Hello and congratulations
on finishing the execution
phase of the minor attack framework,
so you might be asking yourself at
this point, what should we know?
What did we go through?
What did we look at?
Well, we started with command
line interface, and by the end of
that, we had defined what that was.
We discussed some examples of common
command line attack tools.
And we also looked at mitigation and
detection techniques, remembering
that this can be any command line
tool, not just the ones that are
limited to Windows operating
systems.
We also went through execution,
through API.
We reviewed execution through API
and what it was some tools that
you could use. We looked at
mitigation techniques and detection
techniques as well.
In this particular section.
We then discussed control panel
items. We reviewed what that was
methods for attacking using control
panel items such as the dart
file extension that can be sent via
phishing emails and things of that
nature. We reviewed some mitigating
techniques and detection techniques
as well, again, coming back to
blocking malicious attachments and
also user awareness training.
With respect to this type of file,
we then got into power shell,
which could be considered a command
line interface, but it warrants a
separate discussion.
We reviewed what power Shell is
some of its uses and as
well as that, mitigation techniques
and detection techniques.
Remember that at least privilege
should prevail here.
And if your end users don't
need power, shell, if they
don't need to run scripts, if they
don't need to do things of that
nature using power shell, then it
should not be permitted or allowed
on the systems.
Now, you can also set partial up
to only run as an administrator.
But if you're an actor,
we're able to get administrative
access to a system or an
administrative account, then they
would be able to circumvent these
controls. So it's also beneficial
to have some form of analytics
in place that would allow you
to track activity that
could be considered malicious and
not just standard power shell
activity, because that can become
quite cumbersome and lengthy
bit of log information if you want
to trim it down.
Now, scripting was also a separate
discussion where we talked about
some different types of scripting as
well as some tools.
We talked about the
framework and how it is essentially
a combination of scripts
that can be used for both good
and evil.
We also talked about PowerPoint,
which is essentially a grouping of
power shell scripts that
can be used for malicious
purpose, as well as as well as for
security testing.
And so we looked at some of those
areas. We reviewed mitigation and
detection techniques, again,
making sure that scripts cannot
be run in the environment unless
they're approved, making sure
that scripting activity is reviewed
on a regular basis, that you're
logging scripting activity as it
happens within the environment.
And if there's any anomalous
behavior noted that it's reviewed
and checked out,
we then ended things off in
our discussions with user execution,
which is essentially when a
user interacts with
content. And so we talk about direct
execution through things like
attachment interaction and things of
that nature, as well as
going to websites, just general web
surfing. And you hit a malicious
site that interacts with your
system and is able to then
give a threat actor access or
download payloads that may be
malicious.
We talked about some common file
types that I'm sure you're familiar
with dot, dot, dot, PDF,
Excel files and things of that
nature.
But we also talked about text
files, text files as
not being able to run viruses and
things of those nature.
So if you ever see a text file
in an attachment
on an email, always ensure that
you review that file carefully, that
you don't just open it because you
assume it's safe.
Threat actors have some techniques
where they can mask the extension
or the extension look like something
that it is not thereby
fooling you into interacting with
that file.
We talked about mitigation and
detection techniques here, one of
which was in user awareness
training. And so we come
back to that topic over and over
again that educating users and
telling them what is safe
to click, what is not safe, how to
evaluate the validity
of an email, how to not just blindly
trust information that's provided
to them. I know that throughout this
year we've seen a number of
spoofing attacks, as well
as phishing attacks
related to high level executives,
owners of organizations and things
of that nature that are either
the result of account compromise
or a threat actor who knows
who the
CEO is of an organization.
And then they attempt to spoof
that user's email address
and then get people to interact in
a manner that they shouldn't.
Now, what we didn't list here was
the case study.
So I hope you've taken the time to
go through that and to evaluate your
organization in.
Controls and hopefully that was
beneficial to you in being able
to possibly implement some new
controls to help mitigate
some risks.
So with that in mind, I want to
thank you for your time today, and
I look forward to seeing you again
soon.