Good evening aspirants welcome to the hindu news analysis by Shankarase academy for the date 29th of January 2022. These are the list of news articles we will be discussing today. Today before starting the daily news analysis we will discuss one previous year prelims question and one previous year mains question. I have chosen both the questions the prelims and the mains from the static part of modern India. I chose this topic because as prelims is approaching I want you guys to brush up on your static part. First let us take the prelims question. This question appeared on the 2016 prelims paper. Let me read out the question. The plan of Sir Stafford Cripps envisioned that after the second world war this is the question. The statements given are first statement India should be granted complete independence. The second statement India should be partitioned into two before granting independence. Third statement India should be made a republic with the condition that she will join the commonwealth. Fourth statement India should be given dominion status. See this is a very easy question. I am very sure everyone will be aware of the answer. The correct answer here is option D India should be given dominion status. So in the context of this question as a revision we will discuss everything about Cripps mission. Ok that is its background its significance and why the Cripps mission failed. First a little bit of background. We know that in 1939 world war 2 started when Britain and France declared war on Germany when Germany invaded Poland. The Viceroy at that time in India was Lord Linlithkov. See Linlithkov declared that British India would take part in the war in support of the British Empire. He did so without consulting the Indians. This move of Linlithkov angered many. See we Indians were angry because of our previous experience during world war 1. During world war 1 Indians supported the British war efforts hoping to get concession after the war. But this did not happen and we felt cheated. So when Linlithkov said British Indian army will fight in big off of the British Empire everyone was arguably angry. So Congress party which was heading 7 provincial governments at that time resigned from all the 7 provinces. On a side note here the day when the Congress government resigned the Muslim League celebrated the day as the day of deliverance. So although the British Indian army was fighting for the British Empire Indians in general were against the war. See in 1941 Japan carried out an air strike on Pearl Harbor. This made the United States entered the war in support of the Allies. When the United States entered the war it was creating pressure on the British government against its imperial policies in India. Also the United States was keen on getting Indian support for the war. This was one of the reasons that motivated the British government to send the Krips mission. See the next reason is that Japan was rapidly advancing. The fall of Burma to Japanese forces worried the British. The threat of Japanese invasion of India was very evident. See this threat of Japanese invasion pressured the British to get Indian cooperation for British war efforts. This was the other reasons that motivated the British to send Krips mission. So due to these reasons the Krips mission was sent to India on March 1942. Having done with the reasons now let us see the proposals made by the Krips mission. The most important proposal of Krips mission is setting up of an Indian Dominion. Krips mission also proposed that the Dominion would have the freedom to remain with the British Commonwealth or to cede from it. The Indian Dominion would also be at liberty to take part in the international organizations. On a side note here I am going to list out the various places where Dominion status is mentioned. It was mentioned in the Nero report of 1928 where Mothilal Nero asked for the Dominion status for India on the lines of Australia and Canada. Then the Dominion status was again mentioned during the Calcutta Congress session of 1928. In the Calcutta Congress session the Congress gave a one year ultimatum to the British government to accept and give the Dominion status to India. Congress said if the British government does not offer Dominion status to India within one year civil disobedience movement for complete intubations will be launched. Then during the Irwin's declaration of October 1929 the Viceroy proclaimed that the ultimate aim of the British government is to provide Dominion status to India. Here note that during the Irwin declaration he did not offer any time limit during which the Dominion status would be given. Then during the Delhi manifesto of 1929 the National leaders proposed that the purpose of the Raul table conference should not be to determine whether and when to give the Dominion status but to formulate a solid plan for the implementation of Dominion status. So in the Delhi manifesto of November 1929 also the Dominion status was mentioned. Then again in August of 1940 Lord Linditko announced Dominion status as the objective for India and again like we discussed it was mentioned during the Crips mission. See the Dominion status was also mentioned in the Mountbatten plan of 1947. Here it was proposed for the immediate transfer of power on the basis of grant of Dominion status to the Indians. Finally Dominion was again mentioned in the Indian independence act of 1947. The act here proposed for the creation of two independent Dominion of India and Pakistan. See these are the places Dominion status is mentioned. I think I have covered everything. If I have missed something just post it in the comment section. Now coming back we saw that the Crips mission proposed for the setting up of an Indian Dominion once the war gets over. The mission also said that the Dominion also had the right to be with the British common wealth or it has the right to seed from the common wealth. See this right to seed from the common wealth indicated that in the future full sovereignty would be provided. Next the mission proposed that a constituent assembly would be formed to frame a new constitution for the country. This assembly would have members elected by the provincial assemblies and in the case of princely states the members would be nominated by the princes. See this was the first time it was mentioned that Indians could form their own constitution. The next is that the mission also said that any provinces unwilling to join the Indian union could form a separate union and have a separate constitution. See this provision is important because this proposal of giving freedom to the provinces to be a separate union turned out to be the model for the country's partition in 1947. The mission said until the new constitution is formed the defense of India would be under British control and the power of Governor-General would remain the same. Finally the Crips mission also ensued that the rights of the minorities would be protected. See these are some important proposals of the Crips mission. We know that the Crips mission ended up a failure. The failure of the Crips mission resulted in Mahatma Gandhi initiating the Quit India movement in August 1942. So now we will see why the Crips mission ended up a failure. See the Indians considered the proposals of the Crips mission to be more conservative while the Britishers considered the proposals of the mission to be more radical. This was the main reason for the failure of the Crips mission. The Indian National Congress specifically rejected the mission due to the following reasons. First is that the mission gave right for the provinces to form separate union. The INC thought this provision could lead to Balkanization of India so it opposed the Crips mission. Again the next is that the Indian National Congress opposed the proposals of the Crips mission because there was no provision for the sharing of defense related powers with Indians. Also the proposal mentioned that the Governor-General would continue to have the power. The INC just wanted the Governor-General to act as a constitutional head. This was also the reason for the INC not accepting the Crips mission. Finally the Indian National Congress opposed the proposal because it lacked a concrete plan for the immediate transfer of power. So these are the reasons why the Indian National Congress opposed the Crips mission. Now we will see why the Muslim League opposed the Crips mission. Actually they opposed the Crips mission for different reasons. First is the Muslim League was against the idea of a single union for India. The next reason is that the Muslim League did not like the procedure in which the constitution assembly is to be created. So the Congress and the Muslim League opposed the Crips mission. See including them the Hindu Mahasabha also opposed the Crips mission because the Hindu Mahasabha was against the provision that gave the rights for the states to seed or separate from the Indian Union. The mission also failed because there was a clear lack of support for it from the Viceroy Linlithgau, the British Prime Minister at that time Winstead Churchill and the Secretary of State for India Leo Amri. This is all you have to know about Crips mission. I think I have covered every nook and corner of it and with this discussion I am sure you would be able to answer any question asked from the Crips mission part. Before moving on to the main question discussion I want a suggestion from you guys. In my future discussions if I am doing a discussion based on previous year's problems question should I cover it like today that is take one question and discuss the entire topic elaborately or instead should I limit the discussion and focus on covering three or four questions okay. Give your suggestions because your suggestions will be helpful for me to take this thing forward. So post your suggestions in the comment section. Now let us complete this session and take up the main question for discussion. This is the main question we will be discussing today. This is from the 2019 General Studies paper one. This question is also from the static part of modern India. Let me read the question. The 1857 uprising was the culmination of the recurring big and small rebellions that had occurred in the preceding 100 years of British rule. Elucidate. See here the key word is elucidate. See elucidate actually means to explain clearly. So while writing the answer for this question you must explain clearly to the evaluator how the 1957 uprising was indeed a culmination of big and small rebellions that had occurred in the preceding 100 years. Since this is a static question I am not going to discuss the entire answer here. Instead I am going to guide you how to approach the question okay. See in the introduction part you can mention about the nature of the pre 1857 rebellions. We know that they were small localized in character and they were very isolated. See the rebellions that is the pre 1857 rebellions had their own goals and they lacked a common goal. See even though these pre 1857 rebellions lacked a long term vision they are still important because they helped motivate people. See this introduction is enough okay. You can also write your own introduction for your answers okay. Now moving on to the body of the answer. See the question here has a statement saying 1857 uprising was the culmination of recurrent big and small rebellions okay. So if you just list out the rebellions that happened before 1857 uprising you won't get the maximum marks. What you must do is by listing out the rebellions you must link the answer to the question by mentioning how these small rebellions eventually resulted in the 1857 uprising. This is why the keyword elucidate is given. So stay cautious. You should not just list out the rebellions. You should write them and link them to the question to fetch the maximum marks. Now