Module 1 - Data Analysis using Cyber Detect

This module provides an overview of Cyber Recovery Policies creation and running actions such as Secure Copy, Sync Copy, etc.. We will then analyze the copies using Cyber Detect.

Review the existing Cyber Recovery pre-created policies for NetWorker and PPDM

In this lesson you'll Analyze NetWorker copies using CyberSense and learn how to understand the data CyberSense displays for a post-attack investigation.

Navigate to the Policies section of the UI. You should see the **NetWorker-FS** and **PPDM-FS-Linux** policies that were already created as a part of this lab.

Copies Analysis using Cyber Detect

We already have last **GOOD** copy of NetWorker and PPDM data which was analyzed by **Cyber Detect** (that is already added from the Applications tab as part of this lab). The following steps were performed to add a **Cyber Detect** application. Users can delete and add it again with these settings. Provide the FQDN/IP address of the CyberSense host with root credentials and Storage Username which is a ddboost user present on Vault DD. Analysis will use DDBoost API to run analysis for particular workloads. Please check the Cyber Recovery and Cyber Detect guides for additional information.

From the **Infrastructure** menu, click **Assets** on the left-hand side of the CR UI and click on the Applications tab and click Add. Enter the following values for the Cyber Detect host and click SAVE: Nickname =Cyber Detect \ FQDN or IP Address = cybersense.vault.local\ Application Type = Cyber Detect\ Tags = You can give a tag name of your choice for Cyber Detect application (optional) \ Host Username = root \ Host Password = Password123! \ SSH Port = 22

Cyber Recovery version 19.20 and later no longer requires that you use the host username to add the Cyber Detect application. Cyber Recovery version 19.20 running CyberSense version 8.12 uses OpenID Connect (OIDC) for secure communication. For more details on CyberSense authentication refer: [Dell PowerProtect Cyber Recovery Product Guide](https://dl.dell.com/content/manual46835707-dell-powerprotect-cyber-recovery-19-20-product-guide.pdf?language=en-us)

Click "Focusing on remote session"

When working with Cyber Recovery starting release 19.13 and also with Cyber Detect starting release 8.2, you will have to configure the interface links between the Cyber Detect server(s) to the PowerProtect DD systems before you can analyze and copy. The interface link feature, also called "Multi Link" provides Cyber Detect the ability to load balance network traffic when reading data from the DD system(s) during analyze jobs. It's mandatory to configure a DDBoost user on each Cyber Detect server you have for every DD system it's going to read files from, the DDBoost protocol is used to check that the connection exists and that it's stable, while Cyber Recovery will manage that and display the connectivity status. If a DD system has more than one network interface, it's recommended to configure the DDBoost user for each network interface. For more information refer to the Cyber Recovery Product Guide.

Click the Configure link on the "Interface Links" column of the Cyber Detect server

Select the Data Domain system

Select the network interface of the DD, and also a network interface of the Cyber Detect server, then click Add Interface Link. In other environments there might be more network interfaces, and you would be able to link these interfaces together the same way. When ready to create the multi interface link configuration click **Save**.

The **status** should indicate **Active** in order for you to be able to analyze copies. It might take several minutes before the status is updated.

Select the **Policies** page and navigate to **Copies**. Review the last **GOOD** copies related to policy **NetWorker-FS** and **PPDM-FS-Linux**.

PPDM Copies Analysis

In this lesson you'll Analyze PPDM copies using Cyber Detect and learn how to understand the data Cyber Detect displays for a post-attack investigation.

Infected data for the Production client (client.demo.local) is already backed up to the Production DD ddveprod.demo.local using the production PPDM (192.168.1.21) and synced to the Vault DD ddvevault.vault.local

Users can view the infected data by accessing CS-Data --> Pre-configured PPDM policy folder on the Launch Pad's desktop. The infected data was copied to the production client to the /temp directory, backed up and synced.

