Hello and welcome to another
application of the MicroTech
framework discussion today
we're going to be looking at brute
force.
So let's go ahead and jump over to
our objectives.
So today's objectives are as
follows.
We're going to describe what brute
force is and how that can be
to the benefit of a threat actor and
some common points that they would
hit in that mitigation techniques
from brute force and detection
techniques.
So let's go ahead and look at how
we're defining brute force within
the modern attack framework.
So essentially, when a threat actor
doesn't have the ability to obtain
credential hashes, then the
other option is what we call brute
force. And so this is when the
attacker attempts to essentially get
a password so they don't know what
it is. So they're just going to
throw random characters
at a system until
they log in or they do
not. So this can be done against
a possible list of passwords.
This could either be generated or
pre-built. There are a number of
tools that come with pre
generated password lists.
And so this would be considered
high risk for detection or other
high risk for detection because it
would create a huge amount
of noise.
And typically, we don't want to see
things like failed login attempts.
We don't want to see
those kind of things coming up in
logs and so forth and actors trying
to be sneaky.
Then they're not going to usually
use this method.
They're going to try to do something
else.
Now, when we look at brute forcing,
commonly there are reports
associated with that.
And then there are a lot of tools
out there that are used for brute
force in these different areas.
And so we've got things like SS
Agent Telnet and FTP.
These are very common externally.
I mean, again, all of these are
common persay, but brute force
sports.
My skill and skill,
Oracle B and C,
P, L, LDAP.
So any number of these areas
could be brute force and could
be then used by a threat actor
for further accessing
the system or getting into a system
to maybe put payloads or files or
whatever the case may be on
it. Now I do want to say that more
and more we should be
concerned with having already
open. So whether
that's on three three eight nine
three three nine
zero, I've seen people take it and
put it in obscure port ranges
thinking that it's going to keep
that from from being detected.
You have to remember that
it's not about the port no persay.
It's about the actual service
running off the port.
So even if you take something like
S.H.
and you put it in the
assignable port range, that's above
that ten, twenty four.
So if you put it against any
other port, it
still is a service.
It's still going to be detectable.
It'll just be in a higher port
range. And so that just that doesn't
mean that you're securing the port.
It just means that you're attempting
to obscure where that port
is at and most tools that threat
actors are using to scan
network interfaces externally,
things of that nature. They're going
to search the whole range of
usable ports all the way up to the
sixty four thousand, sixty five
thousand and some change.
And so don't don't think that
security through obscurity is going
to prevent detection in this
measure. So you want to lock
down these ports to trust
ISPs.
You want to use white listing
techniques. You want to use maybe
SSL, VPN connections or VPN
connections prior to
doing things like already and things
of that nature.
That's just something that you
should start considering as
just a part of your ISP.
So let's talk about mitigation
techniques real quick so
we can set account lockout's to
prevent password guessing.
Essentially, this is just going to
make it very arduous and slow
for the threat actor to get into
a system through password guessing.
We want to enable multifactor
authentication when we can.
It's again, it's not always
going to prevent a threat actor from
getting in,
but it definitely slows down brute
force in attempts and things of that
nature.
And then we can determine some best
practice policies for the
organization based on this or
other compliance guidelines.
So just ensuring that
we look at what is current in the
organization right now.
I believe that password policies
based on this would say that things
never expire, but they ask
for 14 plus character passwords.
I've seen others where it's 12
characters minimum.
If we're going to use kind of
standard complexity, where we've got
letters, characters, numbers,
things of that nature.
So special characters
in the mix.
So really, it just depends on the
organization, what they're willing
to bear, what compliance regulations
state and what they can do.
So let's talk about some detection
methods as well.
So right out the gate, we can look
for high amounts of
Felde long on attempts against
systems across various
accounts. And so if you see a list
starting from A getting into B,
getting into C of common
usernames, then it may
be that someone's going through and
trying to force a system
on domain controllers.
You can audit
log on success and failures for the
following event. ID forty six.
Twenty five.
We can do Kerberos authentication
service failure and success of an ID
four seven seven one.
And then on all systems we can do
long on success and failure.
Event ID forty six.
Forty eight.
Again, depending on how the
environment is set up and
what you're learning on and
what your capabilities are, you can
use these things to your advantage,
at least turning these logs on, on a
system and
having that locally could
be of use if a threat actor doesn't
wipe that after getting onto
a system.
I mean, again, you have to have
someone going back and checking
these things.
You can't just turn it on and let it
run and think that it's going to
give you an alert right out the box.
So let's do a quick check on
morning.
True or false brute force attacks
or when an adversary attempts to
guess account passwords using
things like password lists.
All right, well, if you need more
time, please pause the video.
So in this case, this is a true
statement. Brute force is
an attack type where an
adversary will guess account
passwords using things like password
lists. And so that is a true
statement.
So let's go ahead and jump over to
our summary for today's discussion.
So in summary, we described brute
force and what that is.
So it's essentially a technique
where a threat actor uses tools and
password lists to attempt to
force their way into a system by
giving a password.
We reviewed some mitigating
techniques and we reviewed some
detection techniques as
well.
So with that in mind, I want to
thank you for your time today, and I
look forward to seeing you again
soon.