1 00:00:00,420 --> 00:00:01,880 [Applause] 2 00:00:01,880 --> 00:00:03,600 thanks banks for the the introduction 3 00:00:03,600 --> 00:00:05,680 thanks all for coming to my talk uh a 4 00:00:05,680 --> 00:00:10,360 tax as a service with the derf and fun 5 00:00:10,360 --> 00:00:12,480 fact about the tool it 6 00:00:12,480 --> 00:00:15,440 originally was going to be called a tax 7 00:00:15,440 --> 00:00:18,279 as a service but I I feared that the 8 00:00:18,279 --> 00:00:20,160 acronym would not pass 9 00:00:20,160 --> 00:00:22,880 HR and then and then I was going to call 10 00:00:22,880 --> 00:00:26,840 it the Derp uh um detection replay 11 00:00:26,840 --> 00:00:29,679 platform but it's really not a platform 12 00:00:29,679 --> 00:00:31,880 it's more of a framework and I just was 13 00:00:31,880 --> 00:00:33,840 worried about truth and advertising so 14 00:00:33,840 --> 00:00:38,440 we have the derf uh detection replay 15 00:00:39,399 --> 00:00:42,000 framework if I haven't met you yet uh my 16 00:00:42,000 --> 00:00:44,280 name is cat Traxler again principal 17 00:00:44,280 --> 00:00:46,199 security researcher focusing on public 18 00:00:46,199 --> 00:00:48,840 Cloud at Vector AI we got a couple 19 00:00:48,840 --> 00:00:51,079 Moonlighting gigs as well I'm the lead 20 00:00:51,079 --> 00:00:53,480 author of the Sans SEC 549 Enterprise 21 00:00:53,480 --> 00:00:55,320 Cloud security architecture course and 22 00:00:55,320 --> 00:00:58,960 I'm onan's faculty if you know anything 23 00:00:58,960 --> 00:01:01,960 about me um on the internet you probably 24 00:01:01,960 --> 00:01:04,159 know that I have an extreme bias towards 25 00:01:04,159 --> 00:01:06,879 Google Cloud 26 00:01:07,680 --> 00:01:09,759 security so I'm here to introduce a new 27 00:01:09,759 --> 00:01:11,880 tool to you all uh the derf the 28 00:01:11,880 --> 00:01:13,720 detection replay 29 00:01:13,720 --> 00:01:16,080 framework um but before we do that I'm 30 00:01:16,080 --> 00:01:19,960 going to do a big rewind and talk about 31 00:01:19,960 --> 00:01:22,079 the existing tooling available to 32 00:01:22,079 --> 00:01:25,479 everybody talk about why that existing 33 00:01:25,479 --> 00:01:28,000 tooling didn't meet my 34 00:01:28,000 --> 00:01:31,159 needs what use cases I was having for 35 00:01:31,159 --> 00:01:33,360 tooling um and really what was the 36 00:01:33,360 --> 00:01:36,520 impetus for creating the derf um I'm 37 00:01:36,520 --> 00:01:39,960 going to do a demo for you I tried my 38 00:01:39,960 --> 00:01:42,159 darnest to get on the Wi-Fi cuz I really 39 00:01:42,159 --> 00:01:44,600 wanted to give you a live demo but I 40 00:01:44,600 --> 00:01:46,799 mean you guys are just hitting that 41 00:01:46,799 --> 00:01:48,840 Defcon Wi-Fi too hard and it is just 42 00:01:48,840 --> 00:01:51,640 crapping out on me so I'm so sorry we 43 00:01:51,640 --> 00:01:54,399 have to do the recorded demo um but I 44 00:01:54,399 --> 00:01:56,399 have a recorded demo for you on how to 45 00:01:56,399 --> 00:01:59,000 use the tool and then finally we're 46 00:01:59,000 --> 00:02:01,159 going to look into the future and see 47 00:02:01,159 --> 00:02:04,520 what's on the road map and how you can 48 00:02:04,520 --> 00:02:08,639 extend the tool for your own 49 00:02:10,360 --> 00:02:13,720 use this to me is the most important 50 00:02:13,720 --> 00:02:17,280 question of of any new tool that comes 51 00:02:17,280 --> 00:02:20,519 out why in the world would you create a 52 00:02:20,519 --> 00:02:25,400 yet another Cloud tool right um if you 53 00:02:25,400 --> 00:02:28,239 want to rewind back in history you know 54 00:02:28,239 --> 00:02:32,239 there is a a long route of cloud tools 55 00:02:32,239 --> 00:02:33,720 as our industry 56 00:02:33,720 --> 00:02:37,480 matured um then paku was released 5 57 00:02:37,480 --> 00:02:41,159 years ago 5 years ago at at bsides LV 58 00:02:41,159 --> 00:02:43,720 since then you know probably a dozen 59 00:02:43,720 --> 00:02:47,440 tools are released every year we have 60 00:02:47,440 --> 00:02:51,159 audit tools we have attack tools we have 61 00:02:51,159 --> 00:02:55,080 tools that spin up purposely vulnerable 62 00:02:55,080 --> 00:02:57,800 infrastructure we have tools that are 63 00:02:57,800 --> 00:03:00,720 more like Frameworks and modular 64 00:03:00,720 --> 00:03:02,879 components we have tools that are just 65 00:03:02,879 --> 00:03:04,680 like handy dandy 66 00:03:04,680 --> 00:03:08,640 scripts but there's one thing that each 67 00:03:08,640 --> 00:03:11,480 one of these tools has in 68 00:03:11,480 --> 00:03:14,000 common all of the existing tools out 69 00:03:14,000 --> 00:03:17,480 there pre assume that the person 70 00:03:17,480 --> 00:03:21,200 downloading the tool administering the 71 00:03:21,200 --> 00:03:24,040 Tool uh setting them up is the same 72 00:03:24,040 --> 00:03:26,959 person who's executing the tool that 73 00:03:26,959 --> 00:03:29,159 this download and execute is the same 74 00:03:29,159 --> 00:03:31,439 and use 75 00:03:31,439 --> 00:03:35,000 this might not sound like a really um 76 00:03:35,000 --> 00:03:38,239 big deal like a big design decision um 77 00:03:38,239 --> 00:03:40,159 but it's been consistent throughout all 78 00:03:40,159 --> 00:03:42,720 tooling and as it turns out I came up 79 00:03:42,720 --> 00:03:45,560 with a ton of use cases that really 80 00:03:45,560 --> 00:03:49,120 needed a decoupling a decoupling of tool 81 00:03:49,120 --> 00:03:53,319 Administration from Attack 82 00:03:55,400 --> 00:03:57,599 execution so like I said there's just a 83 00:03:57,599 --> 00:04:00,000 couple use cases