Daniel's thoughts on infosec
We've had a couple of people reach out about how to get started with our automation. This is part one of a multipart series where we'll cover how to get started with our automation. In this post, I show how to get the automation installed, a payload up and running, and executing a basic module.
I wrote a blog post on Praetorian's website explaining why we chose to benchmark detection and response to MITRE ATT&CK™.
This tool demonstrates what I believe will be the future of Command and Control (C2) for Red Teams and potentially Advanced Persistent Threats (APTs). With Domain Fronting slowly being killed by major CDNs and security teams getting better at looking for unusual sites (I still love that detection for new sites encrypted with LetsEncrypt certificates), Red Teams will look for alternate ways to hide their traffic. What better way than to utilize features of common sites that users are visiting anyways?
This work was inspired by my coworker’s (Josh Abraham) work to demonstrate alternative forms of Command and Control. Some of his POCs included demonstrations using Slack and ICMP for C2. While these techniques aren’t revolutionary, the simplicity of the POC and how hard it was to detect confirmed my suspicion that the future of C2 is going to be tunneling traffic via features of well-known applications.
A random collection of thoughts on cybersecurity.
