I mentioned the Lockheed Martin Cyber Kill Chain and the MITRE
ATT&CK matrix. Hackers follow a pattern.
They understand the environment, gain access,
persist, elevate, move, collect, and exfiltrate.
In this course, we set up traps that cover techniques in four of these
categories, but no joke when I say there are hundreds more, as you see here.
We have this natural progression of the attack we are actively defending
against, but it's not just solely about what our PowerShell scripts tell us
is going on in our environment.
This information needs to be correlated.
A portscan is common, but a portscan, along with a spike in our WAF,
multiple phishing reports, and a user complaining of their MFA getting
spammed with requests is concerning. Very rarely does all this hit over
a single moment, hour, or even day.
Be mindful of the attack patterns found in the matrix to understand if
you're dealing with a passerby or a more persistent threat. Threat
modeling helps to focus some of your effort.
When I have a business predominantly working from home, fully in the
cloud, with very little on‑prem infrastructure, you're going to find
certain attacks around user credentials jump up on the priority list
versus a port scanner. PowerShell can handle more than what we're
throwing at it here.
Part of the deal is to make sure that we are also actively
reviewing our systems and keeping them secure in the first place.
Setting the trap is the defense in depth.
Next, let's take a look at the border more and understanding how PowerShell
can automate security in the configurations and protections.