1
00:00:00,480 --> 00:00:02,399
all right so next up we've got two

2
00:00:02,399 --> 00:00:05,200
speakers with us we got Terren Deus and

3
00:00:05,200 --> 00:00:07,759
Justin abara Terren is a security

4
00:00:07,759 --> 00:00:09,400
detection engineer for elastic where he

5
00:00:09,400 --> 00:00:11,240
balances engineering development with

6
00:00:11,240 --> 00:00:13,480
threat research and Justin is the leader

7
00:00:13,480 --> 00:00:14,719
of the threat research and detection

8
00:00:14,719 --> 00:00:17,160
engineering team at elastic in this talk

9
00:00:17,160 --> 00:00:19,320
they'll speak about SWAT the simple

10
00:00:19,320 --> 00:00:21,720
workspace attack tool which is a cyber

11
00:00:21,720 --> 00:00:23,080
security application grounded in the

12
00:00:23,080 --> 00:00:25,320
miter attack framework uh swats written

13
00:00:25,320 --> 00:00:27,400
in Python it's instrumental in emulating

14
00:00:27,400 --> 00:00:29,240
red teing Behavior specifically against

15
00:00:29,240 --> 00:00:31,800
Google workspace and acting as a post

16
00:00:31,800 --> 00:00:34,840
compromise tool so please give a warm

17
00:00:34,840 --> 00:00:38,320
welcome to Terren and

18
00:00:38,950 --> 00:00:41,960
[Applause]

