Malware Analysis using Osquery | Part 3

Too Long; Didn't Read

This is part 3. In <a href="https://www.alienvault.com/blogs/labs-research/malware-analysis-using-osquery-part-1" target="_blank">part 1</a> of this blog series, we analyzed malware behaviour, and, in <a href="https://www.alienvault.com/blogs/labs-research/malware-analysis-using-osquery-part-2" target="_blank">part 2</a>, we learned how to detect persistence tricks used in malware attacks. Still, there are more types of events that we can observe with Osquery when malicious activity happens. So, in the last blog post of the series, we will discuss how to detect another example of a technique used in a malware attack, one that involves installing a root certificate in the system that can be used to intercept information transmitted over secure TLS/SSL communications (man in the middle). We will also see how to use the Alienvault Agent and Alienvault USM Anywhere to create custom rules and detect malicious activity in your environment.