Cybersecurity Threat Intelligence and Analysis.pdf

CYBERSECURITY THREAT INTELLIGENCE AND ANALYSIS

1 1. MALWARE ANALYSIS TECHNIQUES

Problem 1. A cybersecurity analyst is analyzing a malware sample and discovers that the

malware contains a function that encrypts files using a simple XOR operation. The key used for

encryption is a single byte, represented in hexadecimal as

0x2A

. The analyst decrypts a sample

file and discovers that the first byte of the decrypted file is

0x45

Given the above information, determine the original byte that was encrypted using XOR with

the key

0x2A

Solution 1. Let the original byte be represented as X. The decryption process using XOR can

be expressed as:

X⊕0x2A= 0x45

Converting the hexadecimal values to binary:

X= 01000101

0x2A= 00101010

0x45 = 01000101

Now, perform XOR operation to find the original byte X:

X⊕0x2A= 01000101 ⊕00101010 = 01101111

Therefore, the original byte that was encrypted using XOR with the key

0x2A

0x6F

, which is

equivalent to decimal value 111.

I. BEHAVIORAL ANALYSIS OF CYBER THREATS

Problem 1. A security analyst is examining the network traffic logs of a company and notices an

unusual spike in traffic volume from a specific IP address during non-business hours. The analyst

suspects this could be a potential threat activity. The average number of packets per second from

this IP address on weekdays is 500, with a standard deviation of 50, while on weekends it is 700

with a standard deviation of 70. The analyst wants to determine if the spike in traffic volume on a

particular day is statistically significant.

a) Calculate the z-score for the spike in traffic volume if on that day the number of packets per

second from the IP address was 800. b) Determine whether this spike in traffic volume is statistically

significant at a significance level of 0.05.

Solution 1. a) The z-score is calculated using the formula:

z=(X−µ)

where: - X is the observed value (number of packets per second on the particular day), - µis the

mean number of packets per second, - σis the standard deviation.

For weekdays:

zweekday =800 −500

50 =300

50 = 6

For weekends:

zweekend =800 −700

70 =100

70 ≈1.43

b) To determine if the spike in traffic volume is statistically significant, we compare the z-score to

the critical z-value at a significance level of 0.05. The critical z-value can be found using a standard

normal distribution table or calculator.

For a significance level of α= 0.05, the critical z-value is approximately 1.96.

Since the z-score for weekdays is 6 and for weekends is 1.43, the spike in traffic volume on

weekdays is statistically significant as the z-score is much higher than the critical z-value. However,

the spike in traffic volume on weekends is not statistically significant at α= 0.05.

2 3. THREAT INTELLIGENCE FEED MANAGEMENT

Problem 3. An organization subscribes to three different threat intelligence feeds, labeled A, B,

and C. Feed A provides 150 indicators per day, Feed B provides 200 indicators per day, and Feed

C provides 100 indicators per day. The organization’s threat analyst can investigate a maximum

of 400 indicators per day. If the analyst wants to ensure they can investigate all indicators from

at least two feeds each day, how many days can they subscribe to all three feeds before reaching

their maximum investigation capacity?

Solution 3. Let xrepresent the number of days the organization can subscribe to all three

feeds before reaching their maximum investigation capacity.

The total number of indicators that can be investigated in xdays from Feed A is 150x, from

Feed B is 200x, and from Feed C is 100x.

To ensure the analyst can investigate all indicators from at least two feeds each day, we must

consider the worst-case scenario where the analyst investigates all indicators from Feeds A and B

one day and all indicators from Feeds A and C or B and C the other day.

So in xdays, the total number of indicators from Feeds A and B would be 150x+ 200x= 350x,

and the total number of indicators from Feeds A and C or B and C would be 150x+ 100x= 250x.

According to the problem, the analyst can investigate a maximum of 400 indicators per day, so

350x≤400 and 250x≤400.

Solving these inequalities, we find:

350x≤400

x≤400

350

x≤1.14

Answer: The analyst can subscribe to all three feeds for at most 1 day before reaching their

maximum investigation capacity.

