Видео

copy 154[.]35.10[.]113 > go to Firewall Manager > Set the first tab to Egress (Connection going out) > Source IP: Any (Any of our IP in the network) > Paste 154[.]35.10[.]113 to Destination IP > Action: Deny. Essentially we want to deny any connection from our network to 154[.]35.10[.]113.

Glad I could help!

Short answer: trial and error. Long answer: The goal here is to keep those samples from infecting the system/network. The first sample had a very few uniquely identifiable signature. It only gave us 3 hashes in different formats (MD5, SHA1, and SHA256). I used the MD5 hash to include it in the block list, but it's ok if you use other hash formats and input them into the block list, this is called signature based detection. However, blocking hashes is the most basic form of malware detection; a single character change within the sample can completely alter the string of hashes, rendering a manual hash block list sub optimal. That's why the room forces us to use other methods with other samples to create better endpoint detection and response, which applies a heuristic-based method to identify the pattern/behavior of the malware. Utilizing both methods of detection will create a more comprehensive/optimal response. Sigma rules are one real-life application of malware detection that you will encounter deeper into the learning path, such as SOC level II. Hope this helps! Thanks for watching.

Happy to help!

LOL no, I don't want Mr. Tim Apple and Steve Macbook to haunt me in my sleep.