Hello and welcome to another
application of the modern attack
framework discussion today
we're going to look at S.H.
hijacking within the
lateral movement phase of the
matter, minor attack framework.
So let's go ahead and look at our
objectives.
So today's objectives are as
follows. We're going to describe for
us as a hijacking.
What are some mitigation techniques,
what are some detection techniques
and why this differs from remote
application exploitation.
So instead of hijacking
is when a threat actor
uses a trusted relationship between
systems to establish a connection
to other systems.
By taking advantage of public
key authentication and active SSA
sessions, the threat actors will
hijack the session, which becomes
trivial if the threat actor has
privilege.
Associated hijacking is different
from the use of remote services
or remote service exploitation
because it injects into
an existing S.H.
session rather than creating
a new valid session
or using that session through a
valid account.
So in this case, again, it differs
because we are taking an existing
session and we are hijacking
that session.
Now, an example of a tool
that takes advantage of this is
Ibru, which is an SSA
kit.
It is a back door,
says Trojan.
In this case for Linux style
systems, typically it is installed
by attackers with root level
access to the system, either through
replacing binaries or by
making changes to an S.H.
library.
Some antivirus products
can detect this tool, but
there may be some limitations
depending on the vendors and
the variant that is in place.
Now, this is just one of many
different ways that SSA can
be used to the benefit
of a threat actor to move laterally
through systems.
I know through a number of courses
as well as engagements that I have
been on.
It is always great to find
an open S.H.
session or some type of port
that is open and communicating over
S.H.
that was not properly configured.
And then you can elevate yourself
into administrative or
root privilege.
That is always a nice feeling.
Now mitigation techniques
are as follows.
If SSA is not needed, of course,
we remove the ability of systems to
use it. We do not allow remote
access via SSA as route or
other elevated account types.
So with systems or distributions
like Calli Linux, we have
to go through very specific
steps to allow group
privilege to even run
over SSA and to use that
account over SSA.
And so if you do so,
you are knowingly opening yourself
up to issues
if that account is compromised
and then properly auditing systems
to prevent privilege escalation
again through things like patching
liste privilege on applications,
liste privilege on user accounts.
All is to the benefit
of the organization to mitigate the
ability of a threat actor to move
aggressively through systems
detection techniques.
We can monitor the use of SSA
activity to ensure that it is
not being used in a manner that is
contrary to the organization's
policies.
Again, if you have no
use for S.H.
internally or if you should not have
users internally that are using
that particular method to connect to
systems, then any
incident or event related
to the use of such tools
should be considered flagged and
should be reviewed for malicious
activity.
Now let's do a quick check
on learning.
True or false, SSA
hijacking is when an actor takes
over an active S.H.
session.
All right, well, if you need some
additional time, please pass the
video and take it.
So this is a true
statement. SFH hijacking
is when a threat actor takes over an
active S.H.
session. And so this is a true
statement.
So in summary of today's discussion,
we described S.H.
hijacking.
We described mitigation techniques.
We looked at detection techniques.
We squeezed a tool in between
these two areas.
And we looked at just one
example of what is out there
to take advantage of situations
once a threat actor is on a
system.
So with that in mind, I want to
thank you for your time today, and
I look forward to seeing you again
soon.