WEBVTT

00:00:01.240 --> 00:00:05.160
Let's take a quick look at some other resources that you might find useful.

00:00:06.140 --> 00:00:09.030
LaZagne has a page on the Mitre ATT&CK website,

00:00:09.170 --> 00:00:12.330
which contains details of the techniques it uses and the

00:00:12.330 --> 00:00:13.960
groups that are known to have used it.

00:00:15.040 --> 00:00:19.560
This is useful to understand how it's been used by real‑world attackers.

00:00:20.640 --> 00:00:24.750
LaZagne is also included as a module in a tool called Pupy.

00:00:25.940 --> 00:00:29.450
Pupy is an in‑memory remote administration tool.

00:00:30.340 --> 00:00:33.920
The fact that it runs modules in memory makes it harder for

00:00:33.920 --> 00:00:38.530
antivirus to detect, so it is potentially a good way to run LaZagne

00:00:38.620 --> 00:00:43.980
on an already‑exploited host. Pupy is also written in Python, and

00:00:43.980 --> 00:00:45.660
there's a GitHub repository for it.

00:00:46.640 --> 00:00:51.020
There's also a course on Pluralsight named Command and Control with Pupy,

00:00:51.110 --> 00:00:53.060
which I can recommend you take a look at.

00:00:54.640 --> 00:00:57.850
So how do we limit the risk from a tool like LaZagne?

00:00:58.840 --> 00:01:02.560
We're very much reliant on credentials in their various forms.

00:01:03.540 --> 00:01:07.650
Those credentials are often spread quite widely around a computer,

00:01:08.040 --> 00:01:11.670
creating a large attack surface for a tool like LaZagne to take

00:01:11.670 --> 00:01:16.170
advantage of. The tools that store credentials often don't

00:01:16.170 --> 00:01:21.170
specialize in keeping them safe. When we look at defense, it's wise

00:01:21.170 --> 00:01:23.660
to reduce that potential attack surface.

00:01:24.740 --> 00:01:28.940
This can be achieved by using a reputable password manager, which will have

00:01:28.940 --> 00:01:33.050
stronger controls than the types of tools that LaZagne targets.

00:01:34.040 --> 00:01:38.350
If you're using a strong password to control access to the password manager

00:01:38.350 --> 00:01:41.770
and don't have that password lying around on your machine,

00:01:42.000 --> 00:01:45.450
then it should help a lot. And that's it.

00:01:46.040 --> 00:01:48.900
Hopefully you've found this useful and consider using

00:01:48.900 --> 00:01:51.260
LaZagne on future RedTeam engagements.

00:01:52.140 --> 00:01:57.040
You can catch me on Twitter @Gav_JL, and feel free to put

00:01:57.040 --> 00:02:00.570
thoughts and questions in the comments section for this course

00:02:00.570 --> 00:02:02.850
on Pluralsight. Thanks for watching.