Most common cyberattack techniques of 2020

The video discusses the 2021 threat detection report by Red Canary, highlighting the top ten threat techniques, many of which involve 'living off the land' attacks using existing tools like PowerShell. It emphasizes the importance of establishing a baseline of normal system behavior to detect anomalies. Key threats include signed binary process executions, system process modifications, scheduled tasks, credential dumping, and more. The video recommends using sysmon for logging and monitoring, and stresses the need for off-site log storage to prevent attackers from clearing logs.

What does the 'living off the land' technique involve?

• Utilizing existing tools and software on a system

• Bringing external hardware for attacks

• Developing custom malware for each attack

• Using new tools to attack a system

Which tool is recommended for logging and detecting unusual activities on a system?

• Event Viewer

• Registry Editor

• Sysmon

• Task Manager

What percentage of threats came from signed binary process executions?

• 16%

• 7%

• 19%

• 24%

Which event IDs should be reviewed for system process modifications?

• 4697, 7045, 4688

• 32, 64, 128

• 106, 140, 4697

• 10, 7, 7045

What is a common method attackers use for credential dumping?

• Exploiting LSASS with tools like procdump and mimikatz

• Modifying system services

• Using PowerShell scripts

• Renaming system utilities

What is a sign that an attacker might be using ingress tool transfer?

• BITS or bitsadmin running unexpectedly

• Unusual network traffic

• Frequent system reboots

• High CPU usage

What does masquerading involve in the context of cyber threats?

• Encrypting data to prevent access

• Renaming system utilities to mimic legitimate files

• Installing unauthorized software

• Using social engineering to gain access