[Music]
so
[Music]
hey everybody welcome to grim con uh
thank you so much for joining us today
i'm really super excited to be here and
uh talking about some finishing moves
um so thank you for everybody uh for
inviting me here and uh so let's get
going so this is how to detect finishing
moves before it's game over
and i know i'm sure we have some moral
combat fans that are out there
um so why don't you
you know put in chat or you know
whatever just to tell me you know who
your favorite mortal kombat character is
uh maybe there are a couple you know
maybe it's evolved through time you know
finishing moves in
insecurity definitely evolve through
time although you know some of them have
been around probably for
you know a dozen years
um but so who's who's your favorite one
you know mine is definitely you'll see
in my character sheet uh katana
thank you to our marketing department
for coming up with this it's super cool
uh yeah she's rocking a mask so she's
you know keep keeping it safe but you
know also with some cool defense tools
there um you know my signature move is
honey hot hellfire i don't exactly know
what that means but you know we may uh
in introduce it as some kind of feature
right in the future because that's kind
of a cool name
um i'm not super stealthy but you know
the glasses help with sight so that's
that's a plus
uh origin story is protector of the
realm i love defense uh and detection
and hacker of mental health so i'm ceo
of mental health hackers and you can
find us at hacker's health if you want
more information on that
so here we go
uh what exactly are finishing moves uh
we know what they are in mortal kombat
right finish him um i wish i had you
know the sound board i'm sure there's a
you know the mortal kombat sound board
out there so you guys could have a
little bit of a
peek back into that kind of stuff um i
mean i mean maybe you still play the new
one's pretty interesting
so but as far as information security
these are detections that should be
considered high fidelity and high
priority threats so when one comes
through it's almost certain that it's
not going to be a false positive and
you're going to need to engage incident
response at some point right
um so
when you get a solution that's reporting
this kind of activity um context is
extremely important right
you you know you don't want an alert
that's just the name of alert maybe a
link to a wikipedia article or her to a
miter technique
or something like that like that's not
super helpful you know it's really
important to have some kind of analysis
and explanation of not only what's being
detected but why
what like the information around it why
is it bad
um sometimes you'll get this with an
mssp
um sometimes you know you may have to
build this into your own
um
uh environment and whatever thing that
you're using
that's what we try and do inside lumira
and is build all that into the product
um
so you know because not everybody is
going to be a subject matter expert in
all areas of defense and instant
response like i'm definitely not like as
much as i enjoy it and love it i'm not
you know the subject matter expert in
all of that that's a huge huge huge
section of stuff right
um you know you can defend against all
technology so there's no way you can be
an sme in all of that
but it's better to have some kind of
analysis and understanding of what's
happening
during at least these finishing move
attacks
um you know other than that title right
so i've also heard of several different
solutions uh that
you know
when people the customers ask you know
why wasn't this certain thing detected
you know you'll have a pen test or you
know some some sort of incident where
they're like okay i know this
definitely shouldn't should have been
detected
um i've heard several times well your
your environment isn't baselined yet you
know you haven't had the the especially
when they're doing proof of concepts
right um your environment isn't
baselined it's not been you know there
long enough to figure out uh what's
normal and what in your network and
what's not
um
there are a ton of things in an
environment that should never need
baseline all right that's what these
finishing moves are
we like to differentiate different types
of detections in different ways so
you'll see those in the use cases we're
going to go over here in a little bit
but
most of what you know the the single
point in time
detections that we use are called
indicators
you don't think of them as iocs but just
like
this certain thing happened right now i
want to know about it as soon as
possible
um
it's not something that you know
should wait 20 minutes for a query to
run or you know 24 hours for you to get
a report or maybe the off chance that
you log into the solution and see oh
this thing is bad
um there are certain things that you
should know about
now
right
um
so those fire as soon as possible in the
process um at the mirror even before
they're stored on the database back end
and the uh examples that i'll show you
here a little bit are all of those kind
of things so
along with the detections that we'll go
over um having playbooks so either from
your sim vendor or internally are going
