Yeah,
and so I think we'll talk a little bit more about what's good
versus bad coming up in some of the next module.
We'll get some more experience with that.
I know--- what types of things use these techniques?
I know tools like PowerShell Empire I've used before for some threat emulation.
I've loaded Meterpreter into memory and kind of done,
and run Mimikatz using that and kind of looked at what that
looks like from an attack perspective.
What other tools do you know of that can use those?
Because that's part of the issue with the prevalence is that
you can just download something from GitHub.
Yeah,
a lot of these popular offensive frameworks have
incorporated these techniques already.
So like Empire that you mentioned and Metasploit,
these already have those in there, Metasploit with Meterpreter.
Meterpreter essentially sits in memory.
So everything that it can do is a fileless attack in itself.
Cobalt Strike, PowerSploit.
There are just so many of these tools out there that you can,
that anybody can download and use.
And once you get on the system,
you could use those to pivot and use these fileless malware techniques,
and it's going to evade a lot of detections just by doing that.
Yeah, and Cobalt Strike, that's just kind of the Gucci version of Armitage.
It's just kind of like Kali Distro.
So with that, I mean,
that's--- I encourage people generally to go download these things we just
talked about and then run then and in a safe environment,
and then figure out whether you're catching that or not.
Yeah, it is.
That is really the best way.
What it comes down to is, as defenders,
in order for us to find these fileless malware attacks,
the best thing for us to do is to go out and start looking for them.
We can't rely on our tools, our antivirus,
and our EDR, and everything else, to detect it for us.
And when it detects it for us, that's awesome.
It's great when that happens.
But when it comes down to it,
you still need to go out and start looking for these.
And really, the way to do that is to set up proper logging on the systems,
and once you have that proper logging on the systems,
then you're going to be able to find these attacks.
Yeah, absolutely,
and that's all part of the maturity of your security
operations team and your instance response.
Awesome.
And yeah, so moving forward,
I think we're going to here soon take a look at some more examples and look at
some good versus bad and some tools on how to catch this.
Yeah,
we're going to figure out what do we need to do in Windows systems in
order to enhance that logging and find this stuff.
Yeah, and then to the naysayers who say why do you always talk about Windows?
It's well, because the world uses Windows, and that's what gets attacked.
Yup, that's exactly what it is.