Run Copy Lock for PPDM Policy and Run Analysis

Let's now create a copy of infected data which was already synced to Vault DD. Select **PPDM-FS-Linux** policy under Policies tab and run **Copy Lock.** \-Run Copy Lock on the PPDM-FS-Linux Policy \-Analyze the new Copy that was created by the Copy Lock operation \-Review the analysis status and CSV file \-Review the Attack Profile and list the infected files using Cyber Detect Analyze Dashboard

Select the policy, click Run Now

Select Copy Lock

Click Run

Click on Copies.

Copy creation is successful.

Job showing Copy Operation successful

Once the **Copy Lock** operation is successful, Navigate to **Copies** section. Select the copy click **Cyber Detect Actions.** Click Analyze.

Select Cyber Detect host.

Click Apply

Analysis in progress

Click "Focusing on remote session"

Navigate to Jobs->Protection Jobs->Running

select the job and click on view details

Review the infected copy

Navigate to **Policies --> Copies** tab to see the analysis result. **Suspicious** analysis status means that copy is infected. We will use the previous **Good** copy to recover data.

Click "Focusing on remote session"

Review CSV report

Open Thunderbird Email client from the Desktop and download the CSV report for review

The attack profile is determined using the analytics collected for each backup, knowledge of how these user content/analytics change over time, and then by processing the data with machine learning algorithms. The attack profile identifier provides the information on the type of corruption caused by the current cyberattack. The attack profiles are: 1 - Strong Encrypt w/ Original Filename\ 4 - Strong Encrypt w/ New Known Ransomware Extension \ 6 - Strong Encrypt w/ Obfuscated Filename \ 14 - A profile of 14 is a special case which indicates possible corruption of a database

Save the report.csv file on Desktop and open the file using CSVFileView application. You should first filter the report to show only the backups that are suspect of a ransomware attack. Alert - The “Alert” column in the Analysis file includes a number that corresponds to the specific attack profile for that backup if an infection is suspected and blank if the backup is not suspect of an attack. Sort the "Alert" column. In those rows, you can identify the server and backupset that are suspect.

Select the file and click Open

Cyber Detect uses machine learning to diagnose the attack profile. Go to the last page of Properties and see attack profile value This attack profile is ”6” which is strong encryption with Obfuscated Filename

Post-Attack Forensics With Cyber Detect Analyze Dashboard

Cyber Detect provides a dashboard that helps in the diagnosis and recovery from a cyber-attack. Once an alert is detected, the user can leverage the information to determine the steps for a recovery plan. From the Cyber Recovery UI, navigate to **Policies->Copies**. Select the copy with status Suspicious. The details will display the Cyber Detect host FQDN/IP.

Click on the Host "cybersense.vault.local"

Click OK to confirm and open the Cyber Detect Analyze Dashboard

Click Alerts

Click Show Files. Files have been encrypted and RYK ransomware extension (Attack Profile 4- Strong

Review the analysis details, and focus on the Modified time that might indicate the infection time. Recovery from a Good copy before this time might be a possible solution for this specific cyber-attack.

Click "Download" to download the report.

PPDM Recovery from Last known GOOD copy

We will run a PPDM Recovery from the last known GOOD copy in the Module 4. The Vault PPDM is already deployed with a different hostname and a different IP address than the production PPDM.

Infected data for NetWorker-FS policy

Infected data for Production client (client1.demo.local) is already backed up to Production DD ddveprod.demo.local using Production NetWorker (192.168.1.20) and synced to Vault DD ddvevault.vault.local

Users can view the infected data by accessing **CS-Data --> Pre-configured NW policy** folder on the Launch Pad desktop. The infected data was copied to the production client to the **/temp** directory, backed up and synced.

Create a Copy and Analyze it

Let's now create a copy of infected data which was already synced to Vault DD. Select **NetWorker-FS** policy under Policies tab click **Run Now.**

Select **Copy Lock**

Select Retention Lock Duration of default 12 hours and click Run

Navigate to the **Jobs -> Protection Jobs** page. Ensure the Copy Lock Job is completed.