to help you follow through for a quick
response
and i guarantee you that time to
detection time to response time to
remediation are going to be some of the
key cyber security metrics in coming
years
um i know a lot of people are using them
already and honestly it's one of the
best things we've seen as far as metrics
that you can use to pay attention to
your program maturity
so our first player here is sub-zero and
he wins right so that's definitely a
finishing move there for poor raiden um
and you know maybe that's just like a
active view of what the bits look like
during this curve roasting attack
so i'm not going to go too much into the
inner workings of how microsoft active
directory authentication functions
um or how to successfully exploit it but
you know we'll get into a little bit of
it um you know we can't touch all of
those things in the short amount of time
that that is a talk but we'll cover some
of the high level things um and we'll
discuss ways to detect both in your
environment so first i'll cover curb
roasting
and then as rep roasting and then right
now we'll go over a little bit of
differences
or high level differences right so
curb roasting is an enumeration attack
on accounts in active directory
uh using it's the microsoft spn which is
service principal name ticket function
uh while as rep roasting is an attack
that specifically is against accounts
that don't require
uh pre-authentication so
active directory requires
pre-authentication by default but on
account by count basis you can disable
it um
you know with it with a check mark right
um as far as the request goes uh from
the attacker uh with kerber roasting you
know the threat actor enumerates active
directory and
uses that spn ticket right so it's at
the kerberos ticket granting service um
and they use those for the spns that
have been gathered
with
as rep roasting
they request the ticket granting ticket
so a little bit of a difference there
one's the service enumeration one is the
actual ticket
the response from the active directory
domain controller in kerberos um is
going to respond with that ticket right
and that ticket
is stored in memory so that's where you
end up getting the extracted hashes from
um to go down to the extracted
particular listing and then with as rep
roasting
the dc responds with the ticket granted
ticket so that is actually
um captured from the data packet that
comes across in that response
so
two different attacks
that definitely boast both against the
active directory authentication
functions
um
fairly common
extremely easy to run
uh and we'll go over some examples of
that
so to be effective uh an attacker during
the kerber roasting uh is gonna have to
select what kind of encryption is this
is susceptible to those brute force
attacks in curb roasting it's almost
always rc4
uh m8
rc4 hmac
so and we see it's a favorite of pen
testers but then you might ask yourself
is it still being used in the wild right
are there attacks that like or
is it just like oh this pen tester is
doing a proof of concept
um
great like
that's you but do people actually see
this in the wild
well yes they do so especially
ransomware has actually adapted to use
those kind of techniques
to infect networks so
dfi report not too long ago
had a really good in-depth analysis
demonstrating the use of carb roasting
when ransomware wants to spread
throughout a network and it
did that really really quick
um fireeye has a really good report um
on kerberos attacks
and
you know there's been um accounts of
like different healthcare agencies
and
manufacturing banking that uses
that as part of the attack right to just
spread that malware through the network
so here is a little uh
video let's see if we can
play this
there you go so this slideshow shows the
roasting itself
um and uh how how it's gonna end up with
uh um
the result here so this is invoke
kerberos
um it you know it's looking at active
directory you can run a variety of tools
to do this attack um you know you can
find accounts that are doing things like
running iis or sql or you know some
higher privilege accounts
and kerberos not taking advantage of any
kind of vulnerability or anything like
that
i know that
it's pretty quick let me play that again
so we can kind of go over it i kind of
get on a tangent so this is info
kerberos
and i have multiple screens i promise
i'm not ignoring you
um so you can see here the same account
name so like there's default app pool
and iis there's the hash
distinguished name
you know pound town in this in this
specific instance
um but it's yeah it's not a
vulnerability in active directory it's
how active directory is built that's
like that's what authentication is you
know it's just intercepting that
authentication and stealing the tokens
and you can't block that behavior any
account can do this that's on the on the
network so unless you want to turn off
authentication altogether or i mean
switch to something else which is
definitely possible
um but the problem with trying to detect
that is specifically that right you you
have a really hard time detecting
different roasting techniques
because it's using the same
authentication mechanism that everything
