OK, so the last lecture I sort of laid out my story, how I got into cybersecurity, and now we're
going to dig into the computer attack methodology and we touched on it a little bit in the last lecture.
But and this one, we're going to go a little bit deeper because this is sort of an attack nomenclature
that every cybersecurity professionals understand.
It helps you to break down the attack chain of major threat actor groups today.
So if we go to Spider's Web site, we click on groups right when I click on Talk with this.
You can see a list of various advanced persistent recruits.
So what about 17 like these are different hacking groups.
A lot of them are state sponsored.
But if you if you click, why is the same like April 28?
It'll give you an overview of the group, gives you some, you know, alternate names for that group
because different research teams have different names for the same group.
And then if you go down to the bottom, you can actually see the techniques that are used.
Right.
So there's some things they did, all the techniques that map tommyrot.
Right.
So you can see it register domains, imitating NATO, OSCE, many security websites.
These are some of the things that this particular group has done.
You can scroll through all this and sometimes I'll even see the comments.
Right.
So I'll see.
So if you see this particular, I'll see you in your registry.
Could be an indication that this particular threat cluster was on or in your environment doesn't mean
it is the case, but it could be something that you obviously need to take into consideration here.
You can see that they use a macro like this command, certainly to decode to decode the contents of
a text files during a base64 encoded period.
And this maps to this particular technique, t one one four zero.
So if you go to the main matrices, if you just go to a minor league and you click on matrices, you
can see all the tactics for the attacker goals on the top and then all the techniques, how those goals
are tied on the bottom.
And if you click the vertical gray bar, you can expand.
A particular technique, see, there's two here and see the sub techniques.
Right, so act of scanning has some technique for scanning IP blocks and vulnerability scanning.
Gather victims information has forced up techniques like bar.
You can see what the techniques are.
You can gather information about the hardware, the software, the firmware or the client configurations.
This is really important to know.
Now, the nice thing about it is it's laid out in a logical fashion.
So typically attackers will start with reconnaissance and start fishing for information.
They might search open source technical databases to get information about the victim organization and
how how are they going to do that?
Or they might use who is they might use digital certificates and the same sort of go through these this
data.
Then, of course, they're going to want to mobilize their resources and they're attacking infrastructure,
so they may just compromise a legitimate website that will compromise infrastructure in the first two.
And you can see some of the things they might do.
They might host a virtual private server or they might start a botnet.
They might develop their capabilities by using malware, maybe even using exploits.
And this just continues.
So this is really, really good to know.
And I strongly, strongly recommend that you actually read through at least read through all of the
tactics.
Ideally, you would read through the techniques as well, because it really give you a good understanding
of how attackers think and how they work.
And you also give you the language you can use to speak to other, you know, cyber threat hunters or
ethical hackers, red team or blue team and even management, because this is this going rich that we
all use when it comes to speaking cyber.
All right, so you've got execution, persistence.
How do you survive a reboot, right?
Probably an escalation.
OK, so you can survive a reboot, but how do you elevate your permissions to higher security context
so you can wreak havoc on the system?
Then once you do that, you probably have to worry about.
So antivirus or an endpoint detection and response platform, ETR, like carbon black or cloud strike,
falcon or counter-attack.
You know, there's so many different ideas out there and there's many others.
Once you attack, it might find a way to evade it one day and then the next day it doesn't work because
it's constantly a cat and mouse game between the attackers and the defenders.
And you can keep moving forward, you can see credential access is putting techniques, you can, you
know, brute force, of course, that's one of them.
But look at that as you expand it, you'll see there's different ways to brute force pass, which bring.
Right password guessing.
Password cracking is not the only thing credential stuffing.
It must say you don't know what credential stuffing is.
You just click it.
It tells you that this is when data shows up in a public database.
You know, sometimes when an organization is breached or the credentials are dumped to pastebin or to
the dark web and you have clear text credentials that are now exposed to the public.
Well, if you can match those credentials to a user that maybe you can recycle or reuse those credentials
or what's known as stuff them your credentials stuffing to see if you can authenticate another resource
in the target organization using those previously exposed to credentials.
As you can see, this is a very useful website, and you definitely should be well aware of it.
Now, one of the things I want to show you is if you go to the attack navigator, you have some fun
with this.
So we're going to go first to site and I'm going to download a miter attack layer.
OK, so let me show you what I'm talking about here.
Let's pick up the Ryuk ransomware.
And let's grab the attack navigator where so I click this.
I'm going to actually click raw sometimes that's what you need.
You need the raw link.
So let's control see this go back in here.
We delete until the.
Put a little arrow.
All right, so we're a different versions, but let's see if it works anyway.
Sweet, so the cool thing about this now is you can see that Ferragu sees this right up here.
Remember, we got that from sites.
GitHub, by the way, site is a breach in a tech simulation platform.
It's a way that you can emulate a protector or an activity cluster that's affiliated with a particular
nation state adversary.
And you can use their tool to emulate that.
It's a paid tool.
It's not free, but there are free ones like I think Prelude is an emerging free one is a rework of
Mr. Caldera.
But that's beside the point.
That's a different topic.
When I showed you here that these community threats are all layers.
These are murder attack layers, and so you can just do what I did before you click inside a particular
Apte, you find the attack navigation that Jason you click on the raw stream here, the grab that euro.
Copy it.
Right, click copy, you go back to Navigator and it maps the threat actors techniques against the MIETEK
framework, right?
So that is really, really useful.
So we can create a new type.
And we can say go away from your own space than anyone.
Click the little arrow like, OK.
And look.
Now we've got Ryuk and we've got LPT 41, which is really cool, so you can see here that these guys
are using Paracha.
They're using the Windows command show.
It's about.
Control minus.
Yes, we can get a little bit more of it this way and see the doing these different things for defensive
agents or using bits.
If you don't know what it is, you can just click it.
I thought you could just click and get you can't click it and put it, but you can of course remember
that did or you could just go back to minor attack and look for bits.
Yeah, bits.
I'm in on defensive position, so I'm just going to type Edman
bits.
Bits, jobs on a defensive.
Sorry, the text is really small on my screen, even though it isn't for you, it is for me because
I'm zooming in after I recorded the video sort of -- jobs, you can see what this is and gives you
a nice little explanation.
So I think it's very, very useful, so, you know, make sure that you get comfortable with miter,
you know, understand these techniques, go through these these techniques, read them, you know,
click through the links.
Don't be afraid to just kind of take your time and enjoy this, because this is how you develop a real
passion for the stuff and the ones the people in this field that have the most passion typically are
the most highest paid and also have the highest technical acumen.
So you want to be in the story.
That's all we're going to do for this lecture.
And the next one, we're going to jump into the MITERS Shield methodology and explain the differences
between shield and attack.
And then we're going to really just come right up.
See you in the next lecture.