3 4. INCIDENT RESPONSE STRATEGIES

Problem 4. A cybersecurity analyst is investigating a security incident involving a phishing email

campaign targeting employees in a company. The analyst has identified multiple compromised

endpoints that were used to exfiltrate sensitive data. The analyst needs to prioritize which endpoints

to investigate first based on the severity of the incident.

The analyst assigns a severity score to each compromised endpoint based on the volume of

data exfiltrated, the sensitivity of the data, and the criticality of the endpoint to the company’s

operations. The severity scores for the compromised endpoints are as follows:

•Endpoint A: 8

•Endpoint B: 6

•Endpoint C: 9

•Endpoint D: 5

a) Calculate the average severity score of the compromised endpoints.

b) Rank the compromised endpoints in descending order of severity score.

Solution 4. a) To calculate the average severity score of the compromised endpoints, we sum

up all the severity scores and divide by the total number of compromised endpoints.

Average severity score =8+6+9+5

=28

= 7

Therefore, the average severity score of the compromised endpoints is 7.

b) Ranking the compromised endpoints in descending order of severity score:

1. Endpoint C: 9

2. Endpoint A: 8

3. Endpoint B: 6

4. Endpoint D: 5

Thus, the compromised endpoints should be investigated in the following order: Endpoint C,

Endpoint A, Endpoint B, Endpoint D.

4 5. OPEN SOURCE INTELLIGENCE GATHERING

Problem 5. An analyst is conducting open source intelligence gathering on a suspicious IP

address. The analyst discovers the following information from various sources:

- IP address: 192.168.1.100 - Domain associated: example.com - Country: United States -

Last seen activity: 2 days ago - Number of known vulnerabilities: 5 - Reputation score: 7/10

a) If the analyst wants to conduct a WHOIS lookup on the domain "example.com", what infor-

mation can they potentially gather?

b) Based on the reputation score of 7/10, assess the level of trustworthiness of this IP address.

c) What could be a potential next step for the analyst to gather more information about this IP

address?

Solution 5.

a) A WHOIS lookup on the domain "example.com" can potentially provide the following infor-

mation:

- Registrar information - Creation and expiration date of the domain - Name and contact details

of the domain owner - Domain status (e.g., active, inactive) - Name servers associated with the

domain - Domain registration history

b) The reputation score of 7/10 indicates a relatively good reputation for this IP address. How-

ever, it is important to consider other factors such as the nature of known vulnerabilities and the

type of activities associated with the IP address for a more comprehensive assessment of trust-

worthiness.

c) A potential next step for the analyst could be to conduct a port scan on the IP address to

identify open ports and services running on the system. This can provide insights into potential

vulnerabilities or services that may be exploited by threat actors. Additionally, the analyst could

also search for any mentions of this IP address in threat intelligence feeds or forums to uncover

any malicious activities associated with it.

5 6. ATTRIBUTION OF CYBER ATTACKS

Problem 6. Suppose a cybersecurity analyst has gathered the following data on a recent cyber

attack:

- The attack originated from an IP address: 192.168.10.15 - The attack utilized a specific mal-

ware variant known as "CrimsonRAT" - The attack had similarities to previous attacks attributed to

a threat actor group called "DarkNetHackers" - The attacker left a signature code inside a compro-

mised system: 0x3A7B9F25

Based on this information, the cybersecurity analyst suspects that the DarkNetHackers group is

behind this attack. To confirm this suspicion, the analyst decides to delve deeper into the attribution

analysis.

a) Analyze the signature code 0x3A7B9F25 by converting it to binary form and identifying any

patterns or indicators.

b) Research and provide three possible attribution techniques the analyst could use to further

investigate and attribute the cyber attack to the DarkNetHackers group.

c) Discuss the importance of corroborating evidence and multiple attribution techniques in the

process of attribution analysis.

Solution 6. a) To analyze the signature code 0x3A7B9F25, we need to convert it to binary

form:

0x3A7B9F25 in binary form is 00111010111110111001111100100101.