I am going to give a general structure of the body of the answer okay. See the pre 1857 uprising can be classified into three types. That is tribal uprising, peasant uprising and the uprisings that have religious nature. First let us take up tribal uprising. Here you can mention about Santal uprising, Konda uprising and the Kohl uprising. The main reason behind all these uprisings is changes in the land revenue system brought by the British which affected the tribal way of life and once the rebellions took place the British government stopped the rebellion with a heavy oppression. So the tribal population were angry at the British. Second let us take the peasant uprising. Here you can mention about Rangpur Dihang, Pagalpanthiri vault and the Narbalberia uprising of 1831. See the peasants were also affected by the changes in land revenue brought by the British. Due to the new changes the peasants were exploited by the moneylenders and the local landlords. So they were also dissatisfied with the British. The third type of uprising that happened before 1857 are the rebellions of religious nature. Here you can mention about Fyrazi movement and the Sanyasi rebellion. See the British interfered with the religion of the people. They also supported the work of Christian missionaries. This also angered the people. See in all these cases the British took well the rebellion came down with a heavy hand. So there was a general resentment against the British from all the sections of the society from tribals to peasants to religious people. So this is how the big and small rebellions culminated in the 1857 uprising. That is this general resentment against the British policies resulted in the 1857 uprising. See here I did not just list out the rebellions. What I did was I wrote the rebellions and tied it up with the question. So this is how you have to write an answer for the question which has the word elucidate on it. Okay here I did not give the entire answer. I want you to try writing this answer and post it in the comment section. Now let us wind up the previous year main question discussion and take up the first article for our discussion. See this article here it says that banks are planning to transfer the non-performing assets to the national asset reconstruction company limited that is NIRCL or the bad bank. It is set up to help resolve the stress faced by the banks. The article says that 15 non-performing assets or accounts worth rupees 50,000 crores are to be transferred to the NIRCL and also according to the article approvals have been received for setting up of the NIRCL and the India Debt Resolution Company Limited that is IDRCL. So this is the crux of the article given here. In this discussion let us see about NIRCL and IDRCL in detail. The syllabus regarding this discussion is highlighted here you can go through it. First of all what is a bad bank? See our bad bank is a bank set up to buy the bad loans of another financial institution. The entity or institution holding significant non-performing assets will sell these holdings to the bad bank at a set market price. By transferring such assets to the bad bank the original institution may clear its balance sheet. So this is exactly what banks are planning to do according to the article we have taken here. So with this understanding let us see about NIRCL. See the plan to form a bad bank to clean up banks balance sheets was announced in the union budget last year that is 2021. The new entity is being created in collaboration with both public and private sector banks. The NIRCL has been incorporated under the Companies Act and has applied to the Reserve Bank of India for license as an asset reconstruction company or ARC under the new structure approved by the regulator that is the Reserve Bank of India. The bad bank that is the NIRCL will acquire and aggregate the bad loan accounts from the banks while the India Depth Resolution Company Limited that is IDRCL will handle the resolution process under an exclusive agreement. See what is the role of these two bodies? Under the new framework banks will aggregate and consolidate stressed assets with NIRCL for resolution. Here stressed assets mean non-performing assets. Public sector banks will hold 51% ownership in the NIRCL. NIRCL will acquire fully provisioned stressed assets by making an offer to the lead bank in a consortium of lenders. And once the offer is accepted NIRCL will engage with IDRCL for management and resolution of the stressed assets. In IDRCL private entities will maintain 51% ownership with the government holding the rest. The NIRCL will acquire the stressed assets of about Rs 2 lakh crore in a phased manner. The stressed asset will be acquired through a 15% upfront cash payment and 85% in the form of security receipts. For this purpose the cabinet cleared the proposal to provide a government guarantee worth Rs 30,000 crores to security receipts issued by the NIRCL. The difference between the phased value of the stressed asset from the realized value from the sale or the liquidation of asset represents the guarantee offered by the government. The guarantee will be valid for a period of 5 years. Now you may think why such a guarantee is given by the government? See it is done to impart credibility and to provide for a contingency buffer. And now we will see what the IDRCL will do. See IDRCL is a service or an operational entity established to manage the stressed asset and engage with market professionals including turn-around experts. Stressed assets acquired by NIRCL will be managed by IDRCL for price discovery and value addition. So to simply put NIRCL will acquire and aggregate the stressed assets. The IDRCL will handle the resolution process of the assets by doing value addition. Now we will see the significance of the bad bank. See basically if a bank has a high non-performing assets a large part of its profits would be utilized to cut losses. As a result any bank with more non-performing assets is likely to become more risky and it would be less willing to lend money to the borrowers. This in turn will make it difficult for the businessmen and customers or consumers to take loans from the banks. This affects the overall functioning of the economy. Ok because people are not able to get credit from the bank. See moreover in India a large portion of non-performing assets is with the government owned public sector banks or the PSBs. In the past the government has issued more capital to take care of the non-performing assets problem and to improve the financial health of the public sector banks. So this means the government will have very less money for other welfare schemes. So this is also an issue associated with non-performing assets. See as per the World Bank data the share of NPA to the gross loans in India is significantly high compared to the developed western economies. Look at this image here. See when compared to other economies like the United States the United Kingdom Germany and China India's NPA is significantly higher. Ok see till now we saw about the significance of the bad banks now we will move on and see the issues associated with the bad banks. One of the issues which may arise is telling the stressed asset to potential buyers and resolving the underlying crisis in the system. See in the current situation when economic conditions are deteriorating finding a potential buyer for distressed asset can be a very significant challenge. There is a lack of buyer's demand also the public sector banks will be both shareholders and customers of the bad bank ok and it will lead to the danger of bad bank being a means to shift bad depth from one book that is from the public sector bank to the other book that is the bad banks book ok. And the next key challenge includes the need for rapid reliable data collection and analysis because there is actually a lack of reliable data collection and analysis ok. It requires financial as well as more manpower. Now we have seen the issues associated with bad banks. Now let us understand why the move is a much needed one especially in the current economic situation. See bad banks in the system are expected to increase in the wake of contraction in the economy and the problems faced by many sectors. The RBI noted in its recent financial stability report that the cross non-performing assets of the banking sectors are expected to be shot up to 13.5% of advances by September 2021 from 17.5% in September 2020. So in this context the aggregation of stressed assets at only entity's hand is undoubtedly expected to speed up the process for finding interested buyers transfer of assets restructuring of debts etc. And more than anything else the quality of such asset will matter the most. Historically we have seen proven examples of formation of bad banks. A plenty of it relied on the evolving socio-economic and political conditions of the country. See as India requires from its hardest economic hit due to Covid-19 the challenges going to be faced by the bad banks are not going to be easy but if tackled properly this could provide a much needed momentum to the entire banking sector. So a fully professionally run bad bank funded by the private lenders and supported by the government can be an effective mechanism to deal with the raising non-performing assets. The bad bank concept is in some ways similar to the asset reconstruction company but the difference is that it is funded by the government initially with the banks and other investors co-investing in its due course. The presence of the government in the bad bank is seen as a means to speed up the cleanup process. Many other countries have set up institutions for dealing with non-performing assets. For example in the United States there is a troubled asset relief program which deals with the problem of financial stress in the economy. This has been successful in the United States. Now before winding up the discussion here we saw some points about NARCL and the IDRCL. We saw about the functions of NARCL and IDRCL. Next we moved on to the significance of bad banks and we also saw some issues associated with the bad banks. And finally before concluding we saw about the importance of bad banks in the present economic condition. With this let us conclude this discussion and take up the next news article. Look at this news article. This news article mentions about a study on the coronavirus called as NIOCOV. The study has found that a change in the molecular level of NIOCOV could enable it to infect humans. So in this discussion let us see about NIOCOV then about the set study. To understand NIOCOV we must brush up our basics about coronavirus. Here I am not just talking about COVID-19 but the set of viruses called as coronavirus.  