Hello and welcome to another
application of the moderate tech
framework discussion today
we're going to be looking at
disabling security tools.
So the objectives of today's
discussion are pretty
straightforward.
Again, we're going to describe what
this disabling security tools is.
We're going to look at some mitigation
techniques and we're, of
course, going to talk detection
techniques.
So disabling security tools.
In short, threat actors disable
security tools to avoid detection.
So this can be things like killing
software services, disabling
logging processes and
removing registry keys.
So to talk about a particular
vector. Real quick, there's a tool
by the name of backspace,
and it's a back door that targets
Windows operating systems primarily
associated with Apte
30, which is a persistent
threat group, can
download and execute various
binaries on the impacted system
known to check for a host
based firewalls.
And we'll make them accept and allow
connections out.
So that's very tricky.
So if you get this particular
variant of malware or this
particular backdoor in your system
and you're looking for things like
disabled firewalls or manipulation,
then you may not find it outright.
You may have to do some additional
digging into the system.
So some mitigation techniques here
ensure that file process
and registry permissions are in
place to prevent threat actors from
disabling services and
so ensure that end users
are set up to use this
privilege in the environment.
So both of these things go hand in
hand, making sure that
end users have limited permissions
sets to accomplish
their tasks and their jobs is one
thing, but also ensuring that
systems have
limited permission and permission
that is only required for them to do
their tasks and jobs
is something that we should be
looking at and doing as well.
If a system has privilege that
is in excess of what it needs to
accomplish its goals and
that's threat, actor finds that they
could potentially use that to
their advantage.
So some detection techniques here,
processing command line arguments
should be monitored for suspicious
activity like services that are
killed, registry edits,
things of that nature that aren't in
the standard day to day for the
system, removal of
or gaps in log
or event files.
And so that's always a suspicious
thing, especially if you're
collecting system logs all the
time and you get a huge
gap or even a smaller
gap, a few hours of a gap
in the system's collection process
that could be worth noting and
scratching your head at and maybe
investigating that to see if
something was manipulated or done
to that system.
So let's do a quick check on
learning.
True or false, disabling tools
is a way to troubleshoot system
issues in the minor attack
framework.
All right, well, if you need
additional time, please pass the
video and take it now,
disabling tools is definitely
a way to troubleshoot.
System issues, but
in the MIETEK framework, that
is not the case, this is
a false statement based on the
information that we're providing in
this particular statement.
So in summary,
we looked at what
disabling security tools means,
killing services, again,
registry. And it's doing things to
make sure that tools are not
functioning as they should.
We described some mitigation
techniques and we looked
at some detection techniques.
Again, one of the big themes here
been limiting system permissions
and user permissions can help
us to mitigate risk
and reduce the impact
that a threat actor may have on our
systems or their ability
to impact our systems.
So with that in mind, I
want to thank you for your time
today, and I look forward to
seeing you again soon.