flagged as malware or malicious, provide more details to include a description of the specific threat, the virus or threat name, and the most recent attack date.

Your IT staff is short-staffed and need some assistance generating SHA-256 hashes for several files. This work is to verify the safety of the files in terms of malware but also for downloads processes so those using your organization's data can confirm the hashes are identical.

After you generate the SHA-256 hashes, use a threat intelligence tool to verify there are no issues with malware.
For your report, list the SHA-256 results for each file along with a note stating if any issues were reported from the hash analysis. Provide screenshots verifying your malware analysis for each hash analysis.

Finally, in 4-6 paragraphs summarize your experience using threat intelligence tools. From your experience, discuss strengths and weaknesses for each tool used. Discuss your future envisioned use and tools that might be considered. For example, does it make sense to invest in commercial threat intelligence tool that uses multiple OS-INT and other sources, providing real-time alerts and visualization capabilities? If so, which tools might be good choices and why?

Cisco Talos Exercise
Overview:
In the exercise you will conduct some specific activities using the Cisco's Talos Threat Intelligence web site. After completion, you will be comfortable navigating the tool and categorizing emails from locations across the world.

Use the Advancec Cyber Threat Intelligence Report Template to record your results. Note, your results will most likely be different from other students and from the screenshots shown in this document.