Now I know we're not in the lab environment here, but I do want to point out that you can always
test this out in the lab for the course overall as you go to the labs tab, tongue twister there,
inside the course here on CVT Nuggets. What we're taking a look at here is my personal virtual
machine environment. The reason I did this is because I didn't want to do this inside the lab
and mess anything up that we've been working on so far because this is just a quick demonstration.
So I have on also licensing, so I have here semantic endpoint protection. This is not
a promotional or anything like that. This is just what I have on this particular VM
and I'm running Windows 11. Now the reason I'm doing so is because I want to download Kali
Linux as an ISO and put it on the desktop of this Windows 10 11 system. So I'll go ahead and
minimize that and go into the Microsoft Edge because I haven't made any changes. This is a
basic install of Windows 11. Continue and start browsing. So now we're going to go to the Google
or just say Kali Linux download. Go to the actual Kali site virtual machines installer images
and we're going to look just say this one and I'm going to download it directly and not do a
torrent so that way when it does download all the way it's going to be an ISO. There's a reason I'm
doing this. Don't you worry. Now this is going to take just a second. I'm going to wait for it to
finish downloading and we'll come right back. Now having stepped away because it took so long to
download over my connection here and the fact that I wanted to go grab some coffee, I come back to
this and what this is is as I zoom in for you and make this a little bit bigger
is the Kali ISO triggered the actual semantic endpoint protection here on this system.
Why? Well this is just two of them and I could go on and on and show you multiple examples
but the Aircrack-NG and the Lodunum triggered signature-based detection rules because they
have code in them that matches what's being looked at inside the signature-based rule set.
Meaning these files are malicious according to our endpoint detection. Now is this real or is this
fake? That's where a lot of our questioning comes into when we're distinguishing what's good and
bad inside of our protection area. And finding something fake and having it trigger as a true
is referred to as a false positive. Meaning that we got a fake positive outcome inside of our
detection whether it be through signature or heuristic based. And the example that we have
inside of my virtualized environment is an example of a true positive because it is in fact
malicious. But according to our organization's rules, me here in my house, I'm saying that that's
a false positive because I need to be able to use the Kali ISO. But I just wanted to give you an
example of a signature-based rule working as intended in real life. So that's why I was using
it on my personal VM lab over here and not necessarily inside of the lab that we're used to.
But by all means, if you want to be able to go through inside of our lab, Windows Defender will
pick this up too. If you don't have a third-party endpoint detection system installed, operating
systems like Windows do come with endpoint detection, Windows Defender. And the endpoint
detection, be it third-party like Symantec that we had in our example or Windows Defender that
comes default in Microsoft Windows, uses both signature-based and heuristic-based detection
to be able to make a determination if a file or an action is malicious or not. Now, you might really
be asking yourself, Eric, what does all this mean in terms of our pen testing capabilities?
And I'm really glad you asked that. Because you have to know the enemy to defeat them.
Somebody famous said that once. And we have to know how endpoint detection works in order to
be able to craft files and perform actions that evade not only deep packet inspection across the
network, but also work to be able to evade signature and heuristic-based detection on the
endpoint systems. So we've seen previously where we've created files and it does trigger Windows
Defender and third-party endpoints like this. But we haven't had a chance to work with anything
that does deep packet inspection because we just haven't gotten to need to do a skill on that. We
just need to cover what it is and how it works. Now, theoretically, you could get versions of
Symantec to work on your system to capture and look at traffic as it's going in and out.
And when that happens, that is a form of deep packet inspection. We're looking at the files
here on the system. So they're out of encapsulation and encryption of that transmission. And here on
the local system, which makes this not deep packet inspection in that technical sense. It's just,
it is a deep inspection just here on the system. And because it's done on the system,
it's covered by the actual endpoint protection. And again, knowing what you're up against is
critical because if you could run a scan against this particular system with the Symantec endpoint
installed on it, just as an example, you would see that things like Nmap and OpenVAS and whatever
other scans that you want to run on it come back with alternative readings than if we were to scan
a base Windows operating system without a third party endpoint protection on it, like so.
I have an example of a heuristic happening right here. I'm going to see if I can zoom in on that
real quick. Port scan attack is logged. Now, that is not signature base. That is heuristic base
because I'm running an Nmap scan behind the scenes to be able to capture stuff like this.
And just because an action took place so fast within a certain amount of time based on different
ports, that's why Symantec triggered a warning there and it could have actually blocked the
actual traffic. I wanted to do this scan for a particular reason and show you that once this
is done, we're going to get some information about that particular system that alters slightly from
what we're used to seeing when we do a normal scan in a trusted network. But now you have seen
with your own eyes. One on purpose, the signature base rule detection working in action. One on
accident, heuristic base detection working on purpose by accident.