By analyzing the binary representation, the analyst can look for specific patterns or indicators

that may link this signature code to known patterns associated with the DarkNetHackers group.

b) Three possible attribution techniques the analyst could use are: 1. Technical Analysis:

This involves analyzing the attack vector, malware used, command and control infrastructure, and

any other technical aspects to identify similarities with previous attacks attributed to DarkNetHack-

ers. 2. Open Source Intelligence (OSINT): Researching publicly available information, such as

forums, social media, and dark web sources, to gather intelligence on DarkNetHackers’ activities

and tactics. 3. Behavioral Analysis: Studying the behavior of the attackers, including their TTPs

(Tools, Techniques, and Procedures) and modus operandi, to match them with known behaviors

of DarkNetHackers.

c) Corroborating evidence and using multiple attribution techniques are crucial in attribution

analysis. By cross-referencing findings from different techniques, the analyst can reduce the risk

of misattribution and increase the confidence in attributing the cyber attack to a specific threat actor

group. Different techniques provide different perspectives, allowing for a more comprehensive and

accurate attribution assessment.

6 7. NETWORK TRAFFIC ANALYSIS

Problem 7. An organization’s network traffic has been monitored and suspicious activity has

been detected. The following data shows the number of packets sent in each of 5 intervals:

Interval Number of Packets

1 200

2 450

3 300

4 600

5 700

a) Calculate the average number of packets sent per interval.

b) Determine the standard deviation for the number of packets sent.

c) Identify any intervals that have significantly higher or lower packet counts compared to the

average.

Solution 7. a) To calculate the average number of packets sent per interval, we sum up the

number of packets sent in each interval and divide by the total number of intervals:

Average number of packets = 200+450+300+600+700

5=2250

5= 450 packets

b) To determine the standard deviation, we first need to calculate the variance. The variance

is computed by finding the mean of the squared differences from the average, and the standard

deviation is the square root of the variance.

Variance = (200−450)2+(450−450)2+(300−450)2+(600−450)2+(700−450)2

=(−250)2+0+(−150)2+1502+2502

=62500+0+22500+22500+62500

=170000

= 34000

Standard Deviation = √34000 = 184.39

c) Intervals with significantly higher or lower packet counts can be identified by looking at the

intervals that are around one standard deviation away from the average. In this case, intervals 1

and 5 have packet counts significantly higher than the average, while intervals 3 and 4 have counts

slightly lower than the average.

7 8. DARK WEB MONITORING

Problem 8. Suppose a cybersecurity analyst is monitoring a dark web marketplace and notices

a listing for stolen credit card information. The listing claims to have 500 credit card numbers for sale

at a price of 10percard.Iftheanalystdecidestopurchaseall500creditcardnumbers, howmuchwillitcostintotal?

Solution 8. a) The total cost of purchasing all 500 credit card numbers can be calculated as

follows:

Total Cost =Price per Card ×Number of Cards

Total Cost = $10 ×500 = $5000

Therefore, it will cost $5000 in total to purchase all 500 credit card numbers.

8 8. DARK WEB MONITORING

Problem 8. A cybersecurity analyst is tracking a dark web forum where threat actors are dis-

cussing potential cyber attacks against a website. The analyst notices that the forum has 3 new

posts every hour, and each post contains valuable threat intelligence information. If the analyst

wants to monitor the forum for 24 hours, how many new posts will they need to review in total?

Solution 8. a) The total number of new posts the analyst will need to review in 24 hours can

be calculated as follows:

Total Posts =Posts per Hour ×Total Hours

Total Posts = 3 ×24 = 72

Therefore, the analyst will need to review 72 new posts in total over the 24-hour monitoring

period.

9 9. PHISHING CAMPAIGN DETECTION

Problem 9. In a recent phishing campaign, a cybersecurity analyst identified the following

metrics for a set of suspicious emails:

•300 emails were sent out.

•75 emails were marked as spam by the email provider.

•20 emails were clicked on by recipients.

•5 emails were reported as phishing by recipients.

a) Calculate the click-through rate (CTR) for this phishing campaign.

b) Determine the false positive rate (FPR) of the email provider in marking emails as spam.

c) Find the phishing reporting rate for this campaign.

