►
Description
Fernando Tomlinson is a security expert for the US Army Cyber command handling malware and forensics operations. He demonstrates the many ways that PowerShell can be used for offensive and defensive security purposes. He dives deep into a myriad of tools and scripts he has developed to parse data quickly to find intruders and exploit weaknesses.
Fernando gives in-depth analysis of how to defend (blue team) and attack (red team). He masterfully presents this data in a compelling format that is will keep you on the edge of your seat! Pentesters, security pros, and sysadmins can all get something from this informative video presentation. Please join us for an eye opening look at the good and bad of PowerShell and how to protect your organization's network.
The Research Triangle PowerShell Users Group (RTPSUG) is the largest PowerShell group in the world! We meet twice a month to discuss all topics related to PowerShell and automation. Our topics cover beginner to advanced concepts and offer people a chance to learn new skills and ask questions. Our mission is to create a space for all attendees to feel welcome, have a chance to ask questions and be part of a community.
For more information on our group, please visit any of following links:
WEB: https://rtpsug.com
MEETUP: https://www.meetup.com/Research-Triangle-PowerShell-Users-Group
LINKEDIN: https://www.linkedin.com/company/rtpsug/
TWITTER: https://twitter.com/rtpsug
GITHUB: https://github.com/rtpsug
A
A
A
A
B
A
B
B
B
I
developed
a
number
of
interactive
powershell
training
platforms.
As
you
see
there
I'll
talk
about
both
of
those
rather
quickly
once
we
get
to
the
near
the
presentation
and
kind
of
walk
through
those
real
live
demo
of
sorts
and,
if
you're
looking
to
connect
with
me
outside
of
this
presentation,
that's
my
presence.
If
you
will
on
the
interwebs
okay,
so
very
quickly,
there's
our
agenda.
We
got
a
lot
of
things
that
we're
gonna
try
to
pack
in
here,
but
we're
going
to
get
through
it
right
so
about
powershell.
B
You
guys
already
know
guys
and
gals
2006
is
when
it
came
on
the
scene
implemented
as
an
engine
right.
So
when
we
think
of
powershell.exe
and
powershell
underscore
isc.exe
that
isn't
powershell,
that's
just
a
hosting
engine
that
allows
us
to
to
really
have
access
to
that
dll
system,
dot,
automation,
system.management.automation.dll,
which
is
really
the
true
powershell
juice.
If
you
will
powershell,
is
an
interactive
command
shell,
so
that
allows
us
to
utilize
the
ability
to
go
interactive
and
interact
with
the
system
itself.
B
It's
a
scripted
language,
it's
very
object,
oriented
of
sorts,
so
we
have
properties
and
methods
associated
with
them.
We
have
the
ability
to
do
some
remote
management,
and
you,
you
probably
heard
micro
or
a
number
of
other
people,
talk
about
that
right,
so
allowing
us
to
really
interact
with
one-to-one
machine
or
one-to-many
machines
of
sorts.
It's
built
on
top
of
the
dot-net
framework.
So
what
does
that
mean
that
really
gives
us
access
to
a
lot
of
the
dot-net
classes
to
really
make
powershell
a
lot
more
extensible
than
what
it
may
already
be?
B
Number
of
the
functionalities
are
built
through
commandless
functions
and
scripts,
and
guess
what
we
can
also
use
those
native
commands.
Those
are
things
that
you
already
know
right,
but
what
are
the
real
true
advantages?
Well,
if
I'm
a
blue
team
person,
if
I
jump
on
a
windows,
7
2008,
r2
system
and
above
powershell,
is
already
there
granted,
it's
largely
going
to
be
powershell
v2,
but
that's
not
important
right
now.
The
important
fact
is,
I
have
powershell
there
and
I
can
leverage
the
system
or
really
powershell
to
interact
with
apis
on
windows.
B
B
I
have
some
logging
and
controls
that
I
could
do
a
lot
more
than
other
scripting
engines.
Now,
that's
going
to
vary
based
upon
version
of
powershell,
of
course,
and
I
have
the
ability
to
do
some
monitoring
and
some
detection.
If
you
will-
and
I
don't
necessarily
have
to
install
an
agent,
be
it
an
open
source
agent
or
something
that
my
organization
may
be
power
paying
for.
I
got
a
number
of
things
that
I
can
use
already
built
in
to
the
platform:
that's
great
cool.