19
00:00:41,960 --> 00:00:45,719
Justin hello everybody um if you see my

20
00:00:45,719 --> 00:00:47,039
face throughout the talk and it's very

21
00:00:47,039 --> 00:00:49,239
Stern it's me trying to control my

22
00:00:49,239 --> 00:00:51,359
excitement inside and my nervousness as

23
00:00:51,359 --> 00:00:54,920
well um so yeah just a heads up uh so

24
00:00:54,920 --> 00:00:56,359
yeah let's go ahead and get started we

25
00:00:56,359 --> 00:00:58,160
got a lot of demoing hopefully we're try

26
00:00:58,160 --> 00:01:01,120
not to kill you with uh with with slides

27
00:01:01,120 --> 00:01:04,559
but um yeah so let's introduce SWAT uh

28
00:01:04,559 --> 00:01:06,880
it's a simple Google workspace attack

29
00:01:06,880 --> 00:01:09,880
tool acronym very easy to understand and

30
00:01:09,880 --> 00:01:12,479
it went very

31
00:01:12,840 --> 00:01:15,000
well so we'll kind of just Breeze

32
00:01:15,000 --> 00:01:17,200
through this again who am I I'm Terence

33
00:01:17,200 --> 00:01:19,280
De Jesus uh threat research and

34
00:01:19,280 --> 00:01:21,680
detection engineer at elastic um

35
00:01:21,680 --> 00:01:23,680
focusing on uh detection rules for a lot

36
00:01:23,680 --> 00:01:26,280
of different Cloud um Integrations AWS

37
00:01:26,280 --> 00:01:29,400
Google workspace gcp things like that um

38
00:01:29,400 --> 00:01:30,840
and then yeah do a lot of engineering

39
00:01:30,840 --> 00:01:32,439
for research development as well so a

40
00:01:32,439 --> 00:01:34,520
lot of cicd things um back in

41
00:01:34,520 --> 00:01:37,000
engineering as

42
00:01:37,000 --> 00:01:39,159
well yep and as you heard my name is

43
00:01:39,159 --> 00:01:41,280
Justin um I do lead that threat research

44
00:01:41,280 --> 00:01:42,680
and detection engineering team at

45
00:01:42,680 --> 00:01:45,040
elastic uh primarily Focus around

46
00:01:45,040 --> 00:01:47,360
inpoint Cloud Web but all kinds of

47
00:01:47,360 --> 00:01:48,960
threat research and other detection

48
00:01:48,960 --> 00:01:51,360
engineering enablement we spend a lot of

49
00:01:51,360 --> 00:01:53,399
time building prevention capabilities

50
00:01:53,399 --> 00:01:55,479
Sim EDR all kinds of other things at

51
00:01:55,479 --> 00:01:57,439
scale and yeah this is this is awesome

52
00:01:57,439 --> 00:01:59,399
seeing how packed this room is so we're

53
00:01:59,399 --> 00:02:01,840
excited

54
00:02:02,759 --> 00:02:04,600
yeah you'll see us uh pass the mic quite

55
00:02:04,600 --> 00:02:06,799
quite often here so this is not scripted

56
00:02:06,799 --> 00:02:08,360
at all it's only one

57
00:02:08,360 --> 00:02:10,399
mic uh so yeah hope everybody's a

58
00:02:10,399 --> 00:02:12,120
SpongeBob fan but uh it's probably one

59
00:02:12,120 --> 00:02:15,080
of my favorite episodes

60
00:02:15,200 --> 00:02:17,920
there uh so moving on to the agenda um

61
00:02:17,920 --> 00:02:19,239
we'll talk a little bit about the

62
00:02:19,239 --> 00:02:21,000
background and inspiration and sorry

63
00:02:21,000 --> 00:02:22,160
I'll try to move out of the way for you

64
00:02:22,160 --> 00:02:23,840
guys as well uh we'll talk about

65
00:02:23,840 --> 00:02:25,480
background and inspiration uh we'll do

66
00:02:25,480 --> 00:02:27,720
like an introduction to swat um what was

67
00:02:27,720 --> 00:02:29,280
the core design of SWAT and kind of why

68
00:02:29,280 --> 00:02:30,599
did we go

69
00:02:30,599 --> 00:02:32,400
that route um we'll also do some

70
00:02:32,400 --> 00:02:34,200
commands we'll demo some commands as

71
00:02:34,200 --> 00:02:36,480
well um we'll talk about authentication

72
00:02:36,480 --> 00:02:39,480
and authorization inside of SWAT uh

73
00:02:39,480 --> 00:02:41,000
which we're still figuring out to this

74
00:02:41,000 --> 00:02:43,840
day um and then we'll do emulations

75
00:02:43,840 --> 00:02:45,519
we'll do a couple of emulation demos as

76
00:02:45,519 --> 00:02:47,319
well for what we have uh we'll talk

77
00:02:47,319 --> 00:02:48,599
about road map and then we'll try to

78
00:02:48,599 --> 00:02:51,519
leave some time at the end for uh FAQ if

79
00:02:51,519 --> 00:02:54,239
anybody has any questions um yeah feel

80
00:02:54,239 --> 00:02:57,000
free to Lobby them add

81
00:02:57,000 --> 00:03:00,080
us um so yeah background and inspiration

82
00:03:00,080 --> 00:03:01,560
uh the the simplest way to put it is

83
00:03:01,560 --> 00:03:04,360
automate all the things right so um

84
00:03:04,360 --> 00:03:05,920
being a threat detection engineer is

85
00:03:05,920 --> 00:03:07,760
anybody a detection

86
00:03:07,760 --> 00:03:10,840
engineer awesome uh so yeah you're

87
00:03:10,840 --> 00:03:12,760
probably familiar with uh the whole

88
00:03:12,760 --> 00:03:14,640
process of ingesting logs getting logs

89
00:03:14,640 --> 00:03:17,360
into whatever your platform is um and

90
00:03:17,360 --> 00:03:19,799
trying to uh emulate some type of

91
00:03:19,799 --> 00:03:22,680
activity that seems benign or malicious

92
00:03:22,680 --> 00:03:24,400
and then uh trying to write some really

93
00:03:24,400 --> 00:03:26,000
really good detection rules or high

94
00:03:26,000 --> 00:03:29,400
efficacy rules on that data um so if

95
00:03:29,400 --> 00:03:31,000
you're familiar with Google workspace

96
00:03:31,000 --> 00:03:33,319
Google workspace um everything with

97
00:03:33,319 --> 00:03:35,360
Google workspace is really apid driven

98
00:03:35,360 --> 00:03:37,239
there's an API for Drive there's an API

99
00:03:37,239 --> 00:03:39,959
for docs there's an API for token for

100
00:03:39,959 --> 00:03:42,720
samle for for a lot of different things

101
00:03:42,720 --> 00:03:45,400
um so ultimately when I was um tasked

102
00:03:45,400 --> 00:03:46,799
with doing a lot of the threat detection

103
00:03:46,799 --> 00:03:49,040
rule development for Google workspace uh