that exist exting 84 00:04:00,000 --> 00:04:01,480 tooling is built 85 00:04:01,480 --> 00:04:04,959 around um somebody might build a a cloud 86 00:04:04,959 --> 00:04:07,200 tool to be more of like an educational 87 00:04:07,200 --> 00:04:10,239 tool right use this tool to understand 88 00:04:10,239 --> 00:04:13,280 how Cloud attacks are 89 00:04:13,280 --> 00:04:15,959 executed um or there's a ton of tooling 90 00:04:15,959 --> 00:04:18,560 out there for um 91 00:04:18,560 --> 00:04:21,519 pentesters right you get dropped into an 92 00:04:21,519 --> 00:04:24,600 environment a pentester uses this tool 93 00:04:24,600 --> 00:04:26,560 as just a collection of helper scripts 94 00:04:26,560 --> 00:04:28,600 to help automate their boring 95 00:04:28,600 --> 00:04:30,800 work 96 00:04:30,800 --> 00:04:32,560 right but most of the tooling is f 97 00:04:32,560 --> 00:04:37,520 focused around this idea of a lone wolf 98 00:04:37,520 --> 00:04:40,400 um this like one person who downloads 99 00:04:40,400 --> 00:04:43,720 the tool and executes it um but in my 100 00:04:43,720 --> 00:04:46,800 job as the security researcher and 101 00:04:46,800 --> 00:04:49,280 detection engineer I was hearing from my 102 00:04:49,280 --> 00:04:50,440 data 103 00:04:50,440 --> 00:04:52,800 scientists they needed to execute my 104 00:04:52,800 --> 00:04:54,479 attack techniques in order to train 105 00:04:54,479 --> 00:04:57,400 their models in order to train their 106 00:04:57,400 --> 00:04:59,400 algorithms I wasn't going to be doing 107 00:04:59,400 --> 00:05:01,759 that that I was hearing from my 108 00:05:01,759 --> 00:05:03,680 developers who had code coverage 109 00:05:03,680 --> 00:05:05,479 concerns they needed to make sure all of 110 00:05:05,479 --> 00:05:07,560 their algorithms were fully executed and 111 00:05:07,560 --> 00:05:11,520 to end right they have reliability 112 00:05:11,520 --> 00:05:14,639 concerns I also had users who wanted to 113 00:05:14,639 --> 00:05:17,919 kick off detection logic um testing to 114 00:05:17,919 --> 00:05:20,120 make sure all of the detection logic is 115 00:05:20,120 --> 00:05:22,319 tested end to end we have a cloud 116 00:05:22,319 --> 00:05:24,720 detection it kicks off as expected it 117 00:05:24,720 --> 00:05:28,440 sends to the Sim and alerts the people 118 00:05:28,479 --> 00:05:30,960 appropriately and finally you know like 119 00:05:30,960 --> 00:05:33,039 many of you I operate in a really guard 120 00:05:33,039 --> 00:05:36,520 railed Cloud environment with lots of 121 00:05:36,520 --> 00:05:38,680 controls I needed to make sure that 122 00:05:38,680 --> 00:05:41,840 those controls continuously were tested 123 00:05:41,840 --> 00:05:45,280 and validated and then be alerted to say 124 00:05:45,280 --> 00:05:48,479 oh something that we don't expect to be 125 00:05:48,479 --> 00:05:52,000 able to happen actually is 126 00:05:52,000 --> 00:05:55,240 happening um none of the existing 127 00:05:55,240 --> 00:05:58,000 tooling met any of these use cases I was 128 00:05:58,000 --> 00:06:00,160 coming up with 129 00:06:00,160 --> 00:06:03,240 um none of them had all of them had this 130 00:06:03,240 --> 00:06:05,919 idea of the Lone Wolf and didn't have 131 00:06:05,919 --> 00:06:11,560 the concept of of um the decoupling of 132 00:06:11,560 --> 00:06:14,880 me the attack Creator from the use cases 133 00:06:14,880 --> 00:06:17,599 of the attack 134 00:06:20,000 --> 00:06:23,280 consumer so with this set of use cases 135 00:06:23,280 --> 00:06:28,080 was born the goal of offloading my work 136 00:06:28,080 --> 00:06:30,880 with the derf uh it became with this 137 00:06:30,880 --> 00:06:33,120 came with this very very simple idea 138 00:06:33,120 --> 00:06:36,039 that I should be able to think of a 139 00:06:36,039 --> 00:06:37,440 attack 140 00:06:37,440 --> 00:06:40,759 idea really quickly codify it right just 141 00:06:40,759 --> 00:06:43,240 really quickly jot it down and publish 142 00:06:43,240 --> 00:06:44,720 it 143 00:06:44,720 --> 00:06:47,039 somewhere from there these diverse set 144 00:06:47,039 --> 00:06:49,319 of end users should be able to pull that 145 00:06:49,319 --> 00:06:51,919 attack and execute it at will all 146 00:06:51,919 --> 00:06:57,039 operating off of the same source of 147 00:06:57,039 --> 00:07:01,160 Truth my use case is for an attack tool 148 00:07:01,160 --> 00:07:03,720 my use cases for a cloud attack tool 149 00:07:03,720 --> 00:07:06,520 made it really sound like I needed the 150 00:07:06,520 --> 00:07:10,318 cloud to attack the 151 00:07:10,759 --> 00:07:13,440 cloud not only did I have like a lot of 152 00:07:13,440 --> 00:07:16,759 like personal satisfaction in this idea 153 00:07:16,759 --> 00:07:20,840 it makes a ton of sense to use paths 154 00:07:20,840 --> 00:07:23,360 right for its reliability for its 155 00:07:23,360 --> 00:07:25,759 scalability for all the built-in IM you 156 00:07:25,759 --> 00:07:29,479 get in the cloud to use that to then 157 00:07:29,479 --> 00:07:32,080 execute a 158 00:07:33,319 --> 00:07:37,879 tax so as I think I hinted um if you 159 00:07:37,879 --> 00:07:39,599 know know anything about me you know 160 00:07:39,599 --> 00:07:43,440 that I am a um big Google Cloud nerd so 161 00:07:43,440 --> 00:07:46,159 it's no surprise for you to learn that I 162 00:07:46,159 --> 00:07:48,400 decided to build my Suite of attack 163 00:07:48,400 --> 00:07:51,319 techniques on Google 164 00:07:51,319 --> 00:07:54,879 Cloud that's right even the suite of 165 00:07:54,879 --> 00:07:57,919 attack techniques targeting 166 00:07:57,919 --> 00:08:01,080 AWS ESP especially the