- Foundational lab.
The foundational lab is basically two main topics.
Operating system, and networking,
computer networks in general.
Why this is so important?
Well, if you are working with cybersecurity, you,
and again, depending on which field
in cybersecurity you're gonna work with,
having a strong knowledge of operating system
is a prerequisite for you to understand.
For example, if there is a piece of malware in the system,
if you're doing instant response, for example,
you need to understand the processes that are running,
understand the behavior of those processes,
understand how to read network traces,
understand, all those things are imperative.
You really need to know that.
So when we talk about operating system,
one of the things that always comes
to mind is, okay Windows, opening task,
and things like that.
Well, this is basic operations.
We have to look from the architecture perspective.
And if you really want to go deep, there are specific books
about operating system architecture.
For example, the Sysinternals book
from Mark Russinovich is a great one from Microsoft Press
for you to understand deeply the architecture
of the operating system.
What I'm gonna talk about here is just key concepts,
and I'm gonna demonstrate this
in a Windows operating system just to you have an idea.
The first thing to know is the concept of process,
which is a, basically an instance of a program running.
So for example, if you open in a Windows operating system,
if you open a Notepad.exe,
just the (indistinct) Notepad,
or even Word, WinWord.exe,
you're gonna see that there is a process
that starts with that program, okay?
Now, a process can open multiple threads.
It has its own thread, but it can open multiple threads too,
because a thread, nothing is also considered a task.
For example, can open Notepad.
And when I click file open to open a file,
another thread is gonna be created to handle that request.
So these are some of the things that you need
to be aware when you are working with operating system,
because, for example, if a piece of malware, okay,
is hijack a process
and start opening threads to do different things,
for example there's a thread that is making a call
to command and control to open up a connection
to the internet to download even more malware.
You're gonna be able to see that,
not only when you are using process monitor,
which is a tool from Sysinternals
to analyze the process,
but when you are also using, like, Wireshark,
which is a network sniffer tool
to analyze the network traffic,
you're gonna be able to see that callback coming
from that computer that shouldn't be really making calls
to that IP address.
All those things are important
and if you are not from cyber,
and if you are not from IT,
this can be a lot to absorb, so take it easy.
Use all the resources to read more about those topics.
I'm giving you only the guideline of things
that you need to understand, right?
The other thing is network communication.
You need to understand based knowledge of TCP/IP.
What is an IP address, how it works,
what is a subnet mask?
How communication occurs, what is a,
why the gateway is necessary
to route communications between two subnets?
All those things are important, okay?
And you have to understand how to read network trace.
Again, the goal here is not
to teach all those things to you,
is to give you the roadmap of what you need to study, okay?
I'm gonna do a quick demonstration on those two topics,
so you have some awareness of how it looks like.
And if you have the book,
there are steps that you can follow
from the book to also do on your own, on your own computer.
Right, so we talk about process threads
from the operating system perspective.
So here, one thing that I recommend you to go.
You go to sysinternals.com
And this is a site that you can download a lot
of free tools, and one of the tools that you can use
to help you with this understanding
of process is the process utilities, like Process Monitor.
So process monitor, or ProcMon,
is really something that will help you
to understand how threads are created,
how the process is created.
So take a look on this website, download it,
and do a simple experiment.
For example, you can open Process Monitor here.
And one of the things that you're gonna see is that
in my case here, I already create a filter for Notepad.
Now if I remove this filter, you're gonna see
that there's a lot of things going on here.
A lot of things, because it shows up all,
every single process that has been opened up to the OS.
But I'm gonna create another filter,
and I'm gonna say Notepad.exe,
and this is the process name,
Notepad.exe.
I'm gonna include that, and I'm gonna apply.
Okay, So now it's clear.
Now what's gonna happen when I execute Notepad.exe?
So if I open this start button, type Notepad,
and open notepad, I should see a lot of activity, right?
Now, think about it,
the only thing that I did was
to launch this product, this software.
Look the amount of things that took place.
If I click on one of those things, which is the first one,
which is called Processes Start, right?
So this is the first one,
Processes Start, and I click on properties, right?
This is my process, okay?
This is the process information.
This is the name of the process,
the location of the process,
the comment line behind the process.
Every process has a process ID, okay?
The unique identification, parent ID,
the parent identification for the process, okay?
So that is how you see the process itself.
Now, when it comes to network, now what you can do
is you should go to wireshark.org
and download Wireshark.
Wireshark is a tool that will allow you
to use sniffer network traffic capture
and start to do some very interesting experiments
to better understand.
So for example, what's happened when I type
aka.ms/mdclabs, right,
which is the labs that you are going
to do on the next module.
So what's happening, there is a redirection,
and then it lands on GitHub.
When I capture this traffic here on Wireshark,
I have all the network communication
that took place at that time.
And if I really understand TCP/IP,
you understand that when you type a URL,
that's a domain name,
it needs to be translated to IP address.
So the first step is,
okay, let me filter everything to DNS communication.
When I looked at the DNS communication relevant
to what we've done is aka,
who is aka.ms, that's the domain name.
So, why is so awesome to use a Wireshark to understand this?
Because by looking at, by open the package,
you see here aka.ms.
When I look at the package here, what I really have
is I have the frame,
which is a lower level,
I have the layer link frame,
which gives me the MAC address of the computer
and things like that, the lower level communication.
Then I have the IP layer,
which is the internet protocol layer,
which is the IP address itself.
And then it comes the transport protocol, which is UDP.
So I have this information here available as well.
And then the application, which is DNS.
So if you think about TCP/IP architecture
there is nothing really better than a tool such
as a Wireshark for you to see each layer,
because you can expand each layer and say, okay,
now, on the application level,
I'm doing what is called a standard query, okay?
I have a standard query going on here,
which is a query about a domain name.
And the domain is this aka.ms
that I'm trying to understand who owns this domain,
who can answer for this domain.
So when I send this in the query, okay,
I have a standard response.
Okay, aka.ms, there is a record for that.
And this is the IP address,
this is the answer that I'm expecting to receive.
Okay, so Wireshark helps you
to really comprehend the TCP/IP architecture.
So I really strongly recommend you to install Wireshark,
and just do some experience.
Click on capture, start after you install,
then navigate to a website and start creating filters.
Most of the filters are pretty straightforward to use here.
DNS, because I want to know more about DNS.
If I want to know more about HTTP,
I can just type HTTP and press enter,
and it's gonna filter for any HTTP traffic
that I have captured, okay?
If I want to create filters based on IP address,
I can do that as well.
The website itself, Wireshark website has a lot
of documentation as well
that you can use to learn more in depth.
There are a bunch of videos
about how to capture packets, what to do.
So make sure to visit wireshark.org
and start watching those videos to go deeply on that.