CatsCrdl

CatsCrdl

Daniel's thoughts on infosec and trading

Getting Started with Praetorian’s ATT&CK™ Automation

We've had a couple of people reach out about how to get started with our automation. This is part one of a multipart series where we'll cover how to get started with our automation. In this post, I show how to get the automation installed, a payload up and running, and executing a basic module.

Daniel Wyleczuk-Stern

1-Minute Read

Demonstrating the Future of Command and Control with Wikipedia

This tool demonstrates what I believe will be the future of Command and Control (C2) for Red Teams and potentially Advanced Persistent Threats (APTs). With Domain Fronting slowly being killed by major CDNs and security teams getting better at looking for unusual sites (I still love that detection for new sites encrypted with LetsEncrypt certificates), Red Teams will look for alternate ways to hide their traffic. What better way than to utilize features of common sites that users are visiting anyways?

Daniel Wyleczuk-Stern

2-Minute Read

Wikipedia

This work was inspired by my coworker’s (Josh Abraham) work to demonstrate alternative forms of Command and Control. Some of his POCs included demonstrations using Slack and ICMP for C2. While these techniques aren’t revolutionary, the simplicity of the POC and how hard it was to detect confirmed my suspicion that the future of C2 is going to be tunneling traffic via features of well-known applications.

Recent Posts

Category

About

A random collection of thoughts on cybersecurity and finance.