FALCON FUNDAMENTALS TASK
1. Deploy Falcon sensor on Cymulate-Win VM
2. Deploy Cymulate agent on Cymulate-Win VM
3. Scan the Cymulate-Win with Falcon Sensor on UI
3.1 Follow the below steps to do scan
3.2. Endpoint Security — On-demand scans — Create a scan
3.3. Type Cymulate-win on Hostname field
3.4. Type */** in File path to scan field
3.5. Put the Detection and Prevention levels to the Extra Aggressive for Sensor Anti-malware, Cloud andi-malware, Cloud-based adware&pup
4.5. Click create scan button and complete it
5. It will discover malicious file
6. On Endpoint Security tab find the malicious file detection and click on it. Find the hash of file
7. On the Endpoint Security tab click the decection, and click to Attempt to Connect to Host.
8. Type the get command to install the file, and find the downloading time of the malicious file to the VM(search the command)
9. Do the same steps for Cymulate-lin machine.
11. Go the Cymulate
12. From the scenarios find the “Download and Execute a File Using Mshta.exe” named scenario and run it on the Cymulate-Win VM
13. Check for the Detection of it on the Falcon
14. Click to Threat Feed on the Cymulate and choose one from the latest scenarios for both of the VMs — one for Cymulate-Win, one for Cymulate-Lin VM.
15. Check for the Detection for them.
16. Find the IOC of the suspicious files
Get Gardash Aliyev’s stories in your inbox
Join Medium for free to get updates from this writer.
17. Add IOC to IOC Managment on Falcon.
1.1 Deploy Falcon sensor on Cymulate-Win VM
Path for the installation token: Menu > Host setup and management > Installation token The installation starts after adding the CID and token.
The uploaded agent can be verified on both Windows and CrowdStrike:
- Windows:
sc.exe query csagent - CrowdStrike:
Menu > Host setup and management > Newly Installed sensors
1.2 Deploy Falcon sensor on Cymulate-Lin
First of all, the sensor for Linux is obtained from the CrowdStrike platform.
After the .deb file is sent to the Linux machine via scp, the deployment process is carried out: (Additionally, the installation token is also used here to ensure the connection to the cloud does not fail ( — provisioning-token=<token))
2.1 Deploy Cymulate agent on Cymulate-Win VM
In the image below, you can see the connection phase with Cymulate during the configuration stage of the agent we installed.
2.2 Deploy Cymulate agent on Cymulate-Lin VM
3. Scan the Cymulate-Win with Falcon Sensor on UI (ODS)
For testing purposes, I added the test.exe trojan file on the Cymulate-Win machine, and the Falcon sensor added this trojan to Quarantined Files:
4. On the Endpoint Security tab click the decection, and click to Attempt to Connect to Host.
Connect To Host:
8. Type the get command to install the file, and find the downloading time of the malicious file to the VM
Downloading time:
9. From the scenarios find the “Download and Execute a File Using Mshta.exe” named scenario and run it on the Cymulate-Win VM
After selecting the scenario and configuring the assessment settings, the assessment is launched.
9.1. Check for the Detection of it on the Falcon
A suspicious process attempted to use the legitimate Windows mshta.exe utility to download and execute a malicious file (payload) from a remote server.
10. Click to Threat Feed on the Cymulate and choose one from the latest scenarios for both of the VMs — one for Cymulate-Win, one for Cymulate-Lin VM.
As a result of the test, a ransomware detection was triggered in Falcon: A newly written file on the system was flagged by the cloud-based machine learning (ML) model as “highly likely malicious.” This conclusion was made based on factors such as high entropy in the file’s internal structure, code packing, defense evasion techniques, or a strong similarity to known malware.
11. Check for the Detection for them. When the IOC hash of the detected malicious file was analyzed on VirusTotal, it was confirmed that the hash belongs to a malicious ransomware:
12. Add IOC to IOC Management on Falcon.
The hash was successfully added to the IOC management database:
