SLIDE 1 DIY Blue Teaming DIY Blue Teaming
(Keeping attackers out, with duct tape and chewing gum!)
SLIDE 2 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work Security by obscurity (because sucker punches work, even though nobody wants to admit it. "Hack Back" tricks - *TRY AT YOUR OWN RISK* Why buy the cow when you can have the milk for free?
SLIDE 3 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
SLIDE 4 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Usually the purpose of 0day is to execute
- malware. If you stop that malware from
executing you essentially mitigate the 0day.
SLIDE 5 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
0day (and it's often attached malware) tends to fail in the wild, like A LOT. When it does, it makes errors. If you can catch those errors in context, sometimes, you get to keep / analyse the malware AND THE 0DAY!
SLIDE 6 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
tl;dr, make your environment unpredictable so that you spend less time threat hunting and more time seeing stuff actually being thrown at you! (aka: NOT GETTING PWNED)
SLIDE 7 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods:
SLIDE 8 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods:
SLIDE 9 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Re order all the syscalls Re order all the syscalls
SLIDE 10 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods:
SLIDE 11 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: "Remove" your shell "Remove" your shell
SLIDE 12 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: "Remove" your shell "Remove" your shell
Use unix noshell on every user and then point ssh to a binary that downloads a shell and runs it upon login
SLIDE 13 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: "Remove" your shell "Remove" your shell
Actually remove bash from the box Use unix noshell on every user and then point ssh to a binary that downloads a shell and runs it upon login
SLIDE 14 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Backdoor your own utilities... Backdoor your own utilities...
SLIDE 15 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Backdoor your own utilities... Backdoor your own utilities... SSH "dupe" setup... SSH "dupe" setup...
https://github.com/stealth/sshttp SSH HTTPS
SLIDE 16 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Backdoor your own utilities... Backdoor your own utilities... SSH "dupe" setup... SSH "dupe" setup...
https://github.com/stealth/sshttp Port 22 SSH HTTPS
SLIDE 17 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Backdoor your own utilities... Backdoor your own utilities... SSH "dupe" setup... SSH "dupe" setup...
https://github.com/stealth/sshttp Port 22 Port 8443 Actual SSH Server SSH HTTPS
SLIDE 18 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Backdoor your own utilities... Backdoor your own utilities... GCC shouldn't be on boxes in prod GCC shouldn't be on boxes in prod anyway... anyway...
SLIDE 19 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Backdoor your own utilities... Backdoor your own utilities... GCC shouldn't be on boxes in prod GCC shouldn't be on boxes in prod anyway... anyway...
replace GCC with a binary that never actually outputs the file to disk but DOES run it through virus total and give you alerts
SLIDE 20 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Backdoor your own utilities... Backdoor your own utilities... Tripwire apps that modify the Tripwire apps that modify the filesystem filesystem
SLIDE 21 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Backdoor your own utilities... Backdoor your own utilities... Tripwire apps that modify the Tripwire apps that modify the filesystem filesystem
cp mv ln = If <arg1> == "core lib" { wtf_are_you_doing() }
SLIDE 22 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Backdoor your own utilities... Backdoor your own utilities... Make uname "lie" Make uname "lie"
SLIDE 23 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Backdoor your own utilities... Backdoor your own utilities... Modprobe Modprobe
SLIDE 24 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Backdoor your own utilities... Backdoor your own utilities... Modprobe Modprobe
Check that module contains this supper sekret squirl token that is in all my modules
SLIDE 25 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Backdoor your own utilities... Backdoor your own utilities... Modprobe Modprobe
"decrypt" binaries before loading
SLIDE 26 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Backdoor your own utilities... Backdoor your own utilities... Modprobe Modprobe
Rename modprobe to something else and make modprobe send a security alert
SLIDE 27 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Backdoor your own utilities... Backdoor your own utilities... Break all the things! Break all the things!
SLIDE 28 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Backdoor your own utilities... Backdoor your own utilities... Break all the things! Break all the things!
... and then alias all the things in the user prefs of legit admins
SLIDE 29 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Backdoor your own utilities... Backdoor your own utilities... One app to rule them all! One app to rule them all!
aka: "the initramfs trick"
SLIDE 30 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods:
SLIDE 31 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Get full crash dumps Get full crash dumps
https://support.microsoft.com/en-us/help/927069/how-to-generate-a- complete-crash-dump-file-or-a-kernel-crash-dump-file
SLIDE 32 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Rename the Powershell exe (just like the bash trick but Rename the Powershell exe (just like the bash trick but for windows) for windows)
SLIDE 33 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Over-the-shoulder transcription Over-the-shoulder transcription
https://blogs.msdn.microsoft.com/powershell/2015/06/09/powershell- the-blue-team/
SLIDE 34 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Over-the-shoulder transcription Over-the-shoulder transcription
SLIDE 35 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Over-the-shoulder transcription Over-the-shoulder transcription
SLIDE 36 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Hook OpenProcess() to look for well targeted Hook OpenProcess() to look for well targeted applications applications
SLIDE 37 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Hook OpenProcess() to look for well targeted Hook OpenProcess() to look for well targeted applications applications
Notepad Calc Explorer
SLIDE 38 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Backdoor reg edit Backdoor reg edit
SLIDE 39 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Backdoor reg edit Backdoor reg edit
Who’s using it and why? What is being edited? (key on specific reg keys like appinitdll, etc)
SLIDE 40 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Auto pe-sive dll Auto pe-sive dll
SLIDE 41 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Auto pe-sive dll Auto pe-sive dll
@hasherezade
SLIDE 42 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Auto pe-sive dll Auto pe-sive dll
@hasherezade
SLIDE 43 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods:
SLIDE 44 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Fake SMB Fake SMB
SLIDE 45 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods: Little Snitch / Micro Snitch (or lulu Little Snitch / Micro Snitch (or lulu if ya have to) if ya have to)
SLIDE 46 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: Methods:
https://github.com/kai5263499/osx-security-awesome#hardening
SLIDE 47 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Methods: ... misc Methods: ... misc
SLIDE 48 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Open SMB share that nobody has a reason to access Open SMB share that nobody has a reason to access
(hint, Metasploit SMB link :))
SLIDE 49 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
Canary users Canary users
SLIDE 50 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
“Honey tokens” “Honey tokens”
SLIDE 51 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
“Honey tokens” “Honey tokens”
Fake AWS tokens
SLIDE 52 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
“Honey tokens” “Honey tokens”
Fake AWS tokens Fake github accounts with poisoned source and or credz
SLIDE 53 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
“Honey tokens” “Honey tokens”
Fake AWS tokens Browser automated phishing "clickers" (bonus points for fake 2fa) Fake github accounts with poisoned source and or credz
SLIDE 54 DIY Blue Teaming DIY Blue Teaming
Ways to make malware not work
“Honey tokens” “Honey tokens”
Fake AWS tokens Browser automated phishing "clickers" (bonus points for fake 2fa) Browser automated phishing "clickers" (bonus points for fake 2fa) Fake github accounts with poisoned source and or credz
SLIDE 55
DIY Blue Teaming DIY Blue Teaming
Security by obscurity Security by obscurity
SLIDE 56
DIY Blue Teaming DIY Blue Teaming
Security by obscurity Security by obscurity
Randomly generate "deny" messages in robots.txt Randomly generate "deny" messages in robots.txt
SLIDE 57
DIY Blue Teaming DIY Blue Teaming
Security by obscurity Security by obscurity
Randomly generate "deny" messages in robots.txt Randomly generate "deny" messages in robots.txt
SLIDE 58
DIY Blue Teaming DIY Blue Teaming
Security by obscurity Security by obscurity
TCP/redirect + stuff you actually use + mandatory time delay TCP/redirect + stuff you actually use + mandatory time delay = VERY frustrated attackers VERY frustrated attackers
SLIDE 59
DIY Blue Teaming DIY Blue Teaming
Security by obscurity Security by obscurity
Make bad actors think you're hunting them! Make bad actors think you're hunting them!
