start	end	text
16030	20270	This is Cheerio presenting indicators of immunization.
20270	23950	And with that, I will let Cheerio take it away. Thank you.
24750	28130	Hi, everyone. Thanks so much for coming here.
28130	31530	So let's jump right in.
32570	38330	So really quick, I am not speaking on behalf of any of my employers.
38570	41610	Everything I say is basically my opinion
41610	45210	and not necessarily that of my employer.
45210	48030	So now that we have that out of the way,
48030	52910	I'm going to do a TLDR on this and basically tell you that this talk
52910	57830	is about taking the Windows command line arguments and PowerShell
57830	62910	and seeing what the heck we can do with it as a cyber threat intelligence professional
62910	67870	to provide to other teams in the organization.
67870	72330	So that basically sums up my talk in about a sentence.
72570	78930	So if you're interested in playing along, stick with me.
80510	86050	So Katie Kuzianovic, and I apologize, I probably didn't pronounce that right.
86050	90170	I'm sorry. Her DerbyCon 8 presentation.
90170	95570	And she said that blocked data is the glitter of the TI data world.
95570	100690	And so ever since DerbyCon 8, that's kind of really stuck with me.
100730	104910	And in the spirit of the discovery theme this year for DEF CON,
104910	108850	I decided, hey, why not explore this a little bit further
108850	113770	and see what I can do with actual blocked data
115230	119930	and see how I can extract intelligence and information
119930	122490	to be able to feed to different teams.
122490	132670	So fast forward about 13 months, and I go to Matt Kelly's B-Side Chicago talk in 2019.
132670	138730	And it was a great presentation on threat emulation, adversary-focused red teams.
138730	145690	And in it, he gave a really interesting graph and information about some ideas
145690	151870	as far as how threat intelligence can help feed red teams and adversary emulation.
151870	153870	So that kind of stuck with me.
154070	158730	Then fast forward another five months, and I reached out to Bryce and Bort
158730	163170	because over at Psy, they have something called a marketplace.
163230	170610	And basically, it's, you know, I'm going to paraphrase horribly, so please forgive me.
170890	176610	It's like a thing for researchers to research threat actors out there
176610	185130	and then help build out some of the adversary emulation that they have, right?
185130	188890	So I'm like, oh, that sounds so fascinating. I want to get involved.
189070	193070	And so Bryce got me in touch with Adam Maschini, and I apologize.
193070	195690	I may have pronounced that wrong. Please forgive me.
196470	201890	And he pointed out that there were a lot of threat intel reports with Linux commands,
201890	205750	Linux-related commands, but there wasn't too much with Windows.
205750	210810	So I decided that semester I was doing a malware analysis course,
210810	214430	and I'm like, huh, this would be a really interesting project to take on
214430	220750	and see just what it's about and where it will lead me, right?
220750	229310	So I'm like, okay, so I will just enable Windows command line logging, and it's just easy.
229310	238430	So what I did is I got a VM, and then I figured out how to turn on the logs and all of that, right?
239970	243870	Disable all the security stuff, especially the smart screen.
243870	248050	And God, it was so much disabling of so much security, it was crazy.
248090	251690	And I just want to do a shout out to Microsoft Windows.
251790	254570	Like, I cannot tell you how hard it was for me,
254570	262750	like how many things I had to disable and go through in order to execute malware on the VM.
262750	267030	It was crazy. I'm like, holy crap, they do a really good job.
268170	273350	Like, yeah, I mean, just try. It's involved.
274590	277770	So what I did, too, is I created a baseline.
278150	282970	So Windows command line logging, if you look over it, you're like,
282970	285790	what the H is that, right?
285830	290130	So before introducing malware into the environment,
290130	294890	I decided to just watch the command line a little bit and get a better understanding,
294890	298570	because Defer isn't my 24-7 life, right?
300530	307870	And also, too, since I did it for a doctoral class, I decided, well, let's get a control, too.
307870	311250	You know, kind of make it an experiment so that I can have the control,
311250	317790	and I can have malware samples in the wild and kind of see what it is that's going on.
317790	321970	So I was like, how do I create a control? I don't know how to make malware.
322190	324890	So I don't know how to do all that stuff.
324890	327170	So there were three options that I found.
327650	332710	One was making a quote-unquote test malware, which I'll share with you on the screen there.
332710	335610	You can see it on the left.
335610	341830	Basically, I took Sector 7's Red Team Operator Malware Dev course.
342130	347710	And, of course, he doesn't just have StartCalc in his class,
347710	356610	but that gave me the idea to just compile a C++ program and have it StartCalc.
356610	359830	Really benign. The code's right up there.
359870	363010	And see if it actually works, right? And it did.
363010	365530	Another option was Atomic Red Team.
365970	371510	So they did such a fabulous job at spelling out how to install it, how to get it done.
371510	376390	It was so quick. I just put in a couple commands, and it was done,
376390	380330	and I could run the different PowerShell things to ensure the PowerShell logging
380330	382410	and all that stuff was set up correctly.
382590	386430	And then the final option is just to manually enter the commands myself.
386830	392790	So I did all of that, and then I'm like, where am I going to get all this malware from?
393470	401870	So I tried any run, you know, you change the extension from bin.bin to .exe,
401870	405770	and didn't really get anything.
405770	410270	And I'm like, well, is the malware dysfunctional?
410270	416110	Like, is it not working? Or is it, you know, anti-VM stuff?
416110	418470	Like, defense evasion? What's going on?
418470	420630	Or is it me? Am I just not clicking enough?
420630	422830	Or who knows what, right?
422830	425770	The security person in me is like, don't click!
425950	429530	So I was like, okay, I don't know what's going on with that.
429530	434790	And then I tried a malware hybrid analysis, and then malware bizarre as well,
434790	436370	and I didn't have any luck.
436370	438090	So I'm like, what is going on?
438090	440570	So finally, I was just like, screw it.
440570	447210	I am just going to URL house, taking the most recent, like, posting that people submitted,
447210	452570	and going to the actual attacker's domain and pulling down the malware myself,
452570	458170	so that it's fresh, and so that I know that it's not user error,
458170	460450	or who knows what else, right?
460850	463930	And I tried multiple other malware repositories.
463930	468250	I was like, why is this not executing? Or what's going on, right?
468250	470610	And here's a funny story.
470610	475130	Someone told me to go talk to Bleeping Computer and ask them.
475130	478390	I'm like, yeah, that's probably a bad idea.
478650	482910	Anyways, so that was a really fun story.
483490	490450	So I put up here some of the results of the tests when I pulled the malware myself,
490450	492830	from the actual source.
493190	499950	And as you can see, like, you know, some of them gave me command line arguments
500570	503850	beyond the initial execution of the binary.
503850	506390	Some of them didn't, most of them didn't.
506390	511370	So I'm like, huh, why? What is it doing?
511450	514210	So then I'm like, oh, there's static analysis.
514510	519090	So then I download Ghidra, and of course, IDA and all of that.
519090	522650	And I'm like, wait, I don't really know how to use this very well.
522650	527350	So Joe Slowik, he's like the meme master.
527350	529050	He's awesome.
529050	533190	He recently posted something with a guy trying to drink water,
533190	535710	and he's like, drink water like this?
535710	538390	You know, like, that's how I felt.
538390	539630	It was so bad.
539630	545570	I'm like, oh, my God, like, the learning curve on that is just a little bit more
545570	547150	than I'm willing to invest right now.
547150	547870	I will.
547870	554130	It's just I wanted to get through this and make it accessible to as many people as possible.
554130	559430	So I decided to move on with my life and try something else.
559430	566130	So SANS Defer Summit 2020, actually July, not too long ago,
566790	570590	you know, about five months after the Brace and Bort meeting,
571070	575930	I spoke with Michael Gao, Mr. Malware Archaeology.
575930	577410	He is super awesome.
577410	581630	He did the command line logging cheat sheets.
581630	583810	I don't know if you're familiar with those.
583810	585850	They have just a wealth of information.
585850	587910	And I told him some of the problems I was having.
587910	590470	And I'm like, what's wrong with me?
590770	598150	And he suggested to just buy a computer and, like, bypass all of the anti-analysis stuff.
598150	602930	And I was like, oh, my gosh, I, like, never would have thought of that.
602930	605510	Never, like, in a gazillion years.
605510	613870	So I bought two computers, but not willingly.
614150	616510	So the first one I bought was dead on arrival.
616510	621790	And I'm like, I'm like, I don't have time to try to troubleshoot this.
621790	624150	It's actually still sitting right next to me.
624150	627210	So then I bought another one that was delivered the next day.
627210	629450	And that one actually worked.
629450	630570	Thank God.
631930	641130	So some of the results of that, as you can see, I had, I picked one random sample.
642130	652450	And threw it into a couple of different sandbox solutions to see the difference between the command line arguments that I would get from all these different solutions, right?
652450	656550	The one in the upper left-hand corner, virus total, as you can see.
656550	661210	Oh, okay, so we got the initial binary executing.
661210	662190	Cool.
662190	662990	Okay.
662990	666490	So cape up in the right-hand corner.
666490	667590	Okay.
667590	671510	And then Joe sandbox, holy crap, that's a lot of stuff.
671730	685490	But then what I got, I got 70-something pages of command line arguments and PowerShell commands and all of that from this one particular sample.
686470	688030	Here's just some of it.
688030	695950	Some of it looks like it could be useful for potential adversary emulation exercises, potentially.
697190	705210	So the funny thing about this, so I decided to do a little bit of research on the Raccoon Stealer.
705210	709210	And I came across a Cyber Reason blog on this.
709210	718670	And they said, oh, yeah, one of the main complaints about it by criminals is that it has a very low success rate of 45%.
718670	727130	So as I was going through on my actual real computer, not a VM, it asked me to install the .NET framework.
727130	738230	And I'm like, you know, that's a lot of work for the average user to install this so that you can read an invoice or whatever.
739870	744610	I'm like, no wonder why it has a low success rate. At least that's my understanding of it.
744610	749710	And I didn't really find that anywhere in a lot of the blogs that I read.
749710	754150	So definitely it's a huge advantage that now I know this.
754150	764970	Now it requires me, in order for this particular variant of Raccoon Stealer to work, I have to install the .NET framework of that version.
764970	778910	So if your enterprise computers, whatever, aren't using that and would require the installation of that particular .NET framework,
778910	782690	then this particular variant would be a really low threat to you.
782690	786170	So you wouldn't necessarily need to proceed with analysis.
786290	789570	But here's a little fun tidbit.
789570	794830	So as I was going along, I got a little pop-up video and it said, Nyan Cat.
794830	797970	Like, who doesn't love Nyan? Nyan Cat, right?
797970	801530	I'm like, Pop Tarts? Cats? Rainbows? Sure.
801890	807730	So it said, make this connection available for all users or my use only.
807830	810590	And I was like, oh, I don't know what to do.
811330	814530	You know, of course, I did this safely, on and on and on.
814530	822170	So I was like, you know what? I'm just going to roll with it and click OK and see what happens.
822170	828250	And so I was really excited. I was hoping like, you know, CrowdStrike came to mind.
828250	838450	I'm actually wearing one of their shirts where the activity of actors, how quick they are to jump on connections and stuff like that.
838450	849310	So I was waiting and waiting and I'm like, you know, excited because I'm expecting like, you know, something, something to happen, anything to happen.
849310	855990	And hours later, still nothing. And I'm like, all right, like, I have to move on with this.
855990	862170	But it was fun and exciting for a little bit, like waiting. It was good.
862170	871930	And another thing, because it dropped files in the temp directory, I was like, oh, well, let's just go look there for fun and see what happens.
871930	877910	Right. So one of them was disable Windows Defender. I'm like, oh, that looks nasty.
877910	881690	So I threw it up into VirusTotal and it was nasty.
881690	894070	So, you know, yeah. So that was that particular sample, because I'm assuming a lot of places have Windows 10.
894230	897910	Without the .NET framework, I'm like, meh.
898270	911310	So then last night at 5.15pm Pacific Standard Time, like yesterday, like literally yesterday, less than 24 hours before my talk,
911710	920370	a friend contacted me and said that his company was willing to let me look at their junk data to go through this as an example.
920370	925090	So I'm like, cool. Like, yeah, like, I'll totally do that.
925410	932670	But can I do it or can I not do it for, you know, prepping in less than 24 hours to analyze this?
932670	941390	Well, let's see. Like, it's not unrealistic for enterprise and corporate America for you to get off the wall like crazy ass, you know, last second.
941390	946390	So I'm like, why not? Let's do this. You only live once, right? YOLO.
946750	955390	So I got the sample and I tried to make it as realistic as possible, like pretending your boss comes to you and says, I need this yesterday.
955390	966430	So, you know, and let's say that, I don't know, whatever, I just did the sandbox stuff, OPSEC, blah, blah, blah.
967810	976490	So do whatever you do with your organization, whatever, right? Everyone has different things that they can and can't do.
976490	984790	So with this sample, I loaded it to any run and VirusTotal already had an entry, and then I loaded it to Malware Bazaar.
984910	989750	And the wonderful thing about Malware Bazaar is that I get extra stuff.
989750	994410	So I load it to Malware Bazaar, I get Joe Sandbox, and I get Cape.
994410	1008310	And Cape took a while, like I had to wait until the morning, like probably around 1 p.m., which would be what, 11, 11, yeah, 11 a.m. Pacific time.
1008570	1013270	So to look at the results of those, so I just went with what I had.
1013330	1023730	And, of course, the threat Intel and me knowing that this came from an actual company, you know, I wanted to share additional context with the person that sent it to me.
1023730	1033010	So I'm like, oh, you know, according to VirusTotal, it does a callout with the DNS traffic to a Nigerian-based hosting company, and I pivoted off that.
1033310	1039710	And I ended up creating a custom rule for a YARA rule for this particular company.
1039730	1047070	And interestingly enough, that particular DNS callout was only associated with four other files.
1047070	1055870	So I did a diff on it and then shared the particular YARA rule that was associated with that and passed it off to my contact.
1056450	1063570	And so then I go to MITRE ATT&CK, right, and I'm like, oh, MITRE ATT&CK will save the day.
1064070	1066310	They'll have something on Hawkeye.
1066310	1068550	That's what the sample ended up being.
1068550	1075550	And then I go to MITRE ATT&CK, and I'm like, no, they don't have it up there yet.
1075550	1077630	Why? My God, why?
1077790	1081010	So I'm like, okay, what do I do next?
1081010	1084110	And this is kind of realistic, you know.
1084430	1092870	So then I'm like, well, let's try to create a repeatable process for this since I have such a short amount of time to make this doable.
1092890	1104890	And I decided to just use MITRE ATT&CK's framework anyways and analyze it and tactics to guide the research as far as what to look at.
1104890	1112150	And this is from Joe Sandbox, an output of all the different MITRE ATT&CK variants, right?
1112150	1128690	But we want specifics, because if I just say native API or process injection or WMI to the red teamers, they'll be like, okay, great.
1128690	1135190	So I decided to go a little bit of digging.
1135590	1143950	And with this, the initial access, it was an email with an XE attachment.
1144290	1149550	And the subject said, invoice detached, invoice attached, right?
1149550	1155190	And another thing with this particular sample, it can propagate via USB.
1155190	1163650	So I didn't want to, you know, get too friendly with it, if you know what I mean.
1164050	1174850	The other good thing, though, is that this particular sender was not a third party recipient or was not a third party of the recipient of the particular email.
1175270	1181530	And I really love how they set up their attached is the reverse invoice.
1181530	1187670	So obviously, they might not necessarily have the best English.
1187770	1195490	I went to one of the domains that was in the email on the upper right-hand corner, the big yellow thing.
1195490	1198930	That was the FPE2000.it.
1200230	1202250	Not too exciting.
1202250	1210130	And then at the bottom is the actual, like, domain from the sending organization.
1210130	1217970	So I'm not going to comment further on that, but malicious XEs are coming from there.
1218310	1221630	And it happens to be from Nigeria, too.
1221630	1233530	So the sender, a company from Nigeria, and DNS call-up to Nigeria that gave me four other samples that were malicious.
1233530	1236390	So execution.
1236390	1245910	Obviously, we have user execution of a malicious file, which is the T1204.002.
1245910	1247590	So we have that.
1248090	1250710	And then we have WMI.
1250710	1261990	So specifically, what it is about WMI is that it checks if the AV antivirus firewall program is installed.
1261990	1268290	As you can see here, it has select from antivirus product, select from firewall product.
1270250	1273390	And with this, I used it as an experiment.
1273390	1279450	And here's the process that I came up with that I repeated for each and every single tactic.
1281610	1286010	Basically, I look at Joe's sandbox and the MITRE attack section.
1286010	1293390	And then I look at the specific entry in Joe's sandbox, as far as the detailed information you can see there in that picture.
1293670	1300430	And then I go to Atomic Red Team to see if they have the particular technique available.
1300430	1304630	And I look at the YAML contents of that particular file.
1304630	1307970	And then I Google what isn't there.
1307970	1311200	So here's an example of that.
1311510	1314030	So Atomic Red Team has...
1314030	1322050	When I looked for the T1047 for the WMI, I didn't find specifically what I was looking for.
1322050	1331610	But later, like a lot later in the process, I found what I needed in T1518.001.
1331930	1334750	And put that right up there at the bottom.
1334750	1340310	And then prior to that, I did a little bit of Stack Overflow searching.
1340310	1343910	And also found a similar command. I don't know if it works or not.
1343910	1346730	I would have to do testing on that.
1346730	1352110	But I have that information available to provide to Red Team to cut down their research time.
1353030	1355550	So next, we have the Native API.
1355570	1359990	And specifically, this is related to .NET source code references.
1360370	1364470	And I was like, what the heck do they mean by that?
1364470	1367090	So I looked that up at the bottom.
1367090	1371590	And as you can see, it comes from particular XEs.
1371630	1376410	And I'm like, okay, so I searched through the whole analysis report.
1376410	1379630	And it was still not helpful.
1379810	1382490	So then I went to Atomic Red Team.
1382490	1386390	And as you can see here, I put the big arrow.
1386850	1392490	They have the .NET Framework version 4.0, whatever.
1392490	1396790	And I searched that. And then I found a command line argument.
1396790	1403670	But no qualifiers or information behind that.
1403790	1408190	So there is an Atomic Red Team for it.
1408190	1416690	But it doesn't necessarily state how to engage the different APIs and leverage those.
1416690	1418630	But they're there.
1418630	1422270	So I'm like, okay, I'll include that for context.
1423130	1424970	Persistence is next.
1425350	1434110	So one of the ways that this particular sample gets persistence is through trying to load missing DLLs.
1434110	1440850	And I searched in the sandbox report and found that were WER fault?
1440850	1442870	I don't know if I'm saying that right. Sorry.
1443790	1446730	And I was like, oh, this is interesting.
1446730	1448850	I'm like, interesting.
1448850	1455610	I'm like, I wonder if that particular XE is actually legitimate or what's going on with it.
1455750	1458990	So there was a hash for this particular sample.
1458990	1461110	And I threw it into VirusTotal.
1461110	1462650	And it came back clean.
1462650	1466610	So I'm like, okay, well, that's interesting.
1467790	1469810	Okay, so I'll put that down.
1469810	1472970	There is an atomic test, but it's based on PowerShell.
1474350	1477210	So next is Privesk.
1477210	1482090	And it does include the previous DLL side loading technique that I had up there.
1482090	1487550	Plus it also had process injection.
1487550	1490430	So there was a lot of process injection with this one.
1490430	1492670	And there's an atomic test for it, too.
1492670	1501250	And below here, there was a command line argument down at the bottom related to process injection here.
1501250	1506130	So I provided that as context for the red teamers.
1506350	1507550	Defense evasion.
1507550	1509910	It had a ton of defense evasion.
1509910	1518470	Everything from invalid code citing, software packing, sandbox evasion, lots.
1518830	1525730	And I pulled out the ones that might be helpful to emulation exercises.
1525730	1527650	One was masquerading.
1527650	1531510	So this one, it creates files inside the user directory.
1531510	1540030	So when I looked up atomic red team, they didn't have information specific to that.
1540030	1541970	There were a bunch of other tests.
1542390	1545570	But that is the specific user directory.
1545570	1550570	So I'm assuming they could take care of that.
1550570	1560110	The next one, modify registry, stores large binary data to the registry and then it modifies the registry key.
1561550	1564370	And hidden files and directories.
1564370	1568110	There's key that's created or modified.
1569990	1572770	And obfuscated files.
1572770	1578590	So this one, I assumed that they were talking about the process environment block.
1578590	1583270	Since that's pretty standard with the exploit dev.
1583270	1588710	And trying to walk that in order to find the address of kernel 32 DLL.
1588710	1592190	So I assume that's what the shell code was about.
1592810	1597970	Especially here it says contains functionality to read the PEB.
1598290	1601630	So that was just my educated guess.
1602330	1604310	Regarding the shell code.
1604990	1606250	Credentialed access.
1606250	1607510	There was a ton of that.
1608110	1610330	Credential dumping, all of that.
1611350	1613910	Takes credentials from web browsers.
1613910	1616490	There is an atomic test for that as well.
1616610	1618090	And then discovery.
1618270	1619930	There's a couple of different things.
1619930	1621170	So process discovery.
1621170	1623230	There's an atomic test available.
1623610	1625730	Remote system discovery.
1625730	1627470	Atomic test available.
1627470	1629770	Atomic test for this as well.
1629770	1631390	And I put it at the bottom.
1631390	1633450	Machine GUID.
1634250	1635530	Lateral movement.
1635670	1639190	It has the replicate via USB.
1639510	1642670	Obviously, yeah.
1643150	1646210	I don't know if they're using it to pivot or whatever.
1646210	1651850	It just seems like it's a standard stealer for credentials to use later.
1652470	1654630	Credential collection.
1654650	1659050	So key logging and then data from local system is another one.
1660650	1662170	T1005.
1663090	1666690	And then archived collected data.
1666690	1672910	So with this, I'm assuming they meant that they would either compress or
1672910	1675210	encrypt the data prior to exfil.
1675210	1681370	So that's good info for the red teamers to use in their exercises.
1681370	1684990	Of course, also, too, they take the clipboard data.
1685530	1687470	Local e-mail collection.
1687470	1690730	And there's an actual atomic test for this as well, too.
1691390	1697210	And all of the specific folders that were accessed in order to get the
1697210	1698130	contents.
1698130	1699410	And I provide that.
1700330	1701930	So C2.
1703670	1705230	Encrypted channel.
1705390	1711210	So I know that Jorge has the C2 matrix along with Bryce and Bort.
1711210	1715910	And so they have a lot of different fun things that you can pick through to
1715910	1718410	be like, okay, I need an encrypted channel.
1718410	1722990	So that will be really easy for you to go through.
1723730	1727950	And there is an atomic test available for these as well.
1728510	1729590	Exfiltration.
1729590	1735010	I assume that they exfil the encrypted or compressed data.
1735070	1736710	So there is that.
1736710	1738830	That's what I put as exfiltration.
1738830	1739490	Impact.
1739490	1744430	There doesn't necessarily seem to be an impact other than stealing creds and
1744430	1746830	private information.
1746830	1750930	So, you know, no ransomware type anything.
1750930	1754110	And I wanted to add additional context as well.
1754110	1760830	So I decided to look at the Yara rules that fired on this particular sample.
1760830	1768190	And as you can see, there's consistent hits with this particular rule from
1768190	1769550	Malware Bazaar.
1769770	1772070	And then I decided to go digging a little bit.
1772070	1774790	And I'm like, huh, what is this rule about?
1774830	1779430	So I found a link to it on a GitHub.
1779830	1782350	And same author, same all of that.
1782350	1784630	And it looks like it was made in 2015.
1785010	1791290	And it looks like they're using the same string of the holder mail.txt,
1791290	1796590	which was also a command line argument, as you can see down here at the bottom,
1796590	1798690	since at least 2015.
1798710	1804930	So I'm like, oh, that would probably be good to include in the emulation exercise
1804930	1808590	since that hasn't changed in, what, five years?
1809210	1816090	The other thing is so the HTTP traffic doesn't have a header,
1816090	1821910	I have different examples here of files written and then the process tree too,
1821910	1828770	if they want to try to emulate that as well for, like, security tools
1828770	1831590	and all of that for detection purposes.
1831590	1833490	It dropped 11 files.
1833490	1841330	And I included the different folders that they got dropped to and other characteristics.
1841330	1843710	So I thought that this was interesting.
1843710	1845450	They used port zero.
1845830	1851190	And so I just included stuff that I'm like, huh, this looks really interesting.
1851190	1857550	They used DNS over HTTPS and things like that so that red team can kind of pick
1857550	1859730	and choose what they want and don't want.
1861030	1865650	And so basically this was literally junk data.
1865650	1867110	Like, no one cared about it.
1867110	1868310	It was blocked.
1868310	1870190	Like, who cares, right?
1870210	1874030	But the org was being targeted with it.
1874030	1881350	So just a little bit, what, less than 24 hours that I spent with this particular sample,
1881990	1889030	we got all of this information out of it, was able to map it back to Atomic Red Team or Google
1889030	1896250	and, like, you know, stack overflow and all of that and get somewhat of some commands
1896250	1903370	and behaviors, TTPs, associated with this that they can test within their own environment.
1903370	1912370	And here's just some of the stuff that they can get from this data that's essentially junk.
1912370	1913610	I mean, that's pretty good.
1913610	1923170	They got a Yara rule out of it, custom, made by me, from threat actors that they're actively being targeted with.
1923170	1933150	They got basically kind of a purple team exercise where, you know, if you know it's using this or it's doing that,
1933150	1935510	you can look at your defenses prior to that.
1935510	1938430	Do you have, you know, WMI, all of that.
1938590	1946670	So building out a purple team exercise around this and working with adversary emulation teams,
1946670	1954290	whether that's a dedicated person or a team or blue teamers filling the red team, who knows, right?
1954290	1958090	Organizations have so many different things going on.
1959170	1966890	So in summary, I'm going to leave it to you guys to decide if you think that junk data,
1966890	1977110	essentially blocked data, can provide value to your organization and whether or not you can use that blocked data or even delivered data.
1977110	1981210	You see what I do with blocked data, imagine delivered, right?
1982110	1993210	So, you know, whether or not you can kind of tailor and use this information that's specific to your organization that's being targeted.
1994010	2002290	Having the MITRE ATT&CK heat map and knowing where your coverage is in your environment that people talk about, right?
2003150	2005450	Cyber War Dog talks about that.
2005450	2008370	Olaf, like a ton of people.
2008430	2015170	And so knowing that you can know where your weaknesses are, where your strengths are, where you have visibility, where you don't have visibility.
2015170	2017290	And you can take this information.
2017290	2026710	And as a threat intel analyst, you can see that you don't have to buy two computers to get some of this information.
2027010	2034310	I really loved the Cape Sandbox and also Joe Sandbox and Malware Bazaar.
2034310	2037250	Absolutely love, love them.
2037250	2039170	Just combining all of it.
2039170	2049330	And then also to the different sandboxes, they're not like I got different data from different ones, even though it was the same sample.
2049470	2051750	So I just kind of compiled it all.
2051750	2060710	And then some of the analysis I did on my own, I added additional TTPs that weren't on the actual heat map that I showed you at the beginning.
2060870	2065970	So there's a lot that you can do with this based upon your organization.
2065970	2073970	You can also create a threat library or threat actor dossiers, kind of, even though it's malware.
2073970	2077950	But you can kind of start to paint a picture over time.
2077950	2086790	So you see the Nigerian infrastructure and a Nigerian company sending you maliciousness.
2086990	2089250	I'm not pointing fingers.
2090130	2100130	So you can start to get a more holistic view of your threat landscape and what they could potentially be interested in.
2100370	2105930	Obviously, if they wanted to disrupt your services, I mean, yeah.
2105930	2109010	So I could talk a really long time about that.
2109010	2116750	But I will leave that up to your conclusion and what you find valuable to your organization.
2116750	2120910	And I just want to thank you so much for attending my talk.
2121010	2123010	And that's it.
2123430	2125410	Thank you. Enjoy DEF CON.
2125410	2127090	And thank you.
2127870	2132310	Thank you very much, Cheryl, for that wonderful presentation and talk.
2132810	2146370	And as always, we recommend that you go to TrackTalk1 to direct your questions for the presenter on our Blue Team Village Discord.
2147030	2154310	And if you have any questions, I'm sure she will be able to answer them.
2154310	2156990	And I'm just going to look through real quick.
2156990	2158970	I don't see any at the moment.
2159450	2161290	So thank you very much.
2161410	2162310	Thank you.