else in the environment is
so
if you want to know that specific kind
of stuff like you need a way to do that
but before we do uh the detection part
let's go on to asrep roasting
without playing this video again there
we go
all right so speaking of finishing him
there you go i think jax wins this one
there we go oh that
glorious right
so moving on as rep roasting um you know
we went over the differences and how to
and then we'll cover uh a little bit
more in the airstrip roasting and then
built the detections
and then uh just to point out like
creating these slides like this one uh
always gets me so there's no way we
could have used any of the newer mortal
kombat gifts
but
because boy do they get pretty graphic
now
but
you know pixelated blood splatter is
pretty great
i talked about the check marks check box
that you can mark uh in each individual
account and that's what that is
and a lot of times there are as rep
roastable accounts it's a tongue twister
um for different reasons you know i've
seen it both as you know trying to get
some legacy piece of software to work uh
with authentication because you know
maybe you know it was back from windows
nt and they did not need it so
um you know they don't they don't work
with that pre-authentication method so
people will go in and check that other
times you know i've heard of just
sysadmins help desk whatever just
needing to get something to work they're
like oh i was trying to get you know
this user couldn't log in so i was going
through and checking things and i must
have left that checked you know some
some kind of you know not great method
but you know it's not inherently it
doesn't show the risk here right it
doesn't tell you that that could be used
um for that kind of finishing move it's
just it's just a checkbox right you know
big no big deal
so then we'll see in the next demo uh
the rubius account uh the rubius tool
that we'll be using uh to run that
roasting attack so
here the most important thing on this
slide is you can actually audit your
environment to see
what has that enabled right so this is a
power shell um script command whatever
for getty user and it's looking for
accounts that don't require that
pre-authentication and it's going to
return those to you
in the command line so
pretty important i know that it's out
there i'm sure these slides are going to
be shared later so feel free to run that
if you have an on-prem active directory
environment
um
just to see you know what what you have
that you may not know about
so here is the as rep roast itself
so here we see rubius
running as rep roast
and then
easyhazy right same thing as rep hash
it's pulling that out of the packet
that's being responded
um so if you like run wireshark or
anything like that you can actually see
that in the packets you can see that
hash in the packets
and then this shows how you can kind of
use those i think this is the next one
maybe nope
next slide there we go
and running running demos and slides is
always hard when you're trying to record
it
so this is using crack mac except crack
map exec
to use those cracked as rep roasting
accounts to spray those creds everywhere
and find where we're the local admin so
again there's a handful of different
ways to detect password spray and brute
forcing against a multiple platforms but
again we have only so much time
so we're assuming here that the hashes
we took in the last
walk through
have been captured and
cracked so you can use those to you know
try and pivot right so passwords are
usually not that hard to crack um but we
can use them you know
maintain persistence maybe
pivot move laterally you know all of
those kind of things uh to kind of
get a little bit further into the
environment
so how about the detection so who's
gonna win in this case uh our honey
token account or goro
uh that's a crossover that would be kind
of fun i guess um
i mean
winnie the pooh is a bear so but he's a
stuffed one and like there's you know a
lot of arms there to deal with so maybe
not
um so
to detect cur both kerberos staying and
i guess rep roasting the best way to do
this is with um honey tokens honey
accounts honey whatever right um it's
it's an account that you're going to add
to active directory
to
monitor on so in kerberos saying example
it's the event id 4769
um your ticket encryption type is 0x17
you have ticket options there which
equals something i can't i can't
remember exactly what and then the
service name is going to be whatever
honey account that you have okay
and then as far as uh as rep roasting
um the event ideas event id is 4768
instead of 47.69
same ticket encryption type and options
uh but the service name here is krb tgt
which is the kerberos tank ticket
granting ticket
so
in addition to rubius i mean you can see
in the screenshot here there's also
invoke as rep rose by harmjoy as well as
a handful of other tools that are you
know that can perform those kind of
attacks
and you know in in the um
uh in the bottom of that powershell
script you can see right there you know
the tool finds three separate accounts
with that pre-authentication enabled and
enumerates all of them so
as with any kind of active deception