Solution 9.

a) The click-through rate (CTR) is calculated by dividing the number of emails clicked on by the

total number of emails sent.

Given:

•Total emails sent = 300

•Emails clicked on = 20

Therefore, CTR = 20

300 = 0.0667 or 6.67%.

b) The false positive rate (FPR) is calculated by dividing the number of emails wrongly marked

as spam by the total number of emails marked as spam.

Given:

•Total emails marked as spam = 75

•Emails wrongly marked as spam = 0 (since no information is given, let’s assume none were

wrongly marked)

Therefore, FPR = 0

75 = 0 or 0%.

c) The phishing reporting rate is calculated by dividing the number of emails reported as phish-

ing by the total number of emails clicked on.

Given:

•Emails clicked on = 20

•Emails reported as phishing = 5

Therefore, phishing reporting rate = 5

20 = 0.25 or 25

10 10. INSIDER THREAT IDENTIFICATION

Problem 10. You are analyzing user behavior logs in a company network to identify any poten-

tial insider threats. You notice that an employee, Alice, has accessed an unusually high number of

sensitive files outside of her normal working hours. The files include proprietary information and

client data. You decide to investigate further by looking at the timestamps of these file accesses.

The timestamps for the file accesses are as follows: 1) 7:32 PM 2) 11:45 PM 3) 1:18 AM 4)

3:25 AM 5) 9:03 AM

Assuming working hours are from 9:00 AM to 5:00 PM, determine if Alice’s file accesses are

suspicious based on the timestamps.

Solution 10.

To determine if Alice’s file accesses are suspicious, we need to check if any of the accesses

are outside of normal working hours (9:00 AM to 5:00 PM).

a) Convert the timestamps to a 24-hour format for easier comparison:

1) 7:32 PM = 19:32 2) 11:45 PM = 23:45 3) 1:18 AM = 1:18 4) 3:25 AM = 3:25 5) 9:03 AM =

9:03

b) Now we can determine if any of the accesses are outside of normal working hours:

1) 19:32 (7:32 PM) - Outside working hours 2) 23:45 (11:45 PM) - Outside working hours 3)

1:18 AM - Outside working hours 4) 3:25 AM - Outside working hours 5) 9:03 AM - Within working

hours

c) Therefore, based on the timestamps provided, Alice’s file accesses at 7:32 PM, 11:45 PM,

1:18 AM, and 3:25 AM are all outside of normal working hours, which may indicate suspicious

behavior. Further investigation is warranted.

11 11. VULNERABILITY MANAGEMENT

Problem 11. The Vulnerability Scoring System (VSS) assigns a score to each vulnerability

based on several factors. One such factor is the Exploitability Score (ES), which is calculated

using the formula:

ES = 10 ×N

A+ 1

where Nis the average number of exploit attempts per day and Ais the average time it takes

to deploy a patch in days.

Given that N= 100 and A= 5, calculate the Exploitability Score (ES) for this vulnerability.

Solution 11.

Given the values N= 100 and A= 5, we can plug them into the formula for ES:

ES = 10 ×100

5+1 = 10 ×100

6= 10 ×16.67 ≈166.67

Therefore, the Exploitability Score (ES) for this vulnerability is approximately 166.67.

12 12. ADVANCED PERSISTENT THREATS

Problem 12. A security analyst is investigating an advanced persistent threat targeting a com-

pany’s network. The analyst has identified that the threat actor is using a tactic called "living off

the land," which involves using legitimate tools already present on the network for malicious activ-

ities. The analyst has discovered that the attacker used a common tool, PowerShell, to execute a

malicious script on a compromised system.

The malicious script executed by the attacker contains the following PowerShell commands:

$var1 = 10

$var2 = 20

$result = $var1 + $var2

Write-Output "The result is: $result"

a) What is the value of the variable $result after executing the script?

Solution 12. a) To calculate the value of the variable $result, we first need to perform the

arithmetic operation:

$result =$var1 +$var2 = 10 + 20 = 30

Therefore, the value of the variable $result after executing the script is 30.