104
00:03:49,040 --> 00:03:52,519
a lot of it was UI Madness um a lot of

105
00:03:52,519 --> 00:03:54,040
clickiness a lot of going through

106
00:03:54,040 --> 00:03:56,560
multiple uh Pages a lot of you know

107
00:03:56,560 --> 00:03:58,400
nested folders inside of there it was

108
00:03:58,400 --> 00:04:00,879
just a mess um um so yeah we really

109
00:04:00,879 --> 00:04:02,920
wanted to create something that was

110
00:04:02,920 --> 00:04:05,280
repeatable something to where uh we

111
00:04:05,280 --> 00:04:08,159
didn't have to always set up a lab um we

112
00:04:08,159 --> 00:04:09,239
didn't have

113
00:04:09,239 --> 00:04:12,200
to um you know uh mess with the

114
00:04:12,200 --> 00:04:13,400
different apis and the different

115
00:04:13,400 --> 00:04:15,400
services and ultimately we could just

116
00:04:15,400 --> 00:04:17,000
set up a tool we could run it we could

117
00:04:17,000 --> 00:04:18,440
tell it to do something it would do it

118
00:04:18,440 --> 00:04:20,720
again for us we could tune a rule or we

119
00:04:20,720 --> 00:04:22,079
could create another rule for maybe a

120
00:04:22,079 --> 00:04:23,240
new

121
00:04:23,240 --> 00:04:25,199
emulation um so yeah we got a lot of

122
00:04:25,199 --> 00:04:27,639
inspiration from there's a octa threat

123
00:04:27,639 --> 00:04:29,919
emulation tool called Dorothy that was

124
00:04:29,919 --> 00:04:32,000
released by one of our colleague our

125
00:04:32,000 --> 00:04:34,360
former colleagues attack range of course

126
00:04:34,360 --> 00:04:35,880
Atomic red team Stratus red team I'm

127
00:04:35,880 --> 00:04:37,880
sure everybody in here's you know fairly

128
00:04:37,880 --> 00:04:39,680
familiar with a lot of those emulation

129
00:04:39,680 --> 00:04:42,680
tools um and then secondly or you know

130
00:04:42,680 --> 00:04:45,160
lastly uh for us Google workspace is

131
00:04:45,160 --> 00:04:47,400
still kind of Uncharted in terms of

132
00:04:47,400 --> 00:04:49,160
what's available what can you abuse what

133
00:04:49,160 --> 00:04:51,320
can you not abuse everybody you know

134
00:04:51,320 --> 00:04:54,560
uses either Outlook or Gmail um but yeah

135
00:04:54,560 --> 00:04:56,800
so we kind of wanted to try something

136
00:04:56,800 --> 00:04:59,039
with Google workspace and and see if we

137
00:04:59,039 --> 00:05:00,400
could get some tool out there because

138
00:05:00,400 --> 00:05:02,080
when I was looking maybe there's

139
00:05:02,080 --> 00:05:03,800
something that exists now but when I was

140
00:05:03,800 --> 00:05:05,720
looking there was really no tool to help

141
00:05:05,720 --> 00:05:08,160
me automate a lot of this

142
00:05:08,160 --> 00:05:11,600
stuff yeah okay and just to paint a bit

143
00:05:11,600 --> 00:05:13,880
more context too um there's a real

144
00:05:13,880 --> 00:05:17,000
emphasis on scale here so like uh I came

145
00:05:17,000 --> 00:05:18,639
from ingame and we we built we started

146
00:05:18,639 --> 00:05:21,720
building RTA over 5 years ago and when

147
00:05:21,720 --> 00:05:22,880
you think about it when you detection

148
00:05:22,880 --> 00:05:24,840
engineer at scale right we've got

149
00:05:24,840 --> 00:05:26,919
hundreds and hundreds of rules uh that

150
00:05:26,919 --> 00:05:29,160
we need to be able to test in to end

151
00:05:29,160 --> 00:05:31,680
right and so uh you we'll talk about

152
00:05:31,680 --> 00:05:33,000
some of the design principles here in a

153
00:05:33,000 --> 00:05:35,199
sec but essentially that's like a big

154
00:05:35,199 --> 00:05:36,759
undertone to this whole thing right

155
00:05:36,759 --> 00:05:38,440
being able to emulate that at scale and

156
00:05:38,440 --> 00:05:40,720
so RTA for us was inpoint right and

157
00:05:40,720 --> 00:05:43,080
we're starting to venture now now more

158
00:05:43,080 --> 00:05:45,160
um onto like service based emulation and

159
00:05:45,160 --> 00:05:46,600
stuff that's what Dorothy was that's

160
00:05:46,600 --> 00:05:48,960
what this is um and so you'll tend to

161
00:05:48,960 --> 00:05:50,280
see a lot more of this stuff coming out

162
00:05:50,280 --> 00:05:52,719
as well in the

163
00:05:56,319 --> 00:05:58,800
future yeah so let's talk about SWAT

164
00:05:58,800 --> 00:06:00,560
kind of at a high level I'll let um

165
00:06:00,560 --> 00:06:04,160
Justin talk to a lot of it and uh yeah

166
00:06:04,160 --> 00:06:05,919
yeah sorry should have kept the mic so

167
00:06:05,919 --> 00:06:07,960
obviously this is a demo tool talk so

168
00:06:07,960 --> 00:06:09,400
we're going to we're going to we won't

169
00:06:09,400 --> 00:06:10,680
dive into any code but we're going to

170
00:06:10,680 --> 00:06:13,199
talk about the code um and try to demo

171
00:06:13,199 --> 00:06:14,599
and again try not to just throw a bunch

172
00:06:14,599 --> 00:06:16,919
of slides at y'all um so like I said

173
00:06:16,919 --> 00:06:20,680
there a couple design principles uh we

174
00:06:20,680 --> 00:06:21,840
and when you just think through the name

175
00:06:21,840 --> 00:06:24,360
right simple workspace attack Tool uh

176
00:06:24,360 --> 00:06:26,199
simple was very important for us right

177
00:06:26,199 --> 00:06:29,000
and and a couple things around that um

178
00:06:29,000 --> 00:06:30,680
it needs to be programmatic right we

179
00:06:30,680 --> 00:06:32,919
need as little user interaction as

180
00:06:32,919 --> 00:06:35,120
possible obviously adding that is nice

181
00:06:35,120 --> 00:06:37,599
um nice interaction nice looking fill uh

182
00:06:37,599 --> 00:06:40,400
but we like to run this from cicd right

183
00:06:40,400 --> 00:06:43,199
uh we essentially do validation um on

184
00:06:43,199 --> 00:06:45,440
the Fly and so that drives a lot of

185
00:06:45,440 --> 00:06:47,639
these decisions that we make um so I'll

186
00:06:47,639 --> 00:06:48,599
