Hello and welcome to another
application of the modern attack
framework discussion today
we're going to get on application
deployment software and what that
looks like within lateral
movement.
So today's objectives
are as follows.
We're going to describe application
deployment software.
We're going to look at some
mitigation techniques and we'll talk
detection techniques.
Now, application deployment
software is when
a threat actor deploys software to
systems within the victim network
using application deployment systems
commonly used by system
administrators.
Permissions may vary and results
may vary. In these instances,
you can think of these types of
software, things like we've seen
with managed service providers
and managed security service
providers, where they deploy agents
throughout their different client
environments and then they can
globally manage those systems.
And so we've seen that is a very
prominent vector and a concern
for MSPs and MSPs, just
ensuring that their application
deployment software and remote
management tools are
properly locked down.
But you could see this on a smaller
scale where an enterprise
administrator may use
certain applications to push
software out to end users.
And so I have a quick
look at Apte 30 to here,
which uses is a threat group.
Now, this is provided by far from
their site.
But the area that I really wanted to
focus on in this is
after privilege, escalation
and before the completion of the
mission. There's this internal recon
phase.
Now, you'll notice that lateral
movement is here and
this process is essentially
essentially cyclical and
then it moves through.
This internal recon phase until
we get to the completion
of the mission, so we are right now
in lateral movement
and we want to ensure that we're
doing this, that we maintain
persistence and we'll use
things again, like sysadmin,
utilities, power, shell, remote
deployment tools, other things of
that nature to move laterally.
And we'll discuss some other parts
of that.
But this particular group, it shows
their lifecycle.
So using things like active
mean fish to get to internal
compromise, they establish a
foothold with one of these tools.
They escalate privilege through a
number of areas, such as scheduled
task, cobalt strike, this particular
KVI, many cats,
they get into internal recon
and then they complete their mission
by getting local and usage or
access to VPN, email files, et
cetera, or things of that nature.
Now, this is one viewpoint
for one, Apte,
but it's probably pretty standard
that it would be a modification of
each of these given tool sets in
areas based on what the Predator
likes to use.
I'm sure the mission and the
framework is relatively the same
between them.
Now let's talk about mitigation
techniques.
So when we're talking about
application deployment, software
use of multifactor authentication
for that system prior to
deployment could definitely help
with mitigating that threat.
Actors ability to just compromise an
account run something regular
updates to reduce the likelihood of
exploitation is good for the
escalation.
Use proper network segmentation
to isolate critical systems using
other forms of network protections
to make the task of exploitation
of those systems more difficult.
So by doing some of those things,
you can definitely mitigate the
potential for that type
of attack happening.
We also have a few detection
techniques, such as monitoring
application deployment
from a secondary system,
making sure that we produce a
standard schedule for application
deployment, looking for a normal
activity, monitoring long on
activity of those systems
are onto those systems.
So, again, coming back to
not so much a tool now that's
telling us when something bad is
happening or stopping something,
but us being engaged
in how the system works,
when it works, when it should
be working and what that looks
like, and then knowing the
difference and being able to address
those scenarios on a case
by case basis.
So with this in mind, let's go ahead
and jump in to a check on learning.
True or false application
deployment systems are commonly
employed by enterprise
administrators and could be used by
threat actors to deploy malicious
software.
Well, if you need additional time,
please pause the video at this time.
This is a true statement.
Application deployment systems are
commonly employed by enterprise
administrators, but they could be
used by threat actors to push
malicious software.
So this is a true
statement.
So let's go ahead and jump in to our
summary for today's discussion.
We've looked at and described
application deployment software.
We talked about Apte 30, too,
and their ability to
essentially move laterally through
systems and how that process looks
for them.
We looked at mitigation techniques.
We talked about detection
techniques, all of those things,
again, compounding upon the other
sections of the minor attack
framework.
So with that in mind, I want to
thank you for your time today, and
I look forward to seeing you again
soon.