Before we get to the Infection Monkey demo,
I want to take a moment to talk about where it fits in the MITRE
ATT&CK framework and the Zero Trust model.
MITRE ATT&CK classifies adversary tactics and techniques into categories
associated with the different phases of an attack,
to allow defensive teams to identify and emulate threat actor behavior and
improve security controls around those vulnerabilities.
We will cover three tactics: remote discovery,
exploitation of remote services, and finally,
remote services sub‑techniques, SMB/Windows Admin Shares and SSH.
The Infection Monkey can do this by copying itself on remote
systems from its initial access point host and attempting to
create and escalate its own user.
Zero Trust, a term originally coined by John Kindervag, means what it says.
Don't trust anyone who is accessing your network.
That means, instead of assuming everything behind the corporate firewall
is safe, the Zero Trust model assumes breach and verifies each request as
though it originates from an open network. Regardless of where the
request originates or what resource it accesses, Zero Trust teaches us to
never trust, always verify. Users do not have access until they are
approved to do so.
The company sets up entitlements that allow them to access what they
need, and only what they need, for their work role.
Every access request is fully authenticated,
authorized, and encrypted before granting access.
Micro‑segmentation and least privileged access principles
are applied to minimize lateral movement.
Bridge intelligence and analytics are utilized to detect
and respond to anomalies in real‑time.
Zero Trust is based on three main principles.
Verify explicitly,
which means to always authenticate and authorize
based on all available data points, including user identity,
location, device health, service or workload,
data classification, and anomalies.
Next is use least privilege,
meaning limit user access with risk‑based adaptive policies
and data protection to help secure both data and
productivity. And ultimately, assume breach,
which minimizes blast radius for breaches and prevents lateral movement by
segmenting access by network, user, devices, and app awareness. Verify all
sessions are encrypted end‑to‑end, and use analytics to get visibility and
drive threat detection to improve defenses.
In this course,
we will take a look at two different use cases Monkey
can test for in a real‑world scenario.
First,
if an attacker successfully phished a network, then the endpoint would be
an initial access site. Then, those authentic user credentials would be
used to try and press deeper into the network.
In this case,
the assumed breach approach is testing identity and access management, as
well as configuration management on the network shares.
Second, if you wanted to test micro‑segmentation specifically,
you would enter the IP address ranges of at least two different subnets,
which should not be able to communicate.
The Monkey will start at one and attempt to access the
other subnets hosting other machines.
Depending on the results,
successful connections will be shown on the infection map tab, as well as in
the logs of the Monkey's attempts to access those machines.
Those tactics demonstrated as successful can be confirmed in
another tool or selected specifically to be run again once
mitigating measures are put in place, to see if that path still
exists where it should not.