just jump through a couple of these

187
00:06:48,599 --> 00:06:50,720
components the shell and CLI it'll look

188
00:06:50,720 --> 00:06:52,800
familiar it's just based on python's um

189
00:06:52,800 --> 00:06:54,199
CMD

190
00:06:54,199 --> 00:06:57,039
Library part of the simpleness is we did

191
00:06:57,039 --> 00:06:58,919
this like Dynamic importing where

192
00:06:58,919 --> 00:07:02,479
essentially we expose two objects uh the

193
00:07:02,479 --> 00:07:04,919
command object and the base uh emulation

194
00:07:04,919 --> 00:07:06,280
command object which I'll talk about on

195
00:07:06,280 --> 00:07:10,160
the next slide but the the point here is

196
00:07:10,160 --> 00:07:12,080
it's not just for us to develop on like

197
00:07:12,080 --> 00:07:13,759
we want this to be very Community Driven

198
00:07:13,759 --> 00:07:16,120
open for all to use for anyone to

199
00:07:16,120 --> 00:07:18,800
contribute to so that went in a lot in

200
00:07:18,800 --> 00:07:20,520
the design in trying to simplify these

201
00:07:20,520 --> 00:07:22,440
things so this abstract importing

202
00:07:22,440 --> 00:07:25,120
essentially exposes an interface in both

203
00:07:25,120 --> 00:07:27,680
of those classes um which allows

204
00:07:27,680 --> 00:07:29,120
essentially the takeaways it it should

205
00:07:29,120 --> 00:07:31,520
be really easy to add emulations you

206
00:07:31,520 --> 00:07:32,680
really don't even have to know much

207
00:07:32,680 --> 00:07:35,000
about the core of the code just set a

208
00:07:35,000 --> 00:07:37,479
few variables set a few parameters um

209
00:07:37,479 --> 00:07:40,280
and you'll be good to go um and so yeah

210
00:07:40,280 --> 00:07:41,919
that's commands and emulations again

211
00:07:41,919 --> 00:07:43,479
emulations are the ones actually

212
00:07:43,479 --> 00:07:45,720
generating the the attack data commands

213
00:07:45,720 --> 00:07:48,039
or support commands things like coverage

214
00:07:48,039 --> 00:07:50,080
and and auditing and stuff like that we

215
00:07:50,080 --> 00:07:51,560
have logging throughout obviously

216
00:07:51,560 --> 00:07:54,000
whenever you do stuff like this uh a lot

217
00:07:54,000 --> 00:07:56,039
of you know organizations like to know

218
00:07:56,039 --> 00:07:57,520
what's going on like what what did you

219
00:07:57,520 --> 00:07:59,800
just emulate in our environment auditing

220
00:07:59,800 --> 00:08:01,000
is nice because we kind of get that for

221
00:08:01,000 --> 00:08:02,919
free in Google workspace um so we

222
00:08:02,919 --> 00:08:04,319
essentially just pull that remotely and

223
00:08:04,319 --> 00:08:05,960
you can get step by step of what

224
00:08:05,960 --> 00:08:08,960
different users were doing um and then

225
00:08:08,960 --> 00:08:10,960
lastly we we put credential store up

226
00:08:10,960 --> 00:08:14,400
here because uh with Google workspace it

227
00:08:14,400 --> 00:08:16,599
gets a little convoluted passing around

228
00:08:16,599 --> 00:08:18,680
Scopes right to to

229
00:08:18,680 --> 00:08:21,240
authentication uh ironically enough in

230
00:08:21,240 --> 00:08:23,800
an emulation tool we're we're uh abiding

231
00:08:23,800 --> 00:08:25,319
by lease principle so we're we're being

232
00:08:25,319 --> 00:08:27,280
pretty safe with it rather than just ad

233
00:08:27,280 --> 00:08:28,720
hockly throwing all the Privileges at it

234
00:08:28,720 --> 00:08:30,720
and so it's a convenient object that

235
00:08:30,720 --> 00:08:32,919
goes around it makes setting and getting

236
00:08:32,919 --> 00:08:34,958
credentials much easier and of course

237
00:08:34,958 --> 00:08:36,000
this whole thing is wrapped around

238
00:08:36,000 --> 00:08:38,839
attack so um a lot of niceties around

239
00:08:38,839 --> 00:08:40,360
that a lot of categorization and

240
00:08:40,360 --> 00:08:42,120
coverage um and we'll talk about more

241
00:08:42,120 --> 00:08:44,560
about that in a

242
00:08:44,560 --> 00:08:46,560
sec yeah and one thing just to note on

243
00:08:46,560 --> 00:08:47,600
the credential store again you're

244
00:08:47,600 --> 00:08:48,800
dealing with Google workspace so we're

245
00:08:48,800 --> 00:08:50,640
dealing with ooth we're dealing with

246
00:08:50,640 --> 00:08:52,279
saml we're dealing with credentials from

247
00:08:52,279 --> 00:08:54,279
gcp uh we're dealing with service

248
00:08:54,279 --> 00:08:56,200
accounts right so we wanted a way to

249
00:08:56,200 --> 00:08:58,519
where uh again we want you guys to

250
00:08:58,519 --> 00:08:59,959
interact and use use the tool but we

251
00:08:59,959 --> 00:09:01,040
also don't want you to feel like you're

252
00:09:01,040 --> 00:09:02,600
burdened with a lot of these

253
00:09:02,600 --> 00:09:05,240
authorization workflows and sessions and

254
00:09:05,240 --> 00:09:06,920
uh consent screens and things like that

255
00:09:06,920 --> 00:09:08,560
so hopefully this will make it a lot

256
00:09:08,560 --> 00:09:09,760
more easier so you don't have to go

257
00:09:09,760 --> 00:09:11,320
through all of that um there's also the

258
00:09:11,320 --> 00:09:12,320
approach that when you're doing a lot of

259
00:09:12,320 --> 00:09:13,839
these emulations you're going to be

260
00:09:13,839 --> 00:09:16,160
using multiple users um within your

261
00:09:16,160 --> 00:09:18,760
Google workspace ecosystem to interact

262
00:09:18,760 --> 00:09:20,040
with each other interact with these

263
00:09:20,040 --> 00:09:21,920
services so just having a credential

264
00:09:21,920 --> 00:09:23,640
store to where you could house all of

265
00:09:23,640 --> 00:09:26,560
these valid sessions and credentials um

266
00:09:26,560 --> 00:09:27,959
and not have to load them again or go

267
00:09:27,959 --> 00:09:29,640
through the workflows the authorization

268
00:09:29,640 --> 00:09:31,880
or authentication workflows uh makes it