attack techniques 167 00:08:01,080 --> 00:08:02,520 targeting 168 00:08:02,520 --> 00:08:06,879 AWS I use Google Cloud to to execute 169 00:08:06,879 --> 00:08:08,520 those 170 00:08:08,520 --> 00:08:11,280 attacks um the derf leverages Google 171 00:08:11,280 --> 00:08:15,280 Cloud workflows to describe API 172 00:08:15,280 --> 00:08:17,599 actions and then execute them in a 173 00:08:17,599 --> 00:08:20,800 defined order so I'm able 174 00:08:20,800 --> 00:08:24,199 to um Define each one of my attack 175 00:08:24,199 --> 00:08:27,080 techniques in yaml and most importantly 176 00:08:27,080 --> 00:08:29,440 I have successfully sidestepped learning 177 00:08:29,440 --> 00:08:30,730 go once 178 00:08:30,730 --> 00:08:33,879 [Music] 179 00:08:34,599 --> 00:08:37,240 again um as I mentioned I really want to 180 00:08:37,240 --> 00:08:41,000 give you a live demo um the gods are not 181 00:08:41,000 --> 00:08:43,159 with us I recorded one a few days ago 182 00:08:43,159 --> 00:08:45,120 just for this 183 00:08:45,120 --> 00:08:48,160 um scenario um so what you're going to 184 00:08:48,160 --> 00:08:51,560 see right now is me executing an attack 185 00:08:51,560 --> 00:08:54,839 technique uh as a Google workflow and 186 00:08:54,839 --> 00:08:57,279 then identifying the attack technique in 187 00:08:57,279 --> 00:09:00,160 cloud trail matching up with the um 188 00:09:00,160 --> 00:09:01,880 unique user agent and doing some 189 00:09:01,880 --> 00:09:05,399 correlation there so about six minute 190 00:09:05,399 --> 00:09:09,120 demo um me in my 191 00:09:09,120 --> 00:09:13,480 house see how the audio 192 00:09:19,600 --> 00:09:21,680 goes all right I wanted to show 193 00:09:21,680 --> 00:09:24,040 everybody what it looks like to invoke 194 00:09:24,040 --> 00:09:28,519 another dir workflow the AWS secet 195 00:09:28,519 --> 00:09:31,360 manager retrieve Secrets again we can 196 00:09:31,360 --> 00:09:33,200 take a look at the source code by either 197 00:09:33,200 --> 00:09:35,560 looking at the source tab on Google 198 00:09:35,560 --> 00:09:38,040 workflows or by looking add source code 199 00:09:38,040 --> 00:09:40,320 on GitHub to take a look at the attack 200 00:09:40,320 --> 00:09:42,880 description and see what this attack 201 00:09:42,880 --> 00:09:44,279 technique is 202 00:09:44,279 --> 00:09:47,399 doing here it says that this attack 203 00:09:47,399 --> 00:09:49,920 technique is going to enumerate secrets 204 00:09:49,920 --> 00:09:53,320 with Secrets manager list Secrets 205 00:09:53,320 --> 00:09:55,959 API and then go ahead and it's going to 206 00:09:55,959 --> 00:09:59,480 retrieve secret value one by one using 207 00:09:59,480 --> 00:10:02,399 the get Secrets 208 00:10:02,560 --> 00:10:06,880 API so it's going to call list 209 00:10:09,000 --> 00:10:12,480 secrets and then iterate through all 20 210 00:10:12,480 --> 00:10:14,920 secrets that are populated into this 211 00:10:14,920 --> 00:10:18,279 target AWS account and retrieve the 212 00:10:18,279 --> 00:10:21,480 values we switch over to the 213 00:10:21,480 --> 00:10:23,560 infrastructure created in this module 214 00:10:23,560 --> 00:10:27,320 we'll see that 20 secrets are created 215 00:10:27,320 --> 00:10:30,240 with the prefix der retrieve 216 00:10:30,240 --> 00:10:32,640 Secrets um and these are the values that 217 00:10:32,640 --> 00:10:34,680 are going to be retrieved when we 218 00:10:34,680 --> 00:10:36,800 execute the 219 00:10:36,800 --> 00:10:39,320 attack all right moving over to the 220 00:10:39,320 --> 00:10:41,399 workflows we 221 00:10:41,399 --> 00:10:46,120 can retrieve Secrets 222 00:10:46,519 --> 00:10:49,360 execute and as always we can choose 223 00:10:49,360 --> 00:10:51,279 whether or not to execute this workflow 224 00:10:51,279 --> 00:10:56,639 as user one or user two choose user one 225 00:10:56,639 --> 00:11:00,480 say to log all call 226 00:11:00,480 --> 00:11:03,720 and hit the execute 227 00:11:13,000 --> 00:11:15,480 button and we have a success message 228 00:11:15,480 --> 00:11:17,240 from the workflow saying that this 229 00:11:17,240 --> 00:11:19,720 workflow was successfully 230 00:11:19,720 --> 00:11:22,160 invoked um I want to show you what it 231 00:11:22,160 --> 00:11:26,480 looks like then to grab these events 232 00:11:26,480 --> 00:11:29,440 from ad us and correlate it with the 233 00:11:29,440 --> 00:11:33,839 specific um attack execution so take 234 00:11:33,839 --> 00:11:36,360 note of this execution 235 00:11:36,360 --> 00:11:40,079 ID this is the unique ID assigned to 236 00:11:40,079 --> 00:11:42,279 this invocation up with workflow in 237 00:11:42,279 --> 00:11:47,560 Google Cloud it ends in 238 00:11:51,720 --> 00:11:54,760 b386 this value is going to be appended 239 00:11:54,760 --> 00:11:57,600 to the user agent um for us to be able 240 00:11:57,600 --> 00:12:00,399 to easily identify it and correlate it 241 00:12:00,399 --> 00:12:02,959 in the in cloud 242 00:12:02,959 --> 00:12:06,000 trail we can even take a look at the 243 00:12:06,000 --> 00:12:08,560 attack workflow and see where that 244 00:12:08,560 --> 00:12:11,399 happens we take a look at the get secret 245 00:12:11,399 --> 00:12:13,839 value it's going to call get secret 246 00:12:13,839 --> 00:12:16,680 value in the secret manager 247 00:12:16,680 --> 00:12:20,680 API and the user agent that's going to 248 00:12:20,680 --> 00:12:26,560 send is derf D SM sm- retriev secret 249 00:12:26,560 --> 00:12:30,279 equals equals and then the execution ID 250 00:12:30,279 --> 00:12:32,639 of the Google workflow so this is the 251 00:12:32,639 --> 00:12:34,639 value that