technology you should monitor your honey
accounts how many tokens whatever
way more than a normal account and
it's definitely possible you know to
perform this attack in some environments
with active accounts
but we i mean those accounts are going
to be used all the time right maybe
they're there because they have to have
pre-authentication on
um but
so you can't really
detect done those all the time you're
gonna end up with uh way too many uh
alerts and you know alert fatigue and
you're going to want to ignore it right
so using a honey account is way better
um and you can closely monitor those and
you know everything involved
and they're going to be you know this
kind of stuff is going to be more easily
compromised
even if you don't have accounts that
have pre-authentication in your
environment still add a honey honey
account you'll know when somebody's
attempting to do that as rep roasting
um and just remember never allow those
accounts to have any kind of like
elevated permissions right
so this slide is um this next slide is
going to show you
uh uh doj mira so many pauses for a
second so
dojimira is a powershell script that we
have out there on our github uh if you
just search bluemirror in github you'll
find it um it's a powershell script that
is going to generate the specific kind
of accounts that you need
for
these to
these detections to be created okay so
it'll it'll output uh what those
accounts are and you can take those and
use the other things that i showed you
and
alert on those specific accounts
so here we are
i'm in my lumira directory and i'm just
going to run the powershell script
and that's it
super easy goes ahead and adds uh adds
that account um this one
uh the the video for this is just the um
kerber roasting one we've since added
the ass rep roasting um after actually a
really good um suggestion from one of
our customers
so
um let's see here uh did it do
[Music]
not onto the next one so instead of
playing this again there we go we're
gonna move on to the second use case
so w digest uh
super fun detection
here there we go another finishing move
rain unfortunately does not win that one
but we got some cool blue spikes
and some more pixelated blue
fantastic
uh so w digest is a really old protocol
has introduced an xp i think
where in certain situations
you know you can enable it in the
in the registry
to
fall back to clear test clear text
authentication
in newer versions of operating systems
it's disabled by default but the
registry entry is still there and you
can still enable it with local admin
and that will allow an attacker to come
back later and extract hashes and clear
text passwords from directly from memory
um
you know because why bother cracking
something if it could be in clear text
anyways right
so again with a you know there's
a lot of
opportunities for this one but as far as
like uh performing the attack itself
um but we'll see here uh with crack mac
crack map exec again i always have a
hard time saying that especially you
know when i'm being recorded
so it's going to be planting that w
digest trap by just adding uh flipping
that red registry key
so you have local admin access you're
going to run that
that switch so that's the device that's
being run on
the user that we you know
cracked earlier
and then w digest
and we're going to enable him
and then it right there tells you that
it was created successfully
so yeah handful of thing handful of easy
tools out there that can do that but
it's always going to be that same
registry key
so how do we detect that
fairly simple
sysmon is fantastic
if you don't have it installed i highly
highly recommend it um
and i'll show you i think it's in the
last uk use case we're going to go over
the difference that sysmon gives you as
far as detection capabilities go and how
to map some of that stuff so in this
case you're just detecting registry
change so windows event uh 13 through
sysmon is just for that purpose is for
registry changes
um so your process name is going to be
reg because it's going to be like red
gxe reg whatever you know here you can
see in the bottom part the actual
command that was run it was reg ad
uh through cmd can be done for
powershell you know crack my crack
exec again oh my gosh
um maybe i'll just start saying cme
i feel like at this point uh it would be
easier and you know what i mean
all right so yeah here's the detection
on that and then the command or the
parent command line is going to have
that w digest user logon credential in
there so it's flipping that bit on
um so it's going to mention something
about wdigest something about that
specific key in the registry so you can
detect on all of those kind of things um
sadly we have seen some false positives
from
uh poorly written software so for some
reason
i don't know if they just didn't want to
figure out how to do real authentication
uh or they need to capture credentials
for some reason but there's definitely
some software
platforms out there uh that do this
as a part of how they work which is
which is kind of sad
so on next is
a fun one
everybody always covers past the hash
uh
see the poor little scorpions there
oh no they're poor they're poor dad
