1
00:00:00,000 --> 00:00:03,200
And welcome to DEF CON Red Team Village.

2
00:00:03,200 --> 00:00:11,900
My name is Giorgio Chies, and this talk is titled Deep Dive into Adversary Emulation, Ransomware Edition.

3
00:00:11,900 --> 00:00:20,460
And what we're going to look at is an attack that we saw in July, 2020, against the Garmin organization.

4
00:00:20,460 --> 00:00:24,240
It brought all their services down, asking to pay a ransom.

5
00:00:24,240 --> 00:00:33,440
The particular adversary that was attributed to this attack is EvoCorp, and they used a ransomware called WastedLocker.

6
00:00:33,440 --> 00:00:49,500
So we're going to talk about how we can emulate a ransomware attack against an organization in a professional manner, so that we can test our detective and preventive controls and answer the question that most CISOs want to know.

7
00:00:49,500 --> 00:00:51,840
Can this happen to us?

8
00:00:51,840 --> 00:00:56,160
I hope you enjoy, and I'm available to answer any questions.

9
00:00:56,500 --> 00:00:59,300
As mentioned, my name is Giorgio Chies.

10
00:00:59,300 --> 00:01:02,620
I'm the Chief Technology Officer at SITE.

11
00:01:02,620 --> 00:01:11,780
I'm also the author of the Purple Team Exercise Framework that we recently released and made available to everyone for free on our website.

12
00:01:11,780 --> 00:01:25,320
I co-created the C2 matrix with Bryson Bort and Adam Mash, and it is a framework of various different command and control frameworks with their capabilities and their features.

13
00:01:25,320 --> 00:01:28,300
We'll cover that a little bit in this deck.

14
00:01:28,720 --> 00:01:34,880
Before joining SITE, I worked at Citigroup for 10 years running the offensive security team.

15
00:01:34,880 --> 00:01:43,220
I started as a vulnerability assessment analyst, then introduced penetration testing, and eventually created the Red Team about five years ago.

16
00:01:43,220 --> 00:02:01,400
We then created a Purple Team function and began doing adversary emulations across the globe and working with various regulators, which led to the creation of a global framework with the Global Financial Markets Association titled Threat-Led Penetration Testing.

17
00:02:01,460 --> 00:02:03,800
So we'll cover a lot of that here as well.

18
00:02:03,800 --> 00:02:05,400
That's also a free framework.

19
00:02:05,400 --> 00:02:06,620
I teach for SANS.

20
00:02:06,620 --> 00:02:13,060
I've taught for SANS for the past 10 years, mostly the pen test curriculum and also some of the cloud courses.

21
00:02:13,060 --> 00:02:18,840
But if you've ever taken or have the GCIH or the GPEN, shout out to you.

22
00:02:18,840 --> 00:02:24,460
I also have a two-day Red Team exercise and adversary emulation course.

23
00:02:24,460 --> 00:02:32,720
While at Citi, I was part of the CVSS working group and I was a voting member where we released version 3 and 3.1.

24
00:02:32,840 --> 00:02:44,420
Version 4 is in the works and I'm also working on another working group now as I'm no longer a voting member of CVSS on what's called the Exploit Predictability Scoring System.

25
00:02:44,420 --> 00:02:52,780
We're trying to identify what vulnerabilities will be exploited versus ones that will not, even if they have similar CVSS scores.

26
00:02:52,780 --> 00:02:54,740
It's a very interesting project.

27
00:02:54,740 --> 00:02:59,780
And if you'd like to join, it is a working group as part of FIRST as well.

28
00:02:59,940 --> 00:03:03,440
I really believe in ISSA and giving back to the community.

29
00:03:03,440 --> 00:03:06,380
ISSA is the Information Systems Security Association.

30
00:03:06,380 --> 00:03:08,940
They might have a chapter in your location.

31
00:03:08,940 --> 00:03:09,920
Definitely go out.

32
00:03:09,920 --> 00:03:13,900
I actually found two of my jobs before working at Citi.

33
00:03:13,900 --> 00:03:21,420
I worked at Terramark in a security operations center, found that job through there as well as my job at Citi.

34
00:03:21,420 --> 00:03:25,020
So definitely network and give back to the community.

35
00:03:25,020 --> 00:03:29,000
Long, long ago, I wrote a book on Windows 7.

36
00:03:29,000 --> 00:03:30,920
So I am a published author.

37
00:03:31,200 --> 00:03:33,940
Hopefully no one's using that operating system.

38
00:03:34,220 --> 00:03:36,640
So here's our agenda for today.

39
00:03:36,640 --> 00:03:50,180
We're going to cover some definitions because as any red team talk, we have to argue about definitions and really want to use the same language in the industry and hopefully help the industry use the same language.

40
00:03:50,180 --> 00:03:54,440
So we're going to cover things like red teaming, purple teaming, and adversary emulation.

41
00:03:54,440 --> 00:03:56,960
Then we're going to talk about ransomware.

42
00:03:57,040 --> 00:04:00,100
And ransomware is something that we've all heard about.

43
00:04:00,100 --> 00:04:19,420
And while many of us find this annoying and not sophisticated, we're actually seeing an uptick in the sophistication level where it isn't just about gaining initial access and impacting the target systems, but it also involves moving laterally and exfiltrating information prior to requesting a ransom.

44
00:04:19,740 --> 00:04:26,600
So we're going to cover our usual steps when we talk about adversary emulation, starting with cyber threat intelligence.

45
00:04:26,600 --> 00:04:28,820
We want to learn about various attacks.

46
00:04:28,820 --> 00:04:37,060
In this case, we're going to talk about Garmin and Evil Corp using a piece of malware called Wasted Locker.

47
00:04:37,060 --> 00:04:40,060
It's the attack that affected Garmin in July 2020.

48
00:04:40,060 --> 00:04:41,820
We're going to understand that attack.

49
00:04:41,820 --> 00:04:45,000
We're going to create an adversary emulation plan around it.

50
00:04:45,000 --> 00:04:46,560
Then we're going to perform it.

51
00:04:46,560 --> 00:04:48,040
So it should be a lot of fun.

52
00:04:48,040 --> 00:04:51,380
Then, of course, we're going to talk about defending against ransomware.

53
00:04:51,380 --> 00:04:54,500
Now, the first thing I want to cover is definitions.

54
00:04:54,500 --> 00:05:04,960
And we published this ethical hacking maturity model to kind of show a blueprint of how many organizations are maturing in their offensive security.

55
00:05:04,960 --> 00:05:08,440
Now, this doesn't mean that every organization is the same.

56
00:05:08,440 --> 00:05:20,480
This is really based on my experiences and on experiences of organizations I've talked to, whether they're SANS students or other people in the industry that have asked about this particular subject.

57
00:05:20,520 --> 00:05:25,280
So most organizations start over on the left side with vulnerability scanning.

58
00:05:25,280 --> 00:05:34,640
Here's where you run a scan against an IP or a web app, and you get back a list of vulnerabilities based on signatures.

59
00:05:34,640 --> 00:05:49,860
Vulnerability assessment is when you look at the output of that vulnerability scan and you give it a real risk rating, where you actually calculate if the risk is there, you verify the vulnerability, and you prioritize what needs to get fixed.

60
00:05:50,360 --> 00:05:55,120
Penetration testing then involves the exploitation of vulnerabilities.

61
00:05:55,120 --> 00:06:08,260
And this can involve finding vulnerabilities that the vendor didn't know about, where we call those ODAs, or it could also mean gaining access to a target system and learning and really calculating that business risk.

62
00:06:08,320 --> 00:06:12,240
Unfortunately, in the industry, pen testing got very scoped down.

63
00:06:12,240 --> 00:06:15,300
We weren't allowed to move laterally to other hosts.

64
00:06:15,300 --> 00:06:19,020
We weren't allowed to do social engineering and things like that.

65
00:06:19,020 --> 00:06:21,300
And that's where the red team came in.

66
00:06:21,320 --> 00:06:24,820
The red team started testing people, process, and technology.

67
00:06:25,260 --> 00:06:29,980
Purple teaming is where we work together, the red team with the blue team.

68
00:06:29,980 --> 00:06:37,680
And adversary emulation is a cyber threat intelligence-led assessment, generally carried out by the red team.

69
00:06:37,680 --> 00:06:44,400
And it can be a full knowledge or zero knowledge assessment, in which case it would be a purple team or a red team engagement.

70
00:06:44,400 --> 00:06:51,780
Now, as I mentioned, these don't necessarily mean that it's the steps you must take to get to where you want to go.

71
00:06:51,780 --> 00:06:58,680
This is just an example that you can use with your senior management to explain to them how your organization has matured.

72
00:06:58,680 --> 00:07:04,100
There is an arrow there at the end, which means that I'm sure this will continue to evolve.

73
00:07:04,160 --> 00:07:06,060
Every organization is different.

74
00:07:06,340 --> 00:07:08,700
And of course, don't stop doing the previous step.

75
00:07:08,700 --> 00:07:14,780
Just because you're doing red team and purple team engagements doesn't mean you're not doing vulnerability scanning anymore.

76
00:07:14,780 --> 00:07:18,060
There's an entire article on this if you'd like to read more about it.

77
00:07:18,080 --> 00:07:21,380
The reason we're here is to talk about adversary emulation.

78
00:07:21,380 --> 00:07:25,040
And that can be defined as a type of red team exercise.

79
00:07:25,040 --> 00:07:27,500
There's many different types of red team engagements.

80
00:07:27,500 --> 00:07:29,460
This is one of those types.

81
00:07:29,460 --> 00:07:37,100
And in this type, we are going to emulate adversary tactics, techniques, and procedures or adversary behavior.

82
00:07:37,100 --> 00:07:41,520
We understand those behaviors by leveraging cyber threat intelligence.

83
00:07:41,520 --> 00:07:49,900
And just like the malicious actors, we're going to have an objective, which would be very similar to objective of that actor.

84
00:07:49,940 --> 00:07:57,900
So in this case, we are putting TTPs together in an attack chain for testing of these various scenarios.

85
00:07:57,900 --> 00:08:05,100
And it's really going to answer the question if the target organization is ready for a real sophisticated attack.

86
00:08:05,100 --> 00:08:07,680
Most of the time, the effort here is manual.

87
00:08:07,680 --> 00:08:08,800
There are a number of tools.

88
00:08:08,800 --> 00:08:12,720
There's some automation that you can build around doing TTPs.

89
00:08:12,720 --> 00:08:14,560
My company site does some of this.

90
00:08:14,560 --> 00:08:16,520
So we'll cover that a little later.

91
00:08:16,800 --> 00:08:21,820
But it's mostly manual because you can't really automate an entire red team, right?

92
00:08:21,820 --> 00:08:24,920
You actually need people, which is very important.

93
00:08:25,040 --> 00:08:29,100
So as I mentioned, adversary manipulation is a type of red team exercise.

94
00:08:29,100 --> 00:08:30,700
There's different types.

95
00:08:30,700 --> 00:08:40,120
And a red team can be defined as the practice of looking at a problem or situation from the perspective of an adversary, which means that you can do a lot with that.

96
00:08:40,120 --> 00:08:41,560
It could be physical pen testing.

97
00:08:41,560 --> 00:08:49,980
It could be doing phishing simulations for awareness training, or it could be testing one or creating a new TTP.

98
00:08:49,980 --> 00:08:57,040
In this case, we're going to talk about adversary manipulation, but we want to differentiate the whole red team from pen testing.

99
00:08:57,040 --> 00:09:06,100
For example, in a pen test, you're generally finding and attacking preventive controls, the lack of patching, or maybe you found a vulnerability that the vendor doesn't know about.

100
00:09:06,100 --> 00:09:08,700
In red teaming, our goals are different.

101
00:09:08,700 --> 00:09:18,720
Our goals are to make the blue team better, to train, to test and measure people, process, and technology, and to test assumptions.

102
00:09:18,720 --> 00:09:21,520
The effort here, as I mentioned, is pretty manual.

103
00:09:21,520 --> 00:09:25,580
There's a lot of tools, so we'll cover some of those in the C2 matrix and this talk.

104
00:09:25,580 --> 00:09:28,820
And the frequency is really based on intelligence.

105
00:09:28,820 --> 00:09:39,620
I'm sure many of you this week heard about Black Hat and DEF CON and saw some new techniques, so we might want to be testing those out as soon as we're back at the office.

106
00:09:39,640 --> 00:09:41,760
The frequency really depends.

107
00:09:41,760 --> 00:09:47,600
We are seeing red team engagements being required by various regulators, and the customer here is the blue team.

108
00:09:47,600 --> 00:09:50,560
We want to work with the blue team.

109
00:09:50,960 --> 00:09:55,080
Now, there is a difference between internal and external teams.

110
00:09:55,080 --> 00:10:07,700
Internal red teams will do an engagement, and then they might have to repeat that engagement multiple times to ensure that the operations teams and the blue teams are trained and have the right detections in place.

111
00:10:07,960 --> 00:10:10,420
That means that they have to do a lot of retesting.

112
00:10:10,420 --> 00:10:12,040
They might not like that.

113
00:10:12,040 --> 00:10:13,520
They're also privileged.

114
00:10:13,520 --> 00:10:14,820
They're insiders.

115
00:10:14,820 --> 00:10:16,320
They have information.

116
00:10:16,320 --> 00:10:22,400
They've probably done other red team engagements and exercises, so they know what works and what doesn't work.

117
00:10:22,400 --> 00:10:27,420
So really, internal red teams should be seen more as a sparring partner to the blue team.

118
00:10:27,420 --> 00:10:30,060
They should have collaboration and get along.

119
00:10:30,120 --> 00:10:32,260
External teams are a little different.

120
00:10:32,260 --> 00:10:34,340
They offer a different perspective.

121
00:10:34,340 --> 00:10:37,900
Since they're coming from the outside, they don't have that insider knowledge.

122
00:10:37,900 --> 00:10:50,340
They'll be able to emulate an external malicious actor by performing and doing things like reconnaissance and learning more and seeing what's out there to see if they can breach that perimeter or get internal access.

123
00:10:50,340 --> 00:10:55,400
There's other types, though, where external teams could be brought in in an assumed breach perspective.

124
00:10:55,400 --> 00:10:57,380
We'll talk about that a little bit more.

125
00:10:57,380 --> 00:11:00,460
And these are mostly snapshot engagements, right?

126
00:11:00,460 --> 00:11:02,020
They come in once a year.

127
00:11:02,020 --> 00:11:03,420
They do the test.

128
00:11:03,420 --> 00:11:04,640
They leave a report.

129
00:11:04,640 --> 00:11:07,520
Maybe they do a red team reveal or a replay.

130
00:11:07,720 --> 00:11:10,580
And then they don't come back for at least a year.

131
00:11:10,580 --> 00:11:14,920
So it's very snapshot and point in time oriented.

132
00:11:14,920 --> 00:11:19,700
So why don't we move towards a purple team, especially for those internal teams?

133
00:11:19,700 --> 00:11:26,040
Your job is to make the blue team better, to test and measure and improve people, process and technology.

134
00:11:26,040 --> 00:11:30,200
You don't have to do these zero knowledge engagements all the time.

135
00:11:30,200 --> 00:11:35,320
You might only have to do it maybe every three months or every six months or once a year.

136
00:11:35,320 --> 00:11:41,620
The rest of the time, you can spend it in a purple team fashion, working and collaborating with the blue team.

137
00:11:41,620 --> 00:11:46,540
It is an efficient way of doing a lot of these adversary emulations.

138
00:11:46,540 --> 00:11:48,260
So what is a purple team?

139
00:11:48,260 --> 00:12:05,720
A purple team is a virtual or functional team where various teams actually come together and collaborate to improve the defensive security posture in a method that is more efficient than your standard red team engagement that results in a report.

140
00:12:05,720 --> 00:12:11,220
Here, we use cyber threat intelligence to understand a malicious threat actor.

141
00:12:11,220 --> 00:12:20,900
Generally, this team could be internal, in which case it would have a lot of insider information and really understand the target organization, or it can be an external cyber threat intelligence team.

142
00:12:20,900 --> 00:12:29,400
But the point is that they would provide a threat actor that has the capability, the intent and the opportunity to attack that organization.

143
00:12:29,820 --> 00:12:35,560
Then the red team consumes this information and creates an adversary emulation plan.

144
00:12:35,720 --> 00:12:37,700
You then tabletop this.

145
00:12:37,700 --> 00:12:40,880
You have a discussion with all the parties involved.

146
00:12:40,880 --> 00:12:51,380
The blue team can be the security operations center, a managed security service provider, a hunt team, or an incident response team, digital forensics, right?

147
00:12:51,380 --> 00:12:53,260
All of those are part of the blue team.

148
00:12:53,260 --> 00:13:00,860
You have this tabletop and you say, for these particular TTPs, this is our expected defenses.

149
00:13:00,860 --> 00:13:02,640
And then you emulate that.

150
00:13:02,640 --> 00:13:05,040
Red team shows the blue team what they're doing.

151
00:13:05,040 --> 00:13:05,980
They emulate it.

152
00:13:05,980 --> 00:13:07,800
It's a full knowledge engagement.

153
00:13:07,860 --> 00:13:13,160
The blue team will then go and look for indicators of compromise or indicators of this behavior.

154
00:13:13,460 --> 00:13:23,280
And then both teams work together to say, okay, we believe that this is good enough detection, or we can improve this detection by tuning these various tools.

155
00:13:23,720 --> 00:13:27,520
And then you repeat that over and over for various different TTPs.

156
00:13:27,520 --> 00:13:29,600
You can repeat that to train people.

157
00:13:29,600 --> 00:13:32,060
You can ensure that the processes are working.

158
00:13:32,060 --> 00:13:41,960
A handoff between a security operation center analyst to a level two analyst or to an incident response person all works efficiently.

159
00:13:41,960 --> 00:13:44,940
And of course, you're also tuning your technology.

160
00:13:46,180 --> 00:13:48,260
Did you say purple?

161
00:13:48,260 --> 00:13:50,700
And yes, purple is very hot right now.

162
00:13:50,700 --> 00:13:52,520
And it's because of the efficiencies.

163
00:13:52,520 --> 00:13:56,540
Now, anything we do in offensive is to bring business value.

164
00:13:56,540 --> 00:14:06,080
So regardless of what you're calling this, if it's a red team engagement with no knowledge or a purple team engagement, we always want to bring business value.

165
00:14:07,620 --> 00:14:11,780
So as usual, we start with frameworks and methodologies.

166
00:14:11,780 --> 00:14:22,280
And that's very important for us, because if you're going to sell doing an adversary emulation, especially a ransomware one to your organization, you better have a good plan.

167
00:14:22,280 --> 00:14:26,060
And one of the things that does that is a framework and a methodology.

168
00:14:26,060 --> 00:14:31,560
Now, one of the ones that we recently released through Scythe is the purple team exercise framework.

169
00:14:31,560 --> 00:14:40,780
This covers cyber threat intelligence, covers sponsorships, covers getting the people in the process and getting everything ready for that exercise.

170
00:14:40,780 --> 00:14:43,760
And you can see over here on the right, kind of the life cycle there.

171
00:14:43,760 --> 00:14:51,860
We start with cyber threat intelligence, we do preparation, we execute the exercise, and then we have lessons learned.

172
00:14:51,860 --> 00:14:55,560
There's a number of different methodologies that you can use.

173
00:14:55,560 --> 00:15:03,420
One of the original ones was the Cyber Kill Chain by Lockheed Martin, which was seven steps showing senior management kind of how an attack works.

174
00:15:03,420 --> 00:15:04,760
That has matured.

175
00:15:04,760 --> 00:15:09,060
Paul Poles came out with the Unified Cyber Kill Chain, which goes way more in depth.

176
00:15:09,060 --> 00:15:11,240
Really like that one and shout out to Paul.

177
00:15:11,400 --> 00:15:15,280
And then we have financials that have a number of different regulations.

178
00:15:15,280 --> 00:15:24,620
The Bank of England has CBEST, the European Central Bank, the ECB, has Tiber EU, which is threat intelligence based ethical red teaming.

179
00:15:24,620 --> 00:15:32,280
The Monetary Authority of Singapore and the Association of Banks of Singapore have red team adversarial tax simulation exercises.

180
00:15:32,320 --> 00:15:38,180
Hong Kong Monetary Authority has the intelligence-led cyber attack simulation testing.

181
00:15:38,180 --> 00:15:48,800
And then we all came together and I was a co-author with the Global Financial Markets Association to create a framework for the regulatory use of pen testing in the financial services industry.

182
00:15:48,800 --> 00:15:54,160
So there's many frameworks out there that you can use and leverage that are free and open source.

183
00:15:54,160 --> 00:15:58,960
Pick one and use that one, that way you can show that you are a professional.

184
00:15:58,960 --> 00:16:07,080
And then for testing, of course, we're going to use MITRE ATT&CK, which stands for adversaries, tactics, techniques, and common knowledge.

185
00:16:07,080 --> 00:16:19,160
And it really is a common knowledge or common language that allows the cyber threat intelligence team to work with the blue team, the incident response teams, and the red teams all speaking the same language.

186
00:16:19,160 --> 00:16:32,160
So as something occurs in the wild, something like Garmin hack, which we'll cover right now, the forensics team goes in there, understands what happens, and then they give us cyber threat intelligence.

187
00:16:32,160 --> 00:16:40,040
The cyber threat intelligence team will create these reports, which we will then consume, and then we can map all these back to MITRE ATT&CK.

188
00:16:40,040 --> 00:16:42,700
And of course, everyone's seen the MITRE ATT&CK framework.

189
00:16:42,700 --> 00:16:44,720
On the top, we have our tactics.

190
00:16:44,720 --> 00:16:46,760
Those are the adversary goals.

191
00:16:46,760 --> 00:16:52,240
Under those, we have our techniques, which now have sub-techniques, and also procedures.

192
00:16:52,240 --> 00:16:55,140
And the procedure level is the lowest level you can get.

193
00:16:55,140 --> 00:16:58,100
So it's very good to use frameworks like these.

194
00:16:59,720 --> 00:17:02,300
In this case, we're going to talk about ransomware.

195
00:17:02,300 --> 00:17:09,240
And there is a particular tactic that covers ransomware, and that's called the impact tactic.

196
00:17:09,240 --> 00:17:11,880
It's TA0040.

197
00:17:11,920 --> 00:17:19,380
According to MITRE, that impact is the adversaries trying to manipulate, interpret, or destroy your system and data.

198
00:17:19,380 --> 00:17:27,140
So really, it's trying to disrupt availability or compromise integrity by destroying and tampering your data.

199
00:17:27,140 --> 00:17:32,380
So generally, this is used to achieve that end goal.

200
00:17:32,380 --> 00:17:36,740
And over here on the right, you have an example of just some of the techniques and sub-techniques.

201
00:17:36,740 --> 00:17:38,940
So data manipulation would be the technique.

202
00:17:38,940 --> 00:17:44,960
And then you have stored data manipulation, transmitted data manipulation, and runtime data manipulation as sub-techniques.

203
00:17:44,960 --> 00:17:48,440
You can then click on those and see procedures for different ones.

204
00:17:48,440 --> 00:18:00,420
But this is really one of the main objectives, is to impact the system to then, in ransomware, request money for that particular access back to your systems.

205
00:18:01,420 --> 00:18:04,340
So let's talk about ransomware.

206
00:18:04,560 --> 00:18:15,040
Generally, what we see is threat actors trying to go out and get initial access to a target system or network, and then encrypt files.

207
00:18:15,040 --> 00:18:17,760
And if you want those files back, you have to pay a ransom.

208
00:18:17,760 --> 00:18:24,640
So a lot of this is very opportunist, in that it's a drive-by type of compromise.

209
00:18:24,640 --> 00:18:34,820
Anyone in your organization visits a webpage, whether they clicked on it, or they got there through links or whatnot, and that tries to compromise their system.

210
00:18:34,820 --> 00:18:40,220
From there, the malware will try to run and encrypt files.

211
00:18:40,220 --> 00:18:43,420
Now, we're seeing three different methods of encrypting files.

212
00:18:43,420 --> 00:18:51,740
One is reading the file and create an encrypted version of that file, replacing the original file with the encrypted one.

213
00:18:51,740 --> 00:18:55,480
The other one uses raw disk access for encryption.

214
00:18:56,120 --> 00:19:03,000
And then the third one is open the file and then encrypt the contents of the file, and then save the file itself.

215
00:19:03,000 --> 00:19:05,260
So different ways of doing this.

216
00:19:05,260 --> 00:19:08,960
Sometimes we see organizations stealing those files.

217
00:19:08,960 --> 00:19:10,480
Not all of them steal it.

218
00:19:10,480 --> 00:19:17,260
You get on the target system, you encrypt the files, you steal them, and then you post the ransom note.

219
00:19:17,580 --> 00:19:19,140
So some of those do that.

220
00:19:19,140 --> 00:19:27,560
And then, of course, they download some sort of ransom note saying, now you need to pay if you want access to your files.

221
00:19:27,560 --> 00:19:37,300
And of course, the main actor's goal and objective here is to get paid, get money, generally in some sort of cryptocurrency.

222
00:19:38,140 --> 00:19:40,640
So let's talk about Garmin.

223
00:19:40,640 --> 00:19:46,560
On July 22nd, a lot of folks started posting that they could not connect to Garmin.

224
00:19:46,560 --> 00:19:49,400
Garmin is a company that specializes in GPS.

225
00:19:49,940 --> 00:19:55,860
They also have fitness trackers and a number of other services, as you can see on the screen.

226
00:19:55,960 --> 00:20:01,660
And all that Garmin was saying is that they're currently experiencing an outage.

227
00:20:01,660 --> 00:20:04,940
Now, this outage lasted a number of days.

228
00:20:04,940 --> 00:20:08,400
Rumors started going around that this was ransomware.

229
00:20:08,720 --> 00:20:14,220
And now, by the time you're watching this, we obviously have quite a bit of information about this that we're going to go over.

230
00:20:14,220 --> 00:20:18,300
But you can see here on the right, a lot of services were down.

231
00:20:18,300 --> 00:20:21,840
One that was quite interesting is FlyGarmin.

232
00:20:21,840 --> 00:20:31,680
So a number of planes actually use Garmin devices for their tracking and their GPS, and those planes would not be able to fly because they didn't have tracking.

233
00:20:31,680 --> 00:20:36,000
You can see here, it definitely impacted a lot of people.

234
00:20:36,000 --> 00:20:37,660
It was a global outage.

235
00:20:37,660 --> 00:20:45,120
So given the timeliness of this, this is the malicious organization that we are going to learn from.

236
00:20:45,120 --> 00:20:51,700
We have learned now that the malicious actor is in a threat group called EvilCorp.

237
00:20:51,700 --> 00:20:58,880
And in this particular case, they used a ransomware malware known as WastedLocker.

238
00:20:58,880 --> 00:21:01,660
So let's learn a little bit about this.

239
00:21:01,680 --> 00:21:11,540
So EvilCorp, and in this particular attack, would first get initial access through drive-by sites.

240
00:21:11,540 --> 00:21:22,120
That means they compromised a legitimate website first, and whenever anyone visited this particular website, they would download SockGalish.

241
00:21:22,280 --> 00:21:26,920
And that would trigger a number of different actions.

242
00:21:26,920 --> 00:21:38,840
So in this case, and we're thinking from a red team perspective, we won't be able to emulate this particular TTP because we're not going to have permission to compromise a third party.

243
00:21:38,840 --> 00:21:47,200
So in this case, we will have to simulate what happens and get that initial access through some other method.

244
00:21:47,380 --> 00:21:55,880
And then once SockGalish ran, it is a zip file with malicious JavaScript that was masquerading as a browser update.

245
00:21:55,880 --> 00:21:58,520
That's another TTP in MITRE ATT&CK.

246
00:21:58,520 --> 00:22:14,820
Then a second JavaScript file would profile the computer to see where it was, gain some situational awareness, and then it used PowerShell to download additional discovery-related PowerShell scripts like PowerView, which we've heard quite a bit about.

247
00:22:14,820 --> 00:22:17,980
It's a free script that you can get straight from GitHub.

248
00:22:18,480 --> 00:22:28,100
Then once the attacker had access to execute PowerShell, they gained network access and would drop a Cobalt strike malware.

249
00:22:28,100 --> 00:22:35,700
Cobalt strike is a command and control framework, which we'll cover here or we'll actually demo it because we're going to emulate all of this.

250
00:22:35,700 --> 00:22:42,320
And unfortunately, Cobalt strike has been used by malicious threat actors before because an early version of it was leaked.

251
00:22:42,340 --> 00:22:53,940
With a Cobalt strike command and control established, then they lived off the land to do some things like steal credentials, escalate privileges, and move laterally.

252
00:22:53,940 --> 00:22:59,360
So there's a more sophisticated threat actor that doesn't just get on one system and drops the ransomware.

253
00:22:59,360 --> 00:23:06,640
It was moving laterally up until the point where it would deploy the WastedLocker ransomware.

254
00:23:06,640 --> 00:23:15,440
So EvilCorp is the adversary and the WastedLocker is the ransomware that would actually encrypt the files and request the ransom.

255
00:23:16,040 --> 00:23:25,740
So PowerShell was used to download and execute a loader from a domain that was publicly reported to be delivering Cobalt strike as part of these attacks.

256
00:23:25,740 --> 00:23:28,260
And then injected a payload.

257
00:23:28,380 --> 00:23:35,020
In this case, Cobalt strike uses its payload, it's called a beacon, and that is used to execute commands.

258
00:23:35,020 --> 00:23:46,280
It injects into other processes, it elevates the privilege, and then it could upload and download other files, in which case it would do that for this particular malware.

259
00:23:46,700 --> 00:23:58,420
The privilege escalation, this particular attack against Garmin seemed to be with the software licensing user interface tool, which is a command line tool that comes with the operating system.

260
00:23:58,420 --> 00:24:02,960
We call these living off the land because it's a tool that's already there.

261
00:24:02,960 --> 00:24:05,820
They would use that to escalate privileges.

262
00:24:06,480 --> 00:24:15,980
Then we've learned as well from the cyber threat intelligence that the attackers would use WMI, which is Windows Management Instrumentation Command Line Utility.

263
00:24:15,980 --> 00:24:18,080
This is also a living off the land tool.

264
00:24:18,080 --> 00:24:26,940
It comes with all versions of Windows to execute commands on remote computers, such as adding new users or executing additional PowerShell.

265
00:24:27,340 --> 00:24:41,860
Then the attackers launched a legitimate command line tool for managing Windows Defender to disable Defender and the scanning of new files in the event that this malware they were using would get caught, they would disable this part.

266
00:24:41,860 --> 00:24:43,980
That's another MITRE ATT&CK TTP.

267
00:24:44,720 --> 00:24:57,740
And then lastly, they would use PSXSEC to move laterally and deploy the WastedLocker ransomware, which begins the encryption process and would also delete the shadow volume.

268
00:24:57,740 --> 00:25:04,080
So all of this is cyber threat intel that we have pulled together for emulation.

269
00:25:04,560 --> 00:25:06,940
This is what WastedLocker look like.

270
00:25:06,940 --> 00:25:11,960
It is interesting because it creates a file.

271
00:25:12,000 --> 00:25:21,740
The encrypted file is called the particular file name and then the extension had the organization name and wasted at the end.

272
00:25:21,740 --> 00:25:30,660
And then it would get a ransomware note that was a text file and then it would be called wasted underscore info.

273
00:25:30,660 --> 00:25:32,760
And here you could see this particular message.

274
00:25:32,760 --> 00:25:37,300
So all of this is important for us as we plan what we're going to do.

275
00:25:37,500 --> 00:25:49,720
Now, none of the cyber threat intelligence I read had MITRE ATT&CK mapping, neither for EvoCorp as a threat actor or a group or WastedLocker as a ransomware.

276
00:25:49,720 --> 00:25:59,300
So I had to manually extract these TTPs from the cyber threat intelligence and then create a MITRE ATT&CK navigation layer.

277
00:25:59,300 --> 00:26:00,100
So I've done that.

278
00:26:00,100 --> 00:26:03,840
And here you can see a screenshot on the right of the impact portion.

279
00:26:03,840 --> 00:26:06,620
This is what the WastedLocker ransomware does.

280
00:26:06,620 --> 00:26:12,500
And there you can see that the JSON layer is available for you to take a look.

281
00:26:12,500 --> 00:26:14,980
So let's take a look at that one right now.

282
00:26:14,980 --> 00:26:18,960
Here is the MITRE ATT&CK layer that I created.

283
00:26:19,000 --> 00:26:24,400
A nice feature of ATT&CK Navigator is that you can give it a JSON file.

284
00:26:24,400 --> 00:26:30,400
So you see up here, this is hosted on GitHub and we give it the URL.

285
00:26:30,400 --> 00:26:35,700
This URL here is the site GitHub where I post community threats.

286
00:26:35,700 --> 00:26:39,040
And in this case, it has this layer, which it renders it here.

287
00:26:39,040 --> 00:26:42,760
So we can see the initial access was drive-by compromise.

288
00:26:42,760 --> 00:26:46,320
We can see execution through PowerShell and JavaScript.

289
00:26:46,320 --> 00:26:52,640
We can see user execution through a malicious file, service execution, as well as WMI.

290
00:26:52,640 --> 00:26:56,380
We can see some privilege escalation, defensivation.

291
00:26:56,380 --> 00:27:17,540
And then we have to scroll over to the right, thanks to all the sub techniques, to see other things such as discovery of local accounts and domain accounts, system owner and user discovery, lateral movements, command and control through HTTPS using asymmetric crypto and a web protocol over HTTPS.

292
00:27:17,540 --> 00:27:25,860
And then over on the right, we see the data destruction, data encryption, store data manipulation, and stopping that service.

293
00:27:25,880 --> 00:27:42,860
So I went through all that cyber threat intelligence and I pulled this out, which allows me to create a much better plan for what we are going to try to do here in this red team exercise that emulates EvilCorp and the WastedLocker malware.

294
00:27:43,240 --> 00:27:45,200
So planning is very important, right?

295
00:27:45,200 --> 00:27:56,000
We started with cyber threat intelligence, we learned about the Garmin hack, we learned about EvilCorp, we learned about the WastedLocker malware, and we mapped that automator attack.

296
00:27:56,000 --> 00:27:58,180
Now let's talk about planning.

297
00:27:58,180 --> 00:28:00,120
What are the goals and objectives here?

298
00:28:00,120 --> 00:28:07,580
In this case, we want to determine if an attack like Garmin would work in our target environment.

299
00:28:07,660 --> 00:28:13,200
We also want to decide, are we going to do this as a red team exercise or a purple team exercise?

300
00:28:13,240 --> 00:28:18,220
Given we are in the red team village, we'll do it as a red team exercise.

301
00:28:18,220 --> 00:28:25,120
I'm going to emulate all the steps and then later on, we'll see what the blue team was able to catch or prevent.

302
00:28:25,880 --> 00:28:30,140
It's very important to have an exercise coordinator and a project manager.

303
00:28:30,140 --> 00:28:44,040
That way, even though it is a zero-knowledge engagement, they communicate what is happening to the target organization, to the blue team trusted agents.

304
00:28:44,040 --> 00:28:52,520
Those are folks within the organization that know the exercise is happening, but are not going to tell the players that this is happening.

305
00:28:52,520 --> 00:29:03,480
Because if they know that this is an exercise, their behavior will change, which means your measurement of that particular testing will also change.

306
00:29:03,760 --> 00:29:09,000
Next, we want to do assume breach or a full end-to-end exercise.

307
00:29:09,000 --> 00:29:17,360
In this case, we know through cyber threat intelligence that the initial access was through a compromised third-party site.

308
00:29:17,360 --> 00:29:20,340
So that's not something you're going to be allowed to emulate.

309
00:29:20,760 --> 00:29:23,940
So let's go with an assume breach.

310
00:29:23,940 --> 00:29:31,300
Assume breach is a more efficient way of doing this, especially for mature organizations that know they're going to get breached.

311
00:29:31,300 --> 00:29:39,800
At any given time, there will most likely be some exploits, some vulnerability, or someone inside the target organization is going to click on something.

312
00:29:39,860 --> 00:29:45,760
So for this instance, we're going to go with the assume breach because we want to really get to a ransomware part.

313
00:29:45,760 --> 00:29:50,920
We want to focus on that and not focus on the initial access.

314
00:29:50,920 --> 00:29:53,580
As usual, there's going to be rules of engagement.

315
00:29:53,580 --> 00:29:58,440
So don't encrypt or actually ransom any business data, right?

316
00:29:58,440 --> 00:30:04,860
Create new files, encrypt those, and or exfiltrate them based on this threat actor.

317
00:30:04,860 --> 00:30:10,380
In this particular case, it didn't look like Evil Corp actually exfiltrated the data.

318
00:30:10,380 --> 00:30:26,380
So we're going to create a plan that does exactly that, that creates new files, a lot of new files, encrypts them, downloads a ransom note, and then that way we've emulated in a safe manner so that the target organization, one, approves this exercise,

319
00:30:26,380 --> 00:30:32,520
and two, we will be able to answer the question, can this happen to us without introducing risk?

320
00:30:32,600 --> 00:30:35,820
And then lastly, we have to talk about attack infrastructure.

321
00:30:38,640 --> 00:30:44,420
So for attack infrastructure, the red team needs to determine what tool they're going to use.

322
00:30:44,420 --> 00:30:51,180
Well, this actually was pretty easy because the Cyber Threat Intelligence told us that they use Cobalt Strike.

323
00:30:51,620 --> 00:31:01,580
So what we can do is use the C2 matrix, and it's a Google sheet of a number of different C2s, and it shares all the different capabilities that each of these have.

324
00:31:01,580 --> 00:31:07,660
So if we hadn't heard about Cobalt Strike, we can take a look at that particular one and learn about it here.

325
00:31:07,860 --> 00:31:10,140
You can find the ideal C2.

326
00:31:10,140 --> 00:31:24,360
Now for the malware creation part, we might have to use a different tool to create something that does the same thing that WastedLocker does, because Cobalt Strike doesn't have those particular features.

327
00:31:24,580 --> 00:31:37,300
The C2 matrix also has a Slingshot virtual machine, which allows you to get started and test eight of these C2s without having to install them.

328
00:31:37,300 --> 00:31:40,000
You just download the virtual machine and you can use them.

329
00:31:40,000 --> 00:31:44,880
And there's also a how-to site where you can learn how to use all of these.

330
00:31:44,880 --> 00:31:47,160
So I'll show that shortly.

331
00:31:47,680 --> 00:31:51,340
In this case, we know we need to use Cobalt Strike.

332
00:31:51,340 --> 00:31:55,320
So Cobalt Strike is a commercial command and control framework.

333
00:31:55,320 --> 00:31:57,860
It's available on cobaltstrike.com.

334
00:31:58,020 --> 00:32:00,740
And unfortunately, it was leaked.

335
00:32:00,740 --> 00:32:04,420
And that means that malicious actors have their hands on it.

336
00:32:04,420 --> 00:32:07,040
And it has a MITRE attack page as well.

337
00:32:07,040 --> 00:32:09,420
It's software 0154.

338
00:32:09,420 --> 00:32:13,760
And within there, you can see a number of different malicious actors that have used this.

339
00:32:13,760 --> 00:32:25,120
This here comes from MITRE ATT&CK, which they haven't added EvilCorp as a group , nor have they correlated EvilCorp as having used Cobalt Strike either.

340
00:32:25,120 --> 00:32:27,680
But I'll work with the MITRE team to get that added.

341
00:32:27,680 --> 00:32:35,940
And then on the right, there's a screenshot straight from Cobalt Strike's website as to all the various different features that this particular product has.

342
00:32:35,980 --> 00:32:41,580
So that is our initial access and getting to the point where we can deploy our malware.

343
00:32:41,580 --> 00:32:45,080
Now, for deploying our malware, we're going to use Scythe.

344
00:32:45,080 --> 00:32:58,640
And that's because Scythe specializes in creating custom controlled synthetic malware that will run in a production environment without introducing risk.

345
00:32:58,640 --> 00:33:06,140
It's also a tool that allows you to emulate known threat actors and automate a lot of those TTPs.

346
00:33:06,140 --> 00:33:10,240
Now, obviously, I work at Scythe and I have the cool hoodie, as you can see.

347
00:33:10,940 --> 00:33:16,540
We went with that one to show you how cool and how easy it is to create this particular malware.

348
00:33:16,560 --> 00:33:22,860
Also, I couldn't figure out how to create something like ransomware so easily with any of the other C2s.

349
00:33:22,860 --> 00:33:27,560
But if you have any C2s that you think do this, definitely let me know.

350
00:33:28,000 --> 00:33:31,360
So Scythe is also a command and control framework.

351
00:33:31,360 --> 00:33:32,840
It's a pretty easy installer.

352
00:33:32,840 --> 00:33:34,040
It installs on Windows.

353
00:33:34,040 --> 00:33:36,880
It allows multiple channels for command and control.

354
00:33:36,880 --> 00:33:40,360
In this case, we know we have to use HTTPS, which it has.

355
00:33:40,360 --> 00:33:43,140
And then it builds automation.

356
00:33:43,140 --> 00:33:50,280
So not only do we want to drop this synthetic malware that does what WastedLocker does, we want to automate that, right?

357
00:33:50,280 --> 00:33:51,660
It's going to create files.

358
00:33:51,660 --> 00:33:53,000
It's going to encrypt files.

359
00:33:53,000 --> 00:33:54,560
It's going to download a ransom note.

360
00:33:54,560 --> 00:33:57,680
All of that needs to be done all in one.

361
00:33:57,880 --> 00:34:00,120
So it really allows us to do that.

362
00:34:00,120 --> 00:34:14,620
And it has a variety of integrations with a number of different tools like Vector for tracking red and purple team, Exercises, PlexTrack if you use that in your corporation, and integration for purple teams with Splunk and really any SIEM.

363
00:34:14,620 --> 00:34:21,320
So it's really a great tool for doing this particular ransomware malware that we want to do.

364
00:34:21,320 --> 00:34:24,480
Is it even possible to emulate ransomware?

365
00:34:24,480 --> 00:34:28,040
Well, I've hinted at all of this as we get up to this slide.

366
00:34:28,040 --> 00:34:30,160
And the answer is, of course it is.

367
00:34:30,160 --> 00:34:34,980
The secret is to not encrypt or destroy real production data, right?

368
00:34:34,980 --> 00:34:41,960
You have that already in your plan and it will get approved because you're not impacting the target systems.

369
00:34:41,960 --> 00:34:43,820
You're not impacting production.

370
00:34:43,820 --> 00:34:59,780
So instead of encrypting real files, what we're going to do is first create new files and then encrypt them, exfiltrate them if this particular threat actor did, which Evil Corp did not, and then download a ransom note.

371
00:34:59,920 --> 00:35:07,180
So this method will ensure that no data is ever at risk of being encrypted or destroyed or leaked out.

372
00:35:07,180 --> 00:35:09,820
And over on the right, you can see the steps here.

373
00:35:09,820 --> 00:35:12,400
This is the malware that I've created with Scythe.

374
00:35:12,400 --> 00:35:21,080
It's going to load a number of different things into memory, which WastedLocker also did, was it loaded everything into memory so that it wouldn't get caught.

375
00:35:21,080 --> 00:35:25,700
Then we're going to create a directory on our desktop called Evil Corp.

376
00:35:25,700 --> 00:35:29,500
Within there, we're going to create 55 meg files.

377
00:35:29,500 --> 00:35:31,360
So we have a lot of volume there.

378
00:35:31,360 --> 00:35:33,340
And then we're going to encrypt that.

379
00:35:33,340 --> 00:35:38,060
And the password we chose in this case is Evil Corp in LeetSpeak.

380
00:35:38,240 --> 00:35:46,420
And then we're going to download a ransom note from a pastebin that I created that's very similar to the ransom note from WastedLocker.

381
00:35:46,420 --> 00:35:52,600
And we're going to put that in the desktop so that it shows.

382
00:35:52,600 --> 00:35:56,400
And then, of course, we're going to shut down and clean up after ourselves.

383
00:35:56,900 --> 00:35:59,080
So let's take a look.

384
00:35:59,080 --> 00:36:06,240
We're going to start with our SANS Slingshot C2 Matrix Edition virtual machine.

385
00:36:06,240 --> 00:36:12,120
It is running on a separate network with a Windows 10 victim system.

386
00:36:12,120 --> 00:36:20,280
Again, we're going to focus on the actual ransomware payload and not so much on the initial access and lateral movement.

387
00:36:20,280 --> 00:36:25,120
But because it did use Cobalt Strike, let's go ahead and start with that.

388
00:36:25,120 --> 00:36:29,640
In this case, I have Cobalt Strike installed in slash op slash Cobalt Strike.

389
00:36:29,640 --> 00:36:31,740
I'm going to start a team server.

390
00:36:31,740 --> 00:36:33,360
You have to start that with sudo.

391
00:36:33,360 --> 00:36:36,540
And I'm just going to put a basic password in there.

392
00:36:36,540 --> 00:36:40,820
My IP is 192.168.1.166.

393
00:36:41,000 --> 00:36:42,920
So we'll start that up.

394
00:36:44,340 --> 00:36:48,400
And then on another window, I will start the Cobalt Strike client.

395
00:36:48,400 --> 00:36:50,200
You don't need sudo for that.

396
00:36:52,060 --> 00:36:54,300
And here we will connect.

397
00:36:56,720 --> 00:36:58,360
So this is Cobalt Strike.

398
00:36:58,360 --> 00:37:03,440
The first thing we're going to do, like in any other command control framework, is set up a listener.

399
00:37:03,980 --> 00:37:05,560
I'm going to click add.

400
00:37:15,100 --> 00:37:19,360
And we're going to use port 8080 just because we have something else running.

401
00:37:19,360 --> 00:37:21,640
We have Apache running on port 80.

402
00:37:24,060 --> 00:37:27,360
Now that we have the listener, we are going to create an attack.

403
00:37:27,360 --> 00:37:31,220
As the threat intel told us, they use PowerShell for that.

404
00:37:31,220 --> 00:37:33,660
So we'll do exactly that.

405
00:37:50,230 --> 00:37:56,090
So what we're going to do is move over that payload to the system where we will execute it from.

406
00:38:06,090 --> 00:38:10,350
And we copy and paste that into a standard command prompt.

407
00:38:14,320 --> 00:38:17,900
And here we see it has checked in.

408
00:38:19,120 --> 00:38:29,160
Now that we have access on this target system, we can do the things that Evil Corp did, which was escalate privileges and move laterally, etc.

409
00:38:29,160 --> 00:38:33,180
In this case, we want to focus more on impact, which is on the ransomware.

410
00:38:33,180 --> 00:38:39,340
So let's go over and create the WastedLocker synthetic malware.

411
00:38:39,400 --> 00:38:41,300
So I'm over here in Cypher.

412
00:38:41,300 --> 00:38:43,100
I'm going to Threat Catalog.

413
00:38:43,100 --> 00:38:47,620
And I've already imported the WastedLocker campaign.

414
00:38:47,620 --> 00:38:54,600
So here we see that it will do everything that we discussed, which was load, run, file, correct downloader.

415
00:38:54,760 --> 00:38:59,900
It will create a directory in Evil Corp, an Evil Corp directory on the desktop.

416
00:38:59,900 --> 00:39:05,960
It will create five files all with that wasted extension.

417
00:39:05,960 --> 00:39:07,380
Then it will encrypt them.

418
00:39:07,380 --> 00:39:09,700
Then it will download a message.

419
00:39:09,700 --> 00:39:11,040
And then it'll shut down.

420
00:39:19,780 --> 00:39:29,520
Now we will download that 32-bit executable onto our Linux system, so that we then use Cobalt Strike to upload it and execute it.

421
00:39:38,940 --> 00:39:44,520
Now we will upload the file into this cusers.george directory.

422
00:39:51,300 --> 00:39:54,200
And now we will execute it.

423
00:40:00,250 --> 00:40:03,170
You should see that execution now here.

424
00:40:05,530 --> 00:40:07,450
And there's the check-in.

425
00:40:07,450 --> 00:40:10,510
It's going to go through and load all these modules.

426
00:40:10,510 --> 00:40:28,110
If we observe the directory here on the victim system, we will see it create the folder Evil Corp, create the files, encrypt those files, and then download a ransom note from PasteBit.

427
00:40:29,930 --> 00:40:33,150
There's the Evil Corp folder.

428
00:40:34,030 --> 00:40:45,050
It will now create all these files and then encrypt them, and then download the ransom note.

429
00:40:49,700 --> 00:40:53,010
And here we see the ransom note was downloaded.

430
00:40:54,330 --> 00:40:59,950
And there is the ransom note, very similar to what was used in Garmin.

431
00:40:59,950 --> 00:41:25,550
So as you can see, we use Cobalt Strike to get that initial access with a PowerShell script, and then use Cobalt Strike to dump this executable, which is synthetic malware created with Scythe, to emulate a ransomware attack inside a professional enterprise network without introducing any risk.

432
00:41:25,550 --> 00:41:27,990
How do we defend against ransomware?

433
00:41:27,990 --> 00:41:40,130
Well, before, we just had to worry about that initial access on preventive controls, because ransomware would find its way into any system and then encrypt it, even with user-level privileges.

434
00:41:40,130 --> 00:41:59,210
But now we're seeing these more sophisticated attacks, like Evil Corp on Garmin, where it's getting access, the threat actor gets access to a system, does privilege escalation, moves laterally, does defensivation, executes a number of different ways, and then drops their encryption.

435
00:41:59,210 --> 00:42:09,050
So there's a number of different ways to defend against this, very similar to your other adversary emulations that didn't have the ransomware type impact.

436
00:42:09,050 --> 00:42:11,030
We're now seeing those there.

437
00:42:11,070 --> 00:42:15,370
So there's a number of different ways to defend against this.

438
00:42:15,370 --> 00:42:23,190
I did an excellent interview with Olaf from FalconForce on using things like Sysmon.

439
00:42:23,270 --> 00:42:31,150
Because we are calling all those encryption APIs, you should be able to detect that, especially if a whole bunch of systems do it.

440
00:42:31,150 --> 00:42:36,750
Now, US CERT just recently released these tips, and there's a number of other resources here.

441
00:42:37,130 --> 00:42:42,790
I do want to point out another organization that was recently breached called CWT.

442
00:42:42,790 --> 00:42:52,850
They are an enterprise, a corporate travel organization, and their chats with the malicious actor were leaked.

443
00:42:53,030 --> 00:43:00,270
In this case, they actually paid four million dollars to get access to their files, and the chat was leaked.

444
00:43:00,270 --> 00:43:13,830
The link is there for the entire thread if you want to read it, but here you can see quite a bit of advice that was given to the target organization after the malicious work was done and they got paid.

445
00:43:13,830 --> 00:43:23,270
They gave them some advice as to what to do, which is very similar advice to a lot of the things that we find in our adversary emulations.

446
00:43:24,050 --> 00:43:29,870
So obviously there's a lot more ransomware than just WastedLocker.

447
00:43:29,870 --> 00:43:40,250
These are just a few with their links to MITRE ATT&CK, as well as an interesting service I saw called Shadow Intelligence, which tells you about a number of different ransomware attacks.

448
00:43:40,250 --> 00:43:41,630
So definitely check them out.

449
00:43:42,570 --> 00:43:46,410
Now if this interests you, we have a Threat Thursday.

450
00:43:46,410 --> 00:44:03,610
So every Thursday we choose an adversary, we introduce the adversary, we consume Cyber Threat Intelligence, map it to MITRE ATT&CK, create that navigator layer just like we did here, then we create an adversary emulation plan, we share that plan in our community GitHub,

451
00:44:03,610 --> 00:44:09,090
we emulate the adversary and show it on a video, and we talk about how to defend against this.

452
00:44:09,090 --> 00:44:11,090
So this is all free for the community.

453
00:44:11,090 --> 00:44:16,790
A lot of it is with Scythe, but a lot of the living off the land you'll be able to do without using Scythe.

454
00:44:19,210 --> 00:44:22,010
Another thing I wanted to mention is to save the date.

455
00:44:22,010 --> 00:44:29,830
I know you all like free conferences, so we are hosting a free conference called UNICON, our very own unicorn conference.

456
00:44:29,830 --> 00:44:32,870
Yes, I work at Scythe, where we have unicorns.

457
00:44:32,870 --> 00:44:35,310
And that is going to be on August 20th.

458
00:44:35,310 --> 00:44:41,730
We're doing some very cool stuff and creating an ecosystem for the community.

459
00:44:41,730 --> 00:44:48,210
So we have an SDK that allows you to create your own adversary TTPs.

460
00:44:48,210 --> 00:44:53,970
Think of it of creating a bug bounty, but for TTPs, for Adversary Behaviors.

461
00:44:53,970 --> 00:45:03,630
You can create these modules and put them up in this marketplace, where you can share them for free or sell them and make some money off of them.

462
00:45:03,630 --> 00:45:08,770
So all of that is possible through our marketplace, and we will be releasing that at UNICON.

463
00:45:08,850 --> 00:45:13,690
The way it works is that you use the SDK, which is completely free.

464
00:45:13,690 --> 00:45:30,550
You create a TTP, you add it into the marketplace, and then any Scythe user will be able to grab it or pay you for it, and then run these adversary emulations in their environment and hopefully detect the different behaviors that you've created.

465
00:45:30,550 --> 00:45:33,670
If not, they'll be able to test and hopefully improve it.

466
00:45:33,670 --> 00:45:42,230
So it's an ecosystem of sharing offensive techniques so that organizations can better defend themselves.

467
00:45:43,250 --> 00:45:47,250
I went through a number of different references, so here is the slide.

468
00:45:47,250 --> 00:45:49,410
Obviously, I didn't do all of this on my own.

469
00:45:49,410 --> 00:45:54,790
Big shout out to the folks that did the Cyber Threat Intelligence for Eagle Bull Corp and Wasted Locker.

470
00:45:54,790 --> 00:46:03,870
I did the MITRE Attack Mapping, and as I mentioned, all of that is shared for you, and hopefully you found all of this useful.

471
00:46:03,870 --> 00:46:06,790
So with that, thank you very much for your time.

472
00:46:06,790 --> 00:46:08,250
I really appreciate it.

473
00:46:08,250 --> 00:46:10,970
Hopefully you learned something here today, and I'll see you