we're going to be looking for 252 00:12:34,639 --> 00:12:36,680 um just to correlate that up in the 253 00:12:36,680 --> 00:12:40,760 Box okay Switching over to cloud 254 00:12:40,760 --> 00:12:43,880 trail remember this um attack technique 255 00:12:43,880 --> 00:12:46,279 is making two AP calls first it's doing 256 00:12:46,279 --> 00:12:49,120 the list secrets and then it's doing the 257 00:12:49,120 --> 00:12:50,480 describ 258 00:12:50,480 --> 00:12:52,800 secrets um sorry 259 00:12:52,800 --> 00:12:56,320 the get secret value specifically so I'm 260 00:12:56,320 --> 00:12:58,930 going to look for this get secret value 261 00:12:58,930 --> 00:13:00,760 [Music] 262 00:13:00,760 --> 00:13:02,480 under the event names it might take a 263 00:13:02,480 --> 00:13:04,360 couple minutes to 264 00:13:04,360 --> 00:13:07,399 populate um looks like this is the one 265 00:13:07,399 --> 00:13:10,440 that we did just a couple minutes 266 00:13:10,440 --> 00:13:14,560 ago user one let's drill into this let's 267 00:13:14,560 --> 00:13:18,000 take a look at the user agent and we see 268 00:13:18,000 --> 00:13:22,120 here the user agent is derf SMS retriev 269 00:13:22,120 --> 00:13:25,320 secret equals equals and then that 270 00:13:25,320 --> 00:13:27,760 execution ID that we were looking at 271 00:13:27,760 --> 00:13:30,680 that ends in B 272 00:13:30,680 --> 00:13:35,160 386 um so this a recap on how to um 273 00:13:35,160 --> 00:13:38,720 execute a derf uh attack technique but 274 00:13:38,720 --> 00:13:41,519 then also find the correlating logs um 275 00:13:41,519 --> 00:13:45,600 by matching up the workflow execution 276 00:13:52,399 --> 00:13:56,120 ID yeah so the the demo is a little um 277 00:13:56,120 --> 00:13:57,920 anticlimactic really it's like pressing 278 00:13:57,920 --> 00:13:59,600 a button 279 00:13:59,600 --> 00:14:02,519 I will press the button and it hacks uh 280 00:14:02,519 --> 00:14:06,120 Magic um so how is all of that Mischief 281 00:14:06,120 --> 00:14:08,480 Managed right if anything's too simple 282 00:14:08,480 --> 00:14:10,000 there's got to be there's got to be 283 00:14:10,000 --> 00:14:13,079 something under there right 284 00:14:13,079 --> 00:14:16,000 um to give you a little idea of what's 285 00:14:16,000 --> 00:14:20,360 behind all of that um the um the 286 00:14:20,360 --> 00:14:23,440 backbone of of this is deployed again in 287 00:14:23,440 --> 00:14:26,399 Google Cloud what happened was when I 288 00:14:26,399 --> 00:14:29,600 pressed that button in Google workflows 289 00:14:29,600 --> 00:14:31,360 um the attack was 290 00:14:31,360 --> 00:14:34,120 executed all of the details of the API 291 00:14:34,120 --> 00:14:35,040 call to 292 00:14:35,040 --> 00:14:40,959 AWS were passed Downstream to a proxy 293 00:14:40,959 --> 00:14:43,720 application the proxy application then 294 00:14:43,720 --> 00:14:47,360 pulled the AWS access keys for whatever 295 00:14:47,360 --> 00:14:49,839 user I specified user one user 296 00:14:49,839 --> 00:14:53,120 two um then in runtime then it signed 297 00:14:53,120 --> 00:14:55,600 that request and then forwarded the 298 00:14:55,600 --> 00:14:57,160 request on to 299 00:14:57,160 --> 00:14:59,279 AWS so 300 00:14:59,279 --> 00:15:04,279 all attacks um sent to AWS are emanating 301 00:15:04,279 --> 00:15:08,079 from that AWS proxy 302 00:15:10,519 --> 00:15:13,480 application just like the proxy 303 00:15:13,480 --> 00:15:16,240 application just like all of the 304 00:15:16,240 --> 00:15:19,560 attacks all of the infrastructure that 305 00:15:19,560 --> 00:15:22,079 needs to be manipulated all of this is 306 00:15:22,079 --> 00:15:25,680 managed by terraform it's all managed by 307 00:15:25,680 --> 00:15:29,319 one big one big apply one big uh 308 00:15:29,319 --> 00:15:32,240 one big destroy so let's say you have an 309 00:15:32,240 --> 00:15:35,800 attack technique that makes an S3 bucket 310 00:15:35,800 --> 00:15:38,399 public that attack technique will make 311 00:15:38,399 --> 00:15:41,120 the S3 bucket public and then with a 312 00:15:41,120 --> 00:15:42,880 kind of a background default user it 313 00:15:42,880 --> 00:15:44,680 then reverts that change to kind of 314 00:15:44,680 --> 00:15:47,560 restage the 315 00:15:48,519 --> 00:15:50,480 infrastructure um how does it work in 316 00:15:50,480 --> 00:15:53,240 Google Cloud um actually it's a little 317 00:15:53,240 --> 00:15:55,120 bit easier believe it or not and not 318 00:15:55,120 --> 00:15:58,360 because I'm using Google to to attack 319 00:15:58,360 --> 00:16:00,839 Google Google um but because they have a 320 00:16:00,839 --> 00:16:03,600 sane authorization system and use ooth 321 00:16:03,600 --> 00:16:05,800 and make use of beer tokens so there's 322 00:16:05,800 --> 00:16:08,040 really no need for that silly proxy 323 00:16:08,040 --> 00:16:10,560 application um an attack operator 324 00:16:10,560 --> 00:16:12,839 presses the button on the attack 325 00:16:12,839 --> 00:16:15,279 technique um either presses the button 326 00:16:15,279 --> 00:16:16,839 as I showed on the console or 327 00:16:16,839 --> 00:16:20,079 programmatically hits it um then the 328 00:16:20,079 --> 00:16:22,040 service account attached to the workflow 329 00:16:22,040 --> 00:16:24,240 impersonates one of two other service 330 00:16:24,240 --> 00:16:27,160 accounts in the Target project it then 331 00:16:27,160 --> 00:16:29,040 executes the attack in that Target 332 00:16:29,040 --> 00:16:31,040 project so the derf requires actually 333 00:16:31,040 --> 00:16:33,880 two projects one for deployment and one 334 00:16:33,880 --> 00:16:36,920 for