WEBVTT 00:00:02.480 --> 00:00:04.740 If you're at the maturity point where you've adopted MITRE 00:00:04.740 --> 00:00:07.180 and have a robust testing program in place, 00:00:07.390 --> 00:00:10.540 then you might be wondering to yourself if weak or inconsistent 00:00:10.540 --> 00:00:13.510 configurations present a real risk to your environment. 00:00:13.890 --> 00:00:16.860 You may also be questioning if there is a series of holes 00:00:16.870 --> 00:00:19.920 convenient enough that a virus could worm its way from a basic 00:00:19.920 --> 00:00:22.050 user endpoint to an administrative share. 00:00:22.640 --> 00:00:27.050 Better yet, maybe you know which CVEs might apply to your environment, 00:00:27.050 --> 00:00:30.410 but you aren't sure of the effectiveness of your secondary controls, 00:00:30.660 --> 00:00:32.880 such as segmentation and group policies. 00:00:32.960 --> 00:00:35.690 What if there was a tool that could not only enumerate 00:00:35.690 --> 00:00:39.360 the connected network shares and hosts, even if they are not supposed to be, 00:00:39.360 --> 00:00:43.750 and the credentials for those servers that might be leveraged in an attack, 00:00:43.940 --> 00:00:45.450 but actually confirmed it? 00:00:46.240 --> 00:00:49.550 Are you looking for a tool that can show beyond a proof of concept that a 00:00:49.550 --> 00:00:53.150 configuration vulnerability exists before it is exploited? 00:00:53.940 --> 00:00:56.650 Well, today we're going to show you how to do just that. 00:00:57.140 --> 00:00:59.580 Hi, I'm Maril Vernon, and in this course, 00:00:59.590 --> 00:01:02.340 I'll be showing you how to use Infection Monkey to 00:01:02.340 --> 00:01:04.900 compromise a path of traversable hosts on a virtual 00:01:04.900 --> 00:01:07.010 network consisting of multiple endpoints, 00:01:07.010 --> 00:01:09.950 a few web servers, and domain controllers. 00:01:10.940 --> 00:01:13.610 We will see how Monkey can be used to discover, 00:01:13.620 --> 00:01:16.050 compromise, and map a vulnerable network. 00:01:16.910 --> 00:01:17.520 In this course, 00:01:17.520 --> 00:01:20.630 I will also show you how infection Monkey can be configured 00:01:20.870 --> 00:01:24.130 to employ specific MITRE tactics and discover rogue assets 00:01:24.130 --> 00:01:25.150 connected to your network. 00:01:26.110 --> 00:01:27.770 But before we get to how it's used, 00:01:27.770 --> 00:01:29.870 let's take a few moments to understand what the 00:01:29.870 --> 00:01:32.050 Infection Monkey is and how it works. 00:01:32.540 --> 00:01:34.850 Guardicore, the creator of infection Monkey, 00:01:34.850 --> 00:01:38.130 has always been a prominent vendor in cybersecurity with regards 00:01:38.130 --> 00:01:41.660 to microsegmentation and are once again leading the industry in 00:01:41.660 --> 00:01:43.750 zero trust networking implementation. 00:01:44.320 --> 00:01:47.880 Initially, they had sought to develop a tool to test their own environment, 00:01:48.070 --> 00:01:50.550 but decided to create something openly available to 00:01:50.560 --> 00:01:53.940 organizations of any size and maturity level for whom a 00:01:53.940 --> 00:01:55.980 penetration test might be out of reach. 00:01:56.290 --> 00:01:58.750 Thus, the Infection Monkey was born. 00:01:59.320 --> 00:02:02.320 You can get Infection Monkey by requesting a download link from 00:02:02.320 --> 00:02:04.700 Guardicore's website for your preferred platform. 00:02:05.140 --> 00:02:07.810 It currently comes in Linux, Windows, Azure, 00:02:07.810 --> 00:02:10.449 VMware, and Google Cloud Platform formats. 00:02:10.940 --> 00:02:12.910 It is also AWS compatible, 00:02:12.910 --> 00:02:17.070 but this is an AMI built an updated by Guardicore that you subscribe 00:02:17.070 --> 00:02:20.450 to an launch directly through the AWS Marketplace. 00:02:21.240 --> 00:02:23.560 Since it is Python‑based, its source code, 00:02:23.560 --> 00:02:25.040 which is openly available, 00:02:25.170 --> 00:02:28.250 can also be customized for privately configured environments. 00:02:29.270 --> 00:02:31.320 Infection Monkey consists of two parts, 00:02:31.320 --> 00:02:34.930 a team server called Monkey Island and a web‑based 00:02:34.930 --> 00:02:37.740 GUI client where you configure, deploy, control, 00:02:37.750 --> 00:02:39.350 and eventually kill your monkeys. 00:02:40.140 --> 00:02:42.220 For smaller teams with little expertise, 00:02:42.230 --> 00:02:45.080 Infection Monkey can be run immediately out of the 00:02:45.080 --> 00:02:46.650 box with its default settings. 00:02:47.140 --> 00:02:48.990 But for the more advanced organizations, 00:02:48.990 --> 00:02:52.050 it is highly configurable down to specific exploits, 00:02:52.440 --> 00:02:55.360 assets to include and exclude, such as legacy systems, 00:02:55.440 --> 00:02:59.350 and which attacks to use in its payload for tactic‑specific testing, 00:02:59.880 --> 00:03:02.870 The Monkey is not an adversary emulation tool. 00:03:03.020 --> 00:03:07.310 It works by using a real payload with real attacks and techniques to 00:03:07.310 --> 00:03:09.750 try and exploit its way deeper into a network. 00:03:10.300 --> 00:03:14.070 The only difference between a payload from a real attacker and the 00:03:14.070 --> 00:03:17.280 Monkey's payload is that the Monkey is not malicious. 00:03:17.520 --> 00:03:19.230 It will not attempt to steal, 00:03:19.240 --> 00:03:22.810 encrypt, or corrupt data or to DoS a compromised host. 00:03:23.240 --> 00:03:26.460 Functions of this tool are used in the network discovery and lateral 00:03:26.460 --> 00:03:30.250 movement phase of an attack when you seek to discover what's on a network 00:03:30.250 --> 00:03:33.990 and steal credentials to access additional resources. The Monkey's 00:03:33.990 --> 00:03:37.740 built‑in discovery tool allows it to visualize compromised end‑to‑end 00:03:37.740 --> 00:03:42.700 paths across the network in real time. Monkey also has built‑in exploits 00:03:42.700 --> 00:03:46.610 to brute force existing user accounts and create an attempt to escalate 00:03:46.610 --> 00:03:47.450 its own user.