cover cover the children's eyes poor
little scorpion
it's pretty great i don't think this
part was actually in the game i'm gonna
guess uh
maybe it was i don't know um i didn't
play that much but i i feel like
this is definitely some some good work
on somebody's part
so this is mostly seen with me me cats
you know you'll you'll definitely see
past the hash being mentioned all the
time with me cats but there are a
handful of other tools out there that
can pass along those captured
credentials to gain access to other
endpoints
um you know which if you're using the
same admin account across your entire
environment that can go really really
poorly for you um i recommend if you are
still running
active directory on-prem look into lapse
uh local admin password solution through
microsoft um
it's definitely um
better for
preventing
past the hash with admin credentials
because as soon as one you know i've
seen
lots and lots and lots and lots of
networks um that i mean it's easier
right if you are
re-imaging you know dozens or hundreds
of uh desktops for a new deployment um
it's just easier to have the same admin
password you know you you know
you have 20 help desk people or ever or
maybe one i don't know but it's easier
because they can memorize that password
um and then you know go work on any
device that they need to it's it's super
common
um
so you know passing the hash with really
any admin account is going to be is
going to be bad but it's it's seen a lot
with the local default admin also
so this is going to show the pass this
next slide is going to show the pass the
hash attack um with using
cme again
all right let's play this
so here we see
cme being run against a host
and then we're just gonna
pass the hash that we captured you know
one of those other several ways right
that we that we may have captured a hash
um and right there you know that's i
know it's a really quick video but it
goes really fast especially when it
works
um you know you can
you know in that case you're only
scanning one endpoint so if you're
scanning like slash 24 16 like it may
take a little bit longer but you know it
showed there at the end that it was
successful
so also again sadly uh there's actually
a lot of back end uh stuff on bad
software that will do past the hash
um
so that's why i have in this detection
uh so it's windows event 4624
which is login login type is nine and
then the process is like sec logo and
then that's why i have the fourth little
little mention there of tuning for
terrible software
um i have a list of at least five or six
pieces of software that just
as a part of how they do administrative
processes or manage your environment
or you know i've i've seen um
active directory management tools that
you know they're gonna you know help
your help desk
change passwords or
um you know maybe even change control or
manage endpoints as far as like uh asset
asset inventory go they use past the
hash on the back end and boy they
shouldn't because um uh you know i
recently had um a discussion about
why
uh
why like
is there any good reason
to have
exceptions like antivirus exceptions or
um you know
exceptions on this kind of stuff right
like you
yeah i mean there
the the reason is you don't want alert
fatigue
you know if you have a main piece of
your environment that is going to
trigger this detection
once twice 10 times a day
you're going to have to figure out some
kind of tuning right
but you know i'm sure a lot of you have
played with firewalls or have seen
firewall rules
um
but the concept is least privileged when
it comes to even tuning
so
if you know
what
hash is always doing it you can use you
can use that especially if you're using
cismod because the hash values are in
there
um if you
know what direct uh what i mean
obviously the exe is okay but that can
be spoofed
um the directory also not great because
you put anything in that directory and
then nothing's gonna trigger
um and if attackers know that they're
gonna take advantage of it if they know
software a
does not um you know mimics past the
hash on the back end they're gonna do
what they can to mimic that um and if
you have a blind spot to like that whole
directory
that's what's gonna happen you're not
gonna be able to detect on something
like this that you know is by is
bypassing the um
the administrator login
so how about credential dumping this is
great too
i don't know i think oh right away
scorpion wins
that's super quick right flawless
victory didn't even get a chance
um
so
dumping active director of hashes
no matter what way it's done
what tool is used if it's a script
third-party application built-in windows
application
if all of your hashes from your entire
domain has successfully been captured
and it's not just a pen test you're in
for a really really bad time um
i would love to know if anyone has ever
either had to follow the microsoft guide
on network eviction process
um or starting a forest over from
scratch because those are basically your
two options
um you know if there's any time to move
to the cloud i guess it would be then
because
if an attacker has that
and you don't follow network eviction
process you have no guarantees that they