B
So
now
I'm
going
to
take
my
blue
team
hat
off
and
then
we'll
put
on
the
red
team
hat.
Well,
what
makes
it
great
from
a
red
team
perspective
you'll
see
some
duplications
here.
The
fact
that
it's
already
installed
on
those
those
versions
that
we
mentioned
makes
it
great.
I
don't
know
about
you,
but
when
I
go
over
to
a
get
together-
and
I
ask
people,
what
do
I
need
to
bring-
and
they
say
nando-
don't
bring
anything
just
show
up
to
the
party.
B
We
also
can
utilize
those
apis
so
same
apis
that
provide
information
for
us
from
a
blue
team
perspective,
give
very
relevant
information
to
a
person
with
malicious
intent
and
guess
what
no
red
team,
guy
or
malicious
actor
wants
to
be
having
their
traffic
in
the
clear,
so
the
same
way
that
we
can
encrypt
it
from
a
bluetooth
perspective.
We
can
do
that
here
now,
depending
on
the
version
of
powershell
and
really
the
the
way
in
which
we
use
it.
We
could
avoid
and
bypass
detection
mechanisms.
B
That's
super
great
amazing,
a
number
of
other
things
kind
of
make
it
a
little
bit
difficult,
but
guess
what?
Well,
there's
a
will
there's
a
way
right,
so
we
can
continuously
kind
of
do
a
cat
mouse
thing
if
you
will
luckily
for
us,
if
we're
a
red
team
person,
some
people
don't
understand
the
importance
of
powershell
and
therefore
do
not
update
their
version
of
powershell.
B
Allow
us
to
do
well
that
essentially
allows
us
to
not
have
to
have
something
on
disk
that,
depending
on
the
av,
would
scan
and
trigger
for
malware.
So
we're
now
running
in
such
a
space,
that's
a
little
bit
more
abstract
and
allow
us
to
be
a
little
bit
more
stealthy
in
some
of
the
things
that
we
do
and
really
the
last
one
is,
is
a
close
number
one
for
me
and
why?
What
makes
this
great
and
the
fact
that
it's
script-based
attacks,
it
largely
makes
signaturing
difficult.
B
Like
there's
been
a
number
of
times,
I've
seen
specific
code
be
triggered
as
malware
and
then,
when
you
dig
into
the
av
as
to
why
it's
specific
comments
or
specific
commandlets
in
which
they
use
or
a
succession
of
things,
and
I'm
like
wow
good
on
you
for
catching
this.
This
very
generic
thing
that
we
pulled
down
and
used,
but
understanding
that
it
takes
little
to
no
effort
to
reshape
what
I'm
doing
and
make
things
a
little
bit
different,
especially
when
we
start
talking
about
a
number
of
obfuscation,
tactics
and
techniques,
all
right.
B
So
looking
at
the
landscape
right,
because
we
all
really
know
that
it's
a
great
sys
admin
tool
right.
A
number
of
people
are
doing
amazing
things
in
this
field.
As
far
as
automating
tasks
right
automate,
the
boring
stuff,
if
I
got
to
do
it
more
than
once-
I'm
automating
it
yes
cool
and
in
some
respect
we
realize
that
malicious
people
or
red
teamers
are
utilizing
it
as
well,
and
we
recognize
wine.
We
also
recognize
that
blue
team
members
are
using
it
as
well.
B
I
think
the
big
thing
to
take
away
here
is
that
it
isn't
these
10
or
so
reasons
why
an
admin
used
it
versus
these
10
or
so
reasons
why
a
red
team
person
uses
it.
It's
there's
some
duplication
in
tripling,
if
you
will
of
reasons
across
the
landscape,
so
there's
a
lot
of
duplication
and
tripling
of
sorts,
but
we
see
that
there's
a
little
bit
of
something
special
for
all
three
entities.
B
If
you
will
and
when
I
say
three
entities,
it
doesn't
really
stop
there
right
because
for
anybody
who's
online
right
now,
who
has
a
tesla?
Let
me
just
make
it
known:
real,
quick
nando
does
not
have
a
tesla
right.
Let
you
know
where
I'm
at
on
the
pay
scale,
if
you
will,
but
for
anybody
on
the
line
who
has
a
tesla,
there's
a
module
that
somebody
developed,
so
you
can
control
your
tesla
omg.