12.1 13. INTRUSION DETECTION SYSTEMS

Problem 13. A security operations center (SOC) analyst is reviewing alerts from the intrusion

detection system (IDS) of a company. One of the alerts shows that an internal host has been

communicating with a known malicious IP address. The analyst investigates further and finds the

following information:

-Internal Host IP Address: 192.168.1.10 - Malicious IP Address: 203.0.113.5 - Destination

Port: 443 - Protocol: TCP

The analyst suspects that the internal host may be compromised and communicating with a

command-and-control server.

a) What type of network activity does the observed communication over TCP port 443 typically

represent?

b) How should the SOC analyst respond to this alert to investigate and mitigate the potential

threat?

Solution 13. a) The communication over TCP port 443 typically represents HTTPS (Hypertext

Transfer Protocol Secure) traffic. This port is commonly used for secure web browsing, but in some

cases, threat actors may use it to hide malicious activities within encrypted traffic.

b) To investigate and mitigate the potential threat, the SOC analyst should perform the following

actions: - Monitor the network traffic between the internal host and the malicious IP address to

gather more information. - Analyze the network packets for any suspicious communication patterns

or payloads. - Check the internal host for signs of compromise, such as unusual processes or

network connections. - Isolate the internal host from the network to prevent further communication

with the malicious IP address. - Update the IDS rules to block any future communication attempts

to the known malicious IP address. - Report the incident to the incident response team for further

investigation and remediation.

13 Cybersecurity Threat Intelligence and Analysis

Problem 1. A hacker sends an email to a company’s employees posing as the IT department

and requesting their login credentials to perform a system upgrade. Out of 1000 employees, 200

fall for this social engineering tactic and share their credentials. If each employee’s account is worth

$500 to hackers on the dark web, how much value did the hacker gain from this phishing attack?

Solution 1. To calculate the value gained by the hacker from this phishing attack, we first

determine the number of compromised accounts and then multiply it by the value of each account.

a) Number of compromised accounts:

Compromised accounts = 200

b) Value of each compromised account:

Value per account = $500

c) Total value gained by the hacker:

Total value =Compromised accounts ×Value per account

Total value = 200 ×$500

Total value = $100,000

Therefore, the hacker gained a total value of $100,000 from this phishing attack.

14 14. CRYPTOCURRENCY THREATS

Problem 14. A hacker gained access to a cryptocurrency exchange’s database and stole 500

Bitcoins. The current value of 1 Bitcoin is 10,000.T hehackerthenattemptstosellthestolenBitcoinsonthedarkwebata20

Solution 14.

a) The total value of the stolen Bitcoins before the hacker sells them at a discount can be

calculated by multiplying the number of Bitcoins stolen by the current value of 1 Bitcoin:

Total value before discount = 500×

10,000 = 5,000,000

b) If the hacker sells the stolen Bitcoins at a 20

Price after discount = 0.80×

10,000 = 8,000

c) The total amount of money the hacker could make by selling all the stolen Bitcoins at the

discounted price is:

Total money made = 500×

8,000 = 4,000,000

Therefore, the hacker could make a total of 4,000,000bysellingthestolenBitcoinsata20

15 Cybersecurity Threat Intelligence and Analysis

Problem 1. A cybersecurity analyst is investigating a potential cyber espionage incident and

finds that a malicious actor has successfully conducted a spear phishing attack against a company’s

employees. The analyst discovers that out of 100 targeted employees, 20

Solution 1.

Given that 20

Number of compromised accounts = 100 ×0.20 = 20 accounts

Since each compromised account is valued at $10,000, the total financial impact of the incident

can be calculated as:

Financial impact = 20 accounts ×$10,000/account = $200,000

Therefore, the estimated financial impact of this cyber espionage incident is $200,000.

15.1 16. Security Information and Event Management

Problem 16. A Security Information and Event Management (SIEM) system receives 5000

security events per second. If each security event is an average size of 10 KB, calculate the

average data rate in Mbps that the SIEM must handle.

Solution 16.