They belong to the family called as coronavirus family which is also simply called coronavirus family. One of its sub-families have four genera. They are alpha coronavirus, beta coronavirus, gamma coronavirus and delta coronavirus. Gamma coronaviruses and beta coronaviruses generally affect mammals such as bats and humans. The gamma coronaviruses and the delta coronaviruses are primarily found in birds. Now what impacts does these coronaviruses have? They typically cause respiratory disease in humans and enteritic disease in animals. Entertic disease is the name of any disease caused by an intestinal infection and affects intestines and stomach. Here the one that infects humans are called as human coronaviruses and similarly ones that infect animals are called as animal coronaviruses. So it was thought that coronaviruses cause agriculturally important disease in animals. On the other hand they usually cause milder moderate upper respiratory tract in less like common cold in humans. Currently there are four coronaviruses that have been recognized to cause common cold in humans. They are H-C-O-V-O-C-43, H-C-O-V-H-K-U-1, H-C-O-V-N-L-6-3 and H-C-O-V-229-E, the first two are alpha coronavirus and the next two are beta coronavirus. See this was the scenario before SARS-C-O-V and MERS-C-O-V came into play. That is severe acute respiratory syndrome coronaviruses and the Middle East respiratory syndrome coronaviruses came into play. Here both are beta coronaviruses, they are highly pathogenic coronaviruses and can cause serious and widespread illness and death. The SARS-C-O-V that is the SARS coronavirus emerged in China in 2002. It caused severe acute respiratory syndrome. It was highly pathogenic and there was a 10% fatality rate worldwide. It is said to have disappeared by 2004. Then again after 10 years in 2012 another one emerged in Saudi Arabia. It is called the MERS-C-O-V or the MERS-Coronavirus. It caused Middle East respiratory syndrome and it almost had a 35% mortality rate worldwide. This virus is still causing sporadic and localized outbreaks. Then within the same decade in 2019 the third novel coronavirus emerged which was called as SARS-Coronavirus-2. It causes coronavirus 2019 that is COVID-19. This one emerged in China and it is still causing global pandemic with its variants. The fact to be noted here is that many of these human and animal coronaviruses appear to have origins in a variety of bad species. See, we have heard that bats are natural reservoirs of viruses and harbor a variety of viruses. Now many of these viruses in bats can cause diseases in humans and diseases in agriculturally important animal species. For example, Lysovirus causes Rabbis, Filovirus causes Ebola and Henipa Viruses cause Nepha. And over 200 novel coronaviruses have been identified in bats. Particularly, bats are major hosts for alpha coronaviruses and beta coronaviruses. Even the SARS-Coronavirus and the MERS-Coronavirus have their origins in bats. And the one that causes common cold that is Hutch coronavirus NL63 and the Hutch coronavirus 229E are thought to have origins in bats. This map provides you a bat associated and presumably bat associated emerging infectious diseases around the world. Just go through it. See, several MERS-related coronaviruses are found in bat species. Sometimes they are called bat coronaviruses. One among them is Neo-Coronavirus or the Neo-COV. Note that at the genetic level, Neo-Coronavirus is closer to MERS-Coronavirus than other bat coronaviruses. There is 85% identity at the whole genome level. So it is also a beta coronavirus. Therefore, it is also deadly and dangerous like MERS-Coronavirus. But now, why is it suddenly in news? See, researchers have found that after some molecular changes, the Neo-Coronavirus can also efficiently infect human cells using the same pathway like the SARS-Coronavirus-2 that is COVID-19. So what is the way used by the SARS-Coronavirus-2 to infect human cells? It is the ACE2 receptors. See here, ACE2 stands for angiotensin converting enzyme 2. It is expressed in humans and animals. When it is present in humans, it is mentioned as Hutch ACE2. It is expressed in various human organs, mainly in cell membranes of heart, kidney, lungs, arteries and intestines. It is said to play an important role in regulation of cardiovascular function, renal function and fertility. It is said to protect lungs from severe acute lung injury and kidney from kidney damage. It also plays a role in regulating hypertension and electrolyte balance. Along with this, it also acts as a function receptor for SARS-Coronavirus-2. That is, it provides entry to SARS-Coronavirus-2 or we can say SARS-Coronavirus-2 sneaks into the humans through Hutch ACE2 receptors. In other words, we can also say SARS-Coronavirus-2 spike protein has a strong binding affinity to the Hutch ACE2 receptors. This is the problem. See, when SARS-Coronavirus-2 binds or sneaks in, it down regulates the expression of Hutch ACE2. This makes the ACE2 to forego its protective effect in different organs. Thereby, it is unable to protect from severe acute lung injury, which it was able to before. So, this results in higher infection and transmissibility of SARS-Coronavirus-2, which causes COVID disease. So, this is how ACE2 is related to COVID-19. Now, the research study while studying Neo-Coronavirus have made some findings regarding ACE2 in bats and humans. They found that Neo-Coronavirus can efficiently use some type of bat ACE2. That is, the ACE2 in bats provides entry to Neo-Coronavirus. On the other hand, they found that Hutch ACE2, that is, human ACE2 is less favorable for Neo-Coronavirus's entry. It is unable to bind with Hutch ACE2. So, basically, as of now, there is a species barrier for Neo-Coronavirus in humans, which is preventing human infection. This is a good thing. But there is a cause for worry, because when researchers artificially introduce mutation in Neo-Coronavirus in laboratory settings, the mutated Neo-Coronavirus was able to bind to Hutch ACE2. In the mutated form, the Neo-Coronavirus was 15 to 30 times more efficient in infecting the Hutch ACE2. Plus, they also found that this mutated one could not be suppressed by the antibodies which generally targets SARS-Coronavirus-2 and MERS-Coronavirus. So this poses a potential biosafety threat. So in the future, if there is a natural mutation in Neo-Coronavirus that increases its ability to bind to Hutch ACE2, it may even lead to MERS-Coronavirus-2, resulting in both high fatality and a very high transmission rate. This was the findings of the study. Now, before concluding this session, in this discussion, we saw about basics of coronavirus, SARS-Coronavirus-2, MERS-Coronavirus-2, how SARS-Coronavirus-2 used the Hutch ACE2 receptors to infect humans. And we also saw some points about Neo-Coronavirus. With this, let us conclude this discussion and let us take up the next news article. Look at this editorial article. This article is with reference to the joint statement issued by India and the Central Asian Republics, that is, CAR at the end of the India Central Asia Virtual Summit, which was held on 27 January. During the summit, Prime Minister Modi and the Central Asian leaders discussed the next steps in taking India-Central Asia relations to new heights. This is the crux of this editorial. In this context, we will learn about the significance of Central Asian region for India and the challenges in the India-Central Asian relations. We will also discuss some of the ways to improve India-Central Asia relations. The syllabus relevant to this article is highlighted here for your reference. Kindly go through it. Now let us start our discussion. See, Central region of Asia, which is called Central Asia, extends from the Caspian Sea in the west to the borders of western China in the east. It is bounded on the north by Russia and the south by Iran, Afghanistan and China. The region consists of the former Soviet republics of Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan and Uzbekistan. These five countries constitute the Central Asian republics, which is Khar. The region is strategically vital for many countries like China, Russia, India, the United States and even Europe. Therefore, a geographer named Halford MacKinder observed, he who controls the heartland controls the world. In recent years, foreign affairs analysts have begun observing what they call the new great game in Central Asia. It is characterized by a fierce competition between various states, all aiming to increase their influence, hegemony and power over the Central Asian region. You can see the Central Asian region countries in this map here. Now, we will see in brief about what happened in the virtual summit that is held recently. See, this is the first India-Central Asia summit. It coincided with the 30th anniversary of establishment of diplomatic relationship between India and Central Asian countries. In a historic decision, the leaders agreed to institutionalize the summit mechanism by deciding to hold it every two years. They also agreed on regular meetings of foreign ministers, trade ministers, culture ministers and secretaries of security council to prepare groundwork for summit meetings. Moreover, and India-Central Asia secretariat in Delhi would be set up to support the new mechanism. The leaders discussed about the cooperation in areas of trade and connectivity, developmental cooperation, defense and security. They also stressed on cultural and people-to-people contacts. They also discussed about round table on energy and connectivity and the use of Chabahar port. They went on to discuss about showcasing of Buddhist exhibitions in Central Asian countries and joint counter-terrorism exercises also. Prime Minister Modi also discussed the evolving situation in Afghanistan with the Central Asian leaders. The leaders reiterated their strong support for a peaceful, secure and stable Afghanistan with a truly representative and inclusive government. Prime Minister conveyed India's continued commitment to provide humanitarian assistance to the Afghan people. Now, let us understand the significance of the Central Asia for India. The Central Asia serves as a land-bridge between Asia and Europe and it is very rich in natural resources. It is thus geopolitically significant and economically offers a wide range of opportunities. Okay? Now, we will see the significance of each countries. First let us take Tajikistan. Tajikistan's importance for India lies in its geostatic location. It shares borders with China, Afghanistan, Uzbekistan and Kyrgyzstan. It is also located in proximity to the Pakistan-occupied Kashmir. Next let us take Kazakhstan. See Kazakhstan's importance for India needs to be viewed in the context of India's growing energy needs and Kazakhstan's immense hydrocarbon resource. Next we will take up Turkmenistan. The importance of Turkmenistan for India lies in its enormous gas resource, transit potential and geostatic location. The India imports 70% of its oil requirements right now and it is likely to go up to 90% by 2025. And this fact has made Turkmenistan an attractive destination for India and it is a part of the Tappi which is nothing but a gas pipeline connecting Turkmenistan, Afghanistan, Pakistan and India. Turkmenistan can also serve as a gateway to Central Asia through Iran. Okay? India's point of view, north south corridor would not only help India in reaching out to Central Asia but also enable it to transport goods at a cheaper cost to the European markets also. Now let us take Uzbekistan. Uzbekistan has been appreciative of India's reconstruction efforts in Afghanistan and supports India's candidature for full membership in the United Nations Security Council. Okay? Finally let us take Kyrgyzstan. India has offered assistance to Kyrgyzstan by sending a team to train Kyrgyz armed forces in UN peacekeeping operation and imparting English language skills. Also Kyrgyzstan is located in a geopolitically strategic position. Okay? See, these are the significance of Central Asian Republic nations to India. Okay? Now let us see about the trade relations between Central Asian Republics and the outside world. See, Russia is still a widely influential political and security player in the region. Russia has been promoting its own Eurasian Economic Union to pursue regional and economic integration. See this image here? It shows the trade relations of Central Asian Republics with major countries. It is evident from this graph that the presence of Russia and China is more in the region than other countries. India's trade with this region amounts to just $2 billion, moving to limited connectivity and low economic engagement. Okay? As India ascertains its position as one of the fastest growing major economies of the world, its increased engagement with the region can lead to mutually beneficial gains both in economic and strategic terms. The presence of multiple strong powers in the region offers options to the regional actors like India to