269
00:09:31,880 --> 00:09:35,279
a lot more um I guess I would say easy

270
00:09:35,279 --> 00:09:36,760
to use the tool instead of you know

271
00:09:36,760 --> 00:09:39,720
having to reload it all

272
00:09:42,079 --> 00:09:44,399
again yeah so again two more slides

273
00:09:44,399 --> 00:09:47,040
we'll talk about this high level um this

274
00:09:47,040 --> 00:09:48,519
kind of talks about what I was saying

275
00:09:48,519 --> 00:09:51,120
about the abstraction of exposing uh

276
00:09:51,120 --> 00:09:53,160
these interfaces essentially so the

277
00:09:53,160 --> 00:09:56,040
takeaway here is it's really easy to

278
00:09:56,040 --> 00:09:58,240
create a command right so essentially uh

279
00:09:58,240 --> 00:10:00,839
we do that via import Li um it will

280
00:10:00,839 --> 00:10:03,160
dynamically abstractly just parse and

281
00:10:03,160 --> 00:10:05,839
load um and then you as long as you

282
00:10:05,839 --> 00:10:07,720
define your execute method and one thing

283
00:10:07,720 --> 00:10:09,920
that we don't talk about that's up here

284
00:10:09,920 --> 00:10:13,000
um we we used AR pars like integrated

285
00:10:13,000 --> 00:10:16,079
within to also make parameter parsing uh

286
00:10:16,079 --> 00:10:17,519
much more convenient so again another

287
00:10:17,519 --> 00:10:19,920
way to just simplify this so as you can

288
00:10:19,920 --> 00:10:21,440
see like Simplicity was like a huge

289
00:10:21,440 --> 00:10:23,680
theme for us um and so yeah you define

290
00:10:23,680 --> 00:10:25,000
it in your execute method and it'll just

291
00:10:25,000 --> 00:10:26,800
know what to do you don't have to like

292
00:10:26,800 --> 00:10:31,040
get into the implementation details

293
00:10:31,760 --> 00:10:34,680
and so the nice thing is an emulation

294
00:10:34,680 --> 00:10:36,639
right this looks a bit more complicated

295
00:10:36,639 --> 00:10:38,920
but essentially it's just an additional

296
00:10:38,920 --> 00:10:41,279
layer wrapping right and so again we

297
00:10:41,279 --> 00:10:43,079
provide some niceties in in the base

298
00:10:43,079 --> 00:10:45,320
emulation command um things like

299
00:10:45,320 --> 00:10:47,079
enriching with attack data parsing it

300
00:10:47,079 --> 00:10:49,480
out parsing it from Attack um so you

301
00:10:49,480 --> 00:10:51,160
don't have to statically Define

302
00:10:51,160 --> 00:10:53,720
everything um and it does the same

303
00:10:53,720 --> 00:10:56,560
abstracted import module uh mechanism

304
00:10:56,560 --> 00:10:59,120
and yeah you define your execute really

305
00:10:59,120 --> 00:11:01,399
simple to do if you again what you can

306
00:11:01,399 --> 00:11:02,760
look at the code and see how how easy

307
00:11:02,760 --> 00:11:05,480
you can Define with arars pointing to

308
00:11:05,480 --> 00:11:06,839
like the specific method you want it to

309
00:11:06,839 --> 00:11:10,160
call very nice very clean uh yeah it's

310
00:11:10,160 --> 00:11:12,360
very

311
00:11:14,480 --> 00:11:17,120
simple yeah so again um talking back to

312
00:11:17,120 --> 00:11:19,000
the Simplicity again we we didn't want

313
00:11:19,000 --> 00:11:20,279
to stand up here and say you know this

314
00:11:20,279 --> 00:11:24,560
is the next gen Advanced tool right we

315
00:11:24,560 --> 00:11:27,200
we we focused on Simplicity we focused

316
00:11:27,200 --> 00:11:29,760
on uh it being very mod when you guys

317
00:11:29,760 --> 00:11:31,040
play with it you can if you don't like

318
00:11:31,040 --> 00:11:32,880
the commands that are there you can add

319
00:11:32,880 --> 00:11:34,880
a new uh Command Module and you can have

320
00:11:34,880 --> 00:11:36,079
it do whatever you want with Google

321
00:11:36,079 --> 00:11:38,079
workspace um if you want to add a new

322
00:11:38,079 --> 00:11:40,200
emulation module again you can go ahead

323
00:11:40,200 --> 00:11:42,480
and drop a pi file and have it do what

324
00:11:42,480 --> 00:11:43,959
you want with those services and those

325
00:11:43,959 --> 00:11:46,519
apis um and just have it automatically

326
00:11:46,519 --> 00:11:48,800
and magically kind of just work for you

327
00:11:48,800 --> 00:11:51,160
uh so that was kind of the goal there so

328
00:11:51,160 --> 00:11:52,920
uh yeah I definitely didn't want to hold

329
00:11:52,920 --> 00:11:55,040
you guys with all the slides um so we'll

330
00:11:55,040 --> 00:11:57,959
we'll do uh we'll start a lot of the

331
00:11:57,959 --> 00:12:00,959
demonstration

332
00:12:02,519 --> 00:12:05,720
okay yeah so I'm going to try to demo

333
00:12:05,720 --> 00:12:10,320
and uh work in this um terminal as well

334
00:12:10,320 --> 00:12:13,639
here and I apologize for

335
00:12:17,360 --> 00:12:20,360
that

336
00:12:24,040 --> 00:12:26,600
sorry all right so yeah I I apologize

337
00:12:26,600 --> 00:12:28,560
for all those that are uh huge pie charm

338
00:12:28,560 --> 00:12:30,639
fans and I'll try to increase this here

339
00:12:30,639 --> 00:12:34,040
as well um I started in vs code and

340
00:12:34,040 --> 00:12:35,800
that's what I use Justin loves pie charm

341
00:12:35,800 --> 00:12:37,000
he's trying to get me to switch over

342
00:12:37,000 --> 00:12:40,480
every day um so yeah so here's SWAT uh

343
00:12:40,480 --> 00:12:42,040
as you can see again it's just a you

344
00:12:42,040 --> 00:12:45,680
know stateful shell um looking at SWAT

345
00:12:45,680 --> 00:12:47,040
and the reason I pulled this up so that

346
00:12:47,040 --> 00:12:49,000
way we could see the files is that if

347
00:12:49,000 --> 00:12:50,880
you look at it you have commands and you

348
00:12:50,880 --> 00:12:53,440
have emulations so all of our Command

349
00:12:53,440 --> 00:12:55,160
modules are just Pi files that are

350
00:12:55,160 --> 00:12:56,760
dropped in there and it will dynamically

351