targeting 335 00:16:39,279 --> 00:16:41,560 resources um so as you might appreciate 336 00:16:41,560 --> 00:16:43,519 there's yeah a decent amount of 337 00:16:43,519 --> 00:16:45,959 infrastructure um there to kind of 338 00:16:45,959 --> 00:16:49,279 manage all of this this 339 00:16:49,279 --> 00:16:51,600 miracle um fortunately you can get it up 340 00:16:51,600 --> 00:16:54,399 and down really easily like I I clock it 341 00:16:54,399 --> 00:16:56,639 under 2 minutes typically 3 minutes if 342 00:16:56,639 --> 00:16:59,240 my computer's feeling hogish 343 00:16:59,240 --> 00:17:01,319 um deploying and destroying is really 344 00:17:01,319 --> 00:17:03,639 easy um I've been working on this for 345 00:17:03,639 --> 00:17:05,400 about 2 years and I don't think I've had 346 00:17:05,400 --> 00:17:09,559 an AWS bill over $10 just leaving it up 347 00:17:09,559 --> 00:17:13,119 and a gcp bill over $5 with a thousands 348 00:17:13,119 --> 00:17:15,880 of workflow executions so if you did 349 00:17:15,880 --> 00:17:17,599 just want to just deploy it and have it 350 00:17:17,599 --> 00:17:20,839 up and running um $15 a month is what 351 00:17:20,839 --> 00:17:23,039 you're looking at 352 00:17:23,039 --> 00:17:26,039 um and just a reminder um everything you 353 00:17:26,039 --> 00:17:29,440 need is is with that apply command um so 354 00:17:29,440 --> 00:17:32,760 all of the attacker uh 355 00:17:32,760 --> 00:17:36,039 credentials um all of the workflows that 356 00:17:36,039 --> 00:17:39,000 codify your attack techniques all of the 357 00:17:39,000 --> 00:17:41,440 target 358 00:17:42,000 --> 00:17:46,240 infrastructure um probably the second 359 00:17:46,240 --> 00:17:48,720 most important question that I want to 360 00:17:48,720 --> 00:17:51,840 address after why the hell did I even 361 00:17:51,840 --> 00:17:54,760 build a thing is when to use 362 00:17:54,760 --> 00:18:00,400 it um I would say use the derf 363 00:18:00,400 --> 00:18:04,720 when you need a tool to manage your 364 00:18:04,720 --> 00:18:07,799 infrastructure for you the derf is not a 365 00:18:07,799 --> 00:18:10,640 pen testing tool it's not something that 366 00:18:10,640 --> 00:18:12,400 you're going to use when you get dropped 367 00:18:12,400 --> 00:18:13,440 into an 368 00:18:13,440 --> 00:18:16,120 environment it has the concept of 369 00:18:16,120 --> 00:18:18,120 deploying all of the infrastructure you 370 00:18:18,120 --> 00:18:21,080 need to manipulate in order to generate 371 00:18:21,080 --> 00:18:24,640 detection samples in order to test 372 00:18:24,640 --> 00:18:28,080 controls and I I will be saddened to 373 00:18:28,080 --> 00:18:30,120 hear if somebody's trying to use it on a 374 00:18:30,120 --> 00:18:33,039 pen test it's just not it's not the tool 375 00:18:33,039 --> 00:18:35,080 for the job 376 00:18:35,080 --> 00:18:40,640 right um also use the derf when you need 377 00:18:40,640 --> 00:18:45,039 to test your controls your or policy 378 00:18:45,039 --> 00:18:48,799 constraints your scps right this is 379 00:18:48,799 --> 00:18:50,520 above and beyond something like audit 380 00:18:50,520 --> 00:18:52,240 manager that's going to be pulling your 381 00:18:52,240 --> 00:18:54,679 evidence this is just like a continuous 382 00:18:54,679 --> 00:18:57,200 validation of testing your assumptions 383 00:18:57,200 --> 00:18:58,919 can I do this I shouldn't can I do this 384 00:18:58,919 --> 00:19:00,480 I should can I do this I should let me 385 00:19:00,480 --> 00:19:04,280 know if it happens 386 00:19:04,320 --> 00:19:07,640 right and also use the derf when you 387 00:19:07,640 --> 00:19:11,200 need an extensible tool you need 388 00:19:11,200 --> 00:19:12,960 something that's pretty much off the 389 00:19:12,960 --> 00:19:15,200 shelf that you need to then customize to 390 00:19:15,200 --> 00:19:18,960 your own internal needs the Der is come 391 00:19:18,960 --> 00:19:21,520 comes with a ton of pre-built attack 392 00:19:21,520 --> 00:19:24,280 techniques give me about another week or 393 00:19:24,280 --> 00:19:27,600 so and it should have attack parody with 394 00:19:27,600 --> 00:19:30,640 Stratus red team so you can use Stratus 395 00:19:30,640 --> 00:19:33,840 red team locally and then execute those 396 00:19:33,840 --> 00:19:36,320 same attack techniques with the derf 397 00:19:36,320 --> 00:19:37,520 right but there's going to be a time 398 00:19:37,520 --> 00:19:40,400 when you need to build out your own 399 00:19:40,400 --> 00:19:43,919 internal test Suites this is really 400 00:19:43,919 --> 00:19:46,600 extensible if you know yaml and you can 401 00:19:46,600 --> 00:19:51,719 follow some instructions yes you can 402 00:19:53,320 --> 00:19:56,240 um I'll just do a quick overview of the 403 00:19:56,240 --> 00:19:59,520 road map um Azure coverage currently the 404 00:19:59,520 --> 00:20:02,960 derf supports AWS and gcp I will avoid 405 00:20:02,960 --> 00:20:06,280 the Azure coverage road map like the 406 00:20:06,280 --> 00:20:08,960 plague um if anybody wants to do it let 407 00:20:08,960 --> 00:20:12,440 me know it's it's on the docket 408 00:20:12,440 --> 00:20:16,600 technically um I really want to expand 409 00:20:16,600 --> 00:20:18,240 expand out some attack techniques to 410 00:20:18,240 --> 00:20:20,480 cover um CIS benchmarks I think that'd 411 00:20:20,480 --> 00:20:22,760 be a really cool offering and then I 412 00:20:22,760 --> 00:20:26,000 also want to have the ability to have um 413 00:20:26,000 --> 00:20:27,640 automation built in currently when you 414 00:20:27,640 --> 00:20:29,120 deploy the derf you have to then 415 00:20:29,120 --> 00:20:31,520 configure your own automation like Cloud 416 00:20:31,520 --> 00:20:33,360 scheduler to like automatically hit 417 00:20:33,360 --> 00:20:35,600 these um attack techniques' be really 418 00:20:35,600 --> 00:20:37,640 great if Cloud scheduler like spun up on 419 00:20:37,640 --> 00:20:39,400 its own and then you could say yeah run 420 00:20:39,400 --> 00:20:41,840 it at session Cadence um so actually 421 00:20:41,840 --> 00:20:43,840 that's probably the most near-term item 422 00:20:43,840 --> 00:20:46,600 that I'm going to tackle um but I don't 423 00:20:46,600 --> 00:20:48,000 think I have a ton of time but I'm happy 424 00:20:48,000 --> 00:20:50,919 to take one question 10 minutes ah 10 425 00:20:50,919 --> 00:20:53,200 minutes cool does anybody have any 426 00:20:53,200 --> 00:20:55,360 questions about 427 00:20:55,360 --> 00:20:57,120 it yes 428 00:20:57,120 --> 00:21:00,280 sir seems like so pretty Cloud focused 429 00:21:00,280 --> 00:21:02,799 um because infrastructure is really 430 00:21:02,799 --> 00:21:04,440 complicated not everything lives in the 431 00:21:04,440 --> 00:21:08,120 cloud any plans to make it extensible to 432 00:21:08,120 --> 00:21:09,279 other types of 433 00:21:09,279 --> 00:21:12,480 attacks yeah Network reconnaissance yeah 434 00:21:12,480 --> 00:21:15,200 the question the question is um is there 435 00:21:15,200 --> 00:21:18,840 any plans to make the derf and you know 436 00:21:18,840 --> 00:21:20,679 Target other types of infrastructure 437 00:21:20,679 --> 00:21:22,159 perhaps Network 438 00:21:22,159 --> 00:21:25,799 reconnaissance um you know if you if if 439 00:21:25,799 --> 00:21:29,120 it can be invoked by an HTP requ EST the 440 00:21:29,120 --> 00:21:31,880 derf is is well suited to handle that 441 00:21:31,880 --> 00:21:33,720 that's all the workflows are is just 442 00:21:33,720 --> 00:21:35,559 describe what kind of HTP requests you 443 00:21:35,559 --> 00:21:39,240 would like to make um so um I don't 444 00:21:39,240 --> 00:21:40,760 think I'll will be doing that because I 445 00:21:40,760 --> 00:21:42,760 I live in the clouds I'm not coming down 446 00:21:42,760 --> 00:21:44,600 but if somebody else wants to it's it's 447 00:21:44,600 --> 00:21:47,000 set up to do that 448 00:21:47,000 --> 00:21:49,000 absolutely anybody else anybody else 449 00:21:49,000 --> 00:21:49,919 anybody 450 00:21:49,919 --> 00:21:53,480 else yeah the open source the Der is 451 00:21:53,480 --> 00:21:55,799 open source gosh did I miss that yeah no 452 00:21:55,799 --> 00:21:58,240 it's sound like it is oh yeah okay it's 453 00:21:58,240 --> 00:22:00,080 available on GitHub please please like 454 00:22:00,080 --> 00:22:01,679 And subscribe for 455 00:22:01,679 --> 00:22:04,679 sure 456 00:22:06,840 --> 00:22:09,799 yeah yeah um you know what if you just 457 00:22:09,799 --> 00:22:14,039 go to theed dir. cloud theed dir. cloud 458 00:22:14,039 --> 00:22:16,600 that should get you started yeah link to 459 00:22:16,600 --> 00:22:19,400 the repo link to the docks everything I 460 00:22:19,400 --> 00:22:21,679 talked in and honestly a lot more about 461 00:22:21,679 --> 00:22:24,320 how to create your own attack modules 462 00:22:24,320 --> 00:22:26,520 everything so I'm excited to hear what 463 00:22:26,520 --> 00:22:30,200 people do with it anybody else yeah so 464 00:22:30,200 --> 00:22:32,360 um kind of a newbie question i' I've 465 00:22:32,360 --> 00:22:33,880 been a cloud developer for three years 466 00:22:33,880 --> 00:22:36,279 I've very security though um what are 467 00:22:36,279 --> 00:22:38,240 the life cycle of these attacks like if 468 00:22:38,240 --> 00:22:40,520 you like make an attack isn't it 469 00:22:40,520 --> 00:22:42,840 possible that the CSP could like patch 470 00:22:42,840 --> 00:22:45,320 it or something like how oh the question 471 00:22:45,320 --> 00:22:46,880 is what what are the life cycle of 472 00:22:46,880 --> 00:22:49,039 attacks if I make an attack technique is 473 00:22:49,039 --> 00:22:52,080 it possible that a CSP could patch it 474 00:22:52,080 --> 00:22:53,760 you know the attacks that we're focused 475 00:22:53,760 --> 00:22:56,240 on on aren't exactly zero days they're 476 00:22:56,240 --> 00:22:59,720 just you know features not bugs right so 477 00:22:59,720 --> 00:23:01,880 um like I mentioned before making an S3 478 00:23:01,880 --> 00:23:04,120 bucket public there's a that's a feature 479 00:23:04,120 --> 00:23:06,279 not a bug but also maybe an indication 480 00:23:06,279 --> 00:23:09,600 that something's not right right so um 481 00:23:09,600 --> 00:23:10,840 that's not something that the CSP is 482 00:23:10,840 --> 00:23:12,480 ever going to patch but it also could be 483 00:23:12,480 --> 00:23:14,120 a component of your threat detection in 484 00:23:14,120 --> 00:23:15,400 the 485 00:23:15,400 --> 00:23:19,080 cloud yeah yes are there any detections 486 00:23:19,080 --> 00:23:20,679 you have now that you haven't found in 487 00:23:20,679 --> 00:23:23,440 any other tools yet uh the question was 488 00:23:23,440 --> 00:23:25,919 do I have any detections in the derf 489 00:23:25,919 --> 00:23:27,919 that I haven't found in any other tools 490 00:23:27,919 --> 00:23:30,000 is that the correct question okay so 491 00:23:30,000 --> 00:23:31,600 that's a really great question I'm 492 00:23:31,600 --> 00:23:35,720 focused on first making sure that I have 493 00:23:35,720 --> 00:23:38,159 aack technique parody with Stratus red 494 00:23:38,159 --> 00:23:40,480 team because I think it's really 495 00:23:40,480 --> 00:23:42,640 important that end 496 00:23:42,640 --> 00:23:44,960 