SLIDE 60
DIY Blue Teaming DIY Blue Teaming
Security by obscurity Security by obscurity
Make bad actors think you're hunting them! Make bad actors think you're hunting them!
Step 1: Go get some "Blacklists"
SLIDE 61
DIY Blue Teaming DIY Blue Teaming
Security by obscurity Security by obscurity
Make bad actors think you're hunting them! Make bad actors think you're hunting them!
Step 2: Write some "software" that gathers information about a host....
SLIDE 62
DIY Blue Teaming DIY Blue Teaming
Security by obscurity Security by obscurity
Make bad actors think you're hunting them! Make bad actors think you're hunting them!
Step 3: Build some honey hosts on 1 or 2 DMZs in your IP space that look like the systems you "found"
SLIDE 63
DIY Blue Teaming DIY Blue Teaming
Security by obscurity Security by obscurity
Make bad actors think you're hunting them! Make bad actors think you're hunting them!
Step 4: Go back to the "bad person" forum and say "Hay! I found some more, add these blocks!"
SLIDE 64 DIY Blue Teaming DIY Blue Teaming
Security by obscurity Security by obscurity
Make bad actors think you're hunting them! Make bad actors think you're hunting them!
- 1. Register (fbi|cia|fsb|nsa).<yourOrgName>.com
- 2. Skin it with a web based honey pot that looks
like a lawful interception portal
SLIDE 65 DIY Blue Teaming DIY Blue Teaming
Security by obscurity Security by obscurity
Make bad actors think you're hunting them! Make bad actors think you're hunting them!
- 1. Register (fbi|cia|fsb|nsa).<yourOrgName>.com
- 2. Skin it with a web based honey pot that looks
like a lawful interception portal
SLIDE 66
DIY Blue Teaming DIY Blue Teaming
"Hack – back" tricks "Hack – back" tricks
SLIDE 67
DIY Blue Teaming DIY Blue Teaming
"Hack – back" tricks "Hack – back" tricks
PasswordBackup.autoexec.zip PasswordBackup.autoexec.zip
SLIDE 68
DIY Blue Teaming DIY Blue Teaming
"Hack – back" tricks "Hack – back" tricks
BeEF hooks in "honey" web app accounts BeEF hooks in "honey" web app accounts
SLIDE 69
DIY Blue Teaming DIY Blue Teaming
"Hack – back" tricks "Hack – back" tricks
Solicit shells in your own org... Solicit shells in your own org...
SLIDE 70
DIY Blue Teaming DIY Blue Teaming
"Hack – back" tricks "Hack – back" tricks
Distribute disinformation about your org.. Distribute disinformation about your org..
SLIDE 71
DIY Blue Teaming DIY Blue Teaming
Why buy the cow when you can have the Why buy the cow when you can have the milk for free? milk for free?
SLIDE 72 DIY Blue Teaming DIY Blue Teaming
Why buy the cow when you can have the milk for free? Why buy the cow when you can have the milk for free?
VirtualBox + VirusTotal + https://github.com/elazarl/goproxy
SLIDE 73 DIY Blue Teaming DIY Blue Teaming
Why buy the cow when you can have the milk for free? Why buy the cow when you can have the milk for free?
VirtualBox + VirusTotal + https://github.com/elazarl/goproxy
SLIDE 74 DIY Blue Teaming DIY Blue Teaming
Why buy the cow when you can have the milk for free? Why buy the cow when you can have the milk for free?
ELK + (LVM * Dropbox) = FTW!!!
SLIDE 75
DIY Blue Teaming DIY Blue Teaming
Why buy the cow when you can have the milk for free? Why buy the cow when you can have the milk for free?
https://www.reddit.com/r/Splunk/commen ts/2jwiso/10g_free_splunk_dev_license/
SLIDE 76 DIY Blue Teaming DIY Blue Teaming
Why buy the cow when you can have the milk for free? Why buy the cow when you can have the milk for free?
Appscan is written in .NET .... :)
SLIDE 77
DIY Blue Teaming DIY Blue Teaming
SLIDE 78
DIY Blue Teaming DIY Blue Teaming