00:12:56,760 --> 00:12:59,360
load them and import them uh same things

352
00:12:59,360 --> 00:13:02,360
with uh the the emulations so with the

353
00:13:02,360 --> 00:13:03,920
emulations again it's wrapped around

354
00:13:03,920 --> 00:13:06,240
miter attack so we have like a lot of

355
00:13:06,240 --> 00:13:07,880
the tactics up there and then you just

356
00:13:07,880 --> 00:13:09,560
drop in what emulation you're trying to

357
00:13:09,560 --> 00:13:11,639
do um and as long as you add the

358
00:13:11,639 --> 00:13:14,000
specific emulation class and execute

359
00:13:14,000 --> 00:13:15,680
method you're free to do whatever you

360
00:13:15,680 --> 00:13:17,920
want with Google

361
00:13:17,920 --> 00:13:19,920
workspace um so yeah we'll take a look

362
00:13:19,920 --> 00:13:22,519
at some of the commands here as well try

363
00:13:22,519 --> 00:13:24,800
to feel like it's very is that better

364
00:13:24,800 --> 00:13:25,600
for

365
00:13:25,600 --> 00:13:27,760
people

366
00:13:27,760 --> 00:13:31,920
probably okay sorry so yeah doing help

367
00:13:31,920 --> 00:13:33,199
as you can see here we already have some

368
00:13:33,199 --> 00:13:35,880
commands audit clear creds audit what we

369
00:13:35,880 --> 00:13:37,839
do is we pull the data from Google

370
00:13:37,839 --> 00:13:41,959
workspace um from the admin reports API

371
00:13:41,959 --> 00:13:43,680
which allows you to pull all of the logs

372
00:13:43,680 --> 00:13:45,519
every single API in Google workspace has

373
00:13:45,519 --> 00:13:47,680
its own kind of logging bucket I guess

374
00:13:47,680 --> 00:13:50,320
you could say Doc drives Etc so we pull

375
00:13:50,320 --> 00:13:52,160
the logs into Data frames and that

376
00:13:52,160 --> 00:13:54,240
allows us to kind of splice and dice it

377
00:13:54,240 --> 00:13:57,000
and um look at that data there obviously

378
00:13:57,000 --> 00:13:58,920
clear because you need that in any type

379
00:13:58,920 --> 00:14:02,279
of shell Tool uh creds so creds is where

380
00:14:02,279 --> 00:14:03,320
we actually store a lot of the

381
00:14:03,320 --> 00:14:05,199
credentials we'll try to show that here

382
00:14:05,199 --> 00:14:06,959
shortly just run a little bit behind on

383
00:14:06,959 --> 00:14:09,600
time uh authorization again we store the

384
00:14:09,600 --> 00:14:11,279
credentials authorization will take

385
00:14:11,279 --> 00:14:13,639
those credentials it'll interact with uh

386
00:14:13,639 --> 00:14:15,279
Google workspace and it will give us an

387
00:14:15,279 --> 00:14:18,040
authenticated or authorized um session

388
00:14:18,040 --> 00:14:20,160
uh coverage again this is just to show

389
00:14:20,160 --> 00:14:22,440
what emulations H do we have and what

390
00:14:22,440 --> 00:14:24,320
parts of the miter Tech Matrix does it

391
00:14:24,320 --> 00:14:26,440
cover um and then obviously the emulate

392
00:14:26,440 --> 00:14:29,440
command is how you actually emulate um a

393
00:14:29,440 --> 00:14:32,279
lot of those emulations so a lot of

394
00:14:32,279 --> 00:14:35,560
emulate going on here all right so uh

395
00:14:35,560 --> 00:14:37,800
we'll show a little bit here just just

396
00:14:37,800 --> 00:14:39,759
to save on time I'll kind of show you

397
00:14:39,759 --> 00:14:42,480
guys um kind of the creds that we have

398
00:14:42,480 --> 00:14:44,560
right now and again these credentials

399
00:14:44,560 --> 00:14:45,959
you're pulling them from gcp that's

400
00:14:45,959 --> 00:14:47,160
where you get your credentials for your

401
00:14:47,160 --> 00:14:49,920
oaf or your service accounts so as you

402
00:14:49,920 --> 00:14:51,480
can kind of see here uh we have stored

403
00:14:51,480 --> 00:14:53,040
credentials for whiskers and then we

404
00:14:53,040 --> 00:14:54,920
have some stored credentials for default

405
00:14:54,920 --> 00:14:56,480
as well uh so we can take those

406
00:14:56,480 --> 00:14:58,160
credentials we can transform them we can

407
00:14:58,160 --> 00:15:00,360
refresh our sessions or get new access

408
00:15:00,360 --> 00:15:02,920
tokens making SWAT kind of you know very

409
00:15:02,920 --> 00:15:04,560
simple we don't have to go through all

410
00:15:04,560 --> 00:15:06,320
that workflow

411
00:15:06,320 --> 00:15:09,600
again um just to show

412
00:15:09,600 --> 00:15:13,000
O So with o as you can see we do have

413
00:15:13,000 --> 00:15:15,120
some stored off sessions again these are

414
00:15:15,120 --> 00:15:17,560
live sessions that mean uh we had the

415
00:15:17,560 --> 00:15:20,360
credentials we did the consent screen we

416
00:15:20,360 --> 00:15:22,440
took the authorization code we got an

417
00:15:22,440 --> 00:15:24,720
access token and and now we're good to

418
00:15:24,720 --> 00:15:27,120
go so we can use Whiskers Whiskers is

419
00:15:27,120 --> 00:15:29,319
actually an external Google workspace

420
00:15:29,319 --> 00:15:31,480
account and default is actually kind of

421
00:15:31,480 --> 00:15:33,759
our victim I guess you could say or or

422
00:15:33,759 --> 00:15:36,040
Target account so that way what this

423
00:15:36,040 --> 00:15:37,759
allows us to do is when you run

424
00:15:37,759 --> 00:15:39,399
emulations and you have credentials

425
00:15:39,399 --> 00:15:41,639
stored or authorized sessions stored you

426
00:15:41,639 --> 00:15:44,120
can actually tell it you can tell the

427
00:15:44,120 --> 00:15:46,399
emulation um what session you want to

428
00:15:46,399 --> 00:15:48,839
use for what user based on the keys that

429
00:15:48,839 --> 00:15:51,959
are stored in the credential

430
00:15:54,079 --> 00:15:56,880
store um so moving over again coverage

431
00:15:56,880 --> 00:15:59,000
it's very simple um I'll just kind of

432
00:15:59,000 --> 00:16:01,199
show you guys here quickly and it

433
00:16:01,199 --> 00:16:03,680
probably looks really sloppy cuz I'm