balance external pressures also. Okay? Now we have seen the significance of the region. Now we will move on to look at the challenges in the India-Central Asia relations. Okay? To begin with, there is the problem of trade. See, as we discussed, India's trade with the region amounts to just $2 billion, which is a very small amount. And in that too, India spends mostly on Kazakhstan's energy exports to India. See, compare this with China. China-Central Asian Republic trade figures exceed $41 billion, which is over 20 times what India and Central Asian Republics traded. Apart from this, China also invested billions of dollars in the Belt and Road Initiative in the region. This is the first challenge. Now moving on to the second challenge. This is in regards to Pakistan. Actually, Pakistan is denying India's transit rate. So India's other option is to establish route through Iran's Chabahar port. See, Chabahar port is located on the Gulf of Uman, which is just 75 kilometers away from the Gwadar port in Pakistan, which has been developed by China. The port serves as the only oceanic port of Iran and consists of two separate ports, named Sahid, Bihasti, and Sahid Kalanthar. To make the Chabahar port fully operational, greater investment in railways, roadways, through Iran's northern boundaries with the Central Asian Republics is required. But India is hesitant to do so because India fears of U.S. sanctions. In this image, you can see how Chabahar port is closer to Gwadar port of Pakistan. The other option that India can use to establish connectivity to the Central Asian region is through the Russia-Iran International North-South Transport Corridor. See, this Russia-Iran International North-South Transport Corridor is via the Bandar Abbas port. But the thing is that the Bandar Abbas port is not fully operational. And the other issue is that two Central Asian Republics, that is Uzbekistan and Turkmenistan, are not members of the International North-South Transport Corridor. See, the International North-South Transport Corridor project was originally decided between India, Iran, and Russia in 2000 in St. Petersburg. Later, it included 10 other Central Asian and West Asian countries as observers. The countries are Azerbaijan, Armenia, Kazakhstan, Kyrgyzstan, Tajikistan, Turkey, Uzbekistan, Belarus, Oman, Syria, and Bulgaria. See, the International North-South Transport Corridor proposed a 7,200-kilometre-long multimodern network of ship, rail, and road route for transporting freight. It was aimed at reducing the carriage cost between India and Russia by about 30% and bringing down the transit time between 2 by half. You can see the route of International North-South Transport Corridor project in this image. Now coming to the third challenge. India has delayed Tappi gas pipelines due to its tensions with Pakistan. See, Tappi gas pipeline, also called as Peace Pipeline, is a 1,814-kilometre natural gas pipeline that originates from Turkmenistan and passes through Afghanistan and Pakistan to reach India. It aims to monetize the Turkmenistan's gas reserves and supply them to the neighboring countries to promote the use of natural gas and to improve energy security. You can see the pipeline project in this image. This is the third challenge and now let us move on to the final challenge. This is the challenge of Afghanistan. See Afghanistan is becoming a weak link between Central Asia and South Asia. After the Taliban took over Afghanistan, there is no official government and a humanitarian crisis is also building. There are also worries of terrorism, radicalism spreading across its boundaries. So far we discussed the challenges in the India-Centrelation-Republic relations. Now we will discuss some of the solutions to the challenges. The first solution proposed is setting up a joint working group on Afghanistan and Chabahar. This has been even outlined in the summit joint statement, but the thing is that this must be put into action for effective result. Now coming to the second solution. See India has attempted to establish many projects like Chabahar, International North South Transit Corridor and TAPI, but without much success. So India has to complete and operationalize the project by means of diplomatic dialogues. Developing Chabahar port should be on the top priority list. The next solution is that India should remember that it is not the only country strengthening its ties with the Central Asian republics. While Russia is the most important strategic player, China is now the biggest development and infrastructure partner of these countries. So India can diplomatically use Russia to strengthen its ties with the Central Asian republics. India should institute and strengthen defence and security dialogue with the Central Asian countries. Now we will see the fourth suggestion. See education and medical field provide an excellent opportunity for India to showcase its soft power. However, this will require considerable strengthening of infrastructure at home so that the Central Asians who come to India find it a hospitable and a comfortable country. Finally, India will need to move smartly to ensure it adapts with the changes. India should try to make the ties with the Central Asian republics which closely resemble the deep ties of the distant past. This is all regarding this editorial. In this discussion, we looked at the recent virtual summit between India and the Central Asian republics. The importance of the Central Asian republics for India challenges in the India-Central Asia relations and some solutions to overcome these challenges. With this, let us conclude this discussion. Now we will move on to the next news article. Look at this news article. This article states that the Center on Friday appointed Mr. V. Anantanageswaran as the Chief Economic Advisor. In this context, we will learn about the appointment process and the functions of the Chief Economic Advisor. Now let's start our discussion. See, the Chief Economic Advisor is the head of the Economic Division of the Department of Economic Affairs which comes under the Ministry of Finance. This Economic Division examines domestic and international economic trends. The Economic Division undertakes research studies that deals with economic policies and the management of the economy. The Economic Division also offers policy advice. Note here that the recommendations of the Economic Divisions are advisory in nature. Also, the Chief Economic Advisor plays an important role in bringing out the Economic Survey. Note that the Economic Survey presents the Economic Report Card of the Government during the year. It also gives suggestions on possible reforms. The Chief Economic Advisor is a post in the Government of India and is usually equivalent to the rank of Secretary to the Government of India. You can see this in the table that Chief Economic Advisor is placed on par with the Secretary rank. Okay? The Chief Economic Advisor is either selected from inside the Government or from outside like some Professors of Economics. Here Mr. V. Ananta Nageshwaran is a teacher of international economics, exchange rates and financial markets at leading business schools in Singapore as well as India. See this Office of Chief Economic Advisor is not to be confused with the Office of Economic Advisor. Note here that Office of Economic Advisor is an attached Office of the Department for the Promotion of Industry and Internal Trade under Ministry of Commerce and Industry. The main function of the Office of Economic Advisor is giving policy inputs on industrial development. So, the functions of Office of Economic Advisor is different from the functions of Chief Economic Advisor. Note that. Okay? So, now we will see some functions of the Chief Economic Advisor. As we have discussed, the Economic Division of the Department of Economic Affairs is headed by the Chief Economic Advisor. Some of the main functions of the divisions are given in the table. You can go through it. With this, let us conclude this discussion and take up the next news article. Take a look at this article given here. It talks about the Water Connection Targets for the States for 2021-22 under the Gel Jeevan Mission. It is the Centrally Assisted Rural Waters Apply Initiative. With just two months left in the fiscal year, the state government is nowhere near achieving the objective of 29.38 lakh functional household tap connections. So, this is the crux of the article. In the context of this article, we are going to learn about Gel Jeevan Mission from the prelims point of view. First of all, the mission. The Gel Jeevan Mission, a central government initiative under the Ministry of Gel Shakti, aims to ensure access of piped water for every household in India. It is envisioned to provide safe and adequate drinking water through individual household tap connections by 2024 to all households in rural India. The Hargar Nalsi Gel Program was announced by Finance Minister Nirmala Sita Raman in her budget speech of 2019-20. This program forms a crucial part of the Gel Jeevan Mission. The program aims to implement source sustainability measures as mandatory elements such as recharge and reuse through greywater management, water conservation, and rainwater harvesting. The Gel Jeevan Mission will be based on a community approach to water, and it will include extensive information, education, and communication as a key component of the mission. As you can see, you should know the significance of the scheme as well. As you know, already India is facing one of the most serious water crisis. According to the Nithya Yog's Composite Water Management Index, 2018, 21 Indian cities could face day zero in the coming years. Day zero here refers to the day when a place is likely to have no drinking water of its own. Bengaluru, Chennai, Delhi, and Hyderabad are among the most susceptible cities. The report also says that 75% of the Indian households do not have drinking water on the premise, and about 84% of the rural households do not have piped water access. And also water is not properly distributed where it is supplied through pipes. See, megasities like Delhi and Mumbai get more than the standard municipal water norms of 150 liters per capita per day, while other cities get less than 40 to 50 liters per capita per day. So in the present scenario, the Jaljeevan mission's implementation is highly important. The component of Jaljeevan mission that deals with ensuring sustainability should be given more focus to ensure that there is no major water crisis in India in the near future due to climate change. See in this discussion, we saw some important points about Jaljeevan mission. Then we saw the importance of Jaljeevan mission in present scenario. With this, let us conclude the news article discussion session. Now let us take up the practice brilliance questions. Let us take up the first question. This is a previous year question which appeared in the 2021 brilliance paper. Let me read out the question. The term ACE2 is talked about in the context of. See, from our discussion itself, you can easily say that ACE2 is related to the spread of viral disease because it acts as a functional receptors for certain coronaviruses such as SARS coronavirus and the SARS coronavirus too. But also remember, ACE2 has some positive functions also, like it plays a role in regulation of cardiovascular function, relan function and fertility. It is said to protect lungs from severe acute lung injury and kidneys from damage. The ACE2 also plays a role in regulating hypertension and electrolyte balance. From our discussion, we know that the correct answer here is option D, spread of viral diseases. Now moving on to the second question. This is a two statement question. We have to find the correct statement. Okay. Let us take up the first statement. SARS coronavirus, MERS coronavirus and the Neo coronavirus