Navigate to **Policies -->Copies** tab and analyze the latest copy generated for NetWorker-FS policy after Copy Lock operation. Select the copy, click Cyber Detect Actions and select Analyze.

Select the Cyber Detect Application host

Click Apply.

Analysis in progress

Navigate to Jobs

Navigate to the Jobs section and monitor the analyze operation until completion. Select and click the Analyze Job to view Job Details.

Analyze Job completed with the status "**Completed w/ Exceptions**" which means that this copy of NetWorker data is **Infected**

Click on the alert link to navigate to Alerts and see the infected alert

Review the infected copy

Navigate to **Policies->Copies** tab to see the analysis result and copy details. Suspicious state means that copy is **infected** and we will use the previous **good** copy to recover data.

Email Notification post attack Analysis

If email alerts are enabled, Cyber Detect sends an email alert for both **Success** and **Critical** analysis jobs and report if an infected backup set was detected. The email includes an attached csv file. The text file contains a full listing of all the statistics generated by Cyber Detect analytics. Also included is information on the specific attack profile that was detected.

Open "Mozilla Thunderbird" Email client from the Desktop

Review the CSV report

The attack profile is determined from using the analytics collected for each backup, knowledge of how these user content/analytics change over time, and then by processing the data with machine-learning algorithms. The attack profile identifier provides the information on the type of corruption caused by the current cyber-attack. These are the attack profiles: 1 - Strong Encrypt w/ Original Filename \ 4 - Strong Encrypt w/ New Known Ransomware Extension \ 6 - Strong Encrypt w/ Obfuscated Filename \ 14 - A profile of 14 is a special case which indicates possible corruption of a database

Save the report.csv file on the Desktop and open the file using the CSVFileView application.

You should first filter the report to show only the backups that are suspect of a ransomware attack. Alert - The “**Alert**” column in the Analysis file includes a number that corresponds to the specific attack profile for that backup if an infection is suspected and blank if the backup is not suspect of an attack. Sort the "**Alert**" column. In those rows, you can identify the server and backupset that are suspect.

CyberSense uses machine learning to diagnose the attack profile. Go to the last page of Properties and check the attack profile value of the "Infected" property. This attack profile is ”6” which is "strong encryption with obfuscated filename"

Download the CSV report for infected copy

Reports can be downloaded from the email or directly from the CR GUI under Policies --> Copies --> Analysis Report Actions option. It can also be used to email the report to other users.

Post-Attack Forensics With Cyber Detect Analyze Dashboard

From the Cyber Recovery UI, navigate to Policies --> Copies and click on the infected Copy to review its details. The details will display the Cyber Detect host FQDN/IP. Click on the Cyber Detect host to open the Cyber Detect Analyze Dashboard. Alternatively, users can find this link from the Analyze Job itself.

Click "OK"

Click Alerts

The Analyze Dashboard displays the alerts summary and alerts details. The details include the location of the infection, the type of encryption or infection method that was used by the ransomware, the Policy name, the MAC address of the Cyber Detect server. In this case files have been encrypted and the files extension has been changed to .dsc for all PDF files on the production Linux client.

This last section of the Dashboard displays statistics of the selected Alert and a list of suspect files at the bottom. The list can be grouped by the fields listed in the column headers. Click on an infected file to display its details

In addition to the graphical report, you can download a CSV version of it using the **Download** button

NetWorker Recovery from Last known GOOD copy

We will run a NetWorker Recovery from the last known GOOD copy in the next module. A Vault NetWorker server is already deployed with the same hostname of the Production NetWorker but with a different IP address.

Conclusion

This concludes the Data Analysis Using Cyber Detect and the post-attack forensics.

Module 1 - Data Analysis using Cyber Detect

This module provides an overview of Cyber Recovery Policies creation and running actions such as Secure Copy, Sync Copy, etc.. We will then analyze the copies using Cyber Detect.

Review the existing Cyber Recovery pre-created policies for NetWorker and PPDM

In this lesson you'll Analyze NetWorker copies using CyberSense and learn how to understand the data CyberSense displays for a post-attack investigation.