B
This
is
awesome,
or
maybe
it's
not
awesome
depends
on
what
hack
you
have
on
right
now
of
sorts,
but
the
fact
that
somebody
utilized
powershell
to
develop
this
module
speaks
to
the
the
modularity
of
sorts
in
which
this
language
allows
you
to
become
right,
the
extensibility
of
sorts-
and,
if
you
think,
I'm
joking
about
it,
no
you
can
google,
it
somebody's
got
it
out
there
of
sorts
right.
So
enough
about
that.
B
Let's
talk
about
some
of
the
blue
team
stuff
right
and
when
we
go
into
this,
this
isn't
going
to
be
a
full
extensive
list.
This
is
just
a
couple
of
things
and
building
this
talk
was
really
difficult
for
me.
Why?
Because
there's
like
five
million
different
blue
team
uses
of
powershell,
so
I
had
to
nudge
it
down
to
a
couple
of
sorts
right.
So
really,
when
we
look
at
it
as
a
blue
team
person,
I
want
to
be
able
to
hash
files
and
items
on
a
disk
right.
Why?
B
Because
I
may
have
an
indicator
of
compromise,
be
it
a
hash
or
in
some
case
an
ip
or
something
else,
and
if
I
get
matches
of
that,
then
I'm
rest
assured,
or
I
have
high
confidence-
that
a
system
is
compromised
or
malicious
based
upon
possibly
that
indicator
of
compromise.
So
we
have
an
input
in
this
case
we're
going
to
use
the
binary
command.exe.
B
B
So
from
a
powershell
perspective,
we
have
git
file
hash,
you
may
already
be
familiar
with
it.
We
can
specify
an
individual
file
and
then
it
returns
the
sha-256
of
that
file.
We
could
also
feed
it.
The
algorithm
in
which
we
want
to
use
for
a
function
doesn't
necessarily
have
to
be
shot
256,
as
you
see,
we've
done
md5
and
then,
if
we
wanted
to,
we
got
a
number
of
different
ways
to
do
a
directory
of
sorts
of
files
all
right.
B
This
is
good,
because
if
I'm
at
a
point
where
I
wanted
to,
I
don't
know
hash
every
file
on
my
system.
I
could
do
that
with
powershell.
That's
going
to
be
costly
in
the
sense
of
processor
and
intensive
on
the
sensor
on
the
system.
Excuse
me,
so
what
I
recommend
excuse
me
recommend
instead
is
checking
out
something
like
the
national
national
software
reference
library.
B
Once
a
quarter,
they
publish
a
list
of
quote
unquote,
well-known
hashes
for
windows
systems
and
then
common
software
that
we
may
find
on
them
and
what
we
can
do
is
we
can
take
a
targeted
approach
in
hashing
certain
files
on
our
system,
validate
them
against
this
known
good
list
and
then
continue
on.
If
that's
not
the
approach
you
want
to
use
well,
you
could
also
use
something
like
virus
token
right
and
from
a
virus
total
perspective.
B
We
have
the
ability
to
do
four
hashes
per
minute,
utilizing
their
free
api
and
we've
got
about
5700
that
we
can
do
in
the
date.
This
is
going
to
check
about
50
antivirus
solutions.
Now
the
key
here
is
with
the
free
api.
We
got
four
in
a
minute,
so
we
need
to
be
cognizant
of
that
and
I
don't
want
to
be
doing
something
like
svc
host
every
couple
of
minutes,
because
once
I've
done
it
once
and
validated
that
the
hash
was
good
on
mars
total.
B
B
Well
in
about
10
or
so
lines
of
code.
We
can
get
a
list
of
those
processes
we
can
loop
through
them.
We
could
hash
them
and
then
anything
that
we
don't
have
access
to,
because
it's
protected.
We
could
just
fit
that
out
to
a
file
and
again
I
would
only
want
to
do
that
one
time
for
the
thing
that
I've
seen
the
first
time
and
then
the
next
time.
I
see
that
binary.
B
I
want
to
check
to
see
if
it's
in
my
list
already
I.e
that
I
already
looked
this
up
and
if
so
I
want
to
get
the
reputation
there.