are beta coronaviruses. This statement is correct. From our discussion, we know that SARS coronavirus, MERS coronavirus and Neo coronavirus are indeed beta coronaviruses that infect animals and humans. Okay. Now, let us take up the second statement. SARS coronavirus and SARS coronavirus 2 spike proteins have a strong binding affinity to human angiotensin converting enzyme 2 that is HACE2. See, this statement is also correct. Along with SARS coronavirus 2, SARS coronavirus 1 also have a strong binding affinity to human ACE2. Since both the statements are correct, the correct answer is option C, both 1 and 2. Now moving on. See, this question is about chief economic advisor or CEA. We have to find the incorrect statement. See, this is a very easy static question. We saw in our discussion that chief economic advisor is the head of economic division of the department of economic affairs, which comes under ministry of finance. And the chief economic advisor play a key role in bringing out the economic survey. So, from the statements given here, we know that statement B and statement C are correct and statement A is incorrect. Since they are asking us to find the incorrect statement, the correct answer is option A. Now, let us take up the last problems question for today. This question is in regards to GELG1 mission. Here also two statements are given. We have to find the correct statement. Let us take up the first statement. Okay. It is implemented by ministry of rural development. This statement is incorrect because the program is implemented by ministry of Jalsakthi. Okay. Now, let us take up the second statement. The mission of the program is to provide safe and adequate drinking water through individual household tap connection by 2024 to all households in rural India. See, this statement is correct because it is the mission statement or the vision statement of the program. The program aims to ensure access to piped water to every household in India. Since statement one is incorrect and statement two is correct, the correct answer here is option B2 only. The main question based on today's discussion is here. Write the answer and post it in the comment section. If you like today's discussion, like, comment and share. And for more updates regarding UPSC preparation, subscribe to Shankar A's Academy YouTube channel. Thank you.


Hello everyone, I am glad to be part of DEF CON again this year. Blue team Village, thank you very much for the opportunity and a special thanks to all of you for making time to attend this session. Hunt the Beast in the Shadow. Before we dive into the main topic, let me quickly tell you who is this guy speaking. I am Meisam Aslahi, a Cyber Security Practitioner and Consultant. At the moment I am acting as a Senior Director with EGS, E-Seconcil Global Services for both Reactive and Proactive Cyber Security. I am also a mentor with Blue Team Village and one of the contributors for MITREDefend projects. In my free time I do some research and I do some practical experiments and sharing my finding on the form of the write-up in my blog at CyberMeisamMedium.com or the shorter version in the daily basis at LinkedIn and Twitter. I would be more than happy to connect to you and more than happy to have you in my professional network. So here is the agenda for today. We are going to have a brief discussion about Reactive Cyber Security, a little bit of the challenges and why we need Proactive Cyber Security in parallel. We continue with explanation of a file-less threat that we are going to hunt in this trilogy with three different methods, system life analysis, memory forensics and network packet investigations. But before getting hunted, Reactive Cyber Security. In this case, we spend heavily on the technology, we deploy them in the multi-layer approach, we assume protection and we keep monitoring. In case Cyber Security happened, which must probably happen, we trigger the incident response and following by a digital forensic investigation. Nothing ranked with this approach, actually the Reactive Cyber Security is an integral part of our strategy. But according to the IBM, only 80% of the cyber threat and attacks can be successfully detected by automated Cyber Security solutions, SOC Tier 1 and Tier 2. The remaining are those sophisticated attacks that can avoid the standard detections, bypass our Cyber Security solution and remain undetected in our environment up to 280 days, which is quite a long period of time for an attacker to play around in our environment and cause a serious damages. So one of those sophisticated attack is fileless threat. So when we talk about the fileless threat, it doesn't mean that there is no file activity involved or there will be no trace remain on the hard disk. Yes, there is a rare type of the fileless threat, which completely without files, completely operates in the memory and never touch the hard disk, but they are rare and very difficult to implement it. In general, a fileless threat either need a file to operate or indirectly use a file on the hard disk partially in their life cycle. Then why the fileless threat? Because the malicious part of the activities only conducted in the memory. The malicious part are memory based and not file based. That's why we call them fileless threat. So and that's why they can bypass our automated cyber security. So having a reactive cyber security in our organization is a must, but it would be great idea if in parallel we can add on a proactive approach. In proactive cyber security, unlike the reactive, we assume a breach. We assume that despite the fact that we spend a lot of time, energy and money on our technology to fine tuning our process, educate our staff, a cyber security can occur.  That's why no harm to assume a breach. Keep hunting, fix, improve and prevent the things where it's possible. So the proactive cyber security help us to identify the unknowns and issues, discovering a new attack service, of course, effective risk management and rapid response to the threats. Most importantly, minimizing cyber dual time. The early LVD take the issue, the faster and the better we may able to respond. And during this process, of course, we can enhance our capability and the maturity level, reduce the risk and damage in overall is a main advantage of the proactive cyber security. There are a lot of proactive cyber security practices like security awareness for a staff, cyber drill to fine tune our processes. And one of the technical ones is threat hunting. Threat hunting is a human-derived practice to iteratively look for any sign of malicious activity in our environment in the past and present. So in threat hunting, we have two type in general, an structure and a structure one. In this presentation, we are focusing on the structure threat hunting which is work around educated guests or a hypothesis. The hypothesis is the initial idea that tells us what we should look for and how to look for and a set of steps that threat hunter can follow to detect a potential cyber attack. The hypothesis can be formed around an entity, for example, the high value assets or high risk users. Normally, and mainly we focus on the assets only, but we should keep in mind that behind every assets, there is a human who interact with that assets on that assets and control and have access to data on that assets. That's why it's very important in our hypothesis to consider the high value assets and high risk users. It could be intel-intel driven. For example, a new news about some attacks happen on the particular sector and if by chance we are in the same sector, the chance that we will be the next target is there. So we can trigger a hunt on that direction. So in this presentation, we are focusing on the TTP driven, which is based on the attack techniques that used by the attack vectors. In order to educate our guests and form the hypothesis, we need a threat hunt loop, which is the entire lifecycle of a threat hunting. Start with the initial observation to formulate a hypothesis. To formulate the hypothesis, we can get the aid of the cyber threat intelligence, the other services outcomes. For example, if the red team or blue team practices conducted on our environment and they find some issue and vulnerabilities, we could assume that any of those issues and vulnerabilities may be used by the attackers already and they are in our environment. Then we know what we are looking for. So in this presentation, we focus on the knowledge base. We will talk about it shortly. Once we formulate our hypothesis, we should analyze the requirement, including the source of the data, the tools we need, and the technique we need to collect the data and analyze the data. Then we continue with the investigate and hunt. During the investigate and hunt, we may pivot to the other source of the data. We may actually use a chain of hypotheses. From hypothesis one, we may move to the another educated guesses and hypotheses. So when we come to the finding, we should definitely record them and validate them. Three conditions may happen. Either the finding a firm. So in this case, we should trigger the incident response and digital forensics. We conduct the compromise assessment for the rest of assets in our network. Of course, the enrichment and the automation and most importantly, develop a new detection content with the future. We don't want to manually hunt every and each time for the similar cases, like things should be automated once they are known. So a finding could be rejected or inconclusive. In the case of rejected in, it doesn't mean that we should have peace of mind. Maybe this hypothesis rejects, we need another advanced hypothesis to look for another source of data and so on. In case of the inconclusive, it's maybe because we have the immature hypothesis that we need to work around that or we use the wrong data source and inappropriate tools. Regardless of which loop we are using, we should always review, improve, document and update everything. So let's use this threat hunt loop to hunt a file-less threat. An excellent file-less script written by Daniel Laurie that enable us to demonstrate some kind of file-less threat activities and how to hunt them. If you are keen to know more about it and having a view of a step-by-step implementation, you can follow his YouTube channel. The script is also available in his GitHub page. You can easily download them, execute them in your test environment to sharpen your skills. So the lifecycle of this attack starts with a fake update script which somehow gets into the victim machine. How it has happened, this is not the case to discuss here because we assume a breach. We assume an attacker use many techniques like social engineering or a specific vulnerability to drop that file in a victim machine and convince user to click on it. Once the user execute the script, it pretends that there is some update-related activities ongoing, but in fact, it connects to the server which has a secondary malicious script. Download them and execute them directly into the memory without touching the hard disk and then give us a reverse TCP, shell and remote access. Let's have a quick view. So here I set up a simple HTTP server in the Kali and then I run my NCLE Center on port 443. I execute the update script. As you can see, it shows that some update is going on, but in fact, it's downloading the other scripts, run them and execute them in the memory and give us a remote access. So I run this in the three different scenarios for the Windows Live analysis. I use a Windows 11 as an infected as a victim machine and I am going to use this internal and built-in command to hunt. For memory forensic, I use a Windows 10. Why not 11? This is what we will discuss at the end of this and the end of this presentation. I will use the volatility framework and bulk extractor and strings to hunt