[MUSIC PLAYING]
ROB GAILEY: Welcome to the "Google Cloud Security
Showcase," a special web series where
we'll focus on security use cases
that customers can solve with Google Cloud.
My name is Rob, and I'm a Customer Engineer
at Google Cloud.
Today, we'll be walking through one of the top questions we
get from customers--
how do I investigate beaconing malware with Backstory?
Here, we're in Backstory's Enterprise Insights view,
where we have two ways to display the data
you're sending to Backstory.
First, Assets with Alerts, where we take and re-display
the alerts that might come off of a web proxy or a firewall.
Then, we have IOC Domain Matches,
where we take all the data that you send to Backstory and match
it with IOC feeds we bring into the platform in near-real time.
Here, we can see things like an IOC
that was made known of a day ago,
but it was first seen in your environment two years ago.
There's many feeds here.
But today, I'm most interested in what the DHS has to say.
So here, I'll isolate out the US Department
of Homeland Security's EIS feed.
And we notice something interesting--
serverhalflife.com is classified as APT activity.
It's affecting Todd Fields, and it's
been beaconing as recently as 23 minutes ago.
This warrants investigation.
Here, I'll now dive into our Domain view, where
we can, again, see Todd is the only person who's hitting
this domain every single day.
And that wouldn't be weird if it was Google.com or a common news
site.
But here, we also notice that it's
classified as EIS activity, and VirusTotal has some metadata
around it as well.
If I dive into Todd Fields's PC, we now get to our Asset view.
And here, we can see all the activity
that's happening on Todd's machine in a 10-minute window,
about 206 events.
I can now take this and open it up to, say, a four-hour window.
And soon, we'll see the number of events
will grow, just under 4,000 events.
Here, we've got our Timeline view,
where you can see we use a concept of prevalence, where
rare things bubble up to the top and common lookups
fall down to the bottom.
We can take this a step further by filtering out prevalence.
And let's use a score of 10 or less.
Here, this beaconing picture becomes clear.
We can see the domain that we started this investigation
with, serverhalflife.com, beaconing.
And this would continue on until today,
but we also see an interesting amount
of activity happening prior.
If I click here, we can look and see
what's going on with this officerevision lookup.
Here, on the left-hand side, we isolate out
what we call a human readable logline.
We know the time that this event happened, what happened,
a network connection, and where it was to, officerevision.com.
But what's informing this entry is our ability
to do data stitching, where we've taken data from your DNS
provider, your EDR, and your web proxy,
and put it all together to make hunting easy.
But you always have the ability to go back into the raw logs.
I can also look at our Summary view,
which shows the process that actually
made this hostname lookup.
And we can see that it's ghost.exe, probably not
something that we want running on this user's machine.
So from here, I want to see what ghost is doing.
And for that, I can use procedural filtering
to come over and look for the process name.
If I isolate this out, we can now
track everything that the ghost process is doing.
If I expand out the summaries, we
can see that ghost goes to officerevision,
then makes a file called notepad,
then creates a run key to gain persistence,
and then starts to beacon off to revision
a few times before pivoting over to the serverhalflife.com
domain that we see today, currently active.
From here, we have a link that's created,
which will open this up exactly how I have it saved, 13 events,
and highlighting the serverhalflife.com.
I can put this into my case notes.
I can share this with a colleague
and move forward to the next step, which is remediation.
So this is how you would do a quick investigation
of beaconing malware within Backstory.
Thank you for tuning in.
Please visit cloud.google.com/security
for more content from Google Cloud experts.
[MUSIC PLAYING]