434
00:16:03,680 --> 00:16:07,399
zoomed in quite a bit here um so yeah

435
00:16:07,399 --> 00:16:08,720
it's just showing us exactly what

436
00:16:08,720 --> 00:16:10,360
emulations we have what tactics and

437
00:16:10,360 --> 00:16:12,120
techniques we have and how you would run

438
00:16:12,120 --> 00:16:13,600
that emulation and a little bit about

439
00:16:13,600 --> 00:16:15,759
the

440
00:16:17,040 --> 00:16:19,880
description um and then every single

441
00:16:19,880 --> 00:16:22,639
command actually has its own kind of

442
00:16:22,639 --> 00:16:27,240
helper um for it so like you can see for

443
00:16:27,240 --> 00:16:29,160
uh this one it's going to be a little

444
00:16:29,160 --> 00:16:31,480
hard but I'll explain it so you have

445
00:16:31,480 --> 00:16:33,360
your uh name of the emulation your

446
00:16:33,360 --> 00:16:34,959
emulation command your description the

447
00:16:34,959 --> 00:16:36,560
services that it's going to be using

448
00:16:36,560 --> 00:16:39,319
like Drive forms Gmail all of the apis

449
00:16:39,319 --> 00:16:40,880
that it's going to be using you then

450
00:16:40,880 --> 00:16:42,600
have your Scopes and then you then have

451
00:16:42,600 --> 00:16:45,279
your techniques as well so as you can

452
00:16:45,279 --> 00:16:47,120
see Google workspace is really heavy on

453
00:16:47,120 --> 00:16:50,920
Scopes o off and uh offn and then as

454
00:16:50,920 --> 00:16:52,480
well as you know what different API that

455
00:16:52,480 --> 00:16:54,120
you're going to be hitting do we have

456
00:16:54,120 --> 00:16:56,240
time for an emulation 6 minutes 6

457
00:16:56,240 --> 00:16:59,079
minutes perfect you guys still with me

458
00:16:59,079 --> 00:17:02,040
okay all right thank

459
00:17:02,040 --> 00:17:04,039
you all right so we'll just run an

460
00:17:04,039 --> 00:17:07,919
emulation here um I may have one stored

461
00:17:07,919 --> 00:17:10,839
just to keep it simple and I totally

462
00:17:10,839 --> 00:17:13,240
don't so if Justin wants to entertain

463
00:17:13,240 --> 00:17:15,520
you real quick I'll get that command

464
00:17:15,520 --> 00:17:17,919
going yeah he didn't even mention the

465
00:17:17,919 --> 00:17:20,280
beautiful Google based

466
00:17:20,280 --> 00:17:22,640
colors it's a nice

467
00:17:22,640 --> 00:17:26,079
touch totally forgot got to have

468
00:17:26,079 --> 00:17:30,399
colors uh

469
00:17:37,760 --> 00:17:40,000
um and while he's typing that one thing

470
00:17:40,000 --> 00:17:43,000
you'll notice too is we actually have a

471
00:17:43,000 --> 00:17:46,039
bunch more emulations um prepped ready

472
00:17:46,039 --> 00:17:48,640
to go but we focused on building out the

473
00:17:48,640 --> 00:17:50,679
more complex ones so like a lot of these

474
00:17:50,679 --> 00:17:54,080
more trivial ones um easy to get

475
00:17:54,080 --> 00:17:57,559
coverage on so we we spent other time

476
00:17:57,559 --> 00:17:59,919
refactoring some some other things which

477
00:17:59,919 --> 00:18:02,440
if we have time we can talk

478
00:18:02,440 --> 00:18:05,559
about this is the best part so bear with

479
00:18:05,559 --> 00:18:09,158
me here the anticipation should be

480
00:18:13,080 --> 00:18:15,960
building next time we'll copy and

481
00:18:15,960 --> 00:18:19,000
paste yeah probably a good

482
00:18:19,000 --> 00:18:22,000
idea

483
00:18:22,200 --> 00:18:26,400
uh it's more authentic demo this way

484
00:18:26,400 --> 00:18:29,280
though so we'll let that run here

485
00:18:29,280 --> 00:18:31,200
um so I will Zoom that in here and I'll

486
00:18:31,200 --> 00:18:33,120
talk a little bit about kind of what we

487
00:18:33,120 --> 00:18:36,799
just did

488
00:18:37,000 --> 00:18:39,360
uh there we go yeah so we called the

489
00:18:39,360 --> 00:18:41,400
emulate command which again it has base

490
00:18:41,400 --> 00:18:43,039
command in it it then calls the

491
00:18:43,039 --> 00:18:45,960
emulation Gmail fishing form link uh

492
00:18:45,960 --> 00:18:47,200
which is one of the emulations that we

493
00:18:47,200 --> 00:18:49,280
have available what we're doing is we're

494
00:18:49,280 --> 00:18:51,799
telling it to use whiskers um valid

495
00:18:51,799 --> 00:18:53,960
authorization and authentication session

496
00:18:53,960 --> 00:18:56,080
which again is a different Google

497
00:18:56,080 --> 00:18:57,480
workspace account it's just a regular

498
00:18:57,480 --> 00:18:59,840
user account um it's separate from the

499
00:18:59,840 --> 00:19:02,360
De Jesus

500
00:19:14,240 --> 00:19:17,240
archaeology.org

501
00:19:17,840 --> 00:19:20,600
gratulations everybody's a winner here

502
00:19:20,600 --> 00:19:22,280
um and then it will take that form it

503
00:19:22,280 --> 00:19:24,720
will store it in whiskers Google drive

504
00:19:24,720 --> 00:19:26,440
it will create a sharable link and then

505
00:19:26,440 --> 00:19:28,760
it will send that via Gmail

506
00:19:28,760 --> 00:19:32,600
to the teren at De jesus. archaeology um

507
00:19:32,600 --> 00:19:34,240
so it will then send that I'll get an

508
00:19:34,240 --> 00:19:36,520
email and it will tell me to click that

509
00:19:36,520 --> 00:19:38,640
link again the whole purpose of this is

510
00:19:38,640 --> 00:19:41,200
to just do the emulation so that way uh

511
00:19:41,200 --> 00:19:43,600
we can generate that data for the uh

512
00:19:43,600 --> 00:19:47,480
rule um detection

513
00:19:47,679 --> 00:19:49,799
development so it looks like it did that

514
00:19:49,799 --> 00:19:52,280
and I'll actually show you guys here um

515
00:19:52,280 --> 00:19:55,559
so here's whiskers don't mind his uh

516
00:19:55,559 --> 00:19:58,919
that's the one he got arrested once

517
00:19:58,919 --> 00:20:02,960
but um he's a very very bad cat so

518
00:20:02,960 --> 00:20:04,400
that's a separate account now if you

