[en] In today's digital landscape, organizations of all sizes can expect to experience cybersecurity incidents at some point, making it imperative that they implement robust strategies to both anticipate and effectively respond to such threats. These incidents come in many forms, each with its own intent, capability, and technique, requiring advancements in security measures that not only minimize exposure to new threats, but also quickly analyze and mitigate potential risks. Given the complexity of these incidents, organizations should prioritize implementing a well-structured incident response plan to effectively manage and recover from security breaches. To address the heterogeneous nature of cybersecurity incidents, organizations rely on a comprehensive incident response process that includes four key phases: (i) preparation; (ii) detection and analysis; (iii) containment, remediation, and recovery; and (iv) post-incident activity. At the same time, adversaries follow a meticulous process to execute intrusions, each with their own set of tactics to achieve their objectives. Understanding these adversary tactics is critical for organizations to proactively defend themselves and mitigate potential cyber threats. This dissertation explores three topics of incident response: incident prevention, preliminary incident analysis, and in-depth incident analysis. First, we present a comparative analysis and evaluation of IoT protocols for data exfiltration. Second, we show how memory forensics can help quickly identify the presence of malware or discard legitimate processes in a initial triage. Finally, we explore how dynamic analysis and symbolic execution can help analyze executables that implement unknown network protocols. Our main conclusions are that the IoT protocols MQTT and AMQP emerged as the most suitable options for data exfiltration, due to their optimization for data transfer and their common use in IoT cloud connections through gateways. We also introduced a taxonomy of Windows persistence methods and highlighted their importance in memory forensics analysis. In addition, we explored the effectiveness of relying on code signing in memory forensics, highlighting its limited utility due to incomplete data and changes caused by system runtime. Furthermore, we introduced a system that uses tainted dynamic control-flow graphs and symbolic execution to analyze binaries that implement unknown network protocols; although this proposal can help an analyst, it currently faces limitations such as dependencies on protocol status codes, requirements for valid initial datasets, and partial communication views with protocols involving multiple socket connections.

[es] En el panorama digital actual, las organizaciones –independientemente de su tamaño– son susceptibles de experimentar incidentes de ciberseguridad durante el desarrollo de su actividad, por lo que es primordial que implementen estrategias sólidas tanto para anticiparse como para responder eficazmente a tales amenazas. Estos incidentes se manifiestan de muchas formas, cada cual con su propia intención, capacidad y técnica, lo que requiere de avances en las medidas de seguridad que no sólo minimicen la exposición a nuevas amenazas, sino que también analicen y mitiguen rápidamente los potenciales riesgos. Dada la complejidad de estos incidentes, las organizaciones deben dar prioridad a la implantación de un plan de respuesta a incidentes bien estructurado para gestionar y recuperarse eficazmente de las brechas de seguridad. Para hacer frente a la naturaleza heterogénea de los incidentes de ciberseguridad, las organizaciones se basan en un proceso integral de respuesta a incidentes que incluye cuatro fases clave: (i) preparación; (ii) detección y análisis; (iii) contención, remediación y recuperación; y (iv) actividad posterior al incidente. Al mismo tiempo, los adversarios siguen un meticuloso proceso para ejecutar sus intrusiones, en el que cuentan con su propio conjunto de tácticas para lograr sus objetivos. Comprender estas tácticas de los adversarios es fundamental para que las organizaciones puedan defenderse de forma proactiva y mitigar las posibles ciberamenazas. Esta tesis explora tres temas de la respuesta a incidentes: prevención de incidentes, análisis preliminar de incidentes y análisis en profundidad de incidentes. En primer lugar, presentamos un análisis comparativo y una evaluación de los protocolos IoT para la exfiltración de datos. En segundo lugar, mostramos cómo el análisis forense de memoria puede ayudar a identificar rápidamente la presencia de malware o descartar procesos legítimos en un triaje inicial. Por último, exploramos cómo el análisis dinámico y la ejecución simbólica pueden ayudar a analizar ejecutables que implementan protocolos de red desconocidos. Nuestras principales conclusiones son que los protocolos IoT MQTT y AMQP emergen como las opciones más adecuadas para la exfiltración de datos, debido a su optimización para la transferencia de datos y a su uso común en conexiones IoT en la nube a través de puertas de enlace. También introducimos una taxonomía de los métodos de persistencia de Windows y destacamos su importancia en el análisis forense de memoria. Además, exploramos la eficacia de basarse en la firma de código en el análisis forense de memoria, destacando su limitada utilidad debido a la presencia de datos incompletos y cambios causados por el tiempo de ejecución del sistema. Además, introducimos un sistema que utiliza gráficos de flujo de control dinámicos contaminados y ejecución simbólica para analizar binarios que implementan protocolos de red desconocidos; aunque esta propuesta puede ayudar a un analista, actualmente se enfrenta a limitaciones como la dependencia de códigos de estado en el protocolo, requisitos para el conjunto válido de datos iniciales y la visión parcial de la comunicación con protocolos que implican múltiples conexiones de socket. -------------------------------- In today's digital landscape, organizations of all sizes can expect to experience cybersecurity incidents at some point, making it imperative that they implement robust strategies to both anticipate and effectively respond to such threats. These incidents come in many forms, each with its own intent, capability, and technique, requiring advancements in security measures that not only minimize exposure to new threats, but also quickly analyze and mitigate potential risks. Given the complexity of these incidents, organizations should prioritize implementing a well-structured incident response plan to effectively manage and recover from security breaches. To address the heterogeneous nature of cybersecurity incidents, organizations rely on a comprehensive incident response process that includes four key phases: (i) preparation; (ii) detection and analysis; (iii) containment, remediation, and recovery; and (iv) post-incident activity. At the same time, adversaries follow a meticulous process to execute intrusions, each with their own set of tactics to achieve their objectives. Understanding these adversary tactics is critical for organizations to proactively defend themselves and mitigate potential cyber threats. This dissertation explores three topics of incident response: incident prevention, preliminary incident analysis, and in-depth incident analysis. First, we present a comparative analysis and evaluation of IoT protocols for data exfiltration. Second, we show how memory forensics can help quickly identify the presence of malware or discard legitimate processes in a initial triage. Finally, we explore how dynamic analysis and symbolic execution can help analyze executables that implement unknown network protocols. Our main conclusions are that the IoT protocols MQTT and AMQP emerged as the most suitable options for data exfiltration, due to their optimization for data transfer and their common use in IoT cloud connections through gateways. We also introduced a taxonomy of Windows persistence methods and highlighted their importance in memory forensics analysis. In addition, we explored the effectiveness of relying on code signing in memory forensics, highlighting its limited utility due to incomplete data and changes caused by system runtime. Furthermore, we introduced a system that uses tainted dynamic control-flow graphs and symbolic execution to analyze binaries that implement unknown network protocols; although this proposal can help an analyst, it currently faces limitations such as dependencies on protocol status codes, requirements for valid initial datasets, and partial communication views with protocols involving multiple socket connections.