1
00:00:00,860 --> 00:00:03,420
I don't like when they play it, but whatever.

2
00:00:06,860 --> 00:00:09,060
Okay, we are live.

3
00:00:11,730 --> 00:00:21,290
Hi everyone, thanks for coming to Indicators of Emulation Extra Spicy Adversary Emulation.

4
00:00:21,510 --> 00:00:25,170
And we will just get started and go at it.

5
00:00:25,170 --> 00:00:28,110
And really quick, next slide please.

6
00:00:31,100 --> 00:00:34,980
Before I say anything, I have to do this for the lawyers.

7
00:00:34,980 --> 00:00:40,320
And say that any opinions and anything that I say or do is just me.

8
00:00:40,320 --> 00:00:43,680
And I'm not representing my company at all.

9
00:00:43,780 --> 00:00:46,240
It's in an individual capacity.

10
00:00:46,500 --> 00:00:52,480
And not the views of my employer, not the views of his employer, period.

11
00:00:52,740 --> 00:00:54,180
Yeah, that goes for me as well.

12
00:00:54,700 --> 00:00:58,320
Yeah, we both have our lawyer disclaimers.

13
00:00:58,760 --> 00:01:02,260
So I'm going to start with a little bit of story time.

14
00:01:02,260 --> 00:01:05,140
Back at B-Side Chicago.

15
00:01:06,420 --> 00:01:08,020
Okay, there we go.

16
00:01:08,020 --> 00:01:12,840
Back at B-Side Chicago 2019, Matt Kelly did a really great talk.

17
00:01:12,840 --> 00:01:18,600
And it was called Threat Emulation Adversary Focused Red Teams.

18
00:01:18,620 --> 00:01:24,720
And in it, he got me thinking about how CTI can benefit RED.

19
00:01:24,720 --> 00:01:25,800
All things RED.

20
00:01:25,800 --> 00:01:28,940
Adversary Emulation, Perp Team, all of that.

21
00:01:28,940 --> 00:01:33,400
And so, you know, I'm working on a doctorate at Marymount University.

22
00:01:33,400 --> 00:01:39,020
And I decided to incorporate the thing that I'm curious about into my research.

23
00:01:39,100 --> 00:01:43,620
And conducting, you know, reading tons of articles and all of that.

24
00:01:43,620 --> 00:01:49,880
I came to the kind of conclusion that there's really minimal information out there.

25
00:01:49,880 --> 00:01:54,360
As far as like the practice of CTI applied towards RED teaming.

26
00:01:54,360 --> 00:01:58,120
It seems more focused on BLUE team stuff.

27
00:01:58,120 --> 00:02:05,820
Like extracting indicators of compromise, IOCs, and helping defenders defend the organization.

28
00:02:05,820 --> 00:02:08,920
And so, of course, there's Atomic RED team and all of that.

29
00:02:08,920 --> 00:02:12,420
I'm talking specifically about the trade practice CTI.

30
00:02:12,420 --> 00:02:16,240
Traditionally, it's for BLUE and not necessarily RED.

31
00:02:16,400 --> 00:02:18,800
So, fast forward a little bit.

32
00:02:18,800 --> 00:02:23,820
And I got curious about Bryson Bort and Sai's marketplace.

33
00:02:23,820 --> 00:02:34,220
And in it, basically, they are putting together something where people can build out capabilities for threat actors for organizations to use.

34
00:02:34,220 --> 00:02:36,920
And I thought, oh, my God, that sounds like so much fun.

35
00:02:36,920 --> 00:02:38,720
I kind of want to do it.

36
00:02:38,720 --> 00:02:42,260
And so, Bryson got me in touch with Adam Maschini.

37
00:02:42,260 --> 00:02:52,100
And Adam pointed out that basically, if you look at the threat Intel reports, they have commands and very, very detailed for Linux.

38
00:02:52,100 --> 00:02:55,160
But Windows, not so much.

39
00:02:55,180 --> 00:02:59,340
And that semester, I happened to be in a malware analysis course.

40
00:02:59,340 --> 00:03:04,760
And I'm like, hmm, maybe I can make this my project for the year.

41
00:03:04,780 --> 00:03:08,380
So, I decided, why not?

42
00:03:08,380 --> 00:03:10,560
Why not explore it a little bit further?

43
00:03:10,800 --> 00:03:13,640
So, I decided to take it on.

44
00:03:13,640 --> 00:03:16,340
And I was like, it will be easy.

45
00:03:16,340 --> 00:03:24,700
All I have to do is just enable command line logging and maybe some PowerShell as an extra, you know, thing.

46
00:03:24,880 --> 00:03:26,800
And it will be really easy.

47
00:03:26,800 --> 00:03:27,820
Not hard at all.

48
00:03:27,820 --> 00:03:29,740
Like, I already know where to get all the samples.

49
00:03:29,740 --> 00:03:31,580
There won't be any problems.

50
00:03:32,540 --> 00:03:33,580
Yeah.

51
00:03:34,160 --> 00:03:37,020
So, I got a VM from Windows.

52
00:03:37,020 --> 00:03:38,260
So, Windows 10.

53
00:03:38,260 --> 00:03:43,380
And then I enabled all the logging for the Windows command line and PowerShell.

54
00:03:43,380 --> 00:03:48,820
I used Michael Gao's, let's see, malware archaeology.

55
00:03:48,920 --> 00:03:52,200
And lots of Googling to make sure I had it all right.

56
00:03:52,280 --> 00:03:57,860
And believe it or not, disabling all of the security on Windows 10, like, holy, holy hell.

57
00:03:57,860 --> 00:04:02,700
Like, it was a lot of work to be able to just execute malware.

58
00:04:03,380 --> 00:04:08,400
With the infection rates, I was expecting it would be easy to just, you know, point and click.

59
00:04:08,400 --> 00:04:10,360
But I was wrong.

60
00:04:10,360 --> 00:04:13,000
So, I just want to do...

61
00:04:14,700 --> 00:04:16,140
Oh, next slide.

62
00:04:16,140 --> 00:04:17,680
A couple next slides.

63
00:04:23,280 --> 00:04:24,320
Back.

64
00:04:25,980 --> 00:04:27,160
Yes, that one.

65
00:04:27,160 --> 00:04:34,680
So, I just want to do a really brief shout out to Windows and Microsoft.

66
00:04:34,680 --> 00:04:36,620
And say, thank you so much.

67
00:04:36,620 --> 00:04:40,860
You've done a really good job at protecting us, everyone.

68
00:04:41,560 --> 00:04:45,220
He made it really hard for me to click and point.

69
00:04:45,220 --> 00:04:48,220
And it required a lot of disabling.

70
00:04:48,400 --> 00:04:49,600
Next slide, please.

71
00:04:50,820 --> 00:04:52,720
So, these are the results.

72
00:04:52,720 --> 00:04:57,820
What I did is I wanted to create a baseline since it was for an actual doctoral class.

73
00:04:57,820 --> 00:05:02,660
So, I had to have some sort of methodology behind it to be able to explain.

74
00:05:02,940 --> 00:05:07,780
So, when you look over the command line logging, it's a little...

75
00:05:07,780 --> 00:05:11,420
It can get a little confusing because stuff goes on.

76
00:05:11,420 --> 00:05:18,420
And before I introduce malware, I wanted to make sure that I understood what the heck was going on first.

77
00:05:18,420 --> 00:05:23,800
So, I wanted to create a control that I knew was not malicious and doing weird stuff.

78
00:05:23,800 --> 00:05:26,840
And before I introduce the craziness.

79
00:05:26,920 --> 00:05:28,880
So, there are three options.

80
00:05:28,880 --> 00:05:32,020
One is issuing the commands yourself, which I did.

81
00:05:32,100 --> 00:05:35,040
The next one was Atomic Red Team.

82
00:05:35,040 --> 00:05:37,840
So, I used Atomic Red Team, installed it.

83
00:05:37,840 --> 00:05:40,760
Shout out to the Atomic Red Team crew.

84
00:05:41,040 --> 00:05:42,520
It was so easy.

85
00:05:42,520 --> 00:05:44,460
I just followed the instructions.

86
00:05:44,600 --> 00:05:51,680
And I was able to get it up and running and done and tested in almost no time.

87
00:05:51,680 --> 00:05:54,460
It was ridiculous how easy it was.

88
00:05:54,560 --> 00:05:57,760
And then finally was testing malware.

89
00:05:58,000 --> 00:06:01,840
So, I created a test malware, I call it.

90
00:06:01,840 --> 00:06:04,380
It just pops calc, essentially.

91
00:06:04,380 --> 00:06:07,480
I compiled a C++ binary.

92
00:06:07,820 --> 00:06:17,100
And I used Sector 7's Red Team Operator malware dev course to, I guess, learn how to compile C++ binaries.

93
00:06:17,100 --> 00:06:18,540
So, that was fun.

94
00:06:18,540 --> 00:06:19,720
It was very benign.

95
00:06:19,720 --> 00:06:21,660
The code is right up there on the left-hand side.

96
00:06:21,660 --> 00:06:23,160
It just pops calc.

97
00:06:23,160 --> 00:06:33,140
And the other problem I had, if you can see on the right-hand side, all of the no's for command line arguments.

98
00:06:33,140 --> 00:06:35,900
I'm like, what the heck am I doing wrong?

99
00:06:36,300 --> 00:06:38,140
Why can't I figure this out?

100
00:06:38,140 --> 00:06:39,800
Why aren't these executing?

101
00:06:39,800 --> 00:06:45,800
I went to any run, I did hybrid analysis, malware bizarre, I pulled stuff from virus total.

102
00:06:46,560 --> 00:06:59,280
A fun story about that is someone at some place, which I won't name, I asked, hey, I'm having problems executing your samples.

103
00:06:59,280 --> 00:07:01,000
What am I doing wrong?

104
00:07:01,060 --> 00:07:04,700
I know with any run, you change the .bin to .exe.

105
00:07:05,660 --> 00:07:09,980
I even used the file command and checked that it was an executable.

106
00:07:09,980 --> 00:07:11,440
Different things, right?

107
00:07:11,900 --> 00:07:14,980
And they suggested I speak to Bleeping Computer.

108
00:07:14,980 --> 00:07:17,540
Obviously, I'm not going to do that.

109
00:07:18,420 --> 00:07:22,900
So there are multiple repositories for malware, and I decided, you know what?

110
00:07:22,940 --> 00:07:27,560
I'm having such a hard time with this, I'm just going to go direct to the source.

111
00:07:27,740 --> 00:07:37,580
So at URL House, the wonderful thing about that is that when they post fresh samples, they also include the URL.

112
00:07:37,580 --> 00:07:44,380
So with the new ones that they posted, I honestly, I just went to the attacker's domain and pulled the malware myself.

113
00:07:45,040 --> 00:07:47,640
I was safe, don't worry, I was safe.

114
00:07:48,420 --> 00:07:50,160
So next slide, please.

115
00:07:51,020 --> 00:07:54,880
So these are the results of when I pulled the malware myself.

116
00:07:54,880 --> 00:08:02,440
I ended up getting command line arguments, which was great, but there were still over half that I got nothing.

117
00:08:02,440 --> 00:08:04,800
And I'm like, what is going on?

118
00:08:04,800 --> 00:08:05,640
Is it me?

119
00:08:05,640 --> 00:08:07,000
Is it the malware?

120
00:08:07,000 --> 00:08:10,420
Like, what's wrong with this?

121
00:08:10,420 --> 00:08:11,760
Next slide, please.

122
00:08:13,240 --> 00:08:16,200
So I'm like, oh, there's static analysis, right?

123
00:08:16,200 --> 00:08:22,540
So I'll just download Ghidra and Ida, and I'll just fuss around with it and figure it out.

124
00:08:22,540 --> 00:08:25,720
And it was a little bit harder than that.

125
00:08:26,040 --> 00:08:43,120
I didn't really have the time because it was for a class project too, to sit down and learn all that anti-analysis, anti-VM, and all of that defensive Asian stuff as far as how to defeat it and step through and do that for multiple samples on scale.

126
00:08:43,120 --> 00:08:44,760
Like, I didn't have that time.

127
00:08:44,760 --> 00:08:46,680
I will in the future, possibly.

128
00:08:47,360 --> 00:08:51,260
And also to Joe Slowik, I don't know if you're familiar with him.

129
00:08:51,260 --> 00:08:53,240
He's like the meme master.

130
00:08:53,300 --> 00:08:58,720
He posted something recently where it was a guy drinking out of a cup of water.

131
00:08:58,860 --> 00:09:02,920
And he was like, here, he was like, is this how I drink water?

132
00:09:02,920 --> 00:09:06,700
You know, and like, not actually drinking from it.

133
00:09:06,700 --> 00:09:11,900
And that's how I felt like when I was working with Ghidra and Ida and all that stuff.

134
00:09:11,900 --> 00:09:16,620
So I'm like, whoa, I'm like, I just need to put this down for a second.

135
00:09:16,840 --> 00:09:18,060
Next slide, please.

136
00:09:19,640 --> 00:09:30,320
So at the DFIR Summit in 2020, this year, Mauer Archaeology himself, he was giving a talk, and I was able to talk to him about some of my problems.

137
00:09:30,320 --> 00:09:35,360
And he suggested that I just use a real computer.

138
00:09:35,360 --> 00:09:36,920
And I'm like, what?

139
00:09:36,920 --> 00:09:38,860
That's like crazy.

140
00:09:39,080 --> 00:09:46,940
I would never think to buy a cheap computer and execute it on there to bypass the VM stuff.

141
00:09:46,940 --> 00:09:49,760
So I was like, all right, let's do this.

142
00:09:49,760 --> 00:09:54,200
Like, I will fully commit to this, and I will buy these computers.

143
00:09:54,200 --> 00:09:57,300
So the first one I bought, it was dead on arrival.

144
00:09:57,620 --> 00:09:59,360
It did not work.

145
00:09:59,360 --> 00:10:01,800
And then the second one ended up working.

146
00:10:01,800 --> 00:10:03,320
And next slide, please.

147
00:10:05,940 --> 00:10:23,860
So these are the results of what I did is I grabbed a sample, and I wanted to get a good idea as far as what the different sandboxes gave me before I did my actual analysis on a real computer since, you know, whatever.

148
00:10:24,300 --> 00:10:27,560
And so on the left-hand corner, you see VirusTotal.

149
00:10:27,560 --> 00:10:32,160
And then on the upper part, you see Cape Sandbox, and then the bottom, Joe Sandbox.

150
00:10:32,160 --> 00:10:35,480
Joe Sandbox gave more in this instance.

151
00:10:35,480 --> 00:10:36,820
Next slide, please.

152
00:10:38,040 --> 00:10:42,140
And then this is the actual manual part of it.

153
00:10:42,140 --> 00:10:49,500
And it was about 75 pages worth of stuff that I collected from doing it manually.

154
00:10:49,800 --> 00:10:51,440
This is just some of them here.

155
00:10:51,440 --> 00:10:52,640
Some of them could be helpful.

156
00:10:52,640 --> 00:10:58,400
I also grabbed all the PowerShell command line stuff that came out of executing it.

157
00:10:58,400 --> 00:10:59,700
Next slide, please.

158
00:11:01,140 --> 00:11:08,600
So the funny thing, too, as a threat Intel analyst, I decided to look at threat reports, and it was a Raccoon Stealer sample.

159
00:11:08,600 --> 00:11:15,200
So I came across a Cyber Reason blog, because something funny happened while I was executing that one.

160
00:11:15,200 --> 00:11:19,280
It asked me if I wanted to install the .NET framework.

161
00:11:19,280 --> 00:11:29,780
But then in the threat report, it said that one of the biggest complaints from criminals out there is that the Raccoon Stealer has a very low success rate.

162
00:11:29,780 --> 00:11:33,440
And I'm like, well, gee, now I know why.

163
00:11:33,640 --> 00:11:42,280
Basically, it would require people, at least with the version of Windows 10 that I was using, to install the .NET framework.

164
00:11:42,280 --> 00:11:48,080
So that's a little bit of... that's a lot more work involved.

165
00:11:48,080 --> 00:11:51,060
You know, if they're like, here's an invoice, read it.

166
00:11:51,060 --> 00:11:53,100
It's like, oh, man, I have to install this?

167
00:11:53,100 --> 00:11:54,120
Yeah, screw that.

168
00:11:54,120 --> 00:11:57,300
Like, I'm just going to move on with my life, right?

169
00:11:57,320 --> 00:11:58,700
Next slide, please.

170
00:11:59,220 --> 00:12:00,480
Oh, you did it.

171
00:12:00,620 --> 00:12:21,400
So then, let's see, Thursday of this week, I had a friend contact me, and he was like, hey, I know you're doing a talk at the DEF CON villages, and if I gave you a blocked, you know, sample from my org that we don't really care about, that's junk data,

172
00:12:21,400 --> 00:12:22,880
would you be interested?

173
00:12:22,880 --> 00:12:27,340
Would you want to, you know, see what you can do with it, right?

174
00:12:27,340 --> 00:12:30,880
And this was about 24 hours prior to a previous presentation.

175
00:12:30,880 --> 00:12:31,980
I'm like, sure.

176
00:12:32,100 --> 00:12:37,660
I'm like, let's see what I can come up with, and then I will share it with the world.

177
00:12:38,840 --> 00:12:40,200
So can I do it?

178
00:12:40,200 --> 00:12:41,080
Can I not do it?

179
00:12:41,080 --> 00:12:41,760
We'll see.

180
00:12:43,980 --> 00:12:56,640
So what I did, I found the sample in VirusTotal, and then I loaded it to AnyRun, and then I also loaded it to Malware Bazaar.

181
00:12:56,640 --> 00:13:04,520
So the reason why I loaded it to all these different sandboxes is that Malware Bazaar gives me some really good data.

182
00:13:04,820 --> 00:13:25,040
Joe's Sandbox, I obviously don't have a corporate thing because, you know, I was doing this as an independent researcher, and, you know, if you submit it through Malware Bazaar, you get Joe's Sandbox, you get CAPE, you get a lot of good stuff to look at and pivot between when you're building out your reports.

183
00:13:25,080 --> 00:13:26,980
And then, of course, VMRay.

184
00:13:29,860 --> 00:13:36,180
So just as a little side note, the threat Intel brain in me kicked in, and I'm like, oh, I'm like, I have the sample.

185
00:13:36,180 --> 00:13:38,160
I can make them a custom rule.

186
00:13:38,160 --> 00:13:57,620
So I looked at the callout for the DNS traffic and pivoted, and it was, of course, a Nigerian-based hosting, not saying that Nigerian hosting is potentially malicious, whatever, but I pivoted off of it, and I found four additional samples that were malicious.

187
00:13:57,620 --> 00:14:05,740
So what I did is I created a custom YARA rule using diff and virus total, and then I passed that along to my contact.

188
00:14:05,740 --> 00:14:21,180
And then the next step was I looked up MITRE ATT&CK, because I'm like, okay, I know that it is Hawkeye, and I know that MITRE ATT&CK kind of makes my life easy sometimes and has stuff already done for me.

189
00:14:21,180 --> 00:14:27,480
And lo and behold, I look at MITRE ATT&CK, and no, they don't have what it is that I need.

190
00:14:27,480 --> 00:14:29,620
So that means I need to create it from scratch.

191
00:14:29,620 --> 00:14:31,380
But how do I do that?

192
00:14:34,380 --> 00:14:41,760
So then I use a framework, and I use the MITRE ATT&CK tactics to guide my research.

193
00:14:41,760 --> 00:14:53,520
And this is a printout from Joe Sandbox, where they kind of map the different behaviors and TTPs of the particular malware sample that we have.

194
00:14:54,040 --> 00:14:55,540
Next slide, please.

195
00:14:55,860 --> 00:15:04,780
So for initial access, it was an email with an XE attachment, and the subject said, invoice attached!

196
00:15:05,280 --> 00:15:07,940
And it can propagate through USB.

197
00:15:08,420 --> 00:15:15,700
As you can see here, on the left-hand side, you see the raw sample of the email, and it says reverse invoice.

198
00:15:15,700 --> 00:15:17,200
That was really funny.

199
00:15:17,620 --> 00:15:22,220
And I decided to go to the domain in there just to see what was up with it.

200
00:15:22,220 --> 00:15:25,460
And that's the yellow thing on the right-hand side.

201
00:15:25,460 --> 00:15:35,400
And then the sender, the sender down at the bottom, it was actually a Nigerian company as well that was sending the malicious XE.

202
00:15:36,020 --> 00:15:39,740
So I, of course, passed that along to my contact.

203
00:15:40,280 --> 00:15:42,640
So, next slide.

204
00:15:43,260 --> 00:15:45,400
So now we have execution.

205
00:15:45,400 --> 00:15:51,820
And of course, user execution is required, and that's T1204.002.

206
00:15:51,820 --> 00:15:54,280
And it was execution of a malicious file.

207
00:15:54,280 --> 00:15:55,340
Next slide.

208
00:15:57,060 --> 00:16:02,320
And now we have WMI, T1047.

209
00:16:03,900 --> 00:16:16,360
And so what I wanted to do, since I had a very short amount of time, and I had a lot of stuff to get through, so what I did is I created a process in order to parse all of this and get it out.

210
00:16:16,720 --> 00:16:33,960
Basically, I go to the Joe's Sandbox MITRE ATT&CK section, and then I go to the Joe's Sandbox specific entry in the report, which you can see down at the bottom, the box thing, that's the specific entry that I'm talking about.

211
00:16:33,960 --> 00:16:47,940
And then I check Atomic Red Team to see if there's anything that's related to that, such as check if AV antivirus firewall program is installed, and then I Google what isn't there.

212
00:16:47,940 --> 00:16:49,420
Next slide, please.

213
00:16:51,580 --> 00:17:02,400
So when I first did this for T1047 in Atomic Red Team, I didn't find anything that matched the commands that I needed.

214
00:17:02,440 --> 00:17:08,740
And so I decided to Google, and I found something on Stack Overflow, so I threw it up there.

215
00:17:08,740 --> 00:17:20,800
And later in the presentation, as I was doing my research, I found the T1518.001, and I came back and added it here.

216
00:17:20,840 --> 00:17:32,140
So this is a tip, if you do decide to leverage this, that sometimes things will be under different atomic tests, essentially.

217
00:17:32,140 --> 00:17:33,760
Next slide, please.

218
00:17:33,900 --> 00:17:37,780
So the next one was Native API.

219
00:17:39,320 --> 00:17:55,100
And when I went to go look at the specific section of Joe's Sandbox, I searched and searched and couldn't really find anything beyond just the APIs that were involved with that.

220
00:17:55,100 --> 00:18:06,000
So then I went to Atomic Red Team, and they had something that had a command that was similar to v4.0.30319.

221
00:18:06,000 --> 00:18:16,120
So I did a search in the actual Joe's Sandbox, and I found a command on the command line, but there were no specifics tied with it.

222
00:18:16,120 --> 00:18:28,940
So this at least gives a beginning of what XE was being used to interface with the APIs, and the APIs specifically included.

223
00:18:28,940 --> 00:18:30,420
Next slide, please.

224
00:18:30,720 --> 00:18:32,780
So now we have persistence.

225
00:18:32,780 --> 00:18:34,000
Next slide.

226
00:18:34,940 --> 00:18:42,360
So I looked at the area, the specific area in Joe's Sandbox, and I found wherefault.

227
00:18:42,360 --> 00:18:43,840
Wherefault was the culprit.

228
00:18:43,840 --> 00:18:46,760
And I had a hash of wherefault.

229
00:18:46,820 --> 00:18:52,460
And so I threw that in a various total, and it looks like it's a legitimate service.

230
00:18:53,120 --> 00:18:55,020
So this is interesting.

231
00:18:55,020 --> 00:18:58,580
It looks like that one is being used for DLL side loading.

232
00:18:58,580 --> 00:19:00,880
Next slide.

233
00:19:00,880 --> 00:19:04,760
Next we have privilege escalation.

234
00:19:04,760 --> 00:19:07,660
So we have... slide after that, please.

235
00:19:08,460 --> 00:19:12,120
So now we have DLL side loading again.

236
00:19:12,400 --> 00:19:15,100
Next slide as well.

237
00:19:15,700 --> 00:19:18,640
And then we also have process injection.

238
00:19:18,720 --> 00:19:26,120
And so there is an atomic red team for this, and I put the command line argument there for that.

239
00:19:26,120 --> 00:19:27,560
Next slide.

240
00:19:27,560 --> 00:19:33,260
There was a ton of defense evasion with this particular sample of Hawkeye.

241
00:19:33,260 --> 00:19:43,480
Everything from invalid code signing to software packing to sandbox evasion to obfuscating files.

242
00:19:43,480 --> 00:19:45,200
Next slide, please.

243
00:19:47,540 --> 00:19:53,420
So what I did is I tried to pick the one... the previous slide, please.

244
00:19:53,420 --> 00:20:03,980
I tried to pick stuff out of the defense evasion that I think red teamers and blue and all of that could be able to take advantage of, essentially.

245
00:20:03,980 --> 00:20:06,140
And so one of them was masquerading.

246
00:20:06,200 --> 00:20:11,280
This sample created files inside the actual user directory.

247
00:20:11,360 --> 00:20:17,240
And so I put the location of what was being created and what it was called and all of that.

248
00:20:17,240 --> 00:20:20,560
And there are a ton of tests for atomic red teams.

249
00:20:20,560 --> 00:20:24,960
So you can just pull the commands out of that that make sense that fit with this.

250
00:20:24,960 --> 00:20:26,000
Next slide, please.

251
00:20:26,580 --> 00:20:33,100
So the next one is modify registry, and it stores a large binary data to the registry.

252
00:20:33,100 --> 00:20:41,340
And I put the registry key that was changed or modified along with what it looked like.

253
00:20:41,340 --> 00:20:48,940
I know that there's stuff that could potentially... I'm sure red teamers are like, hmm, I know what that is.

254
00:20:49,820 --> 00:20:52,160
Next slide, please.

255
00:20:53,020 --> 00:20:57,140
The next one is hidden files and directories.

256
00:20:57,140 --> 00:21:06,300
I couldn't find an atomic red team test specifically for this one for changing Windows Explorer.

257
00:21:06,300 --> 00:21:10,720
But I did put the key value that was changed.

258
00:21:10,720 --> 00:21:12,140
Next slide, please.

259
00:21:13,780 --> 00:21:17,900
So this one is my educated guess.

260
00:21:17,900 --> 00:21:27,060
So in the detailed part of the sandbox report, it says that it contains functionality to read the PEB.

261
00:21:27,060 --> 00:21:34,360
So from a little bit of exploit dev reading, essentially, you know, you can create shellcode.

262
00:21:34,360 --> 00:21:44,380
You know this to walk through the PEB, the process environment block in order to find the address of kernel 32 DLL.

263
00:21:44,380 --> 00:21:49,640
And so I made an educated guess that that's what the shellcode was about.

264
00:21:49,640 --> 00:21:51,340
Next slide.

265
00:21:51,500 --> 00:21:54,880
Next one is credentialed access.

266
00:21:54,920 --> 00:22:05,320
So I put in here all the different files that were accessed and stolen from this particular sample.

267
00:22:05,440 --> 00:22:07,840
And there is an atomic test for it.

268
00:22:07,840 --> 00:22:09,200
Next slide.

269
00:22:09,200 --> 00:22:11,540
Next one is discovery.

270
00:22:11,800 --> 00:22:15,820
And this one queries a list of running processes.

271
00:22:15,820 --> 00:22:22,560
And there is an atomic test for it next or atomic commands that you can take out and put into whatever you use.

272
00:22:22,560 --> 00:22:25,280
The next one, remote system discovery.

273
00:22:25,480 --> 00:22:28,920
There is an atomic test available for this one as well.

274
00:22:28,920 --> 00:22:35,540
And it kind of tells you where to go and what's going on, what's reading and stuff like that.

275
00:22:35,540 --> 00:22:37,300
The next one, please.

276
00:22:38,100 --> 00:22:39,840
System info discovery.

277
00:22:39,840 --> 00:22:48,060
I put the key, the registry key that was queried in there for the particular emulation.

278
00:22:48,060 --> 00:22:50,320
And there is an atomic test for this.

279
00:22:50,380 --> 00:22:51,280
Next slide.

280
00:22:52,540 --> 00:22:54,000
Lateral movement.

281
00:22:54,140 --> 00:22:57,640
The only thing that I can talk about... previous slide, please.

282
00:22:57,820 --> 00:23:05,540
The only thing that I can talk about... the only thing that I can talk about regarding this is that it replicates via USB.

283
00:23:05,540 --> 00:23:06,920
Next slide.

284
00:23:07,480 --> 00:23:15,160
So, collection... it steals data from the local system, which is T1005.

285
00:23:15,160 --> 00:23:17,860
There is also key logging as well with this.

286
00:23:17,860 --> 00:23:23,440
And there are atomic red team commands available for this for you to extract.

287
00:23:23,440 --> 00:23:24,620
Next slide, please.

288
00:23:24,620 --> 00:23:28,940
And it also extracts and archives the collected data.

289
00:23:28,940 --> 00:23:36,120
So, my educated guess on this is that it compresses or encrypts the data prior to exfil.

290
00:23:36,120 --> 00:23:39,040
So, that is a good behavior to include as well.

291
00:23:39,040 --> 00:23:43,560
And there is an atomic red team test with a dependency on PowerShell.

292
00:23:43,560 --> 00:23:45,140
Next slide, please.

293
00:23:45,680 --> 00:23:48,340
It does grab your clipboard data.

294
00:23:48,340 --> 00:23:50,460
And there is an atomic test available.

295
00:23:50,460 --> 00:23:51,500
Next slide.

296
00:23:53,540 --> 00:23:55,400
Local email collection.

297
00:23:55,400 --> 00:24:00,180
It shows all the different files where the information was harvested, essentially.

298
00:24:00,180 --> 00:24:02,700
And there is an atomic test for this one.

299
00:24:02,700 --> 00:24:03,720
Next slide, please.

300
00:24:04,460 --> 00:24:05,620
Okay, C2.

301
00:24:05,620 --> 00:24:06,520
Next slide.

302
00:24:06,520 --> 00:24:16,320
Here is the various things that were associated with C2 from an encrypted channel and non-application layer protocol.

303
00:24:16,320 --> 00:24:19,700
And there are atomic tests available.

304
00:24:19,700 --> 00:24:20,780
Next slide.

305
00:24:21,720 --> 00:24:28,300
And the thing that I would recommend when you are building this out and looking at the C2 is the C2 matrix.

306
00:24:28,560 --> 00:24:34,980
So, you can see right here the various functionalities that all of these different C2s...

307
00:24:35,300 --> 00:24:37,620
I think they said that they were at 53 now.

308
00:24:37,620 --> 00:24:38,680
There is a ton.

309
00:24:38,680 --> 00:24:40,560
And there is a Black Hat talk on it.

310
00:24:41,000 --> 00:24:43,320
Black Hat Arsenal talk on it.

311
00:24:43,360 --> 00:24:45,800
And Jorge Artiles talks on it a lot.

312
00:24:45,800 --> 00:24:50,080
So, he can definitely give you a ton of information about it.

313
00:24:50,720 --> 00:24:52,400
C2matrix.com.

314
00:24:52,480 --> 00:24:56,640
And use that to pick your C2 that matches with the capabilities.

315
00:24:56,640 --> 00:24:57,600
Next slide.

316
00:24:58,840 --> 00:25:00,540
So, exfiltration.

317
00:25:00,540 --> 00:25:05,980
I just took that the data is compressed or encrypted.

318
00:25:05,980 --> 00:25:07,080
Next slide.

319
00:25:08,140 --> 00:25:09,120
So, impact.

320
00:25:09,120 --> 00:25:14,240
There really doesn't seem to be a crazy amount of impact like there would be with ransomware.

321
00:25:14,740 --> 00:25:16,180
You know, they steal creds.

322
00:25:16,180 --> 00:25:16,940
Use them later.

323
00:25:16,940 --> 00:25:17,820
Sell them.

324
00:25:17,820 --> 00:25:20,700
Who knows what this particular actor is doing.

325
00:25:21,100 --> 00:25:23,660
So, now I'm going to add some extra context.

326
00:25:23,740 --> 00:25:24,760
Next slide, please.

327
00:25:24,760 --> 00:25:28,340
So, I looked at the Yara rule specifically in Malware Bazaar.

328
00:25:28,340 --> 00:25:31,220
And I saw that it was kind of... it was really active.

329
00:25:31,220 --> 00:25:33,480
Like, it was still getting a lot of samples.

330
00:25:33,480 --> 00:25:34,760
So, not stale.

331
00:25:34,760 --> 00:25:35,980
Next slide, please.

332
00:25:37,760 --> 00:25:38,860
And you'll see...

333
00:25:39,440 --> 00:25:41,140
So, I went to Malware Bazaar.

334
00:25:41,140 --> 00:25:42,220
And then I pivoted out.

335
00:25:42,220 --> 00:25:43,700
Looked at the Yara rule.

336
00:25:43,700 --> 00:25:47,780
And then I looked at the Joe Sandbox command line.

337
00:25:47,780 --> 00:25:52,800
And I saw that this particular Yara rule that was still alerting was from 2015.

338
00:25:52,800 --> 00:25:57,640
And they were still using the same string in the command line.

339
00:25:57,640 --> 00:26:03,100
So, I'm like, oh, that would be really great to include in adversary emulation exercises.

340
00:26:03,300 --> 00:26:06,920
Since it's been pretty consistent for about five years.

341
00:26:07,000 --> 00:26:08,200
Next slide, please.

342
00:26:10,300 --> 00:26:14,180
So, with this, the HTTP traffic doesn't have a header.

343
00:26:14,180 --> 00:26:23,160
And then I put where files, some files that were written, and the process tree for additional context.

344
00:26:23,160 --> 00:26:24,360
Next slide, please.

345
00:26:24,360 --> 00:26:26,880
It also dropped 11 files.

346
00:26:26,880 --> 00:26:30,600
And I put all the different files that were dropped in the different folders.

347
00:26:30,600 --> 00:26:32,040
Next slide, please.

348
00:26:32,980 --> 00:26:34,660
Other characteristics.

349
00:26:34,800 --> 00:26:38,860
Queries connects over DNS, over HTTPS.

350
00:26:39,160 --> 00:26:44,040
The thing that was interesting to me is that it used port 0 for listening.

351
00:26:44,890 --> 00:26:50,300
And then, you know, injection with create remote thread.

352
00:26:50,300 --> 00:26:57,160
So, that sounds like something red team would be interested in knowing that this particular thing does.

353
00:26:57,380 --> 00:26:59,240
So, next slide, please.

354
00:26:59,340 --> 00:27:07,800
So, basically, I mean, I got someone's throwaway malware sample that they didn't really care about.

355
00:27:07,800 --> 00:27:09,200
That was blocked.

356
00:27:09,200 --> 00:27:12,060
And I was able to extract all that information.

357
00:27:12,060 --> 00:27:30,340
Find out, you know, it was, it used a Nigerian infrastructure from a Nigerian, I'm assuming, compromised company to send, you know, invoices to the particular organization.

358
00:27:30,340 --> 00:27:38,900
And built out a thing that they could use to test their defenses regarding adversary emulation exercises.

359
00:27:38,900 --> 00:27:46,580
And this was all just from pivoting between multiple sandbox reports and some of my own analysis as well.

360
00:27:46,580 --> 00:27:48,460
Not all of it was from Joe's sandbox.

361
00:27:48,460 --> 00:27:51,960
I also included some from Kate's sandbox as well.

362
00:27:51,960 --> 00:27:56,300
And then, me just looking over the sandbox results as well.

363
00:27:56,300 --> 00:27:57,640
Next slide, please.

364
00:27:58,980 --> 00:28:06,200
Finally, so what you can do if you decide you want to move forward with this is the purple team exercise framework.

365
00:28:06,200 --> 00:28:09,440
Jorge Archiles talks about this.

366
00:28:09,440 --> 00:28:11,360
He just released it through Scythe.

367
00:28:11,360 --> 00:28:13,880
It's free and available to the community.

368
00:28:14,140 --> 00:28:26,760
And it gives you a really good framework in order to be able to process this and to move forward with a purple team exercise.

369
00:28:26,760 --> 00:28:28,040
Next slide, please.

370
00:28:30,140 --> 00:28:37,040
And CyberWardog, he did a blog post about tracking the hunt team.

371
00:28:37,380 --> 00:28:42,320
And so, what I was thinking is that you could do the same thing for purple.

372
00:28:42,320 --> 00:28:54,300
And essentially, like track over time and present to your manager or upper management or whomever, like the various TTPs that you've been testing over time.

373
00:28:54,420 --> 00:28:57,000
And your coverage with it.

374
00:28:57,000 --> 00:29:04,320
Or, you know, for just throwing out random ideas, right?

375
00:29:04,320 --> 00:29:14,280
So, you can also use it to track the kind of activity that you're getting from the various malicious items that are being sent to your organization.

376
00:29:14,280 --> 00:29:22,080
So, for Nigerian infrastructure, you know, you're like, huh, okay, so they're using these general TTPs.

377
00:29:22,100 --> 00:29:24,100
And here's our coverage for it.

378
00:29:24,100 --> 00:29:25,740
Here's what we've tested.

379
00:29:25,740 --> 00:29:30,820
And basically, the manager can just sit there over time and look at the colors change.

380
00:29:31,440 --> 00:29:33,940
So, that would be helpful.

381
00:29:34,720 --> 00:29:39,740
But as a CTI analyst, like, I'm not a red teamer.

382
00:29:39,740 --> 00:29:48,620
Like, I honestly don't know the commands, whether or not they're right or not, without testing all of them and how to go forward with this.

383
00:29:48,620 --> 00:29:51,360
So, this is where the easy button comes in.

384
00:29:51,360 --> 00:29:55,760
And I'm going to hand off the presentation to my co-speaker.

385
00:29:56,560 --> 00:29:57,600
Hi, everyone.

386
00:29:57,600 --> 00:29:58,880
My name's Hayden.

387
00:29:58,880 --> 00:30:02,580
I was just listening to you and thinking it was amazing this talk, Thierry.

388
00:30:02,580 --> 00:30:06,140
Thank you for inviting me to co-talk with you.

389
00:30:06,140 --> 00:30:10,640
So, Thierry was talking about cyber threat intelligence, adversary emulation, purple teaming.

390
00:30:10,640 --> 00:30:15,560
And what's happened is that we both were talking back and forwards.

391
00:30:15,560 --> 00:30:20,900
I've been a cyber threat intelligence analyst six months ago or years ago for six months.

392
00:30:20,900 --> 00:30:29,220
And what happened was I would use to copy and paste indicators such as IP addresses and domains from a report, throw it through ArcSight.

393
00:30:29,420 --> 00:30:33,560
So, Thierry was telling me she wants to make it easier for cyber threat intel analysts.

394
00:30:33,560 --> 00:30:36,800
So, I started to was into coding and learning Golang.

395
00:30:36,800 --> 00:30:39,440
So, I came up with emulate.go.

396
00:30:39,440 --> 00:30:52,240
Now, the problem that we were identifying, well, not a problem, but the concern we had with C2 tools such as PowerShell Empire or many of the others is that they can have a steep learning curve.

397
00:30:52,240 --> 00:30:55,260
And you need a really deep technical understanding.

398
00:30:55,340 --> 00:30:57,600
They can require a lot of dependencies.

399
00:30:57,760 --> 00:31:04,840
And they can require a bit of a setup as well to get your same interpreter payload working or things like that.

400
00:31:04,840 --> 00:31:07,840
So, most of them can be extremely complex.

401
00:31:07,840 --> 00:31:18,780
And we wanted to abstract that away and focus on cyber threat intelligence of initial access and creating it that way.

402
00:31:18,780 --> 00:31:28,680
So, the goal was to lower the bar of entry for adversary emulation, abstract away the technicality, focus on initial access, and help people learn.

403
00:31:28,680 --> 00:31:31,880
Adversary emulation in Purple Team can be quite advanced.

404
00:31:31,880 --> 00:31:43,260
But ultimately, when you get down to it, it's attempting an attack or building an exercise for attack, executing it, and seeing if you detected it or missed it, and then fine-tuning it.

405
00:31:43,440 --> 00:31:45,160
So, that's what we were doing.

406
00:31:45,420 --> 00:31:49,360
The solution was a client-server implementation.

407
00:31:49,360 --> 00:31:57,120
It doesn't have a command line GUI as advanced as Metasploit or Red Team Atomic Framework or anything like that.

408
00:31:57,120 --> 00:31:59,160
It doesn't have any payloads or modules.

409
00:31:59,160 --> 00:32:00,500
It doesn't have dependencies.

410
00:32:00,500 --> 00:32:02,000
It is written in Go.

411
00:32:02,000 --> 00:32:06,000
So, if you want to run the Go file, you obviously have to install Go.

412
00:32:06,060 --> 00:32:07,940
I think it's been easy to use.

413
00:32:07,940 --> 00:32:10,320
I made some obvious command line arguments.

414
00:32:10,760 --> 00:32:17,840
It's limited to two things, running execution manually and a list of commands.

415
00:32:17,840 --> 00:32:19,800
So, you can say, who am I?

416
00:32:19,800 --> 00:32:23,260
You can do a regedit, but you have to manually do it or put it in a file.

417
00:32:23,460 --> 00:32:26,540
And then there's basic logging into JSON format.

418
00:32:26,540 --> 00:32:28,620
So, let's continue.

419
00:32:28,620 --> 00:32:37,180
The basic C2 infrastructure for command and control is, obviously, the admin sits in the cloud and then it connects to the infected machine.

420
00:32:37,180 --> 00:32:39,260
So, I was like, okay, let's do that.

421
00:32:39,260 --> 00:32:53,620
But with adversary emulation, I really wanted to allow CTI analysts or people who are learning to also test their environment on lateral movement or if one or more systems are infected.

422
00:32:53,620 --> 00:32:56,620
So, the parent proxy mode sits in the middle.

423
00:32:56,700 --> 00:32:59,860
It receives the commands and forwards them to the child.

424
00:33:00,220 --> 00:33:02,420
And that way, it's sort of like a daisy chain.

425
00:33:02,420 --> 00:33:06,980
And it just adds a little bit more complexity or functionality for testing.

426
00:33:07,980 --> 00:33:12,700
So, again, the modes as any C2 tool are, is it has an admin interface.

427
00:33:12,700 --> 00:33:18,120
It runs in the cloud or it pretends to be an external attacker.

428
00:33:18,240 --> 00:33:23,040
The parent mode, obviously, proxies the commands back and forwards, but you don't have to use it.

429
00:33:23,040 --> 00:33:28,820
The client mode receives the commands from either the admin or parent and executes them.

430
00:33:28,820 --> 00:33:29,900
Pretty simple.

431
00:33:29,900 --> 00:33:38,820
So, we tried to abstract away everything and help people or even CTI analysts sort of be more beneficial to an adversary emulation.

432
00:33:39,080 --> 00:33:47,400
So, the two types of modes I mentioned before is on the left, the normal one, you type host name, who am I, and you can see my machine hidden local.

433
00:33:47,400 --> 00:33:55,480
The list one, you just supply a file with a list of commands and it will just run through them automatically and send the results back.

434
00:33:55,480 --> 00:33:56,900
So, nice and easy.

435
00:33:58,180 --> 00:34:09,400
And the dash log is just into a JSON format with the timestamp of command execution, the command that was executed or requested, and then the results.

436
00:34:09,400 --> 00:34:20,680
So , this just allows you as someone, if you're at home or in your org, that if you have 100 commands or you execute them and try the next day, you have timestamps to correlate in your detection tools.

437
00:34:22,680 --> 00:34:26,700
So, with my tool, I wanted to add TLS.

438
00:34:26,700 --> 00:34:32,600
The reason being is that when you're emulating an adversary, they probably don't use clear text.

439
00:34:32,740 --> 00:34:36,840
And I didn't, I was trying to think of things that would get in the way of testing.

440
00:34:36,840 --> 00:34:48,820
And if you have a command control tool reaching outside your network, your IPS or something in the cloud, whichever detection tool you have is going to trigger an alert and most probably block it.

441
00:34:49,000 --> 00:34:53,960
So, I added some certificates and I was playing with Go and got it working.

442
00:34:54,160 --> 00:34:59,300
And I sort of cheated a bit because the idea is to abstract away some of the complexity.

443
00:34:59,300 --> 00:35:06,380
So, I didn't want anyone to have to build their own certificates, the X509, the key, the product key, stuff like that.

444
00:35:06,380 --> 00:35:10,320
So, what I did is I included it in the files.

445
00:35:10,380 --> 00:35:13,880
And when you build them, they're included in the executable or the binaries.

446
00:35:14,280 --> 00:35:18,980
And then I marked it as insecure skip verifier, which means that it skips the verification.

447
00:35:19,020 --> 00:35:21,800
Because TLS is meant to be tied to a domain.

448
00:35:22,280 --> 00:35:28,760
And obviously, if you're putting on different boxes, you're putting in the cloud, you don't want to have to generate a certificate all the time.

449
00:35:28,760 --> 00:35:30,740
So, this was just to help make it easier.

450
00:35:30,740 --> 00:35:37,400
So, regarding encryption, if you don't know, the clear text version is on the left.

451
00:35:37,400 --> 00:35:41,720
And you can see the command being recorded over the network in clear text.

452
00:35:41,720 --> 00:35:43,600
And TLS gobbles it.

453
00:35:43,600 --> 00:35:47,180
So , it's version 1.3, which I was lucky with, I guess.

454
00:35:47,520 --> 00:35:55,460
And then because the tool prints to the screen in all three different modes, malware wouldn't print to the screen.

455
00:35:55,460 --> 00:35:59,320
It's great for learning, but it's not so much great for emulation.

456
00:35:59,320 --> 00:36:04,840
And I didn't want people detecting the print to the screen or printing to the terminal.

457
00:36:05,080 --> 00:36:08,520
So, I wanted you to be able to silence it, and then it would just go blank.

458
00:36:08,520 --> 00:36:10,700
And you wouldn't see anything printed to the screen.

459
00:36:10,700 --> 00:36:12,020
So, that was my thinking.

460
00:36:12,920 --> 00:36:15,180
I did add a pause function.

461
00:36:15,180 --> 00:36:21,460
So, in the bottom left here, you can just see that it shows the options running in clear text or logging as on and off.

462
00:36:21,720 --> 00:36:26,000
And I mostly did that to only script kitties, just because, why not?

463
00:36:26,000 --> 00:36:28,680
In addition to just letting you see the options.

464
00:36:28,680 --> 00:36:32,640
And then if you do the dash skip, you can skip this bit.

465
00:36:32,640 --> 00:36:36,800
And it will just run through automatically, so you can run it quickly.

466
00:36:36,940 --> 00:36:39,920
So, I recorded some demos of this.

467
00:36:39,920 --> 00:36:45,460
I wanted to show all the different modes, list and normal, and then the TLS demonstration.

468
00:36:45,620 --> 00:36:53,920
And then I also wanted to show a registry edit with BlueSpawn, which is an open source EDR, and a scheduled task execution.

469
00:36:54,060 --> 00:36:55,940
So, let's get to that.

470
00:36:58,090 --> 00:36:59,830
I will drag it over here.

471
00:36:59,830 --> 00:37:02,430
See, I have them all in my folder recorded, ready to go.

472
00:37:02,430 --> 00:37:05,170
So, I didn't have any technical issues.

473
00:37:05,190 --> 00:37:08,810
The thing here is that it's just a host name in the cloud called Ubuntu.

474
00:37:08,890 --> 00:37:10,790
And then I set up a lab.

475
00:37:10,790 --> 00:37:12,630
So, this is a domain controller.

476
00:37:13,110 --> 00:37:18,570
So, I have the emulate and the executable on Linux, because I was moving over to the Windows file.

477
00:37:18,690 --> 00:37:21,470
But it's just ./.emulate.

478
00:37:21,470 --> 00:37:22,830
The mode is admin.

479
00:37:22,950 --> 00:37:25,050
And then you choose the listening port.

480
00:37:25,210 --> 00:37:26,910
Listening IP address and port.

481
00:37:26,910 --> 00:37:28,370
So, it's just 8.8.8.8.

482
00:37:28,370 --> 00:37:29,990
The options are on the left.

483
00:37:29,990 --> 00:37:31,430
You've got your TLS, none.

484
00:37:31,430 --> 00:37:32,490
Logging, none.

485
00:37:32,490 --> 00:37:33,470
Pause, none.

486
00:37:33,470 --> 00:37:37,670
And then it even tells you where to connect the client to.

487
00:37:38,270 --> 00:37:42,390
So, when you run the executable, you actually choose client mode.

488
00:37:42,390 --> 00:37:47,310
And then you do client connect with the same IP address and the same ports.

489
00:37:47,390 --> 00:37:49,950
And it should just connect nice and easily.

490
00:37:50,030 --> 00:37:55,710
And you don't have to worry about making sure you've done it right.

491
00:37:55,710 --> 00:37:56,690
Yep.

492
00:37:56,690 --> 00:37:58,270
And it just works like that.

493
00:37:58,330 --> 00:38:01,070
And then you can enter who am I or a host name.

494
00:38:01,070 --> 00:38:03,390
Just a nice demo to show it working.

495
00:38:03,590 --> 00:38:07,810
And then it prints to the screen on the client side so that you know it's working correctly.

496
00:38:07,910 --> 00:38:11,250
And what results it's giving.

497
00:38:11,950 --> 00:38:14,750
And then this is why I put silence in.

498
00:38:14,750 --> 00:38:20,450
Just so that when the client executes, it doesn't detect I'm printing to the screen.

499
00:38:20,450 --> 00:38:22,170
Because that would be rather embarrassing.

500
00:38:23,470 --> 00:38:26,190
So, the admin list works this way.

501
00:38:26,190 --> 00:38:27,590
The same way.

502
00:38:28,310 --> 00:38:29,870
So, we do dot emulate.

503
00:38:29,870 --> 00:38:31,670
The mode is admin list.

504
00:38:31,670 --> 00:38:35,090
You supply the port and IP with the dash listen again.

505
00:38:35,710 --> 00:38:38,110
And my typing is really slow.

506
00:38:38,170 --> 00:38:41,270
And then you just do the dash commands with the file.

507
00:38:41,270 --> 00:38:43,170
So, it would be commando dot text.

508
00:38:43,170 --> 00:38:46,010
And we're attempting to launch it in admin list mode.

509
00:38:46,870 --> 00:38:49,050
So, on the client is the same.

510
00:38:49,050 --> 00:38:50,830
But you do client list mode.

511
00:38:52,030 --> 00:38:55,470
And then you do the IP address and port.

512
00:38:56,110 --> 00:39:01,650
So, what happens is when you run it, it should automatically execute it like that.

513
00:39:02,290 --> 00:39:07,070
So, we just ran whoamihostnamepowershell.exe OS.

514
00:39:07,070 --> 00:39:08,350
Not advanced commands.

515
00:39:08,350 --> 00:39:09,390
It's just a demo.

516
00:39:09,390 --> 00:39:12,150
And to help you guys see the tool in motion.

517
00:39:12,630 --> 00:39:14,310
So, that's how it works.

518
00:39:14,530 --> 00:39:17,970
Let me close Windows Media Player.

519
00:39:18,430 --> 00:39:20,450
The parent mode is pretty cool.

520
00:39:20,450 --> 00:39:22,070
Or at least I think it's pretty cool.

521
00:39:22,070 --> 00:39:24,970
So, here I've got Ubuntu on the left.

522
00:39:25,230 --> 00:39:27,830
I've got two Windows PowerShells open.

523
00:39:28,450 --> 00:39:32,410
And then I'm just using the admin dash listen mode in port 999.

524
00:39:32,530 --> 00:39:35,090
And then I'm just using dash parent mode.

525
00:39:35,090 --> 00:39:37,010
And then the flags are pretty simple.

526
00:39:37,010 --> 00:39:38,870
So , it's dot parent connect.

527
00:39:38,870 --> 00:39:40,510
Where is the parent going to connect to?

528
00:39:40,510 --> 00:39:41,870
It's the admin server.

529
00:39:42,010 --> 00:39:46,810
And then dash parent listen is what port is it going to listen on?

530
00:39:46,850 --> 00:39:47,670
So, it makes sense.

531
00:39:47,670 --> 00:39:48,530
Nice and easy.

532
00:39:48,530 --> 00:39:49,930
And then emulate dot exe.

533
00:39:49,930 --> 00:39:51,150
The mode is client.

534
00:39:51,150 --> 00:39:53,970
Client connect connects to the parent.

535
00:39:54,110 --> 00:39:56,350
And then it just forwards the commands through.

536
00:39:56,470 --> 00:39:59,030
So, when you're in your org or you're learning at home.

537
00:39:59,030 --> 00:40:01,230
You can do more than one machine.

538
00:40:01,370 --> 00:40:02,710
Which is pretty cool.

539
00:40:02,710 --> 00:40:04,770
And here I typed netstat incorrectly.

540
00:40:04,770 --> 00:40:07,150
That's why it doesn't quite work.

541
00:40:09,840 --> 00:40:11,060
And yeah, there you go.

542
00:40:13,320 --> 00:40:17,040
So, the basic logging format, again, is in JSON.

543
00:40:17,040 --> 00:40:18,540
So, if I skip through.

544
00:40:18,860 --> 00:40:20,980
I've just done admin list.

545
00:40:20,980 --> 00:40:23,760
The listen with the IP address and port again.

546
00:40:23,840 --> 00:40:24,900
The dash command.

547
00:40:24,900 --> 00:40:26,960
Because we're going to execute in command.

548
00:40:27,360 --> 00:40:29,940
And then dash log with the name emulog.

549
00:40:29,940 --> 00:40:32,440
Which will create emulog dot JSON.

550
00:40:32,480 --> 00:40:33,680
Simple as that.

551
00:40:33,680 --> 00:40:37,040
And then on the client mode, you don't have to do the logging.

552
00:40:37,040 --> 00:40:39,600
It's only the admin interface that logs.

553
00:40:39,600 --> 00:40:41,000
Which is more realistic.

554
00:40:41,000 --> 00:40:42,200
But I guess you could.

555
00:40:42,200 --> 00:40:46,040
I could build logging for the client if everyone demands it.

556
00:40:46,040 --> 00:40:46,940
Or if it's useful.

557
00:40:46,940 --> 00:40:49,540
But I thought just doing it on the admin was fine.

558
00:40:50,660 --> 00:40:56,220
And then if I skip through and you get the emulog dot JSON file, it's pretty ugly.

559
00:40:56,220 --> 00:40:57,360
It's just there.

560
00:40:57,360 --> 00:40:58,960
It's just basic JSON.

561
00:41:00,560 --> 00:41:02,680
I think that's it.

562
00:41:02,740 --> 00:41:06,440
If you put it in nano, it is actually in a JSON object.

563
00:41:06,440 --> 00:41:10,120
So, it's got the time, the command, and the output that it receives.

564
00:41:10,120 --> 00:41:14,060
So, that allows you to correlate between the different detection tools.

565
00:41:15,580 --> 00:41:18,720
The TLS option is pretty similar.

566
00:41:18,720 --> 00:41:20,680
You just add dash TLS.

567
00:41:20,800 --> 00:41:26,100
So, as you can see here, it's emulate dash mode admin dash listen.

568
00:41:26,100 --> 00:41:30,880
I did port 000 just to show that it can listen multiple interfaces.

569
00:41:30,940 --> 00:41:34,140
But dash TLS is really the important key here.

570
00:41:34,400 --> 00:41:38,160
And then on the client side, you also need to put dash TLS.

571
00:41:38,160 --> 00:41:39,680
Otherwise, the handshake won't work.

572
00:41:39,680 --> 00:41:43,400
It will think SSL on one end and non-SSL on the other.

573
00:41:44,240 --> 00:41:45,760
And then you run that.

574
00:41:45,760 --> 00:41:49,260
And I'm just using Wireshark to show that the encryption actually works.

575
00:41:49,260 --> 00:41:51,040
I'm not talking out my ass.

576
00:41:51,320 --> 00:41:53,700
But yeah, it does the client hello handshake.

577
00:41:53,700 --> 00:41:55,420
And you're off to the races.

578
00:41:55,420 --> 00:41:56,840
So, that's pretty cool.

579
00:41:57,900 --> 00:42:00,620
And it also works with PowerShell and that stuff.

580
00:42:02,220 --> 00:42:04,360
After it executes and runs through.

581
00:42:09,680 --> 00:42:12,900
This one is to show just some recon commands.

582
00:42:13,020 --> 00:42:17,320
So , Xena Oterio was giving me her research.

583
00:42:17,320 --> 00:42:20,780
And there was one that executed multiple recon commands.

584
00:42:20,780 --> 00:42:23,380
And one was even the WLAN export profile.

585
00:42:23,380 --> 00:42:27,780
But I left it in because I thought it would be funny being in AWS.

586
00:42:27,780 --> 00:42:31,060
It doesn't have a Wi-Fi profile.

587
00:42:31,340 --> 00:42:32,900
So, that's the file.

588
00:42:33,600 --> 00:42:34,780
You add it in.

589
00:42:34,780 --> 00:42:36,280
And the log name is advanced.

590
00:42:36,280 --> 00:42:39,160
And so, it will become advanced.json.

591
00:42:39,460 --> 00:42:43,200
And then I just already have it in the Windows CMD.

592
00:42:43,200 --> 00:42:44,520
It clicks through.

593
00:42:44,520 --> 00:42:45,620
It runs it.

594
00:42:45,620 --> 00:42:48,140
And it all logs to a JSON file.

595
00:42:48,220 --> 00:42:50,440
Even though it's quite a lot of output.

596
00:42:50,840 --> 00:42:55,840
And then I use jQuery just to see how it's ugly when you cap the file.

597
00:42:55,840 --> 00:42:57,000
Because it's JSON.

598
00:42:57,140 --> 00:43:00,180
But if you use jQuery, it's a little bit better formatted.

599
00:43:00,580 --> 00:43:02,620
You could probably clean it up a lot better.

600
00:43:02,620 --> 00:43:05,520
But it was just, I made it larger for the demo.

601
00:43:05,540 --> 00:43:09,000
And you can see that it executes CMD slash C.

602
00:43:09,180 --> 00:43:12,420
And then it creates the results.

603
00:43:15,440 --> 00:43:16,360
Close, close.

604
00:43:16,360 --> 00:43:16,680
All right.

605
00:43:16,680 --> 00:43:17,460
Cool.

606
00:43:19,220 --> 00:43:26,560
So, the research Xena gave me, there was a registry add command with environment CMD start.

607
00:43:26,560 --> 00:43:27,480
Things like that.

608
00:43:27,480 --> 00:43:35,960
I wanted to show a demo where this registry add can actually be tipped by an open source EDR called bluespawn.

609
00:43:35,960 --> 00:43:44,940
So, in an example of doing something real world, or in the effort to do so, we have it set up here.

610
00:43:44,940 --> 00:43:46,420
I'm listening on port 44.

611
00:43:46,460 --> 00:43:53,240
We're going to execute bluespawn, which is an open source EDR, to see if we can trip it.

612
00:43:53,240 --> 00:43:54,660
Or it detects something.

613
00:43:55,080 --> 00:43:58,020
So, then we're going to go into client mode with TLS.

614
00:43:58,720 --> 00:44:00,480
And then, as you can see, I'm admin one.

615
00:44:00,480 --> 00:44:02,700
Because that's the only way I could really execute.

616
00:44:03,160 --> 00:44:04,680
And then I copy paste.

617
00:44:04,680 --> 00:44:06,460
But I do this in PowerShell.

618
00:44:06,860 --> 00:44:09,100
Just because I felt like it.

619
00:44:13,390 --> 00:44:14,890
And then it goes through.

620
00:44:14,890 --> 00:44:17,810
It's reported as completing successfully.

621
00:44:18,630 --> 00:44:21,690
And you can see, even on the client, it shows you.

622
00:44:21,690 --> 00:44:28,870
And then when you go to bluespawn, you can see the MITRE technique, T1183, and the registry edit.

623
00:44:28,970 --> 00:44:31,330
So, this was actually from some training.

624
00:44:31,430 --> 00:44:35,930
I did this regedit, and they did a demo with bluespawn.

625
00:44:35,930 --> 00:44:44,050
I thought it would be great to show everyone how the tool can be used in the idea of adversary emulation.

626
00:44:44,910 --> 00:44:51,710
Now, the next one we wanted to show was a scheduled task slash job, which is T1053 in the MITRE framework.

627
00:44:51,990 --> 00:44:56,390
And this was from Cape Sandbox 32597.

628
00:44:56,690 --> 00:44:59,930
So, it's scheduled tasks, and it creates...

629
00:45:00,790 --> 00:45:03,250
Scheduled tasks, it executes when someone logs on.

630
00:45:03,250 --> 00:45:04,990
So, it's a typical persistence mechanism.