in the memory. For network packet investigation, again, I use the Windows 11 and I'm going to use Bireshark, T-Shark, KCPDOM, and T-Shark extractor. Kindly note that I'm not white listing any tools. These are simply the tools that I feel comfortable with and of course, RFMR, free and open source. So to generate the hypothesis, we are using a three different knowledge bases by the MITRE, MITRE ATT&CK, MITRE DEFEND and Cyber Analytics repository. Let the hunt begins. This type of analysis is a hunt that we can't really refuse and it simply refers to the technique in which a hunter collect the data from a running system that may provide us a better understanding of the outgoing events compared to the dead forensic or forensic image analysis. There are a lot of data, wide variety of information to be collected from system information and configuration, user group and privileges, in a style application and running services, process DLL handles, network and internet related data and of course, files and scripts. Because of the time limit, we are not going to cover all of them here, but I have advanced ongoing series on system live forensics in my blog, cybermesammedium.com. Feel free to refer to that to having more advanced write-ups about the system live analysis. So in this presentation, we are only going to focus on the three source of the data which is process and handles, network connections, files and scripts. So I'm going to start with the three simple steps that works for me in the most of the cases for initial educated guess and hypothesis which is collecting the running processes list, the process that running at that particular time in our live system, active network connection, especially the TCP and established one and the process to port mapping to identify which process is behind that particular network connection. So in order to get a list of the processes, there are a lot of tools like the normal task manager or a task list, which is the building command of the windows. However, I'm prefer to using the PS list from the Microsoft sys internal because it gives us the hierarchy of the processes using the switch T with the PS list help us to have the process lineage analysis or process three analysis which is suggested by the different knowledge base. Actually we try to understand who is the parent of each process, who are the siblings and gather the information on how a process initiated that may help us to determine whether the process is malicious or normal one. So running the PS list on the victim machine show us the two instances of the power shell which is already alarming executed with the under the CMD as a parent. So immediately trigger one of the cyber analytics repository detection cases which is power shell executions and suggest that a hunter should look for any version of the power shell that were not launched intractively. Intractively technically means that I am as a user for example, let's say network admin directly execute the power shell which in that case, the parent should be explorer. As we can see here, the parent here is a CMD means it's not intractively executed by a user. The good things about the MITRE analytics is that for most of the detection case they provide us the generic pseudo code that we can easily understand how to implement the detection rule for our automation, cyber security and solutions. So another detection case that related to the process and the process list is a common windows process names that misused by the attacker or used by the attackers to hide their malicious activities. So the attacker use a standard name to hide their malicious activity. So as a first detection hunt and detection, let's check whether these processes are fake or the real and standard windows processes. So again, the MITRE attack knowledge base give us some, the list of the detection methods on how to check whether these files, these processes are a standard. So they suggest two, if the file with no names but in unusual location are suspected or the file hashes that do not match what they're supposed to be. Actually for this case, out of this long list I'm using one of them, which is the match legitimate name or location. So a simple WMIC process helped me to get the process ID plus the executable path. And in order to have a narrow domain I just limited the finding only to those four processes. So as we can see here, it seems they are legitimated because they are executing from the standard windows system 32 folder. So let's switch to the hash values. Get file hash function of the PowerShell help us to generate the hash value of those four processes. So this hash values can be correlated via our knowledge base, our internal resources, community or simply submit to the publicly available resources like VirusTotal. In this case, I submit the con-host hash value to the VirusTotal, which confirm to be a legitimated con-host. So still no peace of mind. Even though these processes are legitimated and a standard, they are still a chance that they are misused by the attacker. That's why we go to another useful detection case by MITREDefend, which is a file access pattern analysis. They provide a very handy example for us how to detect a vipers and the ransomware in case a process has access to the multiple file types, access to the many files, which is located in the multiple location and directories. It could be a indicator of vipers or ransomware. Another handy tools of the SysInternal, which is Handel, help us to gain the information about what are the file and resources that access by the particular process. So I'm using the normal one first without any switch against the CMD and it shows that it has some access to the file which is located in the Windows Cyber Mason download. Obviously, because as we remember, our dropper executed from the same exact path. So I continue with having switch A with the Handel because it gives us more comprehensive information like the port, registry keys, threads and all the process accessed by a particular process, which is in this case, these four instances. And surprisingly, I have seen a lot of indicators. Definitely all of them has access to the Cyber Mason and downloads. So we can see a PowerShell has a Handel which technically means access to the Crypt32 DLL which basically used by the processes in case they want to use some encryption and decryption functionalities. We can see some sort of the information related to the network configuration and TCP IP which indicates that somehow this PowerShell has to do something related to the network. In generic, all of them are alarming. Let's continue with the another useful one which is a command and scripting. So MITRE attack knowledge base suggests that we should monitor a command line argument for a script executed by the any process. Those command may give us some information about what is going on and what each process try to do. So a simple WMIC process get help us, enable us to get a process ID, name and the command line and again limited to only those four. So the command executed by the CMD is interesting because it shows a batch file with the .cmd extension is executed from a download folder. Download folder alone is alarming indicator because it shows that something may download by the user in the download folder and execute it accordingly. So there are another interesting finding that I try to match them with MITRE knowledge bases as much as possible. For example, a cyber analytics again says that unusually long command line strings normally is indicator of the malware activity. However, they didn't define the long, how long it should be. But in this case, as you can see, we have a very long one that indicate the use of the download string, a function of the PowerShell that used to directly download and execute the scripts into the memory, video touching a file. And in this case, as you can see, the win security update is a script that downloaded by using the same technique and function of the PowerShell. So another things is a hide artifacts. Normally attackers try to hide their activity, yes. And in this case, you can see the use of the NOP and window style hidden to hide the windows related to the script running on the victim machine. And so let's focus on the download file because this file downloaded and directly run in the memory. The first thing we try to understand about this file and the CMD, the script with the CMD extension is what is this file and who owns it? This is what we call it a file and resource ownership. So we can easily navigate to the download folder and use a DIR with a Q switch to show the username behind that file. Here, we can see the update script is still there and is owned by the user called CyberMason. If it's possible, we should go and check the content of the file. In this case, you can see the command line which is executed and we observe it in the findings here. It shows again the download of the win security update. So what is this win security update doing? If there is a possibility, we could refer to the same URL or IP and download the script in the isolated system for further analysis, but it's not made possible all the time. And if it's possible, it may alert the attacker because if we are downloading from another location we technically tell the attacker, hey, buddy, we are downloading your script and we are going to analyze it. So in this case, we are getting the win security update and we check the content and we can see encoded, the encoded information. No makes sense why the PowerShell has had access to the Crip32 DLL because it's using the some sort of the decode and encode the data. So this is the simple base 64. We technically can use the echo and decode extension in the Kali Linux to decode the data which indicate another attempt to download the secondary scripts. So having the view of the R1 shows that Suket TCP IP client used to establish a TCP connection to a potentially attacker machine via the port 443 which is a reverse shell. So when we talk about a reverse shell means a network activity is there. The MITRE attack T1049 suggests that the attackers normally upon the initial access to the victim machine try to discover the network connection to evaluate the possibility of finding another vulnerable system or the connectivity. Let's think if the attacker can use this technique for the bad intentions, we as hunters can use it for good. So we can have the list of network connections to see what is going on. A simple net-state dash ANO help us to have the list of all the network connections especially the established TCP one. As we can see here, the network connection is still there which is established by the process ID 9392 to the attacker machine. So here, this is where we need a simple process to port mapping. I'm using a task list and find the name behind the process ID 9392 which is PowerShell. Technically means we have a script which run the PowerShell and that PowerShell give a reverse TCP shell to the attacker. So confirm case, this is the time that we can start generating the IOC and update our automated tools. As it's well said by my friend Josh, threat hunting does not use the IOC, it makes them. Now we know the rules, let's use a free tool, one of my favorite tools, a process explorer. Which can be used to have all these wonder analysis together. So just please keep in mind that we should not install anything on the victim machine and avoid copying or installing anything as much as possible. Technically we should have external storage, copy the file on that, attach it to the live system and then execute the applications and another scripts from the external storage. So up in the execution of the process explorers we can immediately see a very nice view of the process hierarchy that shows the again our CMD and the PowerShell. If you just move your cursor slowly to