Given: - Number of security events per second = 5000 - Average size of each security event =

10 KB

To calculate the average data rate in Mbps, we need to first calculate the total data rate in kilobits

per second and then convert it to megabits per second.

a) Calculating the total data rate in kilobits per second:

Total data rate (in KBps) = Number of events per second ×Size of each event in KB

Total data rate = 5000 events/sec ×10 KB/event = 50000 KBps

Next, we convert KBps to Kbps by multiplying by 8 (since 1 byte = 8 bits):

Total data rate (in Kbps) = 50000 KBps ×8 = 400000 Kbps

b) Converting the total data rate to Mbps:

1 Mbps = 1000 Kbps

Total data rate (in Mbps) = 400000 Kbps / 1000 = 400 Mbps

Therefore, the SIEM system must handle an average data rate of 400 Mbps to process 5000

security events per second, each of size 10 KB.

16 17. THREAT ACTOR PROFILING

Problem 17. You are analyzing a threat actor group’s behavior and notice that they have tar-

geted multiple organizations in the last month. By conducting further analysis, you find the following

information:

- Organization A: 10 intrusion attempts, 5 successful breaches - Organization B: 15 intrusion

attempts, 10 successful breaches - Organization C: 8 intrusion attempts, 6 successful breaches

a) Calculate the intrusion success rate for each organization as a percentage.

b) Determine the average intrusion success rate for this threat actor group.

c) If the threat actor group is planning to target Organization D next, and you estimate that they

will make 20 intrusion attempts, how many successful breaches would you predict based on their

average success rate?

Solution 17.

a) To calculate the intrusion success rate for each organization as a percentage, we use the

formula:

Success Rate (%) =Successful Breaches

Intrusion Attempts ×100

For Organization A:

Success Rate for A =5

10 ×100 = 50%

For Organization B:

Success Rate for B =10

15 ×100 = 66.67%

For Organization C:

Success Rate for C =6

8×100 = 75%

b) The average intrusion success rate for the threat actor group is calculated by taking the

average of the success rates of the organizations:

Average Success Rate =50 + 66.67 + 75

3=191.67

3= 63.89%

c) To predict the number of successful breaches for Organization D based on the average

success rate, we use the estimated intrusion attempts and the average success rate:

Predicted Successful Breaches for D = 20 ×63.89

100 = 12.78 ≈13

Therefore, based on the threat actor group’s average success rate, we can predict approxi-

mately 13 successful breaches for Organization D.

17 18. CYBER THREAT HUNTING

Problem 18. Suppose a cybersecurity analyst is investigating a potential threat actor within an

organization’s network. The analyst has identified the following indicators of compromise (IOCs)

associated with the suspected attacker:

IOCs: - IP Address: 192.168.1.100 - File Hash: 5f4dcc3b5aa765d61d8327deb882, 628502ac9d4f4cf8b5b0bea0fdcb7918

- Domain: malicious.com

The analyst also discovers that the attacker is using a known exploit targeting a vulnerability in

the organization’s web server. The vulnerability has a CVSS score of 9.3.

a) Determine the File Hash values using a cryptographic algorithm. b) Analyze the provided IP

address to identify its network range. c) Evaluate the impact of the exploited vulnerability with a

CVSS score of 9.3 on the organization’s web server.

Solution 18.

a) The most common cryptographic algorithm used to calculate a hash value for files is the MD5

algorithm. Let’s apply the MD5 algorithm to the given strings to determine the File Hash values:

1. MD5("5f4dcc3b5aa765d61d8327debcb7918") = 827ccb0eea8a706c4c34a16891f84e7b 2.

MD5("628502ac9d4f4cf8b5b0bea0fdcb7918") = 1c01e1e4dc9e7d1f9bb442dc3a0144b5

Therefore, the File Hash values are: - 827ccb0eea8a706c4c34a16891f84e7b - 1c01e1e4dc9e7d1f9bb442dc3a0144b5

b) To identify the network range of the given IP address (192.168.1.100), we observe that it

belongs to the Class C private IP address range. This means that the network range would be

from 192.168.1.0 to 192.168.1.255 with a subnet mask of 255.255.255.0.

