1 00:00:00,000 --> 00:00:05,420 Okay, thank you so much. Welcome to the Packet Hacking Village and the Speaker Workshops. 2 00:00:05,440 --> 00:00:10,220 It is now 4.10. We're going to kick it right off. We're not going to waste any time. 3 00:00:10,240 --> 00:00:16,020 And now it is my pleasure to introduce the next talk, Release the Hound. 4 00:00:16,160 --> 00:00:20,380 I mean, no, sorry, not Release the Hound. Hunting the Hound. No, that's not good. 5 00:00:20,500 --> 00:00:25,280 Oh, sorry, sorry. Fooling the Hound by Tom Sella. 6 00:00:25,860 --> 00:00:26,720 Thank you very much. 7 00:00:32,100 --> 00:00:36,340 Hear me okay? Yeah? Cool. Okay. 8 00:00:37,200 --> 00:00:41,480 Hello, everybody. We're going to talk about fooling the Hound, deceiving domain admin hunters. 9 00:00:42,060 --> 00:00:46,360 So in the next 35 minutes or so, we're going to cover letter of movement and deception. 10 00:00:46,960 --> 00:00:48,580 And I hope it will be fun. 11 00:00:50,420 --> 00:00:54,280 My name is Tom Sella. I'm an head of security research in Elusive Networks. 12 00:00:54,280 --> 00:00:57,440 And I want to thank Elusive for giving me the opportunity to stand here in front of you 13 00:00:57,440 --> 00:00:59,500 and all of the friendly faces. 14 00:01:02,940 --> 00:01:07,120 And also I want to share a story with you. 15 00:01:07,520 --> 00:01:13,220 About one year ago, I was sitting in the audience exactly as you're sitting today. 16 00:01:13,540 --> 00:01:17,640 And I attended a talk that changed the way I see letter of movement. 17 00:01:17,980 --> 00:01:23,800 The talk was Six Degrees to Domain Admin, given by Andy, Will, and Ron, who are sitting in the audience today. 18 00:01:25,160 --> 00:01:28,480 And that talk, they showed a great tool, Bloodhound, 19 00:01:28,640 --> 00:01:29,980 that shows how to fool the Hound. 20 00:01:30,000 --> 00:01:34,980 It shifted the bonds between defenders and attackers and gave the attackers a significant 21 00:01:34,980 --> 00:01:35,820 amount of power. 22 00:01:36,120 --> 00:01:41,500 And from that talk, I set a path to see how, as defenders, we can use the same tool. 23 00:01:42,660 --> 00:01:51,820 So the talk will cover the journey of the last year, seeing how Bloodhound can be used 24 00:01:51,820 --> 00:01:53,400 in order to help blue teams. 25 00:01:54,820 --> 00:01:58,040 So if you're expecting this Hound, I'm sorry to disappoint you. 26 00:01:58,160 --> 00:01:59,620 It's not a game from the talk. 27 00:01:59,620 --> 00:02:01,220 It will be on Bloodhound. 28 00:02:02,740 --> 00:02:04,100 What are we going to cover? 29 00:02:04,600 --> 00:02:07,840 We're going to have a crash course on deceptions and letter of movement. 30 00:02:08,160 --> 00:02:10,040 Sorry, letter of movement and graphs. 31 00:02:10,420 --> 00:02:11,860 Then we'll move to deceptions. 32 00:02:12,420 --> 00:02:14,040 And then we'll full down. 33 00:02:14,180 --> 00:02:16,740 We'll combine deceptions and letter of movement. 34 00:02:17,000 --> 00:02:18,320 And we'll wrap up. 35 00:02:20,880 --> 00:02:29,120 Our goal throughout the entire talk will be to detect attackers hunting domain admin credentials in the network. 36 00:02:29,340 --> 00:02:29,600 And we'll wrap up. 37 00:02:29,620 --> 00:02:30,800 Our goal is to detect. 38 00:02:34,660 --> 00:02:41,680 And the method will be to plant and monitor deceptive users and computers through the network. 39 00:02:42,040 --> 00:02:45,860 So those two slides will follow us throughout the presentation. 40 00:02:47,800 --> 00:02:55,200 When we look on the kill chain, an attack usually starts when a computer is being compromised. 41 00:02:55,500 --> 00:02:58,040 Either by phishing mail. 42 00:02:58,040 --> 00:03:01,020 An attacker will get full control of the computer. 43 00:03:01,240 --> 00:03:05,100 Start moving laterally in the network to obtain domain admin credentials. 44 00:03:05,400 --> 00:03:08,900 The credentials that gives him full power on the network. 45 00:03:09,360 --> 00:03:12,340 And only after that we'll continue to achieve the goal. 46 00:03:13,060 --> 00:03:16,060 This talk focuses on the first part. 47 00:03:16,260 --> 00:03:19,900 From the initial breach to obtaining domain admin credentials. 48 00:03:21,620 --> 00:03:26,400 Let's look at a generic attack scenario. 49 00:03:26,400 --> 00:03:34,860 We'll cover how an attacker in only just six stages from the initial breach gets full control of the network. 50 00:03:35,480 --> 00:03:38,300 Let's say in our network we have a receptionist named Liz. 51 00:03:38,660 --> 00:03:42,240 An attacker sent a phishing mail to Liz. 52 00:03:42,300 --> 00:03:46,700 Liz opened the email, clicked on the link, downloaded a malware on a computer. 53 00:03:47,360 --> 00:03:51,100 From that point an attacker has control of Liz's PC. 54 00:03:51,340 --> 00:03:54,960 And tries to move laterally in order to get domain admin credentials. 55 00:03:54,960 --> 00:04:00,160 In our example, you will run Mimikatz or other credential dumping tool. 56 00:04:00,360 --> 00:04:01,800 Get the credentials of Liz. 57 00:04:02,280 --> 00:04:04,600 And then see what else you can do with them. 58 00:04:06,120 --> 00:04:08,960 In our case, Liz is a member of a domain group. 59 00:04:09,160 --> 00:04:11,660 And that group is an admin on another PC. 60 00:04:11,980 --> 00:04:14,980 So using Liz's credentials, you can move laterally. 61 00:04:15,060 --> 00:04:17,880 You can use them and connect into room 2 PC. 62 00:04:18,840 --> 00:04:20,220 There, all over again. 63 00:04:20,660 --> 00:04:21,740 You'll dump credentials. 64 00:04:21,960 --> 00:04:23,120 See what else. 65 00:04:23,760 --> 00:04:24,940 With which additonals. 66 00:04:24,940 --> 00:04:26,600 The additional user is connected to that machine. 67 00:04:26,860 --> 00:04:30,620 In this case, we'll have Clark. 68 00:04:30,900 --> 00:04:31,920 Which is connected. 69 00:04:32,440 --> 00:04:33,660 We'll dump the credentials. 70 00:04:33,940 --> 00:04:36,340 And once again, see what else you can do with them. 71 00:04:36,840 --> 00:04:38,960 Clark is admin on the CFO PC. 72 00:04:39,540 --> 00:04:42,380 The attacker used the credentials just compromised. 73 00:04:42,700 --> 00:04:44,160 And moved to the CFO PC. 74 00:04:44,780 --> 00:04:46,660 And luckily for him, a day before. 75 00:04:47,260 --> 00:04:48,820 Elbdesk connected to that machine. 76 00:04:48,980 --> 00:04:50,140 In order to help with a problem. 77 00:04:50,500 --> 00:04:52,140 Didn't log out correctly. 78 00:04:52,500 --> 00:04:54,600 And the credentials of the Elbdesk. 79 00:04:54,940 --> 00:04:55,780 Stayed on that machine. 80 00:04:56,200 --> 00:04:57,300 Elbdesk is domain admin. 81 00:04:57,780 --> 00:05:00,220 So an attacker in 6 steps. 82 00:05:00,360 --> 00:05:02,600 Were able to move from the reception PC. 83 00:05:03,100 --> 00:05:05,460 Into getting a domain admin credentials. 84 00:05:05,980 --> 00:05:08,320 It just shows us the significance. 85 00:05:08,720 --> 00:05:11,340 Also computers that are not seemingly significant. 86 00:05:11,700 --> 00:05:13,500 That are not high privileged. 87 00:05:13,800 --> 00:05:17,260 How important are them in a tech kill chain. 88 00:05:17,540 --> 00:05:19,240 Or how they can be used. 89 00:05:19,340 --> 00:05:21,240 In order to get complete control of the network. 90 00:05:22,900 --> 00:05:25,760 If we take the graph that we just covered. 91 00:05:25,880 --> 00:05:28,120 And try to make it a little bit more formalized. 92 00:05:28,340 --> 00:05:31,060 We'll see that we had 3 node types. 93 00:05:31,640 --> 00:05:33,260 We had users. 94 00:05:33,700 --> 00:05:34,600 We had computers. 95 00:05:34,940 --> 00:05:36,040 And we had groups. 96 00:05:36,580 --> 00:05:37,940 All of that information. 97 00:05:37,960 --> 00:05:40,840 Can be obtained by any domain user. 98 00:05:41,220 --> 00:05:43,400 You don't have to have any special privileges. 99 00:05:43,580 --> 00:05:46,180 To get the information of the network. 100 00:05:46,820 --> 00:05:49,620 So also, Liz in our example. 101 00:05:49,840 --> 00:05:51,220 Can get the information of all the users. 102 00:05:51,220 --> 00:05:52,980 Computers and groups. 103 00:05:54,840 --> 00:05:56,400 And we had edges. 104 00:05:57,480 --> 00:05:59,300 The attacker had to know. 105 00:05:59,400 --> 00:06:01,580 In order to follow the path we just covered. 106 00:06:01,820 --> 00:06:03,620 Which user is logged into where. 107 00:06:04,000 --> 00:06:06,440 Which user is admin into each machine. 108 00:06:06,760 --> 00:06:07,940 And the group membership. 109 00:06:08,940 --> 00:06:09,500 Surprisingly. 110 00:06:09,960 --> 00:06:12,380 Also that those edges. 111 00:06:12,520 --> 00:06:13,160 Or that information. 112 00:06:13,720 --> 00:06:16,300 Can be obtained by any domain user. 113 00:06:16,680 --> 00:06:17,900 No special privileges. 114 00:06:18,440 --> 00:06:19,520 Need to be. 115 00:06:19,620 --> 00:06:21,000 In order to obtain that information. 116 00:06:21,940 --> 00:06:22,500 So. 117 00:06:22,780 --> 00:06:24,640 If we formalized that. 118 00:06:24,760 --> 00:06:26,420 And we know what edges. 119 00:06:26,760 --> 00:06:27,940 And what nodes. 120 00:06:28,420 --> 00:06:30,560 Are part of a lateral movement. 121 00:06:31,020 --> 00:06:32,560 Why won't we just make a graph? 122 00:06:32,920 --> 00:06:34,220 So it's a great idea. 123 00:06:34,480 --> 00:06:36,300 And we didn't just think about it. 124 00:06:36,520 --> 00:06:38,020 Actually the blood out guys. 125 00:06:38,140 --> 00:06:39,440 Thought about it before us. 126 00:06:39,740 --> 00:06:41,080 And they did exactly that. 127 00:06:41,360 --> 00:06:42,620 They created a tool. 128 00:06:42,780 --> 00:06:44,960 That maps the entire network. 129 00:06:45,360 --> 00:06:47,560 Gets the information of the nodes. 130 00:06:47,620 --> 00:06:50,900 And provides a great UI. 131 00:06:51,220 --> 00:06:52,120 For red teamers. 132 00:06:52,220 --> 00:06:55,020 To see what path do they need to take. 133 00:06:55,180 --> 00:06:57,440 In order to get to the domain admins. 134 00:06:58,460 --> 00:06:59,020 So. 135 00:06:59,120 --> 00:07:00,380 This is a picture. 136 00:07:00,980 --> 00:07:01,800 From blood out. 137 00:07:02,000 --> 00:07:03,000 And what we see. 138 00:07:03,300 --> 00:07:06,040 All possible shortest path. 139 00:07:06,300 --> 00:07:08,240 To get to the domain admin group. 140 00:07:11,860 --> 00:07:12,420 So. 141 00:07:13,420 --> 00:07:14,740 Take a little pause. 142 00:07:15,020 --> 00:07:16,680 With lateral movement. 143 00:07:17,040 --> 00:07:17,820 And blood out. 144 00:07:18,060 --> 00:07:19,760 And move to another subject. 145 00:07:21,220 --> 00:07:21,740 Cover deceptions. 146 00:07:22,060 --> 00:07:23,160 What is a deception? 147 00:07:24,180 --> 00:07:25,800 Deception is the act. 148 00:07:25,940 --> 00:07:28,240 Of causing someone to accept. 149 00:07:28,440 --> 00:07:30,080 As truth or valid. 150 00:07:30,280 --> 00:07:31,800 Something that is not true. 151 00:07:33,700 --> 00:07:34,680 I'll show. 152 00:07:34,960 --> 00:07:36,100 Two examples. 153 00:07:36,280 --> 00:07:37,800 From real world. 154 00:07:38,020 --> 00:07:39,600 Real warfare. 155 00:07:40,240 --> 00:07:41,520 The first one. 156 00:07:41,620 --> 00:07:42,600 As you see. 157 00:07:42,740 --> 00:07:43,740 Are tripsters. 158 00:07:44,420 --> 00:07:46,600 In medieval ages. 159 00:07:46,980 --> 00:07:49,580 The most terrifying thing for defenders. 160 00:07:51,220 --> 00:07:52,620 To storm into the castle. 161 00:07:52,840 --> 00:07:54,080 And take over it. 162 00:07:54,800 --> 00:07:55,700 What they did. 163 00:07:55,880 --> 00:07:58,400 They create a seemingly insignificant change. 164 00:07:58,740 --> 00:07:59,800 In their infrastructure. 165 00:08:00,260 --> 00:08:01,080 In their staircase. 166 00:08:01,520 --> 00:08:04,360 That will be insignificant for defenders. 167 00:08:04,780 --> 00:08:07,000 Will be devastating for attackers. 168 00:08:07,700 --> 00:08:09,820 They took every tenth stair. 169 00:08:10,180 --> 00:08:11,960 And made it a little bit higher. 170 00:08:12,840 --> 00:08:14,800 Defenders living in the castle all their life. 171 00:08:15,000 --> 00:08:16,100 Knew which stairs. 172 00:08:16,260 --> 00:08:17,180 Do they need to skip over. 173 00:08:17,520 --> 00:08:19,280 Because they live there all their life. 174 00:08:21,220 --> 00:08:21,860 When you are going into the castle. 175 00:08:22,020 --> 00:08:23,520 For the first time. 176 00:08:23,600 --> 00:08:26,600 Not noticing this insignificant change. 177 00:08:26,820 --> 00:08:28,020 You will trip on the stair. 178 00:08:28,180 --> 00:08:28,460 Fall. 179 00:08:28,660 --> 00:08:30,060 And it will block the entire attack. 180 00:08:30,400 --> 00:08:32,620 So this is one example from real world. 181 00:08:34,300 --> 00:08:35,440 The second one. 182 00:08:35,660 --> 00:08:36,600 What you see. 183 00:08:37,060 --> 00:08:37,960 It's a tank. 184 00:08:38,160 --> 00:08:40,300 It's being lifted by four people. 185 00:08:40,720 --> 00:08:41,540 Strange right? 186 00:08:42,160 --> 00:08:43,600 It's from the second world war. 187 00:08:43,900 --> 00:08:46,660 The allied forces had an army unit. 188 00:08:46,760 --> 00:08:48,380 Called the ghost army. 189 00:08:51,220 --> 00:08:51,980 To retrieve the German forces. 190 00:08:52,400 --> 00:08:53,800 What we see in the picture. 191 00:08:54,100 --> 00:08:56,080 It's an inflatable tank. 192 00:08:56,280 --> 00:08:57,160 It's not a real tank. 193 00:08:57,440 --> 00:08:59,680 And what the allied forces did. 194 00:08:59,820 --> 00:09:02,420 They deployed tens of those tanks. 195 00:09:02,520 --> 00:09:03,640 In a specific field. 196 00:09:03,980 --> 00:09:05,860 Making the Germans think. 197 00:09:05,940 --> 00:09:07,240 That they are getting to attack. 198 00:09:07,800 --> 00:09:09,080 Where in reality. 199 00:09:09,560 --> 00:09:11,200 It was not just a deception. 200 00:09:11,840 --> 00:09:13,500 They were able to cause the Germans. 201 00:09:13,660 --> 00:09:14,980 To shift their defenses. 202 00:09:15,380 --> 00:09:16,320 To a certain location. 203 00:09:16,780 --> 00:09:19,640 Without using any real force. 204 00:09:21,220 --> 00:09:21,900 Those are two examples. 205 00:09:22,140 --> 00:09:23,060 From real world. 206 00:09:25,800 --> 00:09:27,280 We cover Bloodhound. 207 00:09:27,460 --> 00:09:28,660 And we cover Deceptions. 208 00:09:29,220 --> 00:09:30,500 Let's combine the two. 209 00:09:31,880 --> 00:09:34,000 What Bloodhound showed us. 210 00:09:34,360 --> 00:09:36,200 That an attacker. 211 00:09:36,500 --> 00:09:37,260 Can get. 212 00:09:37,460 --> 00:09:38,900 The precise path. 213 00:09:39,220 --> 00:09:39,980 It needs to go. 214 00:09:40,560 --> 00:09:42,920 In order to get domain admin credentials. 215 00:09:44,340 --> 00:09:45,360 As defenders. 216 00:09:45,680 --> 00:09:46,980 We can use the same tool. 217 00:09:47,460 --> 00:09:48,760 In order to participate. 218 00:09:49,680 --> 00:09:50,300 To. 219 00:09:51,220 --> 00:09:51,900 Know in advance. 220 00:09:52,420 --> 00:09:54,440 Where the attacker will go. 221 00:09:54,880 --> 00:09:56,000 We can know. 222 00:09:56,020 --> 00:09:57,980 That it will take the most efficient path. 223 00:09:59,040 --> 00:10:00,340 But we can do even better. 224 00:10:01,000 --> 00:10:02,120 We control the environment. 225 00:10:02,960 --> 00:10:04,780 We control the information. 226 00:10:04,800 --> 00:10:05,800 They are using. 227 00:10:05,980 --> 00:10:07,460 In order to create the graph. 228 00:10:08,440 --> 00:10:10,040 So as defenders. 229 00:10:10,360 --> 00:10:12,940 We can control the path they will take. 230 00:10:13,240 --> 00:10:15,700 We will create the right manipulations. 231 00:10:15,720 --> 00:10:16,540 In our network. 232 00:10:16,860 --> 00:10:17,980 In order to control. 233 00:10:18,080 --> 00:10:19,300 Where they will go. 234 00:10:21,220 --> 00:10:22,180 And that's exactly. 235 00:10:22,280 --> 00:10:24,780 What we are going to cover from this point on. 236 00:10:25,640 --> 00:10:26,240 So. 237 00:10:26,620 --> 00:10:27,860 This is the network. 238 00:10:28,020 --> 00:10:30,160 How it looks like before planting Deceptions. 239 00:10:31,520 --> 00:10:32,640 And this is. 240 00:10:32,680 --> 00:10:34,280 How it will look after Deceptions. 241 00:10:34,640 --> 00:10:37,120 What you are looking is an extension to Bloodhound. 242 00:10:37,300 --> 00:10:39,140 All the orange nodes. 243 00:10:39,660 --> 00:10:41,000 Are Deceptive nodes. 244 00:10:41,500 --> 00:10:42,080 This means. 245 00:10:42,300 --> 00:10:45,440 That the network is exactly the same. 246 00:10:46,040 --> 00:10:47,820 It's exactly the same network. 247 00:10:48,580 --> 00:10:49,760 The only difference. 248 00:10:50,040 --> 00:10:51,200 That we created manipulations. 249 00:10:51,220 --> 00:10:51,940 That. 250 00:10:52,560 --> 00:10:54,500 If a tracker try to follow them. 251 00:10:54,960 --> 00:10:55,880 The first one. 252 00:10:55,940 --> 00:10:57,260 It will detect him. 253 00:10:57,420 --> 00:10:58,300 And the second. 254 00:10:58,580 --> 00:11:00,440 It will not be able to reach his target. 255 00:11:02,980 --> 00:11:04,220 There are two places. 256 00:11:04,460 --> 00:11:06,420 That Deceptions can be planted. 257 00:11:07,020 --> 00:11:09,000 Either on existing endpoints. 258 00:11:09,260 --> 00:11:10,840 We call it ANI tokens. 259 00:11:11,560 --> 00:11:13,120 Or by adding. 260 00:11:13,360 --> 00:11:14,840 An additional server. 261 00:11:15,040 --> 00:11:16,100 To the network. 262 00:11:16,900 --> 00:11:18,080 The ANI token resembles. 263 00:11:18,480 --> 00:11:19,460 The STR example. 264 00:11:21,220 --> 00:11:22,560 That creating a. 265 00:11:23,400 --> 00:11:24,400 Insignificant change. 266 00:11:24,660 --> 00:11:25,560 To the defender. 267 00:11:26,060 --> 00:11:28,020 That will be devastating for an attacker. 268 00:11:28,420 --> 00:11:30,700 So it resembles ANI tokens. 269 00:11:31,200 --> 00:11:31,800 And. 270 00:11:32,720 --> 00:11:34,700 The example with the tanks. 271 00:11:34,940 --> 00:11:36,120 Resembles ANI pot. 272 00:11:36,420 --> 00:11:37,280 Will create. 273 00:11:37,400 --> 00:11:39,000 Will make an attacker believe. 274 00:11:39,300 --> 00:11:40,480 That something is true. 275 00:11:40,780 --> 00:11:42,740 Although it is just a trap. 276 00:11:45,000 --> 00:11:46,260 Let's start creating. 277 00:11:46,380 --> 00:11:47,500 Deceptive user sessions. 278 00:11:49,960 --> 00:11:50,920 We covered. 279 00:11:51,220 --> 00:11:51,780 In the beginning. 280 00:11:52,660 --> 00:11:53,660 What will happen. 281 00:11:53,840 --> 00:11:54,680 If we do the following. 282 00:11:57,140 --> 00:11:57,960 If we add. 283 00:11:58,140 --> 00:11:59,560 A deceptive user session. 284 00:11:59,960 --> 00:12:01,140 On room 2 PC. 285 00:12:01,700 --> 00:12:02,260 That points. 286 00:12:02,520 --> 00:12:04,500 Into a domain admin user. 287 00:12:05,140 --> 00:12:06,300 An attacker running. 288 00:12:06,580 --> 00:12:09,660 We will see that he has. 289 00:12:10,180 --> 00:12:12,780 It can take only four steps. 290 00:12:12,920 --> 00:12:14,460 In order to get a domain admin. 291 00:12:14,900 --> 00:12:16,680 Four steps is better than six. 292 00:12:17,100 --> 00:12:18,660 So it is a more efficient. 293 00:12:18,980 --> 00:12:20,620 Way to get domain admin. 294 00:12:21,220 --> 00:12:21,600 That is the way. 295 00:12:21,620 --> 00:12:23,280 You will see on bloodhound. 296 00:12:24,320 --> 00:12:24,960 Let's see. 297 00:12:25,180 --> 00:12:26,420 How we can create. 298 00:12:26,520 --> 00:12:27,620 Make an attacker believe. 299 00:12:28,000 --> 00:12:29,620 That superman. 300 00:12:30,280 --> 00:12:32,580 Is logged into room 2 PC. 301 00:12:32,880 --> 00:12:34,480 Although in reality he is not. 302 00:12:34,860 --> 00:12:36,920 And the only real user on room 2 PC. 303 00:12:37,040 --> 00:12:37,340 Is Clark. 304 00:12:41,760 --> 00:12:42,640 We will start. 305 00:12:42,780 --> 00:12:43,460 With ANI tokens. 306 00:12:45,260 --> 00:12:46,260 We will cover. 307 00:12:46,400 --> 00:12:47,360 Four examples. 308 00:12:47,720 --> 00:12:48,720 For each example. 309 00:12:51,220 --> 00:12:51,420 I will describe. 310 00:12:51,420 --> 00:12:52,760 What attackers are doing. 311 00:12:52,980 --> 00:12:54,600 Afterwards I will describe. 312 00:12:54,780 --> 00:12:55,500 What. 313 00:12:55,760 --> 00:12:58,460 How the deception is implemented. 314 00:12:59,020 --> 00:13:01,140 The first example will cover. 315 00:13:01,260 --> 00:13:02,220 Registry key. 316 00:13:04,960 --> 00:13:06,280 For an attacker to know. 317 00:13:06,460 --> 00:13:08,420 Which user is logged in. 318 00:13:08,440 --> 00:13:09,400 Into a specific machine. 319 00:13:10,880 --> 00:13:11,840 He can. 320 00:13:12,220 --> 00:13:13,440 Start otherwise. 321 00:13:13,900 --> 00:13:15,800 When a user logged into a machine. 322 00:13:16,500 --> 00:13:17,500 Is automatically. 323 00:13:18,020 --> 00:13:19,680 Is profile loaded. 324 00:13:21,220 --> 00:13:22,660 A part of it. 325 00:13:22,960 --> 00:13:25,100 A specific key is generated. 326 00:13:25,120 --> 00:13:25,980 In the registry. 327 00:13:26,380 --> 00:13:28,320 The key's name. 328 00:13:28,940 --> 00:13:30,780 Matches the user seed. 329 00:13:31,060 --> 00:13:33,040 The seed is a unique number. 330 00:13:33,200 --> 00:13:33,800 For each user. 331 00:13:35,300 --> 00:13:37,120 Surprisingly by default. 332 00:13:37,380 --> 00:13:38,720 Windows allows. 333 00:13:39,000 --> 00:13:41,360 Read access for everybody. 334 00:13:41,660 --> 00:13:42,900 For that specific key. 335 00:13:43,420 --> 00:13:44,000 That means. 336 00:13:44,280 --> 00:13:45,600 Any domain user. 337 00:13:45,840 --> 00:13:48,640 Can come to any domain machine. 338 00:13:49,080 --> 00:13:50,860 And just get the list. 339 00:13:51,220 --> 00:13:51,420 Of seeds. 340 00:13:52,000 --> 00:13:53,180 And that's exactly. 341 00:13:53,320 --> 00:13:54,380 What attackers are doing. 342 00:13:54,660 --> 00:13:55,900 They get the list of seeds. 343 00:13:56,080 --> 00:13:57,320 Convert them to user name. 344 00:13:57,580 --> 00:13:59,140 And know remotely. 345 00:13:59,660 --> 00:14:01,220 Which users are connected. 346 00:14:01,260 --> 00:14:01,840 To that machine. 347 00:14:05,000 --> 00:14:06,160 Exactly as I described. 348 00:14:06,640 --> 00:14:07,640 An attacker will use. 349 00:14:08,100 --> 00:14:08,980 RPC command. 350 00:14:09,200 --> 00:14:10,920 To ask all the keys. 351 00:14:11,100 --> 00:14:12,220 In the specific location. 352 00:14:12,500 --> 00:14:14,340 The endpoint will return the keys. 353 00:14:14,720 --> 00:14:15,100 Again. 354 00:14:21,380 --> 00:14:22,360 As defenders. 355 00:14:22,560 --> 00:14:23,440 What we can do. 356 00:14:24,480 --> 00:14:25,780 The answer is quite simple. 357 00:14:26,780 --> 00:14:28,760 We can add an additional key. 358 00:14:28,880 --> 00:14:29,460 In that location. 359 00:14:29,760 --> 00:14:31,800 The key will be matching. 360 00:14:32,020 --> 00:14:34,520 The user we want the attacker to believe. 361 00:14:34,720 --> 00:14:35,680 Is logged into that machine. 362 00:14:36,420 --> 00:14:37,500 Let's see a demo of it. 363 00:14:39,340 --> 00:14:40,320 On the right. 364 00:14:40,660 --> 00:14:41,940 We have the attacker machine. 365 00:14:42,700 --> 00:14:43,740 We'll run a command. 366 00:14:43,980 --> 00:14:46,040 That extracts all the logged in users. 367 00:14:46,240 --> 00:14:47,180 By the registry. 368 00:14:47,920 --> 00:14:48,820 At the beginning. 369 00:14:51,220 --> 00:14:51,380 We can see that. 370 00:14:51,380 --> 00:14:52,720 Clark is logged into that machine. 371 00:14:53,240 --> 00:14:54,020 Which is true. 372 00:14:56,980 --> 00:14:58,040 What we'll do now. 373 00:14:58,520 --> 00:15:00,080 It will plant the deception. 374 00:15:00,760 --> 00:15:01,920 On room 2 PC. 375 00:15:03,240 --> 00:15:05,100 I remind you that we want to make. 376 00:15:05,140 --> 00:15:06,180 The attacker think. 377 00:15:06,460 --> 00:15:08,860 That superman is logged into that machine. 378 00:15:09,780 --> 00:15:10,800 So we'll check. 379 00:15:10,900 --> 00:15:12,000 The seed of superman. 380 00:15:12,080 --> 00:15:13,920 We can do it by either powershell. 381 00:15:14,080 --> 00:15:16,040 This example. 382 00:15:16,520 --> 00:15:18,080 I'm using this internal tool. 383 00:15:19,180 --> 00:15:21,160 We got the seed of superman. 384 00:15:23,400 --> 00:15:24,480 And now. 385 00:15:24,620 --> 00:15:26,500 We'll add the specific key. 386 00:15:26,580 --> 00:15:27,140 To the registry. 387 00:15:28,840 --> 00:15:30,120 The key was added. 388 00:15:33,680 --> 00:15:34,700 We see that. 389 00:15:34,760 --> 00:15:35,700 We have additional key. 390 00:15:35,780 --> 00:15:36,380 In the registry. 391 00:15:39,420 --> 00:15:40,060 And. 392 00:15:40,460 --> 00:15:41,460 The attacker. 393 00:15:41,700 --> 00:15:43,840 Will run the same command again. 394 00:15:44,320 --> 00:15:44,960 Previously. 395 00:15:45,500 --> 00:15:46,240 He got. 396 00:15:46,420 --> 00:15:47,800 Only Clark in return. 397 00:15:48,160 --> 00:15:48,940 But now. 398 00:15:49,160 --> 00:15:49,940 He believes. 399 00:15:51,220 --> 00:15:51,900 That superman is logged into that machine. 400 00:15:52,480 --> 00:15:54,260 Exactly what we want to achieve. 401 00:15:55,740 --> 00:15:56,800 Whenever you see the. 402 00:15:57,100 --> 00:15:58,140 Wolf ship thing. 403 00:15:58,940 --> 00:16:00,520 It's an indication that we succeeded. 404 00:16:01,000 --> 00:16:01,520 So. 405 00:16:01,680 --> 00:16:03,100 We cover the first example. 406 00:16:04,760 --> 00:16:06,320 Let's see an additional example. 407 00:16:07,460 --> 00:16:08,000 Again. 408 00:16:08,180 --> 00:16:09,640 We want the attacker to think. 409 00:16:09,860 --> 00:16:12,420 That superman is logged into room 2 PC. 410 00:16:12,660 --> 00:16:13,700 And not only Clark. 411 00:16:15,940 --> 00:16:16,820 That example. 412 00:16:17,220 --> 00:16:18,480 Involves an API. 413 00:16:18,880 --> 00:16:20,280 To remotely query. 414 00:16:21,220 --> 00:16:21,600 Your sessions. 415 00:16:23,560 --> 00:16:24,160 The. 416 00:16:24,900 --> 00:16:25,500 API. 417 00:16:26,100 --> 00:16:28,260 Does require admin privileges. 418 00:16:28,800 --> 00:16:29,960 But the deception. 419 00:16:30,260 --> 00:16:31,300 Is relevant. 