each process you can see the commands that the command line executed by that particular process. However, if we right click on each process and go to the properties, we have a tabs with many fantastic information. For example, the image tab give us the build time, the path, the command line executed and the current directory. And most interestingly, the TCP IP tab show us the connections established by that process. So as you can see the system live analysis give us a very good point of view about what is happening in the system. However, there are a lot of challenges that we will discuss about it in the last slides in details just to name a few. When we deal with the Windows live analysis or system live analysis, there is always a chance to have an unintentional changes, which is really risky if we change the digital forensic artifact or we change even the system estate. That's why now we are going to focus on the memory forensic which more or less give us the same information, but in a very safe way. We are in the second part of our threat hunt trilogy, which is memory forensics. Let's dive into the past. The first step in the threat hunting via memory forensics is to create a forensic image of a memory or simply a bit by bit copy of the memory of a machine under investigation. Instead of talking about the tools, let's talk about a few rules. As we discussed earlier, we should not copy or install anything on the victim machine because forensically we should avoid any intentional and unintentional changes that may happen to the system estate or the digital artifact during a threat hunt, root cause analysis, threat detection and digital forensics. We need to have a forensically clean external storage which we copy all the necessary files and application on it, attach it to the victim machine, execute the file from there and save the result into the external storage as well. So I created a forensic image of the memory of the infected system and copy it to my investigation system which is a version of Kali Linux utilized with the latest version of the volatility which is volatility framework three at this particular moment. So we can easily refer to the help of the volatility framework to get a list of all the current available plugins to retrieve the information from the memory taking from the Windows operating system. They may look a little bit limited at the moment because the volatility framework that is still new and it takes a little bit time for the community to improve it, make it more mature and develop more profiles and plugins. So let's continue with the first step in detection which is similar to what we did for the system live analysis, process lineage analysis. So the volatility command Windows PS3 give us opportunity to have a list of the processes along with their parents and siblings. As we expected, we can see two instances of the PowerShell which is run under CMD. If you may notice the process IDs here are different from what we observed during the system live analysis is simply because I run these two practices in the two different testbed in two different time, two different time slot. So again, the PowerShell is not interactively executed by a user instead is run under a CMD process. Let's have a view of the handles to see each of these processes access to any file, registry key or any other process. So in this case, I used the volatility, the Windows handle and I limited the finding to only those three suspicious processes which is the two instances of the PowerShell and the CMD. And I used a grab to only look for anything match with the file, key and process. So as we can see here, we can have access to the file by the CMD process which is located to the user cyber may some download again access to a file in the download folder is so suspicious. And we can see here the handle created from the CMD to handle another process, which is 9460. We're referring here is the instances of the PowerShell. Getting the handle for these two PowerShell again indicate the access to the CRIP32 DLL which is used for the decoding, encoding and encryption and some network and TCP IP related settings and information which indicates that this PowerShell doing something via network. So the command line scripting is pretty straight forward to extract from the memory image. We have a built in plugin called CMD line. Again, we can limited only to those three suspicious processes and we can clearly see the process ID here followed by the command executed by that particular process. Here we can see again the CMD executed as an update underscore script batch file with the CMD extension. And one of the instances of the PowerShell use the download string to download a secondary and potentially malicious script from this particular IP via the port 8000 and download strings give opportunity to this PowerShell to download directly to the memory and execute it from there without touching the hard disk. So at the moment we are using the volatility but beside I would like to introduce another two handy techniques. One is one of my favorite tools which is bulk extractor is an open source tool that can scan any hard disk image and memory image and extract a wide variety of the data. You can easily refer to the official GitHub page to check what are those data which is available to extract. Here I just run it against our memory image and extracted various data. So because we are aware of this suspicious IP I use a simple graph to look for anything matched with this IP amongst all the data which is derived by the bulk extractor and we can see here another three IP which is another three scripts downloaded and accessed from the same IP. So apart from the bulk extractor we can use built-in command strings. So we can use the cat to open the memory file and then use the string to look for any strings in the memory image that matched to our IP. Again here we can see the indicator of the download of the three additional scripts. So we are not going to repeat the same process as we did it just for the system dive analysis. If it's possible we download all these scripts into the isolated machine for the further investigations. So if you remember we discussed two challenges they are may not available at this point of the time and even if they are available downloading them may alert the attacker. Another real challenges in the memory forensics because this memory image taken in the past. So means at the moment that we are analyzing those links may not accessible anymore or may not even available. But again third hunting is all about evaluating and exploring the different opportunities. If it's possible we download all the script in the isolated environment, see the contents for further investigations. Just to recall the R1 the said the win security update is the one who has two different base 64 encoded strings when we decoded it is relieved that it's downloading another two file A1 and R1 is the one who make a reverse TCP connection. So when the reverse TCP connection is there the last step would be checking the established network connections which is can be done by the net state plugin of the volatility framework three. The good things about this plugin is that we know need to do the process to port mapping individually because once we obtain the data it shows the owner of each established connection. In this case we can see an active TCP connection to the suspicious IP which is made by PowerShell instance. So now we can confirm that our script download another additional script, execute them from the memory and give the reverse shell access to the potential attacker remotely. In the network packet investigation we may deal with the huge volume of the data. That's why I call it hunt in the ocean. So both MITRE Defend and MITRE Attack give us a list of the techniques to look for the suspicious and malicious activities in the network traffic by analyzing the network connection creation, content and flow. But in general all of the techniques talk about how we should look for the uncommon, unknown and abnormal and untrusted IPs, ports and communications. So in this section I'm using the wire shark to open and pick up a file which is captured traffic from the host which is infected by the file less thread. So in the statistics we can have a conversation and we can have a list of the endpoints. Technically the wire shark statistics give us a good idea about what is happening in the network in term of the protocol hierarchy which we cover shortly, the packet lens or endpoint and conversation. Simply the endpoint list all the endpoints and IP addresses which shows some sort of activities on the time that we collect the data while the conversation is specifically showed the list of the packets sent and received between two different endpoints. So there are a few challenges we are dealing with this kind of the data. If we don't have a baseline for the standard and normal things in our environment it could be difficult to define the uncommon to define the unknowns and to define the untrusted. Sometimes even if we have the baseline we may deal with the large volume of the data which a high diversity, dynamic nature and complexity which make a life a little bit hard for a threat hunter and the poor data management analysis could lead our threat hunt to a failure. So that's why apart from the data collection a proper data classification, filtering and unwanted data reduction plays an important role. For example here I just use a very simple data filtering to filter on the traffic to or from a victim machine which is in this case is <IP_ADDRESS>. So this simple data filtering effectively reduce 20% of unwanted data. When we talking about the huge volume of the data 20% could be a time saver and even a life saver. So the MITREDefend Network Traffic Community Deviation suggests that once we collect a data of the network and the packets we should look for any deviation from what it's supposed to be a routine of our network. Again, if we don't have the baseline we cannot do anything. So in this example I try to just understand who is who. I use a very simple command of the TCP dump to extract all the IP addresses exists on that packet capture file. And then I write a very simple script to run the who is for the public IPs. So technically we can have the list of the IPs exists on that pick up file plus the name of the organization. So in this example all look normal but we should keep in mind not all the knowns are good because a legitimate service may be abused by the attacker to conduct the malicious activities is always good to validate the finding based on the IP reputation system, known IOCs and threat intel feeds or a few extra factors that we are going to explain now. Top protocol simply means that the highest, the top protocol that use in the conversation on the network top host means all the host that shows more activity at accordingly the top conversations is a pair of the host that talk to each other more compared to the others. The two interesting things are top listeners and top talkers. Top listeners are those who receive data more than what they send and top talkers are those who send more data compared to what they receive. So let's have a quick example about these terms. I limited our finding our packets only for the IP address related to the victim machine. So going to the statistics and endpoint tap IP version four sorted by the bytes we can have all the list of the top host which shows more activity on the time that we capture the traffic. So as we can see, there is one private IP which is belong to same network of our victim machine and it appears in the top host list. Going to the statistics and conversation and repeat the same sorted by the bytes and surprisingly we have the same IP appear in the top conversations. Means it shows one of the highest activity in the