I
only
want
to
reserve
going
out
to
virustotal
for
the
stuff
that's
brand
new,
and
this
is
how
I
can
be
smart
about
the
four
that
I
can
submit
per
minute,
especially
if
I'm
trying
to
do
this
in
a
centralized
manner
across
some
type
of
essential.
B
Excuse
me,
some
type
of
environment,
so
utilizing
this
code
invoke
bt,
hash
search,
it's
gonna,
allow
you
to
run
or
submit
these
hashes
to
virustotal,
it's
automatically
filtered
in
for
it
to
do
for
a
minute.
So
in
this
case
we
submitted
two
and
it's
going
to
tell
me
my
estimated
run.
Time
is
30
seconds
because
it
factors
in
submitting
one
every
15
seconds.
We
see
varying
links
in
my
hashes
because
I'm
highlighting
that
it
doesn't
necessarily
have
to
be
md5s
or
sha-256.
B
It
could
be
any
mixture
of
them
now
when
this
data
comes
back,
it
comes
to
me
in
a
list
right,
and
this
is
where
it
comes
into.
What
does
an
analyst
like
some
analysts
like
to
do
analysis
on
their
data
in
the
form
of
a
list,
while
that
doesn't
necessarily
work
for
other
people,
so
I
like
to
flip
mine
to
a
table
and
when
we
do
that,
we
see
the
av
name
up
front.
B
Second
column
is
going
to
show
us
the
version
of
that
av
third
column
is
going
to
show
us
if
it
was
false
or
true.
If
it's
true
that's
a
trigger,
and
if
it's
true,
the
fifth
column
is
going
to
show
us.
What
does
that
antivirus
know
it
as
the
six
the
next
column
is
gonna
show
us
the
date
of
the
the
signature.
If
you
will
and
then
it's
gonna
show
us
the
the
hash
associated
with
it.
B
So
if
I'm
scanning
a
file
or
a
hash
rather
because
we're
not
uploading
this
to
virustotal
we're
just
searching
for
the
hash,
if
I'm
searching
for
the
hash
and
out
of
50
avs,
none
of
them
tell
me
that
it's
malicious
well
right
now.
I'd
say
I
probably
trust
that
and
keep
going,
because
I'm
looking
for
the
low-hanging
fruit
but
depending
on
my
environment,
and
who
may
be
targeting
that
that
doesn't
necessarily
mean
that
I'm
necessarily
out
the
clear
if
I
get
a
couple
that
start
to
trigger.
B
C
Yeah
there's
a
question
in
the
chat:
that's
really
relevant
to
what
you're
talking
about
now
a
couple
of
people
were
asking
like.
We
understand
the
concept
of
building
a
hash
list
and
using
that,
instead
of
going
out,
how
long
would
you
rely
on
that
list
before
maybe
you'd
generate
a
new
list
or
age
out
the
old
ones.
B
Well,
that's
a
good
question.
I
think
it's
going
to
be
architecture
dependent
for
me
for
architecture
or
vitamin,
which
I
work
in
if
it's
deemed
good
now
and
it's
something
that
is
a
well-known
hash
like
let's
say,
sbc,
host
or
lsas.
Something
like
that.
That's
not
gonna
change,
I'm
probably
not
gonna
go
back
out
and
never
do
that.
B
But
if
it's
a
one-off
binary
based
upon
some
type
of
program
that
somebody
may
be
running
or
a
pe
executable
well,
then
I
might
go
back
out
there
and
check
that
somewhat
often,
because
that
could
absolutely
change.
So
I
think
it's
going
to
be
environment
dependent
based
upon
the
environment
in
which
you're
in
but
yeah
some
you
might
not
ever
go
back
right
like
spc
host,
isn't
gonna
change
and
if
it
does
it's
because
microsoft
got
compromised
and
we
got
a
bigger
problem.
A
So,
in
that
same
fashion
is
if
you're,
you
know
from
a
from
a
cis
admin
perspective,
the
idea
is
that
the
same
hash
is
going
to
be
svcos's.
Hash
is
going
to
be
the
same
across
all
of
my
systems,
so
I
only
really
effectively
need
to
build
the
hash
across
my
environment
effectively,
and
then
these
are
the
files.
So
even
like
the
windows
system
files,
they
would
be
the
same
across
the
environment
and
then
these
files
would
be
the
same,
but
then
you
know
my
custom,
apps
and
stuff.