users don't have 497 00:23:44,960 --> 00:23:47,720 to you know make a decision based on 498 00:23:47,720 --> 00:23:50,559 attack techniques to use tool a or to 499 00:23:50,559 --> 00:23:52,760 Tool B right because a lot of times it's 500 00:23:52,760 --> 00:23:54,080 more about 501 00:23:54,080 --> 00:23:58,600 like how does this to Tool deploy what's 502 00:23:58,600 --> 00:24:01,039 what's its workflow not about like it 503 00:24:01,039 --> 00:24:03,159 has that work has that technique or is 504 00:24:03,159 --> 00:24:06,760 that that technique I probably will be 505 00:24:06,760 --> 00:24:10,000 publishing some derf unique ones but 506 00:24:10,000 --> 00:24:12,480 then I'll probably say hey Kristoff over 507 00:24:12,480 --> 00:24:14,480 at data dog do you want to publish the 508 00:24:14,480 --> 00:24:16,679 equivalent of Stratus red team I just 509 00:24:16,679 --> 00:24:18,240 think it's really good for our community 510 00:24:18,240 --> 00:24:20,799 to kind of just maintain parity along 511 00:24:20,799 --> 00:24:23,320 along the tooling and just say yeah 512 00:24:23,320 --> 00:24:24,440 we're gonna just they're like 513 00:24:24,440 --> 00:24:26,320 Commodities right does let's just have 514 00:24:26,320 --> 00:24:28,520 this commodification of it and then 515 00:24:28,520 --> 00:24:29,880 we'll just have different tooling for 516 00:24:29,880 --> 00:24:34,000 different use cases that's my theory 517 00:24:34,000 --> 00:24:38,480 anyways yes um do you think a use case 518 00:24:38,480 --> 00:24:41,000 for the tool could be validating 519 00:24:41,000 --> 00:24:43,120 security finding from other tools like 520 00:24:43,120 --> 00:24:44,720 based on the outputs from other tools 521 00:24:44,720 --> 00:24:46,960 validating if those findings are real 522 00:24:46,960 --> 00:24:49,799 positive like trying to exploit those 523 00:24:49,799 --> 00:24:52,640 findings um the question is do I think 524 00:24:52,640 --> 00:24:55,120 that the use case for the tool is to 525 00:24:55,120 --> 00:24:58,760 maybe um attempt to 526 00:24:58,760 --> 00:25:01,760 uh validate findings from other tools 527 00:25:01,760 --> 00:25:05,159 say if a tool has one finding the derf 528 00:25:05,159 --> 00:25:08,039 would go ahead and say is this is this 529 00:25:08,039 --> 00:25:09,480 real or 530 00:25:09,480 --> 00:25:13,399 not maybe you know so I tend to look at 531 00:25:13,399 --> 00:25:15,880 these that sounds like a oneoff thing 532 00:25:15,880 --> 00:25:17,520 you know like you want to just do a 533 00:25:17,520 --> 00:25:20,679 oneoff thing I would just use the CLI 534 00:25:20,679 --> 00:25:23,640 for that honestly and writing a yaml 535 00:25:23,640 --> 00:25:26,039 file is very easy but it also suggests 536 00:25:26,039 --> 00:25:27,320 I'm going to be running this more than 537 00:25:27,320 --> 00:25:28,520 once 538 00:25:28,520 --> 00:25:30,559 right it also suggests like I have a 539 00:25:30,559 --> 00:25:33,679 reason to automate this or like 540 00:25:33,679 --> 00:25:36,480 disseminate it to a larger group so ask 541 00:25:36,480 --> 00:25:38,480 yourself am I doing this as a oneoff or 542 00:25:38,480 --> 00:25:39,919 is there a reason to kind of like 543 00:25:39,919 --> 00:25:42,080 publish this and have it automated and 544 00:25:42,080 --> 00:25:43,279 that's kind of like the the 545 00:25:43,279 --> 00:25:45,960 differentiator or I like to call it the 546 00:25:45,960 --> 00:25:48,039 differentiator on why you would use it 547 00:25:48,039 --> 00:25:50,480 or not 548 00:25:50,480 --> 00:25:54,760 right any other questions oh hi yeah hi 549 00:25:54,760 --> 00:25:56,880 so you mentioned earlier you alluded to 550 00:25:56,880 --> 00:25:59,200 like the admin scenario like you know 551 00:25:59,200 --> 00:26:01,080 you need admin credentials to deploy all 552 00:26:01,080 --> 00:26:05,200 that stuff so uh for the data scientists 553 00:26:05,200 --> 00:26:07,080 developers who are using your framework 554 00:26:07,080 --> 00:26:08,600 what permissions what arback do they 555 00:26:08,600 --> 00:26:10,480 need oh that's great what permissions do 556 00:26:10,480 --> 00:26:13,880 you need to use it um so and because all 557 00:26:13,880 --> 00:26:17,200 the attack techniques are executed with 558 00:26:17,200 --> 00:26:20,799 um Google workflows how you um have 559 00:26:20,799 --> 00:26:22,520 access control around your Tech 560 00:26:22,520 --> 00:26:25,840 techniques is Google Im so you give them 561 00:26:25,840 --> 00:26:28,880 the um the workflow in inv ER role uh 562 00:26:28,880 --> 00:26:30,399 you can get that at the project level to 563 00:26:30,399 --> 00:26:33,279 say Hey you know data scientist hey 564 00:26:33,279 --> 00:26:35,640 developers you can access you can invoke 565 00:26:35,640 --> 00:26:37,320 any of these attack techniques or you 566 00:26:37,320 --> 00:26:39,080 can say no specifically you can only 567 00:26:39,080 --> 00:26:41,240 invoke this one attack technique that 568 00:26:41,240 --> 00:26:43,159 attack technique does not execute as 569 00:26:43,159 --> 00:26:46,159 them it does not execute as the workflow 570 00:26:46,159 --> 00:26:48,480 it executes as a couple users that they 571 00:26:48,480 --> 00:26:50,000 can specify as 572 00:26:50,000 --> 00:26:51,960 parameters that answer your 573 00:26:51,960 --> 00:26:53,919 question okay 574 00:26:53,919 --> 00:26:56,600 yeah yes in the 575 00:26:56,600 --> 00:26:58,640 back 576 00:26:58,640 --> 00:27:00,520 oh y you 577 00:27:00,520 --> 00:27:03,799 yeah thank you for the contribution 578 00:27:03,799 --> 00:27:06,919 really quick question related to was are 579 