network and it has one of the highest rate of conversation with our victim. So I use a TCP dump again to extract the list of the top talkers in our network and our suspected IP, it appears there again. So means it was one of the top talkers with talk more with the endpoints in the system. But we may need more details to validate the finding because the devil is in the details. So even though this IP is among the top talkers when we dig more and go for further investigation specifically for the conversation between this IP and our victim, we notice that this IP received more data than sending. So it received more data than sending data to the victim machine. So the MITRE DS-0029 network traffic as a source of, as a data source suggests to monitor network data for uncommon data flows. For example, a client sending significantly more data than it received from the server, which is this case. Let's focus on that particular conversation and extract the protocols that mainly use in this conversation. So we apply that specific conversation as a filter to limited the data only for that conversation. So the filter, the traffic is already filtered based on the victim IP and the suspect IP. So again, from the statistics menu, we can go to the protocol hierarchy and based on what we can observe here, the TCP involved, we have some HTTP traffic and we have some data. So again, MITRE suggests to focus on the application layer protocols because the web protocols are widely used by the cyber attackers to hide the activity amongst the normal web traffic. So in the left side, I added one more filter as HTTP to not only limited the finding to this conversation, but only give us the HTTP related traffic because we have seen the HTTP traffic exist in the protocol hierarchy. So interestingly, we can see a get method used to download a few files. So again, we can focus on these files which is downloaded via the HTTP get, right click on any of them and follow the stream either the TCP or HTTP may give us opportunity to see the content. In this case, we are using the follow HTTP stream to see the content of the win security update, which I believe this is familiar to you and ring a bell for you because this is the same encoded database 64. So when we can see a few files involved in the traffic is immediately triggered a file carving detection method by the MITRE defense which says we should identify an extracting file from network application protocol. So in this filter, I only focus on the file and the hosts for that particular conversation. Here I demonstrate a TCP example that help us to extract all the host field from the request header for entire IP and entire conversation within a packet capture file. Let's get back to the file carving if we want to extract those files from the network traffic packet capture. We have a few options. I just listed two. One is a built-in option of the wire check export object that we can select the conversation and go to the file menu and select export object. We can see the list of the extracted objects from that conversation and we can select and save them all. Another interesting tools is a T-Shark extractor again the open source tools. You know that I'm a big fan of the open source and the free tools. So if we run the T-Shark extractor against our pickup file, it automatically extracts all the potential file exists in that conversation. However, they are saved based on the S-TRIM number. A simple T-Shark command help us to find the TCP S-TRIM index for the HTTP get methods. For example, here I have the S-TRIM index of 22 for the VIN security update, 23 for the A1 and 24 for the R1. Let's take a look on the R1 which has the TCP S-TRIM index of the 24. So I refer to the finding of the T-Shark extractor and open the HTTP S-TRIM 24. And if you remember the content from the previous investigations, we can have the evidence of establishing a reverse TCP. We are the 4443 which is according to the another MITRE knowledge-based information is a commonly used port by attacker to hide their activities. So let's narrow down our information this time to the HTTP to the TCP port 4443 for the same conversation. We can see a few first row are the typical standard 3-way TCP handshake. We can see some evidence of the push acknowledge acknowledge with indicate the some data transfer. So based on the MITRE again, the network traffic, we should analyze the network traffic content when it's not encrypted or the encryption is a way that we can decrypt it or is plain text in our case. So right click on any of these data and follow the TCP S-TRIM show us the command executed by the advisory and extracted again by the follow TCP S-TRIM. So we can see a few commands executed which indicate of the system information discovery. Normally the attackers do the system information discovery up at the initial access to get a better understanding of the current state of the machine. If there is any chance for privilege escalation, identify another vulnerable connection and resource in the network for the lateral movement. System live analysis give us a better understanding of ongoing events because we are doing the threat hunting while the system is still running. In some cases, we're making the forensic images are difficult or challenging like when we are dealing with a huge volume of the storage or sometimes based on the SLA when we are renting the services from the vendors we may not even have an opportunity to touch their storages. The system live analysis could be a good option. Another example is where the sounds sophisticated attacks may not leave any traces on the hard disk. The system live analysis again could be a big help. However, there are a few risk associated with this technique. For example, the risk of unintentional changes is always there because we are dealing interactively with the running system. And if by chance, the attack is still ongoing at the same time with the threat hunting activities, we may have a conflict and we may alert the attacker. And the main important one, the procedure may not be repeatable because the state of the system keep changing. Memory forensic give us a good insight about the running system activity and one point and we may have access to the system volatile data. Video risk of evidence changes, which is very important. Because here we don't touch the live system and we are conducting the threat hunt on the forensic image of a memory. It may also give us a more opportunity for threat analysis because we may have access to the data which is only exists on the memory. Talking about the challenges apart from the forensic imaging challenges that we may always face, the main challenge is a limitation of the current available framework and tools. Talking about the open source, we have a very limited number of the tools like volatility and they may not fully compatible all the time with the latest version of the operating system. These tools are community based. We may need to be a little bit patient and wait for the community and for the developers to come up with the more plugins that enable us to retrieve the data accurately from the latest version of the operating system. Network packet in investigation give us a visibility to the network activities. Not only tell us about what is happening on our network from the security point of view but issues in the network infrastructure as well. And we may not require the local access to the endpoints if we are not directly collecting the packets from the host, which give us opportunity to expand the scale of the investigation rapidly. However, there are a few serious challenges with the network packet investigation. Apart from the limited data that we have about the host level and local user activities, the encrypted data analysis challenges, the main challenge is about how we strategize the network packet collection. It must be placed before an incident happened. In the system live analysis and memory forensic, we may still have a chance to get back to the traces and collect the data that belong to the past and remain on the hardest during the live analysis and resides in the memory. But in the network packet collection, some things happen ongoing and gone and the data will be erased forever. So if we miss a chance to collect the data, we have no visibility to what has happened in that particular time. Another challenge is the data volume capturing and storing. That's why capturing the network packets is not applicable most of the time as a full-time strategy for the security solutions. If we run about one hour of the network capture for the small to medium size of the network, we may deal with a really huge volume of data. So I'm not going to whitelist any of this, any of these techniques, each of them have their own advantage and disadvantage. If there is possible, they actually work better together. So I would like to say the special thanks to my team for all the brainstorming and the support, especially Joko Tan, the man, the me, the mountain and my other lovely team members that known as a team born ready. Feel free to connect to me via the LinkedIn or Twitter if you have any additional clarification or question about this presentation or if you are willing to have a productive conversation about any cybersecurity related topic. This talk ends here, but threat hunting is a never-ending battle. Explore your scope X and unknowns. Be proactive, dive into the beats and hunt the beats, especially those who hides in shadows. Hope you all enjoy this session.


Stevenson with the 76-66 win over Weidner thanks in large part to 27 points and 20 rebounds for Olivia Coleman Olivia have you had many 2020 games like even going back to high school? How many 2020 games have you had? I've never had a 2020 game. Pretty good. Pretty good. You picked the right time to do it. Well, I guess let's start with this What did you eat today? What do we take from like, you know, did you have any superstitions anything like that that we take moving forward? I mean there was nothing special going in today. It's just I had the advantage over everyone out there So I just worked with my advantage It seemed like early on you knew and you were sort of demanding it Did you have a feel early on that today was gonna be a special day? Not really no not that not this big So let's talk about halftime You guys a battled in the first half right you were hanging around you were in there But it was a nine-point game at halftime. What was the conversation like in the locker room? What led to you guys coming out with that huge spurt to start the second half and get a big win? Well, we just had to keep coming at them and just keep giving them blows and everything just keep going and just not Slow down or anything just keep going at them. That's exactly what you did in the second half They tried double teaming you a few times. They tried some different things What allowed you to still have success even as you were getting that much attention? Well, it's just slowed down and just made sure like what I was doing see what was going on who was guarding me and Just assess what of what was going on around me to see what I can do I was working now. You want to shout out anybody you want to give anybody some love here No, no like family anything like that that might be watching. I guess my mom Good one now. How do you guys build from this obviously? It's your biggest win of the season, right? It's a huge win over a really good team you won three straight How do you keep that going next week as you stay home to face Lebanon Valley? Well, we just got I keep working hard just keep doing what we're doing right now and just keep going It's working. No doubt about that Olivia Coleman Congratulations on a huge day and a great win and we'll talk to you again next week. Thank you. She's Olivia Coleman. I'm Glenn Clark Go Mustang sports calm