B
Well,
so
app
blocker
or
now
we're
talking
like
white
listing
in
blacklisting
right,
so
I'm
not
tracking
app
locker
actually
goes
out
and
does
some
validation
to
say
whether
this
is
malicious
or
not.
Here,
we're
doing
almost
real-time
analysis
to
say
it's
malicious
if
you're
actually
executing
a
white
listing
or
black
listing
you're,
much
more
better
posture,
in
my
opinion,
than
what
we're
doing
here,
some
environments
take
the
time
to
do
that,
because
that's
a
little
bit
more
intensive.
B
Okay,
all
right,
so
the
next
thing
right
from
a
blue
team
perspective
processes.
Netstat.
If
you
will,
I
mean
common,
what's
running
on
the
box,
what
type
of
connections
do
we
have?
What
binaries
have
a
port
that
they're
bound
to
and
when
I
look
at
this
individually,
this
is
good
right.
So
I
look
at
my
process
list,
I'm
getting
stuff
of
interest.
B
I
might
transition
over
to
my
my
network
list
and
I
might
return
in
my
network
list
binaries
that
are
tied
to
a
established
connection
or
have
a
port
open,
but
when
I
look
at
it,
there's
an
actual
pid
associated
with
it.
And
now,
when
I
transition
back
over
to
my
get
my
process
list,
sometimes
I
might
be
like
what
was
that
pid?
Was
it
one
two
three
four?
Was
it
three
two
one
I
get
a
little
mixed
up.
B
If
you
will
so
I
find
myself
transitioning
back
and
forth,
and
really
we
want
to
take
some
of
that
human
nature
ability
out
of
it
where
somebody
could
mess
up.
If
you
will
and
then
I
had.
This
epiphany
well
started
thinking
about
reese's
pieces
in
a
reese's
cup
and
when
they
put
it
together
how
it
was
pure
magic,
and
if
I
had
more
time
I
would
have
had
confetti
drop
out
the
ceiling
or
something
right
now.
I
thought
that
was
a
genius
thing,
so
guess
what
we
did.
B
We
just
put
it
together
and
then
we
made
our
own
object
right.
So
we
want
to
reduce
some
human
oversight.
We
want
to
provide
a
clearer
picture
for
analysis
for
the
analyst
and
it
is
easily
exportable
to
csv
xml
json.
Whatever
you
want
what's
key
about
that.
Well,
you
could
import
it
into
your
seam
or
your
log
aggregation
system
or,
however,
you
want
to
continue
to
conduct
analysis
on
it.
So
getting
that
data
back.
We
have
two
different
entries.
If
you
will,
we
see
very
clearly
the
local
remote
ipm
port
for
each
one.
B
We
also
see
very
quick,
clearly
the
name,
the
pid,
the
process
path.
We
see
the
hash
associated
with
it
and
any
command
line
argument
and
guess
what
else
we
see
we
see
what
kicked
it
off
right?
What's
the
parent?
What's
the
parent
pid
and
then
the
same
stuff
associated
with
it?
So
in
one
view
we
start
to
get
all
that
information
as
opposed
to
having
the
swivel
chair
back
and
forth
and
try
to
put
it
back
together,
all
right,
so
automated
profiler.
B
I
recall
a
couple
years
ago
where
I
was
on
this
very
highly
visible
incident
and
we
had
found
something
and
my
supervisor
was
standing
over
me
and
my
team
and
he's
like
okay
where's
the
report
where's
the
analysis
right
because
it
had
some
high
visibility.
They
wanted
to
be
able
to
provide
that
to
some
higher
leadership,
and
I
don't
know
about
you
but
anytime.
I
have
somebody
standing
over
me
like.
Is
it
done
yet?
Is
it
done
yet?
Is
it
done
yet?
B
I
can't
concentrate
if
I
can't
concentrate,
I
can't
get
the
job
done,
so
I
didn't
want
to
feel
like
that
anymore,
neither
myself
or
my
team.
So
we
end
up
coming
up
with
automated
profiler
and
roughly
it
takes
about
four
minutes
depending
on
the
system
and
what
resources
are
available
for
us
to
parse
a
500
gig
hard
drive.
Now?
What
does
this
really
do?
Well,
this
is
going
to
go
through
for
anybody
who's,
a
forensic
analyst
and
it's
going
to
provide
the
information
that
you
would
always
look
for
and
include.
