Sources of Identification

To effectively identify incidents, a variety of sources should be monitored and correlated, including:

• Intrusion Detection Systems (IDS)/Intrusion Prevention Systems (IPS): These systems analyze network traffic for signatures of known attacks or anomalous behavior. There are two types:
  • Signature-based detection: Looks for patterns that match known attacks, e.g., Snort rules.
  • Anomaly-based detection: Detects unusual network or system behavior by comparing it to established baselines.
• Log Analysis: Centralized logging tools like SIEM (Security Information and Event Management) systems aggregate logs from firewalls, servers, and network devices to flag unusual activity, such as:
  • Repeated login failures (indicating brute force attempts).
  • Unusual access times or access from geographically suspicious locations.
  • Privilege escalation in logs (user switching to root/admin unexpectedly).
• Endpoint Detection and Response (EDR): This involves monitoring host systems for suspicious activities, such as:
  • Memory injections.
  • Processes being spawned by unknown binaries.
  • Unexpected file changes.
• Network Traffic Analysis (NTA): Tools like Wireshark or Zeek analyze network traffic, looking for anomalies such as:
  • Sudden spikes in traffic (indicating DoS or DDoS attacks).
  • Traffic leaving to known malicious IP addresses.
  • Suspicious command-and-control traffic from malware.
• Alerts from Third-Party Services: Threat intelligence feeds provide up-to-date information on emerging threats. This includes IPs, URLs, or domains associated with known attacks, which can be correlated against internal logs.

Types of Indicators

• Indicators of Compromise (IOCs): IOCs are forensic data points that help to identify potentially compromised systems or malicious activity. Common types of IOCs include:
  • File Hashes: MD5, SHA256, etc., of known malware.
  • IP Addresses: Known malicious IPs that are associated with attack campaigns.
  • Domain Names: Domains related to phishing campaigns, malware, or C2 infrastructure.
  • Behavioral Indicators: Processes or actions on a host that deviate from the norm (e.g., PowerShell execution with encoded commands).
  • Registry Keys/Changes: Malware often modifies system settings, such as adding persistence mechanisms in the Windows Registry.
• Indicators of Attack (IOA): These are signs that a malicious actor is in the process of executing an attack but has not yet caused damage. Examples include:
  • Scanning for open ports or vulnerable services.
  • Attempted lateral movement within the network (e.g., unusual SMB or RDP traffic).
  • Attempts to exploit vulnerabilities (e.g., seeing buffer overflow attempts in server logs).

Correlation and Contextualization

• Contextual Analysis: During identification, the incident handler must contextualize the detected activity. For instance, a single failed login attempt might not be alarming, but hundreds of failed attempts over a short period (especially from the same IP) could indicate a brute-force attack.
• Baselining: Organizations should develop baselines of normal network traffic and system behavior. Deviations from this baseline can serve as a strong indicator of a potential incident. For example, if a normally dormant server starts transmitting large amounts of data externally, it could be a sign of data exfiltration.
• False Positives: Not all flagged activities are legitimate incidents. For example, security scans or vulnerability assessments performed by internal teams may resemble real attacks in their patterns. One of the key skills in the identification phase is differentiating these false positives from true incidents by correlating the activity with other data points (e.g., was the scanner IP internal, or did the activity come from an unknown external source?).

Threat Categorization

Once an event is flagged, it needs to be categorized based on the threat type. This helps prioritize the response effort. Common categories include:

• Malware Infection: Indicated by unexpected processes, file modifications, or alerts from endpoint protection systems.
• Unauthorized Access: Signs include abnormal login attempts, privilege escalation, or unusual lateral movement.
• Denial of Service (DoS): Characterized by overwhelming traffic or service downtime.
• Data Exfiltration: Outbound traffic spikes, especially to suspicious IPs, are red flags for data theft.
• Phishing: Identified through emails containing suspicious links or attachments, or from user reports.

Incident Severity and Impact Assessment

Once a potential incident has been identified, it needs to be classified based on its potential impact and severity. Some factors to consider include:

• Scope: How many systems are affected? Is it isolated to a single endpoint or spreading laterally across the network?
• Data Sensitivity: Is the compromised system handling critical or sensitive data, such as customer information, intellectual property, or financial data?
• Operational Impact: Will the incident lead to system downtime, service outages, or other operational disruptions?
• Threat Actor: Is the attacker an insider or an external actor? Do the IOCs suggest this is part of a known APT (Advanced Persistent Threat) campaign?
• Reputation Impact: Does the incident have the potential to harm the organization’s reputation (e.g., through publicized data breaches)?

Classifying the incident as low, medium, or high priority ensures that resources are allocated appropriately during the response phase.

Triage

Triage involves deciding which incidents should be dealt with immediately and which can be addressed later. This is usually done based on:

• Urgency: How quickly the incident needs to be handled to prevent damage.
• Impact: The potential damage or risk if the incident is not dealt with in a timely manner.

Triage is an ongoing process during the identification phase because new information may come in that changes the priority of an incident. For example, what seems like a minor malware infection could evolve into a large-scale ransomware outbreak.

Automation and Playbooks

To speed up the identification process, many organizations implement automated responses and predefined playbooks. For example:

• SOAR (Security Orchestration, Automation, and Response) systems can be configured to automatically respond to certain types of alerts by, for instance, isolating a compromised endpoint or blocking malicious IP addresses.
• Incident Response Playbooks: Predefined workflows that guide incident handlers through standardized response procedures. For example, a playbook for ransomware might include steps like isolating infected machines, preserving evidence, and blocking the C2 servers.

Common Identification Challenges

• Stealthy Attacks: Advanced attackers, particularly those using APT techniques, often use subtle and stealthy methods (e.g., living off the land techniques) to evade detection. Monitoring native tools (e.g., PowerShell, WMI) for unusual behavior becomes crucial.
• Volume of Alerts: Organizations can often be overwhelmed by the sheer number of alerts, making it difficult to identify the most critical ones without effective prioritization and correlation.
• Zero-Day Attacks: These attacks use previously unknown vulnerabilities, making them hard to detect with signature-based tools. In these cases, anomaly detection, behavioral analysis, and heuristic methods become vital.

Conclusion

The Identification phase is about accurately detecting and classifying potential security incidents based on a wide array of data sources and indicators. This phase sets the stage for the response actions that follow, and if done correctly, can significantly reduce the time and damage caused by a security breach.