00:27:06,919 --> 00:27:10,360 asking we uh consider wrapping around 580 00:27:10,360 --> 00:27:12,919 the existing like providing some you 581 00:27:12,919 --> 00:27:15,679 know additional features as you know a 582 00:27:15,679 --> 00:27:18,279 correlation is 583 00:27:18,279 --> 00:27:22,320 called ex 584 00:27:24,320 --> 00:27:26,640 we the question was would I consider 585 00:27:26,640 --> 00:27:28,799 like a wrapper around existing tooling 586 00:27:28,799 --> 00:27:31,159 to leverage what's already built did you 587 00:27:31,159 --> 00:27:34,279 have a particular tool in mind um for 588 00:27:34,279 --> 00:27:37,000 for example stravis right yeah that's a 589 00:27:37,000 --> 00:27:39,159 great example yeah so that's one of the 590 00:27:39,159 --> 00:27:40,919 reasons why I'm actually doing the 591 00:27:40,919 --> 00:27:43,279 conversion of taking we have a Stratus 592 00:27:43,279 --> 00:27:45,320 we have Stratus routine module I'm 593 00:27:45,320 --> 00:27:46,720 actually just converting that into a 594 00:27:46,720 --> 00:27:49,279 workflow takes me anywhere between 30 595 00:27:49,279 --> 00:27:51,799 minutes to 3 hours depending on if I run 596 00:27:51,799 --> 00:27:54,720 into a situation so I just need to sit 597 00:27:54,720 --> 00:27:56,039 down and crank the rest of it out I 598 00:27:56,039 --> 00:27:58,799 think I've got like 20 modules right now 599 00:27:58,799 --> 00:28:01,120 when he has 35 600 00:28:01,120 --> 00:28:04,360 so yes I'm definitely committed to 601 00:28:04,360 --> 00:28:07,159 having the attack technique parody but 602 00:28:07,159 --> 00:28:08,880 it's not a wrapper it's a conversion 603 00:28:08,880 --> 00:28:11,279 it's just we'll we'll stay in in in lock 604 00:28:11,279 --> 00:28:13,720 sync so we can just have 605 00:28:13,720 --> 00:28:16,240 consistency Yeah you mentioned some of 606 00:28:16,240 --> 00:28:18,559 the motivations are detection 607 00:28:18,559 --> 00:28:21,120 reliability control validation can you 608 00:28:21,120 --> 00:28:22,440 talk a little bit to the developer 609 00:28:22,440 --> 00:28:23,919 workflow the exection engineering 610 00:28:23,919 --> 00:28:26,120 workflow and how you do you kick this 611 00:28:26,120 --> 00:28:27,480 off sort of manually while you're 612 00:28:27,480 --> 00:28:31,440 veloping a detection to generate the 613 00:28:31,440 --> 00:28:33,240 that you're going to yeah the question 614 00:28:33,240 --> 00:28:34,919 was can I talk to you a little bit about 615 00:28:34,919 --> 00:28:39,320 the the workflow around you know the use 616 00:28:39,320 --> 00:28:41,480 cases I mentioned like you know a data 617 00:28:41,480 --> 00:28:43,440 scientist needs to train a model is that 618 00:28:43,440 --> 00:28:44,360 what you're thinking and like a 619 00:28:44,360 --> 00:28:47,679 developer needs code coverage or so I 620 00:28:47,679 --> 00:28:49,360 can you can definitely say like you know 621 00:28:49,360 --> 00:28:51,200 there's cicd pipelines you can put in 622 00:28:51,200 --> 00:28:54,519 place that it's needs to exercise um a 623 00:28:54,519 --> 00:28:57,600 detection model right and those cic C 624 00:28:57,600 --> 00:29:00,679 pipelines are intended to exercise the 625 00:29:00,679 --> 00:29:02,799 entire code base then the code base will 626 00:29:02,799 --> 00:29:05,600 then you know spit out a 627 00:29:05,600 --> 00:29:07,640 detection um depending on how you have 628 00:29:07,640 --> 00:29:09,000 that configured is it going to go to 629 00:29:09,000 --> 00:29:11,320 somebody's UI is it going to send a 630 00:29:11,320 --> 00:29:13,600 slack alert is it going to then go to a 631 00:29:13,600 --> 00:29:15,559 Sim but you need a kicker for all of 632 00:29:15,559 --> 00:29:17,200 that right so they're generally like 633 00:29:17,200 --> 00:29:20,080 it's like a kicker to a c pipeline that 634 00:29:20,080 --> 00:29:22,880 makes sense we can talk more later 635 00:29:22,880 --> 00:29:25,960 yeah one more question do you want oh 636 00:29:25,960 --> 00:29:28,080 yeah hi in the back um I know you talked 637 00:29:28,080 --> 00:29:29,720 about the correlation with the workflow 638 00:29:29,720 --> 00:29:31,559 ID didn't any like Pro tips to kind of 639 00:29:31,559 --> 00:29:33,240 sip through like what was successful 640 00:29:33,240 --> 00:29:35,120 maybe what was a failure when you're 641 00:29:35,120 --> 00:29:37,279 generating some of these events oh the 642 00:29:37,279 --> 00:29:40,919 question was any pro tip on um sifting 643 00:29:40,919 --> 00:29:42,760 through what was success and what was 644 00:29:42,760 --> 00:29:46,120 failure when generating the events um 645 00:29:46,120 --> 00:29:47,440 all of the attack techniques I've 646 00:29:47,440 --> 00:29:50,200 written have um pretty decent error 647 00:29:50,200 --> 00:29:55,039 messages that um go through the HTP 648 00:29:55,039 --> 00:29:58,240 response codes and will let you know 649 00:29:58,240 --> 00:30:00,960 it's a you know 400 and why it's a 44 650 00:30:00,960 --> 00:30:05,039 this is why it's a 200 it's a success so 651 00:30:05,039 --> 00:30:08,039 um you should know based on the feedback 652 00:30:08,039 --> 00:30:09,600 provided to you when executing that 653 00:30:09,600 --> 00:30:11,360 workflow whether or not that attack 654 00:30:11,360 --> 00:30:14,039 execution was successful and whatever 655 00:30:14,039 --> 00:30:16,799 success means in that 656 00:30:16,799 --> 00:30:20,320 workflow so it's built in yeah okay uh 657 00:30:20,320 --> 00:30:21,279 catch me later if you have any more 658 00:30:21,279 --> 00:30:23,440 questions thank 659 00:30:23,440 --> 00:30:26,440 you