Therefore, the network range for the IP address 192.168.1.100 is 192.168.1.0/24.

c) A Common Vulnerability Scoring System (CVSS) score of 9.3 indicates a critical vulnerability

with a significant impact. The impact could potentially lead to the complete compromise of the

organization’s web server, allowing an attacker to gain full control, access sensitive data, or disrupt

services. Immediate remediation and patching of the vulnerability are crucial to mitigate the risk

posed by such a high-severity exploit.

18 19. DATA BREACH DETECTION

Problem 19. A cybersecurity analyst is analyzing network traffic logs for a company and notices

an unusually high number of failed authentication attempts from a single IP address. The analyst

suspects a potential brute force attack. The logs show the following data over a 24-hour period:

Time Failed Attempts

00:00 - 01:00 10

01:00 - 02:00 15

02:00 - 03:00 20

03:00 - 04:00 25

04:00 - 05:00 30

05:00 - 06:00 35

06:00 - 07:00 40

07:00 - 08:00 45

08:00 - 09:00 50

09:00 - 10:00 55

10:00 - 11:00 60

11:00 - 12:00 65

12:00 - 13:00 70

13:00 - 14:00 75

14:00 - 15:00 80

15:00 - 16:00 85

16:00 - 17:00 90

17:00 - 18:00 95

18:00 - 19:00 100

19:00 - 20:00 105

20:00 - 21:00 110

21:00 - 22:00 115

22:00 - 23:00 120

23:00 - 00:00 125

a) Determine the total number of failed authentication attempts from the suspicious IP address

over the 24-hour period.

b) Calculate the average number of failed attempts per hour from the suspicious IP address.

c) If the threshold for identifying a potential brute force attack is set at an average of 50 failed

attempts per hour, would you consider this a probable attack based on the data?

Solution 19.

a) To find the total number of failed authentication attempts from the suspicious IP address over

the 24-hour period, we sum up all the failed attempts recorded in the provided table:

Total = 10 + 15 + 20 + 25 + ... + 115 + 120 + 125

This is an arithmetic series with a common difference of 5 and a first term of 10, and there are

24 terms.

Using the formula for the sum of an arithmetic series:

Sum =n

2×(2a+ (n−1)d)

Substitute a= 10,d= 5,n= 24 into the formula gives:

Total =24

2×(2(10) + (24 −1)(5)) = 12 ×(20 + 23(5)) = 12 ×(20 + 115) = 12 ×135 = 1620

Therefore, the total number of failed authentication attempts from the suspicious IP address

over the 24-hour period is 1620.

b) The average number of failed attempts per hour can be calculated by dividing the total number

of attempts by the number of hours:

Average per hour = Total / Number of hours

Average per hour =1620

24 = 67.5

The average number of failed attempts per hour from the suspicious IP address is 67.5.

c) The threshold set for identifying a potential brute force attack is 50 failed attempts per hour.

Since the average number of failed attempts per hour from the suspicious IP address is 67.5, which

is above the threshold, it is likely that a brute force attack is in progress based on the data provided.

19 20. THREAT INTELLIGENCE SHARING PLATFORMS

Problem 20. You are analyzing threat intelligence data on a platform that uses the STIX (Struc-

tured Threat Information eXpression) format. Given the following STIX indicators, determine their

types and meanings:

Indicator Type Meaning

1.file :hashes.MD5 = ”5f4dcc3b5aa765d61d8327deb882cf99” File hash MD5 hash of a file

2.email −message :fromref.type = ”domain −name”Email sender Email sender’s domain name

3.domain −name :value = ”example.com”Domain Indicates a domain name

Solution 20. a) The first indicator is of type File hash and it specifies the MD5 hash of a file:

"5f4dcc3b5aa765d61d8327deb882cf99."

b) The second indicator is of type Email sender and it represents the domain name of the email

sender: "domain-name."

c) The third indicator is of type Domain and it indicates the domain name "example.com."