Navigate to the Policies section of the UI. You should see the **NetWorker-FS** and **PPDM-FS-Linux** policies that were already created as a part of this lab.

Copies Analysis using Cyber Detect

Click "Focusing on remote session"

Click the Configure link on the "Interface Links" column of the Cyber Detect server

Select the Data Domain system

The **status** should indicate **Active** in order for you to be able to analyze copies. It might take several minutes before the status is updated.

Select the **Policies** page and navigate to **Copies**. Review the last **GOOD** copies related to policy **NetWorker-FS** and **PPDM-FS-Linux**.

PPDM Copies Analysis

In this lesson you'll Analyze PPDM copies using Cyber Detect and learn how to understand the data Cyber Detect displays for a post-attack investigation.

Run Copy Lock for PPDM Policy and Run Analysis

Select the policy, click Run Now

Select Copy Lock

Click Run

Click on Copies.

Copy creation is successful.

Job showing Copy Operation successful

Once the **Copy Lock** operation is successful, Navigate to **Copies** section. Select the copy click **Cyber Detect Actions.** Click Analyze.

Select Cyber Detect host.

Click Apply

Analysis in progress

Click "Focusing on remote session"

Navigate to Jobs->Protection Jobs->Running

select the job and click on view details

Review the infected copy

Navigate to **Policies --> Copies** tab to see the analysis result. **Suspicious** analysis status means that copy is infected. We will use the previous **Good** copy to recover data.

Click "Focusing on remote session"

Review CSV report

Open Thunderbird Email client from the Desktop and download the CSV report for review

Select the file and click Open

Post-Attack Forensics With Cyber Detect Analyze Dashboard

Click on the Host "cybersense.vault.local"

Click OK to confirm and open the Cyber Detect Analyze Dashboard

Click Alerts

Click Show Files. Files have been encrypted and RYK ransomware extension (Attack Profile 4- Strong

Click "Download" to download the report.

PPDM Recovery from Last known GOOD copy

We will run a PPDM Recovery from the last known GOOD copy in the Module 4. The Vault PPDM is already deployed with a different hostname and a different IP address than the production PPDM.

Infected data for NetWorker-FS policy

Create a Copy and Analyze it

Let's now create a copy of infected data which was already synced to Vault DD. Select **NetWorker-FS** policy under Policies tab click **Run Now.**

Select **Copy Lock**

Select Retention Lock Duration of default 12 hours and click Run

Navigate to the **Jobs -> Protection Jobs** page. Ensure the Copy Lock Job is completed.

Navigate to **Policies -->Copies** tab and analyze the latest copy generated for NetWorker-FS policy after Copy Lock operation. Select the copy, click Cyber Detect Actions and select Analyze.

Select the Cyber Detect Application host

Click Apply.

Analysis in progress

Navigate to Jobs

Navigate to the Jobs section and monitor the analyze operation until completion. Select and click the Analyze Job to view Job Details.

Analyze Job completed with the status "**Completed w/ Exceptions**" which means that this copy of NetWorker data is **Infected**

Click on the alert link to navigate to Alerts and see the infected alert

Review the infected copy

Navigate to **Policies->Copies** tab to see the analysis result and copy details. Suspicious state means that copy is **infected** and we will use the previous **good** copy to recover data.

Email Notification post attack Analysis

Open "Mozilla Thunderbird" Email client from the Desktop

Review the CSV report

Save the report.csv file on the Desktop and open the file using the CSVFileView application.

Download the CSV report for infected copy

Reports can be downloaded from the email or directly from the CR GUI under Policies --> Copies --> Analysis Report Actions option. It can also be used to email the report to other users.

Post-Attack Forensics With Cyber Detect Analyze Dashboard

Click "OK"

Click Alerts

In addition to the graphical report, you can download a CSV version of it using the **Download** button

NetWorker Recovery from Last known GOOD copy

Conclusion

This concludes the Data Analysis Using Cyber Detect and the post-attack forensics.