519
00:20:04,400 --> 00:20:06,880
look at my

520
00:20:08,360 --> 00:20:11,480
emails you'll actually see oh hey uh

521
00:20:11,480 --> 00:20:13,799
somebody whose name is not not a hacker

522
00:20:13,799 --> 00:20:16,039
reversed uh says congratulations on

523
00:20:16,039 --> 00:20:18,200
winning the giveaway and uh he actually

524
00:20:18,200 --> 00:20:20,919
sent me a link he's a very nice cat um

525
00:20:20,919 --> 00:20:22,640
very nice cat so uh yeah I won a

526
00:20:22,640 --> 00:20:24,799
giveaway so if I were to CL click on

527
00:20:24,799 --> 00:20:27,200
that um I would have a winning giveaway

528
00:20:27,200 --> 00:20:29,280
form and then you know as we work on

529
00:20:29,280 --> 00:20:30,919
emulations like this we plan on adding

530
00:20:30,919 --> 00:20:33,000
things like of course stealing um Social

531
00:20:33,000 --> 00:20:34,600
Security numbers and credentials and

532
00:20:34,600 --> 00:20:36,760
things like that but this is just uh for

533
00:20:36,760 --> 00:20:39,720
demo purposes so again it staged that in

534
00:20:39,720 --> 00:20:42,400
his own domain sent it to ours and now

535
00:20:42,400 --> 00:20:45,400
I've I've been fished

536
00:20:46,080 --> 00:20:49,760
essentially how much time Justin two two

537
00:20:49,760 --> 00:20:52,919
okay three maybe three three

538
00:20:52,919 --> 00:20:55,720
okay uh cool so one thing I wanted to

539
00:20:55,720 --> 00:20:57,679
show you guys um was just the audit

540
00:20:57,679 --> 00:21:00,400
commands so again audit will pull logs

541
00:21:00,400 --> 00:21:03,360
um so what we can actually see

542
00:21:03,360 --> 00:21:07,039
is I can type

543
00:21:07,919 --> 00:21:10,000
here so I'm going to audit I'm going to

544
00:21:10,000 --> 00:21:11,840
tell it to pull the token data from

545
00:21:11,840 --> 00:21:14,679
Google workspace uh for the last 15

546
00:21:14,679 --> 00:21:16,120
minutes and it's probably going to look

547
00:21:16,120 --> 00:21:19,120
really horrible so I'll put it in

548
00:21:19,120 --> 00:21:21,000
interactive um and that will help me

549
00:21:21,000 --> 00:21:22,640
kind of look at that data better so

550
00:21:22,640 --> 00:21:24,640
it'll tell me what columns are available

551
00:21:24,640 --> 00:21:29,080
I'll look at uh you know name

552
00:21:29,080 --> 00:21:32,600
name and then it'll kind of tell me so

553
00:21:32,600 --> 00:21:35,679
I'll pick a row and it will probably

554
00:21:35,679 --> 00:21:36,760
looks

555
00:21:36,760 --> 00:21:39,000
bad and it will actually pull that data

556
00:21:39,000 --> 00:21:40,279
from Google workspace so there's a

557
00:21:40,279 --> 00:21:41,720
little bit of like forensics I guess you

558
00:21:41,720 --> 00:21:43,240
could do here with the Google workspace

559
00:21:43,240 --> 00:21:46,200
logs but it's all available um via SWAT

560
00:21:46,200 --> 00:21:47,240
so that way as you're doing the

561
00:21:47,240 --> 00:21:49,480
emulations you can pull the data and you

562
00:21:49,480 --> 00:21:52,159
can look at it as

563
00:21:54,360 --> 00:21:57,120
well I'll try to move fast here if you

564
00:21:57,120 --> 00:21:59,159
want to talk about that we'll wrap it up

565
00:21:59,159 --> 00:22:01,720
yeah obviously you know this emulation

566
00:22:01,720 --> 00:22:03,640
is a means to an end for us um in the

567
00:22:03,640 --> 00:22:04,880
grander scheme of our detection

568
00:22:04,880 --> 00:22:06,960
engineering I just threw an example R up

569
00:22:06,960 --> 00:22:11,120
here um that's equal one of our language

570
00:22:11,120 --> 00:22:13,559
um languages I also threw a link down

571
00:22:13,559 --> 00:22:15,760
here for some existing Google workspace

572
00:22:15,760 --> 00:22:18,320
rules we have again the the the point

573
00:22:18,320 --> 00:22:20,520
here like teren just alluded to is it's

574
00:22:20,520 --> 00:22:22,320
the generation of the data right and so

575
00:22:22,320 --> 00:22:24,120
for us this goes through the stack goes

576
00:22:24,120 --> 00:22:25,679
through our integration it's normalized

577
00:22:25,679 --> 00:22:27,520
adjusted and it's exposed to our

578
00:22:27,520 --> 00:22:29,840
detection where we can write these rules

579
00:22:29,840 --> 00:22:32,919
and so yeah this is essentially what's

580
00:22:32,919 --> 00:22:35,159
driving all of this um for for the road

581
00:22:35,159 --> 00:22:37,840
map uh we're very open by Design us

582
00:22:37,840 --> 00:22:39,520
individually and also the work we work

583
00:22:39,520 --> 00:22:42,440
on and so again we built this primarily

584
00:22:42,440 --> 00:22:44,360
to make it friendly for Community

585
00:22:44,360 --> 00:22:46,760
contribution and interaction uh so more

586
00:22:46,760 --> 00:22:50,000
of that more from us um expanding we've

587
00:22:50,000 --> 00:22:52,400
already got some refactor PRS in again

588
00:22:52,400 --> 00:22:54,039
this this started from a hack we project

589
00:22:54,039 --> 00:22:55,919
internally for us and it was kind of

590
00:22:55,919 --> 00:22:58,799
cool so we kept doing it um Tango and

591
00:22:58,799 --> 00:23:00,240
app scripts going to be some awesome

592
00:23:00,240 --> 00:23:02,520
persistent stuff we're working on um and

593
00:23:02,520 --> 00:23:04,640
then yeah expanding more with Google

594
00:23:04,640 --> 00:23:05,960
workspace

595
00:23:05,960 --> 00:23:08,919
Services um no time for questions we

596
00:23:08,919 --> 00:23:10,400
just open sourced this right before

597
00:23:10,400 --> 00:23:13,240
coming up here so if you go there it's

598
00:23:13,240 --> 00:23:15,840
there now um follow us on Twitter if you

599
00:23:15,840 --> 00:23:18,520
want to

600
00:23:22,559 --> 00:23:25,120
chat we love collaborating so thanks

601
00:23:25,120 --> 00:23:26,880
y'all

602
00:23:26,880 --> 00:23:29,640
absolutely

603
00:23:29,640 --> 00:23:32,080
thanks