don't still have a token
or a ticket or some kind of um
persistence in your network
um
so i you know as much as i loved doing
sis admin stuff for a very long time uh
that just seems extremely extremely
stressful and so so much work um so i'd
love to hear your stories if you know if
if you've gone through that
so this slide uh shows doing
run as domain admin
and then using mimi cats to extract all
the hashes active out of active
directory
so that's the password we cracked and
now we're into you know
name cast directory
zoom in a little bit on that
so you know you have the right
privileges when you do privilege debug
and then you're going to do lsa dump
on the domain
and ta-da
there's all of them which
uh some active director environments are
extremely large
um there are a multitude of ways to
detect this kind of activity a common
being a common one being what we saw
here um
but then i'm not detected sorry attack
this directory or that oh my gosh sorry
so common way of
attacking so this one we just saw
uh which was mimikats but there's also
one that you can use that's built in to
windows called ntds util and we'll go
over that one too
and this one will show you a little bit
the difference of um sysmod in between
just windows like plane plane logging
so again hash jumping is going to be
something you want to know as soon as
possible and definitely does not need a
single bit of baselining lining
because as the more time passes the more
likely that attacker is going to be able
to move laterally
set up persistence perform other attacks
inside the environment
you know we saw mimikatz in the video
example here's another one liner right
so ntds util
is a built-in microsoft utility
so if you ever hear living off the land
that's
that falls into this category
um so that uh ntds utils was created to
manage the active directory database
right which completely makes sense uh
it's been used for years and years to
perform functions and but it can also be
used by threat actors to dump the
ntds.dit file
so ntds.dit is the ese database
that contains all the active directory
information
you can use it to create a backup
and the thread actor can use that and
then go crack all those credentials so
instead of capturing one two maybe three
credentials using the other um the other
ways we saw in the beginning this is
everything they can take the entire
database and go crack all the hashes at
once
um here we can see in
this match evidence portion the actual
command and the device it was being run
against
and you know that ntds you tell which
tells you what that did
aci ntds
is setting
ntds as the active instance so what pc
means
ifm is install for media and then
creating the full backup
that qq is just quitting both commands
that it's run
so let's dive a little deeper into the
detection engineering side of this
so
i hope a lot of you have system
installed feel free to say if you do or
not and why you don't if you don't i
would be interested to know that
um
but here are some major differences in
this attack
using just seeing the windows event ids
and then seeing all of the cessna event
ideas so on the left you just see a huge
list of 47.99
um you'll also see process creation but
process
so process creation with sysmon is the
event one and don't worry about like
blowing up your screen or like looking
really really hard because i'm going to
blow up these things in the next couple
slides
um
and uh i'll go a little bit into why i i
picked cis11 event one as opposed to the
um
process creation and just windows plane
so
on the left-hand side huge list of 47.99
which enumerating security group
memberships happens all of the time in
active directory for a multitude of
reasons it's definitely again part of
how active directory works
um to provide you know information to
clients applications whatever
and then on the right hand side you see
a huge wall of text tiny tiny ticks
with a bunch of information we're able
to gather using sysmon so let's move on
so you can see that's a little bit
better
so this is event id one a little closer
up
you can see that in tds util is the
original file name there on the top the
command that was run the full command
line that was run uh who ran it there's
me yay uh from the parent image of
powershell i think is on the bottom yep
all the way to the bottom if you see the
parent image and then parent command
line i was just running it through ice
so i could capture it
and it provides way way way more
information about that newly created
process when a commune was run so
like the hashes it gives you there and
you can correlate against those you see
it's terminal session id seven it's
because i was logged in over rdp when i
ran it
um and then you can use all of that to
correlate across you know when different
stuff like that is run
if you know you want to baseline your
environment you can use that
but that command should never be ran by
anyone
maybe
an admin does it every now and then but
at that point you should be able to you
know
tune out that activity
here's where we see event id 10
which is a process being accessed so
this is one of the 10 events that's
included in
that is included in sysmon that windows
