WEBVTT

00:00:01.050 --> 00:00:03.240
The ATT&CK knowledge base, developed by MITRE,

00:00:03.250 --> 00:00:06.440
categorizes adversary tactics and techniques into multiple

00:00:06.440 --> 00:00:09.070
categories to describe the adversary's behavior.

00:00:09.840 --> 00:00:12.730
The tactics are categories that cover different phases of an

00:00:12.730 --> 00:00:16.530
attack and allow defensive teams to model an adversary's actions

00:00:16.540 --> 00:00:18.660
and improve the defense of their networks.

00:00:19.940 --> 00:00:23.530
We will cover three tactics that Pupy can be used for,

00:00:23.530 --> 00:00:28.350
credential dumping, input capture, and encrypted channel.

00:00:29.340 --> 00:00:32.590
If an attacker wanted to use Pupy as a command‑and‑control server

00:00:32.600 --> 00:00:34.930
against their victims on Globomantics' network,

00:00:34.940 --> 00:00:35.850
depicted here,

00:00:36.340 --> 00:00:38.900
they would first have to stand up a Pupy server and

00:00:38.900 --> 00:00:42.420
have it generate client files, which they would run on their exploited hosts.

00:00:43.010 --> 00:00:45.920
These hosts would then connect back to the Pupy server over the

00:00:45.920 --> 00:00:49.280
attacker's chosen protocol and establish an encrypted session,

00:00:49.300 --> 00:00:52.360
which will make it appear as legitimate traffic on the network.

00:00:53.240 --> 00:00:55.970
This enables the attackers to then securely transfer

00:00:55.970 --> 00:00:58.760
information from the victims back to the Pupy server,

00:00:58.930 --> 00:01:03.050
or escalate privileges and obtain access to additional resources.