Chapter 11 — Operating systems | Bachelor's Threat intelligence and OSINT

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 11 published. Map, example, EX031.

flowchart TD
  N0["Learning outcomes"]
  N1["11.1 Processes and command interpreters"]
  N2["11.2 Privilege"]
  N3["11.3 Endpoint telemetry"]
  N4["11.4 Reading a technique page"]
  N5["11.5 Remote services"]
  N6["11.6 Patching and support status"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX031"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["11.1 Processes and command interpreters"]
  N2["11.2 Privilege"]
  N3["11.3 Endpoint telemetry"]
  N4["11.4 Reading a technique page"]
  N5["11.5 Remote services"]
  N6["11.6 Patching and support status"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX031"]

[Learning outcomes]
    |
    v
[11.1 Processes and command interpreters]
    |
    v
[11.2 Privilege]
    |
    v
[11.3 Endpoint telemetry]
    |
    v
[11.4 Reading a technique page]
    |
    v
[11.5 Remote services]
    |
    v
[11.6 Patching and support status]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX031]

Learning outcomes

You will (1) relate operating-system concepts to ATT&CK techniques; (2) identify endpoint telemetry useful for checking intelligence; (3) explain privilege and its abuse; (4) read a technique page critically.

11.1 Processes and command interpreters

An operating system runs processes, each started by a parent. Attackers often use built-in interpreters — PowerShell, command shells, scripting hosts — which ATT&CK groups under Command and Scripting Interpreter (T1059). Because administrators use the same tools, detection depends on context: which parent, which user, which time.

Amara notes that a hospital's administrators run scripts at night for backups and updates, so a script at night is not suspicious on its own. The useful question is whether the parent process and account match what the administrators normally use.

11.2 Privilege

Accounts carry privileges. Attackers prefer valid accounts (T1078) because using real credentials looks like normal work. Least privilege limits what a stolen account can do.

For HCHT, valid accounts include supplier accounts used for remote maintenance of clinical systems. Amara learns that intelligence about stolen supplier credentials is especially urgent, since such accounts often have broad access. She checks that each supplier account in the directory has an owner and an expiry date, and reports those without either to the identity team.

11.3 Endpoint telemetry

Process creation events with command lines, logon events and service installations are the endpoint logs most relevant to CTI. If a report says a group ran a specific scheduled task name, Amara can search for that name in HCHT's endpoint data.

Before searching, Amara confirms with the endpoint team which systems send process data, since medical devices and some laboratory systems do not run the agent. Where telemetry is missing, the search result says so, rather than implying that nothing was found.

11.4 Reading a technique page

Each ATT&CK technique page has a description, procedure examples drawn from public reporting, mitigations and detection notes. Procedure examples show that someone observed this; they do not show how common it is.

Amara uses technique pages to understand what a report describes, not to estimate how likely HCHT is to see it. When a report maps an incident to a technique, she reads the procedure examples to see whether the mapping fits. Detection notes give ideas for searches, which she checks with the endpoint team before running.

11.5 Remote services

Remote Services (T1021) covers attackers moving between systems using legitimate remote access. In a hospital, remote desktop is used by suppliers, so baselines of who connects where are essential.

Amara helps the team build a baseline of supplier connections: which supplier connects to which systems, from which addresses and at what times. A connection outside the baseline is not proof of an attack, but it is worth a quick check with the supplier. The baseline is reviewed each quarter with clinical engineering, since maintenance schedules change and new suppliers are added.

11.6 Patching and support status

Unsupported operating systems no longer receive fixes, so intelligence about vulnerabilities affecting them has no patch remedy. The inventory should record support status, and advisories touching unsupported systems trigger compensating controls — segmentation, restricted access, extra monitoring — agreed with the system owner.

Amara adds support status to her advisory notes, so readers see at once whether patching is possible. Compensating controls are reviewed when the owner's replacement plan changes. Amara keeps a short list of unsupported systems with their controls and owners, so an advisory can be checked against it quickly, and she notes when a replacement date has slipped.

Worked example

HSSC reports that an intruder at another trust used remote desktop from a supplier account at 03:00. Amara asks the HCHT endpoint team for remote logons by supplier accounts outside business hours over 30 days. Two appear; both match scheduled maintenance tickets. She records "checked; no match" with the query and dates.

Synthetic case. The report and logons are invented.

Errors and limits

Absence in logs may mean missing logging. Record coverage when reporting "no match".

Exercises

EX031 — Technique choice. An attacker logs in with a stolen supplier password. Which ATT&CK technique fits?
Show marking criteria
Rubric: 3 = Valid Accounts T1078 with reason; 2 = name only; 1 = T1059; 0 = none.
EX032 — Procedure caution. What does a procedure example on an ATT&CK page not tell you?
Show marking criteria
Rubric: 3 = frequency/prevalence or whether it targets you; 2 = partial; 1 = it tells everything; 0 = none.
EX033 — No-match record. What should Amara include when recording "no match"?
Show marking criteria
Rubric: 3 = query, period, data source and coverage gaps; 2 = two; 1 = verdict only; 0 = none.

Synthesis

Map OS behaviour to techniques, use endpoint telemetry to check reports, and record coverage with every negative result.

Continue studying — chapter 11 of 40

← Chapter 10 (draft) · Course chapter index · Chapter 12 (draft) →