420 00:16:31,620 --> 00:16:33,300 Also for other tools. 421 00:16:33,500 --> 00:16:34,520 Such as Mimikatz. 422 00:16:34,940 --> 00:16:37,340 So the deception that we're going to cover. 423 00:16:37,660 --> 00:16:39,160 Will influence an attacker. 424 00:16:39,280 --> 00:16:40,540 That after you've got. 425 00:16:41,120 --> 00:16:42,340 Control of the endpoint. 426 00:16:42,820 --> 00:16:44,020 And will try to run Mimikatz. 427 00:16:44,100 --> 00:16:44,880 To dump the credentials. 428 00:16:45,440 --> 00:16:46,640 We're using this deception. 429 00:16:51,220 --> 00:16:51,300 So. 430 00:16:51,760 --> 00:16:54,580 We want to add an additional deceptive session. 431 00:16:55,220 --> 00:16:56,300 The problem that. 432 00:16:56,420 --> 00:16:58,780 Each time that you want to authenticate. 433 00:16:58,860 --> 00:16:59,640 Or add a session. 434 00:17:00,600 --> 00:17:02,660 You have to authenticate the credentials. 435 00:17:02,840 --> 00:17:04,040 Against active directory. 436 00:17:04,500 --> 00:17:06,760 And we want to plant deceptive credentials. 437 00:17:07,180 --> 00:17:09,140 We want to plant the deceptive credentials. 438 00:17:09,500 --> 00:17:11,300 That if they will be used. 439 00:17:11,340 --> 00:17:11,980 By the attacker. 440 00:17:12,680 --> 00:17:15,420 It will not be able to actually move laterally. 441 00:17:16,280 --> 00:17:17,300 Luckily for us. 442 00:17:17,380 --> 00:17:18,980 There is a method to do that. 443 00:17:19,360 --> 00:17:20,420 That method involves. 444 00:17:21,220 --> 00:17:22,380 Run as net only. 445 00:17:23,000 --> 00:17:25,100 The run as command creates an additional process. 446 00:17:25,480 --> 00:17:27,280 When passing the flag net only. 447 00:17:27,720 --> 00:17:28,960 You can pass. 448 00:17:29,120 --> 00:17:30,440 Any credentials that you want. 449 00:17:30,920 --> 00:17:33,220 Without them actually authenticating. 450 00:17:33,240 --> 00:17:34,520 Against active directory. 451 00:17:35,020 --> 00:17:37,300 But the credentials are still. 452 00:17:37,340 --> 00:17:39,420 Added to the windows memory. 453 00:17:40,100 --> 00:17:41,240 And will do exactly that. 454 00:17:42,040 --> 00:17:42,680 So. 455 00:17:42,860 --> 00:17:45,240 An attacker remotely queries. 456 00:17:45,320 --> 00:17:47,060 All the sessions. 457 00:17:47,640 --> 00:17:48,780 And the computer. 458 00:17:48,940 --> 00:17:49,900 Returns the response. 459 00:17:51,220 --> 00:17:52,340 The attacker will know. 460 00:17:52,520 --> 00:17:54,320 Which users are connected to that machine. 461 00:17:54,760 --> 00:17:55,740 Let's see it in action. 462 00:17:57,000 --> 00:17:58,160 So again. 463 00:17:58,320 --> 00:17:59,060 We have our attacker. 464 00:17:59,500 --> 00:18:00,960 First we will run the command. 465 00:18:01,980 --> 00:18:03,340 And we will see. 466 00:18:03,440 --> 00:18:06,100 We got only the computer account. 467 00:18:06,420 --> 00:18:08,400 And Clark connected to that machine. 468 00:18:09,840 --> 00:18:10,880 And of course. 469 00:18:11,120 --> 00:18:12,160 That's the reality. 470 00:18:12,660 --> 00:18:14,640 In reality only Clark is connected. 471 00:18:19,340 --> 00:18:19,920 Now. 472 00:18:21,580 --> 00:18:22,180 We will. 473 00:18:22,180 --> 00:18:23,360 Create the reception. 474 00:18:23,640 --> 00:18:24,540 Or edit the reception. 475 00:18:25,720 --> 00:18:27,040 We will run run as. 476 00:18:27,280 --> 00:18:29,620 With any random password. 477 00:18:29,900 --> 00:18:32,240 It's not the real password of the user. 478 00:18:37,860 --> 00:18:39,220 The command executed. 479 00:18:39,640 --> 00:18:40,280 And now. 480 00:18:40,420 --> 00:18:42,000 The attacker once again. 481 00:18:42,160 --> 00:18:43,540 Will run the same command. 482 00:18:44,080 --> 00:18:45,060 And this time. 483 00:18:46,060 --> 00:18:47,880 He also sees superman. 484 00:18:48,060 --> 00:18:49,600 Exactly what I wanted to achieve. 485 00:18:51,220 --> 00:18:52,600 This is the second method to create. 486 00:18:52,760 --> 00:18:53,800 Deceptive user sessions. 487 00:18:55,220 --> 00:18:56,860 We are going to cover the last. 488 00:18:57,480 --> 00:18:59,180 Example of creating user sessions. 489 00:19:00,360 --> 00:19:00,920 Again. 490 00:19:01,040 --> 00:19:01,920 We want to create. 491 00:19:02,000 --> 00:19:03,100 Make the attacker believe. 492 00:19:03,480 --> 00:19:05,800 That superman is logged into PC2. 493 00:19:07,420 --> 00:19:08,640 For this example. 494 00:19:08,840 --> 00:19:10,620 We will use our trap server. 495 00:19:10,860 --> 00:19:11,520 Or any pot. 496 00:19:14,360 --> 00:19:14,920 Any. 497 00:19:15,400 --> 00:19:16,400 Windows machine. 498 00:19:17,000 --> 00:19:18,040 Is by default. 499 00:19:18,220 --> 00:19:19,400 Also SMB server. 500 00:19:21,220 --> 00:19:23,040 It's a file server. 501 00:19:23,260 --> 00:19:24,140 But also. 502 00:19:24,180 --> 00:19:25,180 Active directory. 503 00:19:25,500 --> 00:19:27,500 Or your organizational file server. 504 00:19:28,560 --> 00:19:29,840 Those file servers. 505 00:19:30,360 --> 00:19:32,560 For each machine that connects to them. 506 00:19:33,040 --> 00:19:34,760 All the name of the user. 507 00:19:34,920 --> 00:19:36,580 And the machine that connected to them. 508 00:19:37,180 --> 00:19:38,440 What attackers are doing. 509 00:19:39,000 --> 00:19:39,360 Again. 510 00:19:39,820 --> 00:19:42,700 Instead of going machine one by one. 511 00:19:43,140 --> 00:19:43,900 They connect. 512 00:19:44,140 --> 00:19:46,240 They quarry a file server. 513 00:19:46,660 --> 00:19:49,120 Ask them for all the machines. 514 00:19:49,260 --> 00:19:50,980 And users that connected to them. 515 00:19:53,340 --> 00:19:53,940 So. 516 00:19:54,140 --> 00:19:55,000 In our example. 517 00:19:55,840 --> 00:19:56,440 Clark. 518 00:19:57,040 --> 00:19:58,240 Connected to a file server. 519 00:19:59,340 --> 00:20:00,320 Our attacker. 520 00:20:00,620 --> 00:20:02,440 Will quarry the file server. 521 00:20:02,580 --> 00:20:03,880 For all of the. 522 00:20:04,120 --> 00:20:05,380 The users and machines. 523 00:20:05,720 --> 00:20:07,520 That has active sessions to it. 524 00:20:08,180 --> 00:20:10,000 The files are returned response. 525 00:20:10,940 --> 00:20:11,980 Saying that Clark. 526 00:20:12,340 --> 00:20:14,460 Is connected from computer. 527 00:20:14,540 --> 00:20:15,360 Room to PC. 528 00:20:15,960 --> 00:20:17,400 And our attacker would know. 529 00:20:17,580 --> 00:20:19,680 That Clark is on room to PC. 530 00:20:22,840 --> 00:20:24,200 When adding an. 531 00:20:24,220 --> 00:20:25,700 To the network. 532 00:20:26,120 --> 00:20:27,140 We control. 533 00:20:27,400 --> 00:20:29,380 All the responses it will generate. 534 00:20:29,860 --> 00:20:31,000 We can control. 535 00:20:31,280 --> 00:20:33,660 Whatever it will return to the attacker. 536 00:20:34,060 --> 00:20:35,560 And we will do exactly that. 537 00:20:36,500 --> 00:20:37,160 We added. 538 00:20:37,460 --> 00:20:38,080 A server. 539 00:20:38,720 --> 00:20:40,420 And when our attacker. 540 00:20:40,700 --> 00:20:42,700 Will quarry it for all the remote. 541 00:20:42,880 --> 00:20:44,080 All the active sessions. 542 00:20:44,620 --> 00:20:45,700 Will just let him know. 543 00:20:46,160 --> 00:20:48,440 Superman is connected on room to PC. 544 00:20:48,960 --> 00:20:50,220 And I'm going to show you. 545 00:20:51,340 --> 00:20:52,800 And the example we have. 546 00:20:54,300 --> 00:20:55,520 Deceptive file server. 547 00:20:55,760 --> 00:20:57,640 With our own implementation. 548 00:20:57,660 --> 00:20:58,920 Of an SMB server. 549 00:20:59,340 --> 00:21:01,020 And the implementation with a file. 550 00:21:01,420 --> 00:21:03,280 That holds the response. 551 00:21:03,560 --> 00:21:04,560 It will return for attacker. 552 00:21:06,320 --> 00:21:07,720 So on the right. 553 00:21:07,800 --> 00:21:08,560 We have the attacker. 554 00:21:09,000 --> 00:21:10,080 And on the left. 555 00:21:10,160 --> 00:21:11,200 Our deceptive server. 556 00:21:13,940 --> 00:21:15,180 What we see in the background. 557 00:21:15,480 --> 00:21:17,020 Is the file that will hold. 558 00:21:17,100 --> 00:21:17,760 The responses. 559 00:21:21,220 --> 00:21:21,640 The file is empty. 560 00:21:21,840 --> 00:21:23,760 So when attacker quarries. 561 00:21:23,800 --> 00:21:25,880 Of all the active sessions. 562 00:21:26,140 --> 00:21:27,480 He got nothing in response. 563 00:21:28,880 --> 00:21:30,380 But once we added. 564 00:21:30,580 --> 00:21:32,100 Superman and room to PC. 565 00:21:32,380 --> 00:21:34,220 The same request. 566 00:21:34,660 --> 00:21:36,680 Now gives the attacker. 567 00:21:36,920 --> 00:21:37,940 The notion. 568 00:21:38,160 --> 00:21:39,920 That Superman is connected to that machine. 569 00:21:40,340 --> 00:21:42,480 And we can do anything we want. 570 00:21:42,600 --> 00:21:44,080 We can add an additional like. 571 00:21:44,200 --> 00:21:46,000 Random PC or whatever we want. 572 00:21:46,300 --> 00:21:47,700 And an attacker will believe. 573 00:21:48,100 --> 00:21:49,500 That those users. 574 00:21:51,220 --> 00:21:51,340 Are connected to those machines. 575 00:21:51,340 --> 00:21:54,280 So that was the third example. 576 00:21:54,420 --> 00:21:56,200 Of how we can deceive attackers. 577 00:21:56,540 --> 00:21:57,440 And make them think. 578 00:21:57,600 --> 00:21:59,600 That a user is connected. 579 00:21:59,620 --> 00:22:00,720 To a specific machine. 580 00:22:00,960 --> 00:22:02,180 Although in reality. 581 00:22:02,380 --> 00:22:03,200 It is not that. 582 00:22:06,520 --> 00:22:08,820 I will give one last example. 583 00:22:09,340 --> 00:22:11,780 But not for deceptive user sessions. 584 00:22:12,140 --> 00:22:14,500 But deceptive local admin privileges. 585 00:22:17,460 --> 00:22:18,760 Taking the same graph. 586 00:22:19,160 --> 00:22:20,900 If you create the following manipulation. 587 00:22:21,220 --> 00:22:23,560 Will make an attacker believe. 588 00:22:24,000 --> 00:22:25,680 That user leads. 589 00:22:25,920 --> 00:22:26,720 Is admin. 590 00:22:27,040 --> 00:22:28,560 Into our trap server. 591 00:22:29,060 --> 00:22:31,600 And there is a domain admin. 592 00:22:31,800 --> 00:22:32,900 Connected to that machine. 593 00:22:33,300 --> 00:22:35,000 Will provide an attacker. 594 00:22:35,300 --> 00:22:37,220 A shorter path. 595 00:22:38,060 --> 00:22:38,700 To a domain admin. 596 00:22:39,040 --> 00:22:41,580 That path is only three steps. 597 00:22:42,820 --> 00:22:43,820 Even better. 598 00:22:43,880 --> 00:22:45,160 Than deception using. 599 00:22:45,280 --> 00:22:46,160 User sessions. 600 00:22:48,320 --> 00:22:49,080 Let's see. 601 00:22:49,140 --> 00:22:49,960 How we can do that. 602 00:22:52,420 --> 00:22:54,720 As with previous examples. 603 00:22:55,600 --> 00:22:56,240 Quering. 604 00:22:56,340 --> 00:22:57,400 Remotely quarrying. 605 00:22:57,500 --> 00:22:58,320 Group membership. 606 00:22:58,640 --> 00:23:00,680 Does not require special privileges. 607 00:23:01,260 --> 00:23:02,200 Any user. 608 00:23:02,240 --> 00:23:03,920 Can just come to any machine. 609 00:23:04,160 --> 00:23:05,280 And ask it. 610 00:23:05,360 --> 00:23:07,060 For all the local members. 611 00:23:07,400 --> 00:23:08,740 Of the administrative group. 612 00:23:11,000 --> 00:23:12,020 What we do. 613 00:23:12,240 --> 00:23:14,380 Is similar to the previous example. 614 00:23:14,900 --> 00:23:16,080 We have our trap server. 615 00:23:16,380 --> 00:23:17,860 And we control all the response. 616 00:23:18,040 --> 00:23:18,360 It generates. 617 00:23:21,220 --> 00:23:22,080 Return response. 618 00:23:22,580 --> 00:23:23,340 That leads. 619 00:23:23,540 --> 00:23:24,440 Is an admin. 620 00:23:24,640 --> 00:23:25,620 On our trap server. 621 00:23:25,960 --> 00:23:27,240 And for this example. 622 00:23:27,400 --> 00:23:29,100 We use even a name. 623 00:23:29,240 --> 00:23:30,700 That matches the convention. 624 00:23:30,720 --> 00:23:31,440 Of the organization. 625 00:23:32,920 --> 00:23:34,160 Matches the convention. 626 00:23:34,280 --> 00:23:35,280 Of other computers. 627 00:23:36,440 --> 00:23:37,860 I will skip the example. 628 00:23:37,960 --> 00:23:39,220 The demo for that one. 629 00:23:39,460 --> 00:23:41,020 It's similar to the previous one. 630 00:23:42,220 --> 00:23:44,100 So enough technique for now. 631 00:23:45,840 --> 00:23:46,580 Let's see. 632 00:23:51,220 --> 00:23:51,920 We detect attackers. 633 00:23:52,280 --> 00:23:54,460 Hunting domain admin credentials in the network. 634 00:23:54,700 --> 00:23:56,900 And we want to do it by placing. 635 00:23:56,960 --> 00:23:58,740 And monitoring deceptive users. 636 00:23:58,860 --> 00:23:59,320 And machines. 637 00:23:59,680 --> 00:24:01,220 We got the piece of the puzzle. 638 00:24:01,500 --> 00:24:05,040 We know we can create or add deceptive users. 639 00:24:05,260 --> 00:24:06,100 And deceptive machines. 640 00:24:08,320 --> 00:24:09,580 To make sure. 641 00:24:09,740 --> 00:24:10,820 We detect attackers. 642 00:24:11,260 --> 00:24:13,080 We have a specific goal. 643 00:24:13,520 --> 00:24:15,200 The goal is that. 644 00:24:15,400 --> 00:24:17,120 Any shortest path. 645 00:24:17,400 --> 00:24:18,300 To a domain admin. 646 00:24:18,860 --> 00:24:20,460 Will contain at least. 647 00:24:21,220 --> 00:24:21,680 One edge. 648 00:24:21,900 --> 00:24:23,000 Or one node. 649 00:24:23,120 --> 00:24:24,220 That is deceptive. 650 00:24:24,580 --> 00:24:27,380 And those nodes and edges. 651 00:24:27,600 --> 00:24:29,480 Will provide us a detection mechanism. 652 00:24:29,940 --> 00:24:31,940 If an attacker uses a deceptive user. 653 00:24:32,180 --> 00:24:32,940 Or connects. 654 00:24:33,180 --> 00:24:35,280 To our trap server. 655 00:24:36,000 --> 00:24:36,780 We can alert. 656 00:24:37,720 --> 00:24:39,480 We'll do it in three steps. 657 00:24:39,980 --> 00:24:41,180 It's a native implementation. 658 00:24:41,820 --> 00:24:45,160 There are even more interesting implementations. 659 00:24:45,200 --> 00:24:45,960 Using graph theory. 660 00:24:46,240 --> 00:24:47,780 I deliberately chose to. 661 00:24:48,940 --> 00:24:50,020 Use something native. 662 00:24:51,220 --> 00:24:51,480 To explain. 663 00:24:51,760 --> 00:24:53,980 So the steps are as follows. 664 00:24:54,440 --> 00:24:55,060 First. 665 00:24:55,240 --> 00:24:58,180 We want to add a deceptive user session. 666 00:24:58,460 --> 00:25:00,200 For all the computers. 667 00:25:00,340 --> 00:25:02,860 That are closest to the domain admin group. 668 00:25:03,520 --> 00:25:04,180 Second. 669 00:25:04,280 --> 00:25:06,000 We'll add deceptive computers. 670 00:25:06,200 --> 00:25:08,220 To the top groups. 671 00:25:08,400 --> 00:25:09,380 In the network. 672 00:25:09,860 --> 00:25:11,220 And lastly. 673 00:25:11,580 --> 00:25:13,520 We'll take clicks. 674 00:25:13,720 --> 00:25:15,020 Or end points. 675 00:25:15,220 --> 00:25:18,000 That in reality does not have. 676 00:25:18,200 --> 00:25:20,460 A clear path to domain admin. 677 00:25:21,220 --> 00:25:23,060 And we'll make an attacker think. 678 00:25:23,240 --> 00:25:24,680 That they can lead him to domain admin. 679 00:25:24,940 --> 00:25:26,620 So for an organization. 680 00:25:26,660 --> 00:25:28,280 With 10,000 nodes. 681 00:25:29,120 --> 00:25:30,600 The blood and graph. 682 00:25:30,860 --> 00:25:32,080 Will show approximately. 683 00:25:32,500 --> 00:25:34,160 Maybe 100 nodes. 684 00:25:34,440 --> 00:25:35,760 Because not all computers. 685 00:25:35,900 --> 00:25:36,960 Can lead to domain admin. 686 00:25:37,520 --> 00:25:39,160 But using the third option. 687 00:25:39,440 --> 00:25:41,360 We can create a graph. 688 00:25:41,640 --> 00:25:44,260 That for an attacker will see 500 nodes. 689 00:25:44,360 --> 00:25:44,820 Or even more. 690 00:25:45,000 --> 00:25:48,660 Because we can take computers from the network. 691 00:25:48,880 --> 00:25:50,420 And create a deceptive connection. 692 00:25:51,220 --> 00:25:52,440 That will lead to domain admin. 693 00:25:54,440 --> 00:25:55,080 So. 694 00:25:55,940 --> 00:25:56,980 This is again. 695 00:25:57,160 --> 00:25:59,260 The blood and UI. 696 00:25:59,700 --> 00:26:00,280 The blood and graph. 697 00:26:00,600 --> 00:26:02,320 And this is our. 698 00:26:02,760 --> 00:26:05,040 Domain admin group. 699 00:26:05,640 --> 00:26:06,400 Let's see. 700 00:26:06,500 --> 00:26:08,040 Those three steps in action. 701 00:26:08,480 --> 00:26:09,540 Step number one. 702 00:26:10,960 --> 00:26:11,800 We just added. 703 00:26:12,940 --> 00:26:15,240 Users to all the closest computers. 704 00:26:15,780 --> 00:26:17,040 If we just stop. 705 00:26:17,220 --> 00:26:17,920 Right here. 706 00:26:18,060 --> 00:26:19,620 We already achieved our goal. 707 00:26:21,220 --> 00:26:22,140 All the path. 708 00:26:22,280 --> 00:26:23,960 That lead to domain admin group. 709 00:26:24,440 --> 00:26:26,920 Already contain at least one. 710 00:26:27,720 --> 00:26:28,900 One node. 711 00:26:29,480 --> 00:26:30,700 But we want to create. 712 00:26:30,840 --> 00:26:32,900 Even more complex picture for the attacker. 713 00:26:33,460 --> 00:26:34,720 So the second stage. 714 00:26:36,780 --> 00:26:37,620 Will add. 715 00:26:38,440 --> 00:26:39,320 Deceptive computers. 716 00:26:39,780 --> 00:26:40,980 To the top groups. 717 00:26:42,600 --> 00:26:43,500 Once again. 718 00:26:44,060 --> 00:26:45,060 All of the. 719 00:26:46,140 --> 00:26:47,060 Those nodes. 720 00:26:47,320 --> 00:26:48,740 And new path that you are seeing. 721 00:26:49,260 --> 00:26:50,660 Are not real path. 722 00:26:51,220 --> 00:26:52,540 An attacker that will follow them. 723 00:26:52,600 --> 00:26:54,640 Will not be able to get. 724 00:26:54,820 --> 00:26:55,800 Domain admin credentials. 725 00:26:56,120 --> 00:26:58,280 It will only trigger an alert. 726 00:26:58,740 --> 00:27:00,220 So we added. 727 00:27:01,160 --> 00:27:01,800 Additional. 728 00:27:03,140 --> 00:27:04,620 Machines to the top groups. 729 00:27:06,120 --> 00:27:06,760 And. 730 00:27:06,860 --> 00:27:07,500 Lastly. 731 00:27:07,860 --> 00:27:10,240 We took additional machines in the network. 732 00:27:10,380 --> 00:27:12,980 And connected them to the blood and graph. 733 00:27:14,080 --> 00:27:14,720 So. 734 00:27:14,800 --> 00:27:15,740 All of those. 735 00:27:16,840 --> 00:27:19,100 Are either deceptive computers. 736 00:27:19,320 --> 00:27:20,160 Or users. 737 00:27:21,640 --> 00:27:23,400 Are added to the graph. 738 00:27:23,620 --> 00:27:24,600 And one result. 739 00:27:24,720 --> 00:27:25,800 You can see over here. 740 00:27:26,780 --> 00:27:27,700 This user. 741 00:27:27,800 --> 00:27:29,880 Is the antivirus. 742 00:27:31,480 --> 00:27:32,600 Service user. 743 00:27:33,280 --> 00:27:33,840 Before. 744 00:27:34,020 --> 00:27:36,420 It would not lead. 745 00:27:36,840 --> 00:27:38,420 To the domain admin group. 746 00:27:38,860 --> 00:27:40,000 But using deceptions. 747 00:27:40,260 --> 00:27:42,340 We added all of those machines. 748 00:27:43,020 --> 00:27:45,180 That if an attacker will compromise them. 749 00:27:45,460 --> 00:27:46,320 It will think. 750 00:27:46,320 --> 00:27:47,820 That he has a valid path. 751 00:27:48,060 --> 00:27:51,060 That will lead to the domain admin group. 752 00:27:53,720 --> 00:27:54,660 Wrapping up. 753 00:27:56,180 --> 00:27:57,280 What we covered. 754 00:27:57,660 --> 00:27:59,340 We covered lateral movement. 755 00:27:59,400 --> 00:28:00,100 And graphs. 756 00:28:00,840 --> 00:28:03,120 I showed four methods. 757 00:28:03,180 --> 00:28:04,780 To deceive attackers. 758 00:28:06,720 --> 00:28:07,820 We showed. 759 00:28:07,820 --> 00:28:08,780 How we can control. 760 00:28:09,060 --> 00:28:10,700 The path an attacker will take. 761 00:28:11,220 --> 00:28:13,200 And we showed an algorithm. 762 00:28:13,580 --> 00:28:14,500 That will make sure. 763 00:28:14,660 --> 00:28:16,060 That every shortest path. 764 00:28:16,260 --> 00:28:18,460 Will contain at least. 765 00:28:18,560 --> 00:28:20,080 One deceptive edge. 766 00:28:21,220 --> 00:28:21,320 To conclude. 767 00:28:23,300 --> 00:28:24,920 What we can take from that. 768 00:28:26,620 --> 00:28:27,200 Deceptions. 769 00:28:27,460 --> 00:28:28,580 Bring doubt. 770 00:28:29,280 --> 00:28:30,300 And uncertainty. 771 00:28:30,620 --> 00:28:32,200 To the operations of the attacker. 772 00:28:32,820 --> 00:28:33,680 An attacker. 773 00:28:34,020 --> 00:28:36,140 That tries to move laterally. 774 00:28:36,220 --> 00:28:37,220 In an organization. 775 00:28:37,500 --> 00:28:38,420 That employs deception. 776 00:28:39,060 --> 00:28:41,160 Will doubt any piece of information. 777 00:28:41,180 --> 00:28:41,700 He finds. 778 00:28:42,200 --> 00:28:45,140 Because he will no longer be able. 779 00:28:45,220 --> 00:28:45,620 To be sure. 780 00:28:45,860 --> 00:28:47,860 That this information. 781 00:28:52,360 --> 00:28:54,180 And our current security. 782 00:28:54,960 --> 00:28:55,440 Strategy. 783 00:28:55,980 --> 00:28:57,520 Is mostly built on walls. 784 00:28:57,680 --> 00:28:58,360 And walls are good. 785 00:28:58,640 --> 00:28:59,960 They keep the bad things out. 786 00:29:00,280 --> 00:29:01,540 But we also understand. 787 00:29:01,940 --> 00:29:04,860 That we live in an assumed bridge era. 788 00:29:05,100 --> 00:29:06,620 That any wall. 789 00:29:06,740 --> 00:29:08,240 Will eventually be bypassed. 790 00:29:08,560 --> 00:29:09,900 What I wanted to show you. 791 00:29:10,000 --> 00:29:11,420 And if we will take only one thing. 792 00:29:12,120 --> 00:29:13,460 From this talk. 793 00:29:13,780 --> 00:29:15,860 Is that using deceptions. 794 00:29:15,860 --> 00:29:17,380 We can make attackers. 795 00:29:17,560 --> 00:29:19,240 Fear of what awaits them. 796 00:29:19,640 --> 00:29:20,380 Behind those walls. 797 00:29:21,220 --> 00:29:23,100 And one last game of thrones. 798 00:29:28,760 --> 00:29:29,420 That's it. 799 00:29:29,600 --> 00:29:30,640 Thank you very much. 800 00:29:40,040 --> 00:29:41,700 If you have any questions. 801 00:29:42,100 --> 00:29:42,400 Okay. 802 00:29:42,780 --> 00:29:43,340 So. 803 00:29:48,120 --> 00:29:49,520 . 804 00:30:02,440 --> 00:30:03,840 . 805 00:30:03,840 --> 00:30:05,300 . 806 00:30:05,300 --> 00:30:05,320 . 807 00:30:05,320 --> 00:30:05,560 . 808 00:30:05,560 --> 00:30:08,060 . 809 00:30:08,060 --> 00:30:08,900 . 810 00:30:08,900 --> 00:30:11,060 . 811 00:30:11,060 --> 00:30:11,100 . 812 00:30:11,100 --> 00:30:11,200 . 813 00:30:27,000 --> 00:30:27,840 . 814 00:30:29,080 --> 00:30:29,920 . 815 00:30:31,100 --> 00:30:31,940 . 816 00:30:31,940 --> 00:30:32,000 . 817 00:30:32,000 --> 00:30:32,080 . 818 00:30:32,080 --> 00:30:32,780 . 819 00:30:32,780 --> 00:30:32,880 . 820 00:30:32,880 --> 00:30:33,920 . 821 00:30:33,920 --> 00:30:33,940 . 822 00:30:33,940 --> 00:30:34,000 . 823 00:30:37,860 --> 00:30:38,700 . 824 00:30:38,700 --> 00:30:38,840 . 825 00:30:39,860 --> 00:30:40,280 . 826 00:30:40,280 --> 00:30:40,300 . 827 00:30:40,300 --> 00:30:41,120 . 828 00:30:44,160 --> 00:30:45,560 . 829 00:30:45,560 --> 00:30:45,940 . 830 00:30:55,020 --> 00:30:56,420 . 831 00:31:01,820 --> 00:31:03,220 . 832 00:31:03,220 --> 00:31:05,140 . 833 00:31:10,300 --> 00:31:10,720 . 834 00:31:19,500 --> 00:31:20,340 . 835 00:31:20,340 --> 00:31:20,380 . 836 00:31:23,460 --> 00:31:24,300 . 837 00:31:24,300 --> 00:31:24,420 . 838 00:31:24,420 --> 00:31:24,480 . 839 00:31:24,480 --> 00:31:24,500 . 840 00:31:24,500 --> 00:31:24,560 . 841 00:31:30,320 --> 00:31:31,160 . 842 00:31:31,160 --> 00:31:32,220 . 843 00:31:32,220 --> 00:31:33,460 . 844 00:31:33,460 --> 00:31:33,580 . 845 00:31:36,500 --> 00:31:37,340 . 846 00:31:40,820 --> 00:31:42,220 . 847 00:31:44,240 --> 00:31:44,940 . 848 00:31:44,940 --> 00:31:45,780 . 849 00:31:45,780 --> 00:31:46,800 . 850 00:31:46,800 --> 00:31:47,360 . 851 00:31:47,360 --> 00:31:47,860 . 852 00:31:47,860 --> 00:31:49,540 . 853 00:31:49,540 --> 00:31:49,740 . 854 00:31:49,740 --> 00:31:51,040 . 855 00:31:51,040 --> 00:31:51,060 . 856 00:31:51,060 --> 00:31:51,080 . 857 00:32:12,780 --> 00:32:13,340 . 858 00:32:29,180 --> 00:32:29,740 . 859 00:32:29,740 --> 00:32:30,100 . 860 00:32:30,100 --> 00:32:30,120 . 861 00:32:30,120 --> 00:32:30,600 . 862 00:32:30,600 --> 00:32:30,880 . 863 00:32:30,880 --> 00:32:31,760 . 864 00:32:31,760 --> 00:32:31,880 . 865 00:32:34,300 --> 00:32:34,860 . 866 00:32:34,860 --> 00:32:34,880 . 867 00:32:34,880 --> 00:32:34,900 . 868 00:32:34,900 --> 00:32:34,940 . 869 00:32:34,940 --> 00:32:34,960 . 870 00:32:40,300 --> 00:32:40,520 . 871 00:32:42,860 --> 00:32:44,220 . 872 00:32:44,220 --> 00:32:44,700 . 873 00:32:44,700 --> 00:32:44,840 . 874 00:32:44,840 --> 00:32:45,720 . 875 00:32:47,260 --> 00:32:48,620 . 876 00:32:48,620 --> 00:32:48,640 . 877 00:32:48,640 --> 00:32:48,720 . 878 00:32:50,420 --> 00:32:51,780 . 879 00:32:51,780 --> 00:32:51,880 . 880 00:32:56,740 --> 00:32:58,100 . 881 00:33:00,440 --> 00:33:01,800 . 882 00:33:10,300 --> 00:33:13,660 will monitor them, and if you place honeypots, you will monitor them. 883 00:33:18,340 --> 00:33:22,200 That's separate. That's an extension that I created with 884 00:33:22,200 --> 00:33:23,800 the deceptive nodes and edge. 885 00:33:29,600 --> 00:33:34,300 Yeah, as I said, I work for a company named Elusive Networks, and we can talk afterwards. 886 00:33:49,200 --> 00:33:50,740 Can you repeat the question? 887 00:33:53,460 --> 00:33:57,540 The examples that you use are mostly for workstations, but I'm assuming you can also 888 00:33:57,540 --> 00:34:02,180 use deceptive technology for web servers, which are also highly attacked, and capture 889 00:34:02,180 --> 00:34:04,020 movement from the web servers. 890 00:34:05,500 --> 00:34:09,220 That's completely true. I deliberately showed only a small amount 891 00:34:09,220 --> 00:34:15,280 of what possibilities there are for deception, so we're also relevant for servers and endpoints 892 00:34:15,280 --> 00:34:19,880 and for other services, and not just Active Directory-related services. 893 00:34:33,600 --> 00:34:34,220 Yeah. 894 00:34:36,000 --> 00:34:38,400 We'll help you to cover it if you want afterwards. 895 00:34:38,640 --> 00:34:46,000 There is a vast options for creating deceptions, and I'll be happy to cover it. 896 00:34:49,040 --> 00:34:50,120 Thank you very much, everybody.