doesn't have no matter what you
configure you know there are certain
things that sysmon has
um
that windows does but you have to
configure for policy like several
different places
or you know you have to
turn features on or or something like
that so like
to have process creation
show
command line uh arguments right like
anything in the powershell command line
or the regular command line
for regular windows
event to show those it shows up in you
know multitude of windows event ids
but you also have to turn on several
settings in group policy just to have
that kind of thing happen but process
being accessed you can't even do you
can't do no matter
what gpo thing you configure
um
and you know we see it here
it's
you know basically still powershell
using ntds util
and then what it's accessing underneath
that granted access is the space in
memory
and then leads us to the third one event
id 13 which is a registry value being
set so this populates whenever that
process executes successfully
so you see where it was executed at that
it was on tdsutel
now how to detect on this many different
ways all right so many different ways to
detect on ntds util being used in
general
um we can detect on me you know the
first example is mimi cats right there's
like a bunch of different ways to detect
on mimi mimikats
um
in this example though this is just
dumping active directory with ntds util
so that's you can detect on that windows
event id1 from through sysmon is the
first one that i showed
the process name is going to be
some version of ntds util
i have like there because
um
there are tools that try and do obvious
obfuscation
of those commands so you can kind of get
around that with doing likes um and and
different kind of regexes
and then the same thing with like the
command or the parent command line
for this example we just have the q q in
there
so to wrap up a little bit with some
detection planning
um who here on a regular cadence test
your sim
uh somewhere another not counting having
a
regularly scheduled pen test like that
obviously should be testing your sim but
do you test it at any other point in
time
um
just think about it you know the amount
of things that can go wrong in any given
day when it comes to the implementation
of alerting system you know you could
have
an endpoint client that
suddenly stops like the service stops or
maybe a network fire will rule or local
firewall rules put into place or maybe
you know there's a piece of uh an
endpoint software that stops stops the
export of logs
you know maybe
the mapping or the parsing of those
different things into fields that you're
looking at
has changed you know if
after doing this for years like vendors
all i mean windows not so much but
vendors in general will change
um the format of their logs like oh
we've got a firmware update or software
update or this update and
now there's a space in the logs or they
renamed a field
or the api endpoint has changed like
so many different things
can happen and that's that's just the
process that's above and beyond
you know
maybe there's a different way to run a
tool or an explainer maybe there's a new
tool or exploit like doing this stuff is
never ending which is why i find it so
incredibly
interesting and fun
so just thinking about all of those
different ways can interrupt those
detections from firing
regular testing is going to be
one of the best ways you can ensure that
system is working how you expect it to
now don't get me wrong
you're not going to be able to test all
of your detections all the time on every
endpoint that would be
incredibly a large amount of time and
i'm sure you have better stuff to do
than that
however prioritizing what endpoints and
top tests you want to ensure continue to
work
is a really good first step at
planning those ongoing tests and i'll
show you a little bit how we do that too
i also highly recommend adding parts of
detection testing into any tabletop you
might be doing whether it's tabletop
in general or maybe you're creating ir
playbooks
put some testing in there like run it
through from beginning to end
see what happens if you uh try and dump
those credentials that's just one
command obviously you should have you
know
approval and not just do it on random
you know active directory environments
but
running those commands seeing if it's
it's been detected and then what
if that's not
um
if that's not a
pen tester then what like do you have
some kind of in great agreement with a
third-party ir firm do you have any plan
do you
have you know even if you just write it
on a sticky note like
bad thing happens call number right like
that's something that is something more
than more than a lot of people do have
um
you know i've been involved in a large
number of tabletop exercises and they
identify those gaps and detections all
the time
you know when you're walking through a
real life scenario and you come up with
this situation you're like oh my gosh
like i completely forgot like that sql
server talks to that web server that you
know backs up to this thing and you know
we've never tested those backups so we
have no process on that
we didn't know that that's how you know
i'm the i'm the only one that knew how