For weekends:

zweekend =800 −700

70 =100

70 ≈1.43

b) To determine if the spike in traffic volume is statistically significant, we compare the z-score to

the critical z-value at a significance level of 0.05. The critical z-value can be found using a standard

normal distribution table or calculator.

For a significance level of α= 0.05, the critical z-value is approximately 1.96.

Since the z-score for weekdays is 6 and for weekends is 1.43, the spike in traffic volume on

weekdays is statistically significant as the z-score is much higher than the critical z-value. However,

the spike in traffic volume on weekends is not statistically significant at α= 0.05.

2 3. THREAT INTELLIGENCE FEED MANAGEMENT

Problem 3. An organization subscribes to three different threat intelligence feeds, labeled A, B,

and C. Feed A provides 150 indicators per day, Feed B provides 200 indicators per day, and Feed

C provides 100 indicators per day. The organization’s threat analyst can investigate a maximum

of 400 indicators per day. If the analyst wants to ensure they can investigate all indicators from

at least two feeds each day, how many days can they subscribe to all three feeds before reaching

their maximum investigation capacity?

Solution 3. Let xrepresent the number of days the organization can subscribe to all three

feeds before reaching their maximum investigation capacity.

The total number of indicators that can be investigated in xdays from Feed A is 150x, from

Feed B is 200x, and from Feed C is 100x.

To ensure the analyst can investigate all indicators from at least two feeds each day, we must

consider the worst-case scenario where the analyst investigates all indicators from Feeds A and B

one day and all indicators from Feeds A and C or B and C the other day.

So in xdays, the total number of indicators from Feeds A and B would be 150x+ 200x= 350x,

and the total number of indicators from Feeds A and C or B and C would be 150x+ 100x= 250x.

According to the problem, the analyst can investigate a maximum of 400 indicators per day, so

350x≤400 and 250x≤400.

Solving these inequalities, we find:

350x≤400

x≤400

350

x≤1.14

Answer: The analyst can subscribe to all three feeds for at most 1 day before reaching their

maximum investigation capacity.

3 4. INCIDENT RESPONSE STRATEGIES

Problem 4. A cybersecurity analyst is investigating a security incident involving a phishing email

campaign targeting employees in a company. The analyst has identified multiple compromised

endpoints that were used to exfiltrate sensitive data. The analyst needs to prioritize which endpoints

to investigate first based on the severity of the incident.

The analyst assigns a severity score to each compromised endpoint based on the volume of

data exfiltrated, the sensitivity of the data, and the criticality of the endpoint to the company’s

operations. The severity scores for the compromised endpoints are as follows:

•Endpoint A: 8

•Endpoint B: 6

•Endpoint C: 9

•Endpoint D: 5

a) Calculate the average severity score of the compromised endpoints.

b) Rank the compromised endpoints in descending order of severity score.

Solution 4. a) To calculate the average severity score of the compromised endpoints, we sum

up all the severity scores and divide by the total number of compromised endpoints.

Average severity score =8+6+9+5

=28

= 7

Therefore, the average severity score of the compromised endpoints is 7.

b) Ranking the compromised endpoints in descending order of severity score:

1. Endpoint C: 9

2. Endpoint A: 8

3. Endpoint B: 6

4. Endpoint D: 5

Thus, the compromised endpoints should be investigated in the following order: Endpoint C,

Endpoint A, Endpoint B, Endpoint D.

4 5. OPEN SOURCE INTELLIGENCE GATHERING

Problem 5. An analyst is conducting open source intelligence gathering on a suspicious IP

address. The analyst discovers the following information from various sources:

- IP address: 192.168.1.100 - Domain associated: example.com - Country: United States -

Last seen activity: 2 days ago - Number of known vulnerabilities: 5 - Reputation score: 7/10

a) If the analyst wants to conduct a WHOIS lookup on the domain "example.com", what infor-

mation can they potentially gather?

b) Based on the reputation score of 7/10, assess the level of trustworthiness of this IP address.

c) What could be a potential next step for the analyst to gather more information about this IP

address?

Solution 5.

a) A WHOIS lookup on the domain "example.com" can potentially provide the following infor-

mation: