WEBVTT 00:00.860 --> 00:03.420 I don't like when they play it, but whatever. 00:06.860 --> 00:09.060 Okay, we are live. 00:11.730 --> 00:21.290 Hi everyone, thanks for coming to Indicators of Emulation Extra Spicy Adversary Emulation. 00:21.510 --> 00:25.170 And we will just get started and go at it. 00:25.170 --> 00:28.110 And really quick, next slide please. 00:31.100 --> 00:34.980 Before I say anything, I have to do this for the lawyers. 00:34.980 --> 00:40.320 And say that any opinions and anything that I say or do is just me. 00:40.320 --> 00:43.680 And I'm not representing my company at all. 00:43.780 --> 00:46.240 It's in an individual capacity. 00:46.500 --> 00:52.480 And not the views of my employer, not the views of his employer, period. 00:52.740 --> 00:54.180 Yeah, that goes for me as well. 00:54.700 --> 00:58.320 Yeah, we both have our lawyer disclaimers. 00:58.760 --> 01:02.260 So I'm going to start with a little bit of story time. 01:02.260 --> 01:05.140 Back at B-Side Chicago. 01:06.420 --> 01:08.020 Okay, there we go. 01:08.020 --> 01:12.840 Back at B-Side Chicago 2019, Matt Kelly did a really great talk. 01:12.840 --> 01:18.600 And it was called Threat Emulation Adversary Focused Red Teams. 01:18.620 --> 01:24.720 And in it, he got me thinking about how CTI can benefit RED. 01:24.720 --> 01:25.800 All things RED. 01:25.800 --> 01:28.940 Adversary Emulation, Perp Team, all of that. 01:28.940 --> 01:33.400 And so, you know, I'm working on a doctorate at Marymount University. 01:33.400 --> 01:39.020 And I decided to incorporate the thing that I'm curious about into my research. 01:39.100 --> 01:43.620 And conducting, you know, reading tons of articles and all of that. 01:43.620 --> 01:49.880 I came to the kind of conclusion that there's really minimal information out there. 01:49.880 --> 01:54.360 As far as like the practice of CTI applied towards RED teaming. 01:54.360 --> 01:58.120 It seems more focused on BLUE team stuff. 01:58.120 --> 02:05.820 Like extracting indicators of compromise, IOCs, and helping defenders defend the organization. 02:05.820 --> 02:08.920 And so, of course, there's Atomic RED team and all of that. 02:08.920 --> 02:12.420 I'm talking specifically about the trade practice CTI. 02:12.420 --> 02:16.240 Traditionally, it's for BLUE and not necessarily RED. 02:16.400 --> 02:18.800 So, fast forward a little bit. 02:18.800 --> 02:23.820 And I got curious about Bryson Bort and Sai's marketplace. 02:23.820 --> 02:34.220 And in it, basically, they are putting together something where people can build out capabilities for threat actors for organizations to use. 02:34.220 --> 02:36.920 And I thought, oh, my God, that sounds like so much fun. 02:36.920 --> 02:38.720 I kind of want to do it. 02:38.720 --> 02:42.260 And so, Bryson got me in touch with Adam Maschini. 02:42.260 --> 02:52.100 And Adam pointed out that basically, if you look at the threat Intel reports, they have commands and very, very detailed for Linux. 02:52.100 --> 02:55.160 But Windows, not so much. 02:55.180 --> 02:59.340 And that semester, I happened to be in a malware analysis course. 02:59.340 --> 03:04.760 And I'm like, hmm, maybe I can make this my project for the year. 03:04.780 --> 03:08.380 So, I decided, why not? 03:08.380 --> 03:10.560 Why not explore it a little bit further? 03:10.800 --> 03:13.640 So, I decided to take it on. 03:13.640 --> 03:16.340 And I was like, it will be easy. 03:16.340 --> 03:24.700 All I have to do is just enable command line logging and maybe some PowerShell as an extra, you know, thing. 03:24.880 --> 03:26.800 And it will be really easy. 03:26.800 --> 03:27.820 Not hard at all. 03:27.820 --> 03:29.740 Like, I already know where to get all the samples. 03:29.740 --> 03:31.580 There won't be any problems. 03:32.540 --> 03:33.580 Yeah. 03:34.160 --> 03:37.020 So, I got a VM from Windows. 03:37.020 --> 03:38.260 So, Windows 10. 03:38.260 --> 03:43.380 And then I enabled all the logging for the Windows command line and PowerShell. 03:43.380 --> 03:48.820 I used Michael Gao's, let's see, malware archaeology. 03:48.920 --> 03:52.200 And lots of Googling to make sure I had it all right. 03:52.280 --> 03:57.860 And believe it or not, disabling all of the security on Windows 10, like, holy, holy hell. 03:57.860 --> 04:02.700 Like, it was a lot of work to be able to just execute malware. 04:03.380 --> 04:08.400 With the infection rates, I was expecting it would be easy to just, you know, point and click. 04:08.400 --> 04:10.360 But I was wrong. 04:10.360 --> 04:13.000 So, I just want to do... 04:14.700 --> 04:16.140 Oh, next slide. 04:16.140 --> 04:17.680 A couple next slides. 04:23.280 --> 04:24.320 Back. 04:25.980 --> 04:27.160 Yes, that one. 04:27.160 --> 04:34.680 So, I just want to do a really brief shout out to Windows and Microsoft. 04:34.680 --> 04:36.620 And say, thank you so much. 04:36.620 --> 04:40.860 You've done a really good job at protecting us, everyone. 04:41.560 --> 04:45.220 He made it really hard for me to click and point. 04:45.220 --> 04:48.220 And it required a lot of disabling. 04:48.400 --> 04:49.600 Next slide, please. 04:50.820 --> 04:52.720 So, these are the results. 04:52.720 --> 04:57.820 What I did is I wanted to create a baseline since it was for an actual doctoral class. 04:57.820 --> 05:02.660 So, I had to have some sort of methodology behind it to be able to explain. 05:02.940 --> 05:07.780 So, when you look over the command line logging, it's a little... 05:07.780 --> 05:11.420 It can get a little confusing because stuff goes on. 05:11.420 --> 05:18.420 And before I introduce malware, I wanted to make sure that I understood what the heck was going on first. 05:18.420 --> 05:23.800 So, I wanted to create a control that I knew was not malicious and doing weird stuff. 05:23.800 --> 05:26.840 And before I introduce the craziness. 05:26.920 --> 05:28.880 So, there are three options. 05:28.880 --> 05:32.020 One is issuing the commands yourself, which I did. 05:32.100 --> 05:35.040 The next one was Atomic Red Team. 05:35.040 --> 05:37.840 So, I used Atomic Red Team, installed it. 05:37.840 --> 05:40.760 Shout out to the Atomic Red Team crew. 05:41.040 --> 05:42.520 It was so easy. 05:42.520 --> 05:44.460 I just followed the instructions. 05:44.600 --> 05:51.680 And I was able to get it up and running and done and tested in almost no time. 05:51.680 --> 05:54.460 It was ridiculous how easy it was. 05:54.560 --> 05:57.760 And then finally was testing malware. 05:58.000 --> 06:01.840 So, I created a test malware, I call it. 06:01.840 --> 06:04.380 It just pops calc, essentially. 06:04.380 --> 06:07.480 I compiled a C++ binary. 06:07.820 --> 06:17.100 And I used Sector 7's Red Team Operator malware dev course to, I guess, learn how to compile C++ binaries. 06:17.100 --> 06:18.540 So, that was fun. 06:18.540 --> 06:19.720 It was very benign. 06:19.720 --> 06:21.660 The code is right up there on the left-hand side. 06:21.660 --> 06:23.160 It just pops calc. 06:23.160 --> 06:33.140 And the other problem I had, if you can see on the right-hand side, all of the no's for command line arguments. 06:33.140 --> 06:35.900 I'm like, what the heck am I doing wrong? 06:36.300 --> 06:38.140 Why can't I figure this out? 06:38.140 --> 06:39.800 Why aren't these executing? 06:39.800 --> 06:45.800 I went to any run, I did hybrid analysis, malware bizarre, I pulled stuff from virus total. 06:46.560 --> 06:59.280 A fun story about that is someone at some place, which I won't name, I asked, hey, I'm having problems executing your samples. 06:59.280 --> 07:01.000 What am I doing wrong? 07:01.060 --> 07:04.700 I know with any run, you change the .bin to .exe. 07:05.660 --> 07:09.980 I even used the file command and checked that it was an executable. 07:09.980 --> 07:11.440 Different things, right? 07:11.900 --> 07:14.980 And they suggested I speak to Bleeping Computer. 07:14.980 --> 07:17.540 Obviously, I'm not going to do that. 07:18.420 --> 07:22.900 So there are multiple repositories for malware, and I decided, you know what? 07:22.940 --> 07:27.560 I'm having such a hard time with this, I'm just going to go direct to the source. 07:27.740 --> 07:37.580 So at URL House, the wonderful thing about that is that when they post fresh samples, they also include the URL. 07:37.580 --> 07:44.380 So with the new ones that they posted, I honestly, I just went to the attacker's domain and pulled the malware myself. 07:45.040 --> 07:47.640 I was safe, don't worry, I was safe. 07:48.420 --> 07:50.160 So next slide, please. 07:51.020 --> 07:54.880 So these are the results of when I pulled the malware myself. 07:54.880 --> 08:02.440 I ended up getting command line arguments, which was great, but there were still over half that I got nothing. 08:02.440 --> 08:04.800 And I'm like, what is going on? 08:04.800 --> 08:05.640 Is it me? 08:05.640 --> 08:07.000 Is it the malware? 08:07.000 --> 08:10.420 Like, what's wrong with this? 08:10.420 --> 08:11.760 Next slide, please. 08:13.240 --> 08:16.200 So I'm like, oh, there's static analysis, right? 08:16.200 --> 08:22.540 So I'll just download Ghidra and Ida, and I'll just fuss around with it and figure it out. 08:22.540 --> 08:25.720 And it was a little bit harder than that. 08:26.040 --> 08:43.120 I didn't really have the time because it was for a class project too, to sit down and learn all that anti-analysis, anti-VM, and all of that defensive Asian stuff as far as how to defeat it and step through and do that for multiple samples on scale. 08:43.120 --> 08:44.760 Like, I didn't have that time. 08:44.760 --> 08:46.680 I will in the future, possibly. 08:47.360 --> 08:51.260 And also to Joe Slowik, I don't know if you're familiar with him. 08:51.260 --> 08:53.240 He's like the meme master. 08:53.300 --> 08:58.720 He posted something recently where it was a guy drinking out of a cup of water. 08:58.860 --> 09:02.920 And he was like, here, he was like, is this how I drink water? 09:02.920 --> 09:06.700 You know, and like, not actually drinking from it. 09:06.700 --> 09:11.900 And that's how I felt like when I was working with Ghidra and Ida and all that stuff. 09:11.900 --> 09:16.620 So I'm like, whoa, I'm like, I just need to put this down for a second. 09:16.840 --> 09:18.060 Next slide, please. 09:19.640 --> 09:30.320 So at the DFIR Summit in 2020, this year, Mauer Archaeology himself, he was giving a talk, and I was able to talk to him about some of my problems. 09:30.320 --> 09:35.360 And he suggested that I just use a real computer. 09:35.360 --> 09:36.920 And I'm like, what? 09:36.920 --> 09:38.860 That's like crazy. 09:39.080 --> 09:46.940 I would never think to buy a cheap computer and execute it on there to bypass the VM stuff. 09:46.940 --> 09:49.760 So I was like, all right, let's do this. 09:49.760 --> 09:54.200 Like, I will fully commit to this, and I will buy these computers. 09:54.200 --> 09:57.300 So the first one I bought, it was dead on arrival. 09:57.620 --> 09:59.360 It did not work. 09:59.360 --> 10:01.800 And then the second one ended up working. 10:01.800 --> 10:03.320 And next slide, please. 10:05.940 --> 10:23.860 So these are the results of what I did is I grabbed a sample, and I wanted to get a good idea as far as what the different sandboxes gave me before I did my actual analysis on a real computer since, you know, whatever. 10:24.300 --> 10:27.560 And so on the left-hand corner, you see VirusTotal. 10:27.560 --> 10:32.160 And then on the upper part, you see Cape Sandbox, and then the bottom, Joe Sandbox. 10:32.160 --> 10:35.480 Joe Sandbox gave more in this instance. 10:35.480 --> 10:36.820 Next slide, please. 10:38.040 --> 10:42.140 And then this is the actual manual part of it. 10:42.140 --> 10:49.500 And it was about 75 pages worth of stuff that I collected from doing it manually. 10:49.800 --> 10:51.440 This is just some of them here. 10:51.440 --> 10:52.640 Some of them could be helpful. 10:52.640 --> 10:58.400 I also grabbed all the PowerShell command line stuff that came out of executing it. 10:58.400 --> 10:59.700 Next slide, please. 11:01.140 --> 11:08.600 So the funny thing, too, as a threat Intel analyst, I decided to look at threat reports, and it was a Raccoon Stealer sample. 11:08.600 --> 11:15.200 So I came across a Cyber Reason blog, because something funny happened while I was executing that one. 11:15.200 --> 11:19.280 It asked me if I wanted to install the .NET framework. 11:19.280 --> 11:29.780 But then in the threat report, it said that one of the biggest complaints from criminals out there is that the Raccoon Stealer has a very low success rate. 11:29.780 --> 11:33.440 And I'm like, well, gee, now I know why. 11:33.640 --> 11:42.280 Basically, it would require people, at least with the version of Windows 10 that I was using, to install the .NET framework. 11:42.280 --> 11:48.080 So that's a little bit of... that's a lot more work involved. 11:48.080 --> 11:51.060 You know, if they're like, here's an invoice, read it. 11:51.060 --> 11:53.100 It's like, oh, man, I have to install this? 11:53.100 --> 11:54.120 Yeah, screw that. 11:54.120 --> 11:57.300 Like, I'm just going to move on with my life, right? 11:57.320 --> 11:58.700 Next slide, please. 11:59.220 --> 12:00.480 Oh, you did it. 12:00.620 --> 12:21.400 So then, let's see, Thursday of this week, I had a friend contact me, and he was like, hey, I know you're doing a talk at the DEF CON villages, and if I gave you a blocked, you know, sample from my org that we don't really care about, that's junk data, 12:21.400 --> 12:22.880 would you be interested? 12:22.880 --> 12:27.340 Would you want to, you know, see what you can do with it, right? 12:27.340 --> 12:30.880 And this was about 24 hours prior to a previous presentation. 12:30.880 --> 12:31.980 I'm like, sure. 12:32.100 --> 12:37.660 I'm like, let's see what I can come up with, and then I will share it with the world. 12:38.840 --> 12:40.200 So can I do it? 12:40.200 --> 12:41.080 Can I not do it? 12:41.080 --> 12:41.760 We'll see. 12:43.980 --> 12:56.640 So what I did, I found the sample in VirusTotal, and then I loaded it to AnyRun, and then I also loaded it to Malware Bazaar. 12:56.640 --> 13:04.520 So the reason why I loaded it to all these different sandboxes is that Malware Bazaar gives me some really good data. 13:04.820 --> 13:25.040 Joe's Sandbox, I obviously don't have a corporate thing because, you know, I was doing this as an independent researcher, and, you know, if you submit it through Malware Bazaar, you get Joe's Sandbox, you get CAPE, you get a lot of good stuff to look at and pivot between when you're building out your reports. 13:25.080 --> 13:26.980 And then, of course, VMRay. 13:29.860 --> 13:36.180 So just as a little side note, the threat Intel brain in me kicked in, and I'm like, oh, I'm like, I have the sample. 13:36.180 --> 13:38.160 I can make them a custom rule. 13:38.160 --> 13:57.620 So I looked at the callout for the DNS traffic and pivoted, and it was, of course, a Nigerian-based hosting, not saying that Nigerian hosting is potentially malicious, whatever, but I pivoted off of it, and I found four additional samples that were malicious. 13:57.620 --> 14:05.740 So what I did is I created a custom YARA rule using diff and virus total, and then I passed that along to my contact. 14:05.740 --> 14:21.180 And then the next step was I looked up MITRE ATT&CK, because I'm like, okay, I know that it is Hawkeye, and I know that MITRE ATT&CK kind of makes my life easy sometimes and has stuff already done for me. 14:21.180 --> 14:27.480 And lo and behold, I look at MITRE ATT&CK, and no, they don't have what it is that I need. 14:27.480 --> 14:29.620 So that means I need to create it from scratch. 14:29.620 --> 14:31.380 But how do I do that? 14:34.380 --> 14:41.760 So then I use a framework, and I use the MITRE ATT&CK tactics to guide my research. 14:41.760 --> 14:53.520 And this is a printout from Joe Sandbox, where they kind of map the different behaviors and TTPs of the particular malware sample that we have. 14:54.040 --> 14:55.540 Next slide, please. 14:55.860 --> 15:04.780 So for initial access, it was an email with an XE attachment, and the subject said, invoice attached! 15:05.280 --> 15:07.940 And it can propagate through USB. 15:08.420 --> 15:15.700 As you can see here, on the left-hand side, you see the raw sample of the email, and it says reverse invoice. 15:15.700 --> 15:17.200 That was really funny. 15:17.620 --> 15:22.220 And I decided to go to the domain in there just to see what was up with it. 15:22.220 --> 15:25.460 And that's the yellow thing on the right-hand side. 15:25.460 --> 15:35.400 And then the sender, the sender down at the bottom, it was actually a Nigerian company as well that was sending the malicious XE. 15:36.020 --> 15:39.740 So I, of course, passed that along to my contact. 15:40.280 --> 15:42.640 So, next slide. 15:43.260 --> 15:45.400 So now we have execution. 15:45.400 --> 15:51.820 And of course, user execution is required, and that's T1204.002. 15:51.820 --> 15:54.280 And it was execution of a malicious file. 15:54.280 --> 15:55.340 Next slide. 15:57.060 --> 16:02.320 And now we have WMI, T1047. 16:03.900 --> 16:16.360 And so what I wanted to do, since I had a very short amount of time, and I had a lot of stuff to get through, so what I did is I created a process in order to parse all of this and get it out. 16:16.720 --> 16:33.960 Basically, I go to the Joe's Sandbox MITRE ATT&CK section, and then I go to the Joe's Sandbox specific entry in the report, which you can see down at the bottom, the box thing, that's the specific entry that I'm talking about. 16:33.960 --> 16:47.940 And then I check Atomic Red Team to see if there's anything that's related to that, such as check if AV antivirus firewall program is installed, and then I Google what isn't there. 16:47.940 --> 16:49.420 Next slide, please. 16:51.580 --> 17:02.400 So when I first did this for T1047 in Atomic Red Team, I didn't find anything that matched the commands that I needed. 17:02.440 --> 17:08.740 And so I decided to Google, and I found something on Stack Overflow, so I threw it up there. 17:08.740 --> 17:20.800 And later in the presentation, as I was doing my research, I found the T1518.001, and I came back and added it here. 17:20.840 --> 17:32.140 So this is a tip, if you do decide to leverage this, that sometimes things will be under different atomic tests, essentially. 17:32.140 --> 17:33.760 Next slide, please. 17:33.900 --> 17:37.780 So the next one was Native API. 17:39.320 --> 17:55.100 And when I went to go look at the specific section of Joe's Sandbox, I searched and searched and couldn't really find anything beyond just the APIs that were involved with that. 17:55.100 --> 18:06.000 So then I went to Atomic Red Team, and they had something that had a command that was similar to v4.0.30319. 18:06.000 --> 18:16.120 So I did a search in the actual Joe's Sandbox, and I found a command on the command line, but there were no specifics tied with it. 18:16.120 --> 18:28.940 So this at least gives a beginning of what XE was being used to interface with the APIs, and the APIs specifically included. 18:28.940 --> 18:30.420 Next slide, please. 18:30.720 --> 18:32.780 So now we have persistence. 18:32.780 --> 18:34.000 Next slide. 18:34.940 --> 18:42.360 So I looked at the area, the specific area in Joe's Sandbox, and I found wherefault. 18:42.360 --> 18:43.840 Wherefault was the culprit. 18:43.840 --> 18:46.760 And I had a hash of wherefault. 18:46.820 --> 18:52.460 And so I threw that in a various total, and it looks like it's a legitimate service. 18:53.120 --> 18:55.020 So this is interesting. 18:55.020 --> 18:58.580 It looks like that one is being used for DLL side loading. 18:58.580 --> 19:00.880 Next slide. 19:00.880 --> 19:04.760 Next we have privilege escalation. 19:04.760 --> 19:07.660 So we have... slide after that, please. 19:08.460 --> 19:12.120 So now we have DLL side loading again. 19:12.400 --> 19:15.100 Next slide as well. 19:15.700 --> 19:18.640 And then we also have process injection. 19:18.720 --> 19:26.120 And so there is an atomic red team for this, and I put the command line argument there for that. 19:26.120 --> 19:27.560 Next slide. 19:27.560 --> 19:33.260 There was a ton of defense evasion with this particular sample of Hawkeye. 19:33.260 --> 19:43.480 Everything from invalid code signing to software packing to sandbox evasion to obfuscating files. 19:43.480 --> 19:45.200 Next slide, please. 19:47.540 --> 19:53.420 So what I did is I tried to pick the one... the previous slide, please. 19:53.420 --> 20:03.980 I tried to pick stuff out of the defense evasion that I think red teamers and blue and all of that could be able to take advantage of, essentially. 20:03.980 --> 20:06.140 And so one of them was masquerading. 20:06.200 --> 20:11.280 This sample created files inside the actual user directory. 20:11.360 --> 20:17.240 And so I put the location of what was being created and what it was called and all of that. 20:17.240 --> 20:20.560 And there are a ton of tests for atomic red teams. 20:20.560 --> 20:24.960 So you can just pull the commands out of that that make sense that fit with this. 20:24.960 --> 20:26.000 Next slide, please. 20:26.580 --> 20:33.100 So the next one is modify registry, and it stores a large binary data to the registry. 20:33.100 --> 20:41.340 And I put the registry key that was changed or modified along with what it looked like. 20:41.340 --> 20:48.940 I know that there's stuff that could potentially... I'm sure red teamers are like, hmm, I know what that is. 20:49.820 --> 20:52.160 Next slide, please. 20:53.020 --> 20:57.140 The next one is hidden files and directories. 20:57.140 --> 21:06.300 I couldn't find an atomic red team test specifically for this one for changing Windows Explorer. 21:06.300 --> 21:10.720 But I did put the key value that was changed. 21:10.720 --> 21:12.140 Next slide, please. 21:13.780 --> 21:17.900 So this one is my educated guess. 21:17.900 --> 21:27.060 So in the detailed part of the sandbox report, it says that it contains functionality to read the PEB. 21:27.060 --> 21:34.360 So from a little bit of exploit dev reading, essentially, you know, you can create shellcode. 21:34.360 --> 21:44.380 You know this to walk through the PEB, the process environment block in order to find the address of kernel 32 DLL. 21:44.380 --> 21:49.640 And so I made an educated guess that that's what the shellcode was about. 21:49.640 --> 21:51.340 Next slide. 21:51.500 --> 21:54.880 Next one is credentialed access. 21:54.920 --> 22:05.320 So I put in here all the different files that were accessed and stolen from this particular sample. 22:05.440 --> 22:07.840 And there is an atomic test for it. 22:07.840 --> 22:09.200 Next slide. 22:09.200 --> 22:11.540 Next one is discovery. 22:11.800 --> 22:15.820 And this one queries a list of running processes. 22:15.820 --> 22:22.560 And there is an atomic test for it next or atomic commands that you can take out and put into whatever you use. 22:22.560 --> 22:25.280 The next one, remote system discovery. 22:25.480 --> 22:28.920 There is an atomic test available for this one as well. 22:28.920 --> 22:35.540 And it kind of tells you where to go and what's going on, what's reading and stuff like that. 22:35.540 --> 22:37.300 The next one, please. 22:38.100 --> 22:39.840 System info discovery. 22:39.840 --> 22:48.060 I put the key, the registry key that was queried in there for the particular emulation. 22:48.060 --> 22:50.320 And there is an atomic test for this. 22:50.380 --> 22:51.280 Next slide. 22:52.540 --> 22:54.000 Lateral movement. 22:54.140 --> 22:57.640 The only thing that I can talk about... previous slide, please. 22:57.820 --> 23:05.540 The only thing that I can talk about... the only thing that I can talk about regarding this is that it replicates via USB. 23:05.540 --> 23:06.920 Next slide. 23:07.480 --> 23:15.160 So, collection... it steals data from the local system, which is T1005. 23:15.160 --> 23:17.860 There is also key logging as well with this. 23:17.860 --> 23:23.440 And there are atomic red team commands available for this for you to extract. 23:23.440 --> 23:24.620 Next slide, please. 23:24.620 --> 23:28.940 And it also extracts and archives the collected data. 23:28.940 --> 23:36.120 So, my educated guess on this is that it compresses or encrypts the data prior to exfil. 23:36.120 --> 23:39.040 So, that is a good behavior to include as well. 23:39.040 --> 23:43.560 And there is an atomic red team test with a dependency on PowerShell. 23:43.560 --> 23:45.140 Next slide, please. 23:45.680 --> 23:48.340 It does grab your clipboard data. 23:48.340 --> 23:50.460 And there is an atomic test available. 23:50.460 --> 23:51.500 Next slide. 23:53.540 --> 23:55.400 Local email collection. 23:55.400 --> 24:00.180 It shows all the different files where the information was harvested, essentially. 24:00.180 --> 24:02.700 And there is an atomic test for this one. 24:02.700 --> 24:03.720 Next slide, please. 24:04.460 --> 24:05.620 Okay, C2. 24:05.620 --> 24:06.520 Next slide. 24:06.520 --> 24:16.320 Here is the various things that were associated with C2 from an encrypted channel and non-application layer protocol. 24:16.320 --> 24:19.700 And there are atomic tests available. 24:19.700 --> 24:20.780 Next slide. 24:21.720 --> 24:28.300 And the thing that I would recommend when you are building this out and looking at the C2 is the C2 matrix. 24:28.560 --> 24:34.980 So, you can see right here the various functionalities that all of these different C2s... 24:35.300 --> 24:37.620 I think they said that they were at 53 now. 24:37.620 --> 24:38.680 There is a ton. 24:38.680 --> 24:40.560 And there is a Black Hat talk on it. 24:41.000 --> 24:43.320 Black Hat Arsenal talk on it. 24:43.360 --> 24:45.800 And Jorge Artiles talks on it a lot. 24:45.800 --> 24:50.080 So, he can definitely give you a ton of information about it. 24:50.720 --> 24:52.400 C2matrix.com. 24:52.480 --> 24:56.640 And use that to pick your C2 that matches with the capabilities. 24:56.640 --> 24:57.600 Next slide. 24:58.840 --> 25:00.540 So, exfiltration. 25:00.540 --> 25:05.980 I just took that the data is compressed or encrypted. 25:05.980 --> 25:07.080 Next slide. 25:08.140 --> 25:09.120 So, impact. 25:09.120 --> 25:14.240 There really doesn't seem to be a crazy amount of impact like there would be with ransomware. 25:14.740 --> 25:16.180 You know, they steal creds. 25:16.180 --> 25:16.940 Use them later. 25:16.940 --> 25:17.820 Sell them. 25:17.820 --> 25:20.700 Who knows what this particular actor is doing. 25:21.100 --> 25:23.660 So, now I'm going to add some extra context. 25:23.740 --> 25:24.760 Next slide, please. 25:24.760 --> 25:28.340 So, I looked at the Yara rule specifically in Malware Bazaar. 25:28.340 --> 25:31.220 And I saw that it was kind of... it was really active. 25:31.220 --> 25:33.480 Like, it was still getting a lot of samples. 25:33.480 --> 25:34.760 So, not stale. 25:34.760 --> 25:35.980 Next slide, please. 25:37.760 --> 25:38.860 And you'll see... 25:39.440 --> 25:41.140 So, I went to Malware Bazaar. 25:41.140 --> 25:42.220 And then I pivoted out. 25:42.220 --> 25:43.700 Looked at the Yara rule. 25:43.700 --> 25:47.780 And then I looked at the Joe Sandbox command line. 25:47.780 --> 25:52.800 And I saw that this particular Yara rule that was still alerting was from 2015. 25:52.800 --> 25:57.640 And they were still using the same string in the command line. 25:57.640 --> 26:03.100 So, I'm like, oh, that would be really great to include in adversary emulation exercises. 26:03.300 --> 26:06.920 Since it's been pretty consistent for about five years. 26:07.000 --> 26:08.200 Next slide, please. 26:10.300 --> 26:14.180 So, with this, the HTTP traffic doesn't have a header. 26:14.180 --> 26:23.160 And then I put where files, some files that were written, and the process tree for additional context. 26:23.160 --> 26:24.360 Next slide, please. 26:24.360 --> 26:26.880 It also dropped 11 files. 26:26.880 --> 26:30.600 And I put all the different files that were dropped in the different folders. 26:30.600 --> 26:32.040 Next slide, please. 26:32.980 --> 26:34.660 Other characteristics. 26:34.800 --> 26:38.860 Queries connects over DNS, over HTTPS. 26:39.160 --> 26:44.040 The thing that was interesting to me is that it used port 0 for listening. 26:44.890 --> 26:50.300 And then, you know, injection with create remote thread. 26:50.300 --> 26:57.160 So, that sounds like something red team would be interested in knowing that this particular thing does. 26:57.380 --> 26:59.240 So, next slide, please. 26:59.340 --> 27:07.800 So, basically, I mean, I got someone's throwaway malware sample that they didn't really care about. 27:07.800 --> 27:09.200 That was blocked. 27:09.200 --> 27:12.060 And I was able to extract all that information. 27:12.060 --> 27:30.340 Find out, you know, it was, it used a Nigerian infrastructure from a Nigerian, I'm assuming, compromised company to send, you know, invoices to the particular organization. 27:30.340 --> 27:38.900 And built out a thing that they could use to test their defenses regarding adversary emulation exercises. 27:38.900 --> 27:46.580 And this was all just from pivoting between multiple sandbox reports and some of my own analysis as well. 27:46.580 --> 27:48.460 Not all of it was from Joe's sandbox. 27:48.460 --> 27:51.960 I also included some from Kate's sandbox as well. 27:51.960 --> 27:56.300 And then, me just looking over the sandbox results as well. 27:56.300 --> 27:57.640 Next slide, please. 27:58.980 --> 28:06.200 Finally, so what you can do if you decide you want to move forward with this is the purple team exercise framework. 28:06.200 --> 28:09.440 Jorge Archiles talks about this. 28:09.440 --> 28:11.360 He just released it through Scythe. 28:11.360 --> 28:13.880 It's free and available to the community. 28:14.140 --> 28:26.760 And it gives you a really good framework in order to be able to process this and to move forward with a purple team exercise. 28:26.760 --> 28:28.040 Next slide, please. 28:30.140 --> 28:37.040 And CyberWardog, he did a blog post about tracking the hunt team. 28:37.380 --> 28:42.320 And so, what I was thinking is that you could do the same thing for purple. 28:42.320 --> 28:54.300 And essentially, like track over time and present to your manager or upper management or whomever, like the various TTPs that you've been testing over time. 28:54.420 --> 28:57.000 And your coverage with it. 28:57.000 --> 29:04.320 Or, you know, for just throwing out random ideas, right? 29:04.320 --> 29:14.280 So, you can also use it to track the kind of activity that you're getting from the various malicious items that are being sent to your organization. 29:14.280 --> 29:22.080 So, for Nigerian infrastructure, you know, you're like, huh, okay, so they're using these general TTPs. 29:22.100 --> 29:24.100 And here's our coverage for it. 29:24.100 --> 29:25.740 Here's what we've tested. 29:25.740 --> 29:30.820 And basically, the manager can just sit there over time and look at the colors change. 29:31.440 --> 29:33.940 So, that would be helpful. 29:34.720 --> 29:39.740 But as a CTI analyst, like, I'm not a red teamer. 29:39.740 --> 29:48.620 Like, I honestly don't know the commands, whether or not they're right or not, without testing all of them and how to go forward with this. 29:48.620 --> 29:51.360 So, this is where the easy button comes in. 29:51.360 --> 29:55.760 And I'm going to hand off the presentation to my co-speaker. 29:56.560 --> 29:57.600 Hi, everyone. 29:57.600 --> 29:58.880 My name's Hayden. 29:58.880 --> 30:02.580 I was just listening to you and thinking it was amazing this talk, Thierry. 30:02.580 --> 30:06.140 Thank you for inviting me to co-talk with you. 30:06.140 --> 30:10.640 So, Thierry was talking about cyber threat intelligence, adversary emulation, purple teaming. 30:10.640 --> 30:15.560 And what's happened is that we both were talking back and forwards. 30:15.560 --> 30:20.900 I've been a cyber threat intelligence analyst six months ago or years ago for six months. 30:20.900 --> 30:29.220 And what happened was I would use to copy and paste indicators such as IP addresses and domains from a report, throw it through ArcSight. 30:29.420 --> 30:33.560 So, Thierry was telling me she wants to make it easier for cyber threat intel analysts. 30:33.560 --> 30:36.800 So, I started to was into coding and learning Golang. 30:36.800 --> 30:39.440 So, I came up with emulate.go. 30:39.440 --> 30:52.240 Now, the problem that we were identifying, well, not a problem, but the concern we had with C2 tools such as PowerShell Empire or many of the others is that they can have a steep learning curve. 30:52.240 --> 30:55.260 And you need a really deep technical understanding. 30:55.340 --> 30:57.600 They can require a lot of dependencies. 30:57.760 --> 31:04.840 And they can require a bit of a setup as well to get your same interpreter payload working or things like that. 31:04.840 --> 31:07.840 So, most of them can be extremely complex. 31:07.840 --> 31:18.780 And we wanted to abstract that away and focus on cyber threat intelligence of initial access and creating it that way. 31:18.780 --> 31:28.680 So, the goal was to lower the bar of entry for adversary emulation, abstract away the technicality, focus on initial access, and help people learn. 31:28.680 --> 31:31.880 Adversary emulation in Purple Team can be quite advanced. 31:31.880 --> 31:43.260 But ultimately, when you get down to it, it's attempting an attack or building an exercise for attack, executing it, and seeing if you detected it or missed it, and then fine-tuning it. 31:43.440 --> 31:45.160 So, that's what we were doing. 31:45.420 --> 31:49.360 The solution was a client-server implementation. 31:49.360 --> 31:57.120 It doesn't have a command line GUI as advanced as Metasploit or Red Team Atomic Framework or anything like that. 31:57.120 --> 31:59.160 It doesn't have any payloads or modules. 31:59.160 --> 32:00.500 It doesn't have dependencies. 32:00.500 --> 32:02.000 It is written in Go. 32:02.000 --> 32:06.000 So, if you want to run the Go file, you obviously have to install Go. 32:06.060 --> 32:07.940 I think it's been easy to use. 32:07.940 --> 32:10.320 I made some obvious command line arguments. 32:10.760 --> 32:17.840 It's limited to two things, running execution manually and a list of commands. 32:17.840 --> 32:19.800 So, you can say, who am I? 32:19.800 --> 32:23.260 You can do a regedit, but you have to manually do it or put it in a file. 32:23.460 --> 32:26.540 And then there's basic logging into JSON format. 32:26.540 --> 32:28.620 So, let's continue. 32:28.620 --> 32:37.180 The basic C2 infrastructure for command and control is, obviously, the admin sits in the cloud and then it connects to the infected machine. 32:37.180 --> 32:39.260 So, I was like, okay, let's do that. 32:39.260 --> 32:53.620 But with adversary emulation, I really wanted to allow CTI analysts or people who are learning to also test their environment on lateral movement or if one or more systems are infected. 32:53.620 --> 32:56.620 So, the parent proxy mode sits in the middle. 32:56.700 --> 32:59.860 It receives the commands and forwards them to the child. 33:00.220 --> 33:02.420 And that way, it's sort of like a daisy chain. 33:02.420 --> 33:06.980 And it just adds a little bit more complexity or functionality for testing. 33:07.980 --> 33:12.700 So, again, the modes as any C2 tool are, is it has an admin interface. 33:12.700 --> 33:18.120 It runs in the cloud or it pretends to be an external attacker. 33:18.240 --> 33:23.040 The parent mode, obviously, proxies the commands back and forwards, but you don't have to use it. 33:23.040 --> 33:28.820 The client mode receives the commands from either the admin or parent and executes them. 33:28.820 --> 33:29.900 Pretty simple. 33:29.900 --> 33:38.820 So, we tried to abstract away everything and help people or even CTI analysts sort of be more beneficial to an adversary emulation. 33:39.080 --> 33:47.400 So, the two types of modes I mentioned before is on the left, the normal one, you type host name, who am I, and you can see my machine hidden local. 33:47.400 --> 33:55.480 The list one, you just supply a file with a list of commands and it will just run through them automatically and send the results back. 33:55.480 --> 33:56.900 So, nice and easy. 33:58.180 --> 34:09.400 And the dash log is just into a JSON format with the timestamp of command execution, the command that was executed or requested, and then the results. 34:09.400 --> 34:20.680 So , this just allows you as someone, if you're at home or in your org, that if you have 100 commands or you execute them and try the next day, you have timestamps to correlate in your detection tools. 34:22.680 --> 34:26.700 So, with my tool, I wanted to add TLS. 34:26.700 --> 34:32.600 The reason being is that when you're emulating an adversary, they probably don't use clear text. 34:32.740 --> 34:36.840 And I didn't, I was trying to think of things that would get in the way of testing. 34:36.840 --> 34:48.820 And if you have a command control tool reaching outside your network, your IPS or something in the cloud, whichever detection tool you have is going to trigger an alert and most probably block it. 34:49.000 --> 34:53.960 So, I added some certificates and I was playing with Go and got it working. 34:54.160 --> 34:59.300 And I sort of cheated a bit because the idea is to abstract away some of the complexity. 34:59.300 --> 35:06.380 So, I didn't want anyone to have to build their own certificates, the X509, the key, the product key, stuff like that. 35:06.380 --> 35:10.320 So, what I did is I included it in the files. 35:10.380 --> 35:13.880 And when you build them, they're included in the executable or the binaries. 35:14.280 --> 35:18.980 And then I marked it as insecure skip verifier, which means that it skips the verification. 35:19.020 --> 35:21.800 Because TLS is meant to be tied to a domain. 35:22.280 --> 35:28.760 And obviously, if you're putting on different boxes, you're putting in the cloud, you don't want to have to generate a certificate all the time. 35:28.760 --> 35:30.740 So, this was just to help make it easier. 35:30.740 --> 35:37.400 So, regarding encryption, if you don't know, the clear text version is on the left. 35:37.400 --> 35:41.720 And you can see the command being recorded over the network in clear text. 35:41.720 --> 35:43.600 And TLS gobbles it. 35:43.600 --> 35:47.180 So , it's version 1.3, which I was lucky with, I guess. 35:47.520 --> 35:55.460 And then because the tool prints to the screen in all three different modes, malware wouldn't print to the screen. 35:55.460 --> 35:59.320 It's great for learning, but it's not so much great for emulation. 35:59.320 --> 36:04.840 And I didn't want people detecting the print to the screen or printing to the terminal. 36:05.080 --> 36:08.520 So, I wanted you to be able to silence it, and then it would just go blank. 36:08.520 --> 36:10.700 And you wouldn't see anything printed to the screen. 36:10.700 --> 36:12.020 So, that was my thinking. 36:12.920 --> 36:15.180 I did add a pause function. 36:15.180 --> 36:21.460 So, in the bottom left here, you can just see that it shows the options running in clear text or logging as on and off. 36:21.720 --> 36:26.000 And I mostly did that to only script kitties, just because, why not? 36:26.000 --> 36:28.680 In addition to just letting you see the options. 36:28.680 --> 36:32.640 And then if you do the dash skip, you can skip this bit. 36:32.640 --> 36:36.800 And it will just run through automatically, so you can run it quickly. 36:36.940 --> 36:39.920 So, I recorded some demos of this. 36:39.920 --> 36:45.460 I wanted to show all the different modes, list and normal, and then the TLS demonstration. 36:45.620 --> 36:53.920 And then I also wanted to show a registry edit with BlueSpawn, which is an open source EDR, and a scheduled task execution. 36:54.060 --> 36:55.940 So, let's get to that. 36:58.090 --> 36:59.830 I will drag it over here. 36:59.830 --> 37:02.430 See, I have them all in my folder recorded, ready to go. 37:02.430 --> 37:05.170 So, I didn't have any technical issues. 37:05.190 --> 37:08.810 The thing here is that it's just a host name in the cloud called Ubuntu. 37:08.890 --> 37:10.790 And then I set up a lab. 37:10.790 --> 37:12.630 So, this is a domain controller. 37:13.110 --> 37:18.570 So, I have the emulate and the executable on Linux, because I was moving over to the Windows file. 37:18.690 --> 37:21.470 But it's just ./.emulate. 37:21.470 --> 37:22.830 The mode is admin. 37:22.950 --> 37:25.050 And then you choose the listening port. 37:25.210 --> 37:26.910 Listening IP address and port. 37:26.910 --> 37:28.370 So, it's just 8.8.8.8. 37:28.370 --> 37:29.990 The options are on the left. 37:29.990 --> 37:31.430 You've got your TLS, none. 37:31.430 --> 37:32.490 Logging, none. 37:32.490 --> 37:33.470 Pause, none. 37:33.470 --> 37:37.670 And then it even tells you where to connect the client to. 37:38.270 --> 37:42.390 So, when you run the executable, you actually choose client mode. 37:42.390 --> 37:47.310 And then you do client connect with the same IP address and the same ports. 37:47.390 --> 37:49.950 And it should just connect nice and easily. 37:50.030 --> 37:55.710 And you don't have to worry about making sure you've done it right. 37:55.710 --> 37:56.690 Yep. 37:56.690 --> 37:58.270 And it just works like that. 37:58.330 --> 38:01.070 And then you can enter who am I or a host name. 38:01.070 --> 38:03.390 Just a nice demo to show it working. 38:03.590 --> 38:07.810 And then it prints to the screen on the client side so that you know it's working correctly. 38:07.910 --> 38:11.250 And what results it's giving. 38:11.950 --> 38:14.750 And then this is why I put silence in. 38:14.750 --> 38:20.450 Just so that when the client executes, it doesn't detect I'm printing to the screen. 38:20.450 --> 38:22.170 Because that would be rather embarrassing. 38:23.470 --> 38:26.190 So, the admin list works this way. 38:26.190 --> 38:27.590 The same way. 38:28.310 --> 38:29.870 So, we do dot emulate. 38:29.870 --> 38:31.670 The mode is admin list. 38:31.670 --> 38:35.090 You supply the port and IP with the dash listen again. 38:35.710 --> 38:38.110 And my typing is really slow. 38:38.170 --> 38:41.270 And then you just do the dash commands with the file. 38:41.270 --> 38:43.170 So, it would be commando dot text. 38:43.170 --> 38:46.010 And we're attempting to launch it in admin list mode. 38:46.870 --> 38:49.050 So, on the client is the same. 38:49.050 --> 38:50.830 But you do client list mode. 38:52.030 --> 38:55.470 And then you do the IP address and port. 38:56.110 --> 39:01.650 So, what happens is when you run it, it should automatically execute it like that. 39:02.290 --> 39:07.070 So, we just ran whoamihostnamepowershell.exe OS. 39:07.070 --> 39:08.350 Not advanced commands. 39:08.350 --> 39:09.390 It's just a demo. 39:09.390 --> 39:12.150 And to help you guys see the tool in motion. 39:12.630 --> 39:14.310 So, that's how it works. 39:14.530 --> 39:17.970 Let me close Windows Media Player. 39:18.430 --> 39:20.450 The parent mode is pretty cool. 39:20.450 --> 39:22.070 Or at least I think it's pretty cool. 39:22.070 --> 39:24.970 So, here I've got Ubuntu on the left. 39:25.230 --> 39:27.830 I've got two Windows PowerShells open. 39:28.450 --> 39:32.410 And then I'm just using the admin dash listen mode in port 999. 39:32.530 --> 39:35.090 And then I'm just using dash parent mode. 39:35.090 --> 39:37.010 And then the flags are pretty simple. 39:37.010 --> 39:38.870 So , it's dot parent connect. 39:38.870 --> 39:40.510 Where is the parent going to connect to? 39:40.510 --> 39:41.870 It's the admin server. 39:42.010 --> 39:46.810 And then dash parent listen is what port is it going to listen on? 39:46.850 --> 39:47.670 So, it makes sense. 39:47.670 --> 39:48.530 Nice and easy. 39:48.530 --> 39:49.930 And then emulate dot exe. 39:49.930 --> 39:51.150 The mode is client. 39:51.150 --> 39:53.970 Client connect connects to the parent. 39:54.110 --> 39:56.350 And then it just forwards the commands through. 39:56.470 --> 39:59.030 So, when you're in your org or you're learning at home. 39:59.030 --> 40:01.230 You can do more than one machine. 40:01.370 --> 40:02.710 Which is pretty cool. 40:02.710 --> 40:04.770 And here I typed netstat incorrectly. 40:04.770 --> 40:07.150 That's why it doesn't quite work. 40:09.840 --> 40:11.060 And yeah, there you go. 40:13.320 --> 40:17.040 So, the basic logging format, again, is in JSON. 40:17.040 --> 40:18.540 So, if I skip through. 40:18.860 --> 40:20.980 I've just done admin list. 40:20.980 --> 40:23.760 The listen with the IP address and port again. 40:23.840 --> 40:24.900 The dash command. 40:24.900 --> 40:26.960 Because we're going to execute in command. 40:27.360 --> 40:29.940 And then dash log with the name emulog. 40:29.940 --> 40:32.440 Which will create emulog dot JSON. 40:32.480 --> 40:33.680 Simple as that. 40:33.680 --> 40:37.040 And then on the client mode, you don't have to do the logging. 40:37.040 --> 40:39.600 It's only the admin interface that logs. 40:39.600 --> 40:41.000 Which is more realistic. 40:41.000 --> 40:42.200 But I guess you could. 40:42.200 --> 40:46.040 I could build logging for the client if everyone demands it. 40:46.040 --> 40:46.940 Or if it's useful. 40:46.940 --> 40:49.540 But I thought just doing it on the admin was fine. 40:50.660 --> 40:56.220 And then if I skip through and you get the emulog dot JSON file, it's pretty ugly. 40:56.220 --> 40:57.360 It's just there. 40:57.360 --> 40:58.960 It's just basic JSON. 41:00.560 --> 41:02.680 I think that's it. 41:02.740 --> 41:06.440 If you put it in nano, it is actually in a JSON object. 41:06.440 --> 41:10.120 So, it's got the time, the command, and the output that it receives. 41:10.120 --> 41:14.060 So, that allows you to correlate between the different detection tools. 41:15.580 --> 41:18.720 The TLS option is pretty similar. 41:18.720 --> 41:20.680 You just add dash TLS. 41:20.800 --> 41:26.100 So, as you can see here, it's emulate dash mode admin dash listen. 41:26.100 --> 41:30.880 I did port 000 just to show that it can listen multiple interfaces. 41:30.940 --> 41:34.140 But dash TLS is really the important key here. 41:34.400 --> 41:38.160 And then on the client side, you also need to put dash TLS. 41:38.160 --> 41:39.680 Otherwise, the handshake won't work. 41:39.680 --> 41:43.400 It will think SSL on one end and non-SSL on the other. 41:44.240 --> 41:45.760 And then you run that. 41:45.760 --> 41:49.260 And I'm just using Wireshark to show that the encryption actually works. 41:49.260 --> 41:51.040 I'm not talking out my ass. 41:51.320 --> 41:53.700 But yeah, it does the client hello handshake. 41:53.700 --> 41:55.420 And you're off to the races. 41:55.420 --> 41:56.840 So, that's pretty cool. 41:57.900 --> 42:00.620 And it also works with PowerShell and that stuff. 42:02.220 --> 42:04.360 After it executes and runs through. 42:09.680 --> 42:12.900 This one is to show just some recon commands. 42:13.020 --> 42:17.320 So , Xena Oterio was giving me her research. 42:17.320 --> 42:20.780 And there was one that executed multiple recon commands. 42:20.780 --> 42:23.380 And one was even the WLAN export profile. 42:23.380 --> 42:27.780 But I left it in because I thought it would be funny being in AWS. 42:27.780 --> 42:31.060 It doesn't have a Wi-Fi profile. 42:31.340 --> 42:32.900 So, that's the file. 42:33.600 --> 42:34.780 You add it in. 42:34.780 --> 42:36.280 And the log name is advanced. 42:36.280 --> 42:39.160 And so, it will become advanced.json. 42:39.460 --> 42:43.200 And then I just already have it in the Windows CMD. 42:43.200 --> 42:44.520 It clicks through. 42:44.520 --> 42:45.620 It runs it. 42:45.620 --> 42:48.140 And it all logs to a JSON file. 42:48.220 --> 42:50.440 Even though it's quite a lot of output. 42:50.840 --> 42:55.840 And then I use jQuery just to see how it's ugly when you cap the file. 42:55.840 --> 42:57.000 Because it's JSON. 42:57.140 --> 43:00.180 But if you use jQuery, it's a little bit better formatted. 43:00.580 --> 43:02.620 You could probably clean it up a lot better. 43:02.620 --> 43:05.520 But it was just, I made it larger for the demo. 43:05.540 --> 43:09.000 And you can see that it executes CMD slash C. 43:09.180 --> 43:12.420 And then it creates the results. 43:15.440 --> 43:16.360 Close, close. 43:16.360 --> 43:16.680 All right. 43:16.680 --> 43:17.460 Cool. 43:19.220 --> 43:26.560 So, the research Xena gave me, there was a registry add command with environment CMD start. 43:26.560 --> 43:27.480 Things like that. 43:27.480 --> 43:35.960 I wanted to show a demo where this registry add can actually be tipped by an open source EDR called bluespawn. 43:35.960 --> 43:44.940 So, in an example of doing something real world, or in the effort to do so, we have it set up here. 43:44.940 --> 43:46.420 I'm listening on port 44. 43:46.460 --> 43:53.240 We're going to execute bluespawn, which is an open source EDR, to see if we can trip it. 43:53.240 --> 43:54.660 Or it detects something. 43:55.080 --> 43:58.020 So, then we're going to go into client mode with TLS. 43:58.720 --> 44:00.480 And then, as you can see, I'm admin one. 44:00.480 --> 44:02.700 Because that's the only way I could really execute. 44:03.160 --> 44:04.680 And then I copy paste. 44:04.680 --> 44:06.460 But I do this in PowerShell. 44:06.860 --> 44:09.100 Just because I felt like it. 44:13.390 --> 44:14.890 And then it goes through. 44:14.890 --> 44:17.810 It's reported as completing successfully. 44:18.630 --> 44:21.690 And you can see, even on the client, it shows you. 44:21.690 --> 44:28.870 And then when you go to bluespawn, you can see the MITRE technique, T1183, and the registry edit. 44:28.970 --> 44:31.330 So, this was actually from some training. 44:31.430 --> 44:35.930 I did this regedit, and they did a demo with bluespawn. 44:35.930 --> 44:44.050 I thought it would be great to show everyone how the tool can be used in the idea of adversary emulation. 44:44.910 --> 44:51.710 Now, the next one we wanted to show was a scheduled task slash job, which is T1053 in the MITRE framework. 44:51.990 --> 44:56.390 And this was from Cape Sandbox 32597. 44:56.690 --> 44:59.930 So, it's scheduled tasks, and it creates... 45:00.790 --> 45:03.250 Scheduled tasks, it executes when someone logs on. 45:03.250 --> 45:04.990 So, it's a typical persistence mechanism.