Discover and read the best of Twitter Threads about #GuardrailsOfTheGalaxy
Most recents (4)
🔨A Tough Outlook for Home Page Attacks
🔗fireeye.com/blog/threat-re…
Blog has #APT33 🇮🇷, #APT34 🇮🇷, and #UNC1194 🏴😉 home page persistence & RCE.
🔒We talk CVE-2017-11774 patch tampering in-the-wild and made a hardening guide!
😱Cool TTPs (pictured) #GuardrailsOfTheGalaxy
🔗fireeye.com/blog/threat-re…
Blog has #APT33 🇮🇷, #APT34 🇮🇷, and #UNC1194 🏴😉 home page persistence & RCE.
🔒We talk CVE-2017-11774 patch tampering in-the-wild and made a hardening guide!
😱Cool TTPs (pictured) #GuardrailsOfTheGalaxy
Here is the #UNC1194 first stage (recon) payload stored in an attacker-controlled @Azure storage blob:
Pretty neat that the attacker (@TrustedSec) can conduct a full intrusion by just swapping the storage blob content for the next stage!
Pretty neat that the attacker (@TrustedSec) can conduct a full intrusion by just swapping the storage blob content for the next stage!
This was a fun one to write with McWhirt & @doughsec. We ended up with 3 registry settings to enforce with Group Policy for CVE-2017-11774 Outlook hardening:
fireeye.com/blog/threat-re…
Final step is to enforce GPO reprocessing.
fireeye.com/blog/threat-re…
Final step is to enforce GPO reprocessing.
Hey #ATTACKcon here's a recap of
#GuardrailsOfTheGalaxy: The Prologue
including the *first* three awards – #Guardies 🏆
+ the slides
I'm your thread host, @ItsReallyNick from the #AdvancedPractices 🦅 Adversary Methods team where we "reverse engineer" attacker techniques...
#GuardrailsOfTheGalaxy: The Prologue
including the *first* three awards – #Guardies 🏆
+ the slides
I'm your thread host, @ItsReallyNick from the #AdvancedPractices 🦅 Adversary Methods team where we "reverse engineer" attacker techniques...
Why a lightning talk on Execution Guardrails (#T1480)?
• We worked with @stromcoffee & @MITREattack team who added the new technique in April 2019:
• Smart people suggest that guardrails are correlated with adversary sophistication
• 💂🛤️ are fun! ...
• We worked with @stromcoffee & @MITREattack team who added the new technique in April 2019:
• Smart people suggest that guardrails are correlated with adversary sophistication
• 💂🛤️ are fun! ...
Guardrail Definition & Detection Concepts
$coverage = /de(fini|tec)tion/
The unique combination of behaviors that define guardrailing – and their order – can be used to detect it.
Pitfalls: stage 1 recon, confusing with broader AV/tech evasions, and "legitimate" guardrailing...
$coverage = /de(fini|tec)tion/
The unique combination of behaviors that define guardrailing – and their order – can be used to detect it.
Pitfalls: stage 1 recon, confusing with broader AV/tech evasions, and "legitimate" guardrailing...
#GuardrailsOfTheGalaxy
A lightweight domain check in this malicious spreadsheet references the following protected cells:
A101 = ms
A102 = build
A103 = exe
A104 = C:\Users\Public\ptedcod.xml
A100 = MSBuild payload
Shellcode calls back to RFC1918
http://10.200.23.122/dcb3
A lightweight domain check in this malicious spreadsheet references the following protected cells:
A101 = ms
A102 = build
A103 = exe
A104 = C:\Users\Public\ptedcod.xml
A100 = MSBuild payload
Shellcode calls back to RFC1918
http://10.200.23.122/dcb3
XLS upload fired on my #GuardrailsOfTheGalaxy VT hunting rules (23/58): virustotal.com/gui/file/23d13…
Note the ⏱️ guardrail
I agree with @buffaloverflow's previous comments that these are very basic implementations of #T1480 Guardrails (that expose your targets).
Note the ⏱️ guardrail
I agree with @buffaloverflow's previous comments that these are very basic implementations of #T1480 Guardrails (that expose your targets).
@buffaloverflow @MITREattack Let me connect the dots:
• @JohnLaTwC shared a sample "leav_blackboard_training.xlsm" in June 2018
• Document metadata aligns in both (Company=United States Army 😉) with different authors
• Syntax, builder (@infosecn1nja), and MSBuild payload overlaps
• @JohnLaTwC shared a sample "leav_blackboard_training.xlsm" in June 2018
• Document metadata aligns in both (Company=United States Army 😉) with different authors
• Syntax, builder (@infosecn1nja), and MSBuild payload overlaps
#GuardrailsOfTheGalaxy
Here is a fun sample uploaded to VT yesterday - combining some adversary guardrails¹ with light obfuscation²
VT (17/58): virustotal.com/gui/file/bc85e…
¹ active directory domain check
² string splits & integer Unicode code point encoding
@MITREattack #T1480
Here is a fun sample uploaded to VT yesterday - combining some adversary guardrails¹ with light obfuscation²
VT (17/58): virustotal.com/gui/file/bc85e…
¹ active directory domain check
² string splits & integer Unicode code point encoding
@MITREattack #T1480
@MITREattack @virustotal @HackingDave I'll try to share more of these techniques/styles on Twitter - with the plan to pull together a cohesive #GuardrailsOfTheGalaxy blog exploring execution guardrails in-the-wild from a defender's perspective.
Here was another previously shared:
Here was another previously shared:
@stvemillertime @MITREattack @virustotal @HackingDave Another one, uploaded 15 minutes ago from same 🇪🇸 submitter. Looks like a few changes to the loader.
VT (16/57): virustotal.com/gui/file/53558…
I understand that this is likely a red team exercise.
VT (16/57): virustotal.com/gui/file/53558…
I understand that this is likely a red team exercise.