that information flowed so like if i
leave nobody else will know that that
kind of stuff
um that you may never have thought of
before
and also highly highly recommend that
you have an active relationship if you
have a sim vendor um whether they're
your mssp
or you know you know you just you run it
internally
having that relationship especially if
they're an
mssp
um
is one of the things that i love i love
having active customers that test my
detections all the time you know we've
come up with some great detection ideas
like oh you know they ran this tool we
didn't detect it and oh that's why
because they're running it this way or
they ran it you know from this script
that called this thing that you know
there's a lot of different ways you can
get around detections um
and
it's it's great to have that kind of
relationship with your vendors
so another main detection creation
strategy is using adversary emulation
right so running those tools
and one of the ones that we use at our
disposal um is called vector and it's
free it's out there so vector.io and you
can import a lot of different frameworks
into the tool and i'll give you a few
examples of what we use uh when we went
down like our uh detection creation
journey
in the beginning so here you can see a
heat map of the minor attack framework
imported into vector
so each tactic
there are commands and other adversary
emulation notes tests whatever that you
can perform and track you know they're
using the atomic red team test through
red canary which also a huge fan of
and if you spent much time in either the
attack framework or atomic red team um
you know you can look at what to map
those two i'm sure there's other things
that you can import into vector like
pick your favorite adversary emulation
technique or our framework like there's
a lot of stuff vector does fantastically
right
um and it can be a daunting task at
first right so it makes it easier to
kind of track that stuff especially if
you're doing all of this stuff
internally um
it's it's a lot of work right you you
look at the minor attack framework
you're like oh my gosh there's thousands
of things there and i have to worry
about this and i have to worry about
that
prioritizing and mapping them
in here makes it so much easier um and
like i don't have anything to gain by
telling you to use them i just think
it's a great tool
um
and then in the next couple of slides
i'll just pick one of these and i'll
show you kind of what that looks like
so
we don't dive into this specific one
it's uh windows discover domain trust
with ntl test
um that's another
um
uh
ntl and l test um
so diving into that one there's a few
different sets of information this is
the red team portion right
um vector does a great job of separating
out the
different
stuff into different fields and here it
gives you the description of what it is
it gives you the operator guidance which
is the test you want to perform
and why it's potentially malicious so it
also lists here like this technique's
been used by the trickbot malware family
that's great i mean
i suppose depends on whose viewpoint but
it's great information to have right so
that operator guidance has you know the
specific and this is just one example
right this is just one tiny little
command
um some of them are a little bit more
in-depth
and you can use those to kind of you
know i'm not a red teamer right i don't
know exactly how all right teamers do
all of their stuff but this is great um
if you're going to start down that
journey into where to even start on
creating those detections
and then that same technique page they
offer a section for blue team detail so
this is where you can track the status
of
the detection in your organization so
you know any other notes you have can go
in here you know we use we use this for
um
going through all of our cismod
detections you know we perform the red
team attack uh save our working query
which is kind of blacked out here
because like there's customer specific
information in there
um and then we save it in like our
working notes right
we test it again after we've created it
in the application
use our notes whatever see if that maybe
there's other iterations that we can use
different flags that may bypass the
detection
um and then complete that specific
emulation
and
there you go you have a detection
created so
uh at the time we were creating these it
was just the system on related ones but
you could do this with anything you
could do it with your endpoints
um you know this is the obviously the
query is going to differ depending on
what kind of type of sim you use and if
you're attempting to see you know the
other detections
you know you can import
um
uh
and have different tracking things for
like your endpoint solution or network
ids ips other technologies plain windows
logs whatever you can have different uh
sections in there that you
try and cover all your bases for
and that's it so
hopefully that was helpful to uh you all
and i hope you have an awesome rest of
the con
um this is gonna be super fun
and
uh have a great time watching all the
other talks
and
hope to see you
in real life soon thank you
[Music]
you