In this first section here,
we're going to cover a few of the ways of using
PowerShell to lay some traps for the attacker.
We are hacking back. As I mentioned,
active defense isn't sitting around waiting for an alarm to
sound off that a virus was found in a file.
Active defense utilizes a trapping scheme. You may have heard of threat hunting,
which is an active defense approach of actively
discovering hackers in your system.
But what we're going to focus mainly on here are honeypots.
Honeypots are often used by organizations to gain a better
understanding of the types of attacks that are being
launched against their systems.
These are what they call TTPs, or tactics, techniques,
and procedures. By monitoring the activity of hackers
within the honeypot environment,
security professionals can gain insight that will help
them to design more effective defenses.
Honeypots come in many flavors, which are virtually limitless.
Your only constraint is it needs to be something that you can
trigger an action on to block an alert or, at the very least,
simply alerts you that someone is snooping and there is a
potential problem to investigate.
Files and services are very common honeypots.
Did someone open the employee payroll spreadsheet in
the Downloads folder type stuff?
This is as easy as turning on file access auditing at the
GPO or for the specific files directly and monitoring the
events that fire off in the SIEM.
Today, we're going to focus on the last three in the list,
tokens, credentials, and ports.
There are some good scripts you can use to customize that will
allow you to set honeypot traps in these areas.
Let's look at tokens and ports first,
and we will build a credential honeypot into a larger discussion.