B
B
So
I
think
it
varies
a
little
bit,
but
let's
talk
about
the
system
on
login
when
I
was
doing
incident
response
right-
let's
let's
say
I'm
coming
to
your
organization:
I'm
like
hi,
I'm
nando.
This
is
my
team.
We
want
to
we're
doing
incident
response
in
in
you
know,
in
response
to
whatever
is
happening.
To
do
this
we
want
to
deploy
sysmon.
We
want
to
deploy
this
edr.
We
want
to
change
this
setting
and
then
we
want
to
be
able
to
get
this
data
to
respond
to
your
intrusion
depending
on
the
environment.
B
You
might
be
like
hey.
My
house
is
on
fire,
but
no
you're
not
doing
that,
because
it's
got
to
go
through
change
management,
no
you're,
not
installing
that,
because
we
don't
understand
what
it
is
right.
So
when
we
get
into
that
type
of
conversation,
then
this
is
where
bro
both
process
gives
you
that
ability
very
quickly
and
really
we
talked
from
a
defense
perspective.
If
I
had,
the
ability
to
install
sysmon
or
sysmon
was
all
over
the
place.
B
It'd
be
a
different
conversation
of
sorts,
but
now,
if
I'm
looking
at
it
from
a
red
team
perspective,
although
I
probably
wouldn't
use
this
from
a
red
team
perspective
again,
it's
already
there,
but
largely
speaking.
If
it's
a
do,
I
use
verbose,
processor,
cismod.
Well,
if
you've
got
cismod
available,
you're
going
to
get
the
enrichness
that
you're,
probably
already
seeking
to.
B
B
Okay,
awesome
so
now,
when
I
look
at
the
dns
process
right
we're
going
to
explain
this
dns
process
kind
of
some.
So
what
behind
it?
So,
let's
say
a
user
navigates
out
to
google.com.
Well,
first
thing:
the
assistant's
going
to
do
is
check
his
local
host
file,
see
if
there's
any
entry
in
there
for
google.com.
If
not
it's
going
to
check
the
local
dns
cache
see
if
it
already
has
the
ip
for
it.
B
If
not,
it's
going
to
query
whatever
is
configured
for
its
dns
server
and
if
that
dns
server
has
it
in
its
cache,
it's
going
to
provide
the
answer
back.
If
it
doesn't
it's
going
to
see
if
it's
the
authoritative
source
for
that
domain
and
if
not,
it's
then
either
going
to
utilize
root,
hints
to
go
get
that
answer
or
it's
going
to
send
it
to
a
forwarder
depending
on
how
it's
configured.
B
Now,
if
I'm
at
a
point
where
there's
an
intrusion
in
my
network
and
if
we
look
at
the
incident
response
model,
I'm
trying
to
contain
it,
I
may
look
to
sinkhole
the
domain
or
prevent
the
domain
from
being
resolved,
and
I
got
a
couple
of
places
in
which
I
can
affect
that.
Well,
if
it's
one
or
two
systems
or
less
than
10
or
less
than
whatever
you're
willing
to
go
touch,
if
you
will
or
script
out,
I
can
utilize
the
local
host
file.
B
I
can
put
an
entry
in
there
for
google
and
I
can
put
the
loopback
ip
or
quad
zeros
if
I'm
talking
about
a
full
environment.
Well,
I'm
probably
gonna
look
to
do
that
at
my
dns
server,
the
lowest
one
of
sorts
and
just
make
myself
authoritative
for
that
domain
and
then
give
it
quad
zeros
or
loop
back.
But
when
I
say
sinkhole,
what
am
I
talking
about?
Well,
let's
say
nandynan.com
is
known
to
be
malicious.
B
I
want
to
prevent
my
users
from
getting
it
and
we've
already
seen
two
places
in
which
we
would
do
that.
Let's
take
this
picture,
let's
use
a
car.
The
car
would
be
on
my
left
and
would
be
trying
to
get
on
the
other
side
where
those
buildings
are
at
there's
a
gigantic
sinkhole
there,
which
in
theory,
is
preventing
me
from
getting
to
my
getting
to
my
destination.
So
essentially,
when
I
sink
hold
that
domain,
I'm
going
to
prevent
the
machine
from
getting
the
information
it
needs
to
to
then
navigate
to
that
domain.
B
Now
the
person
the
malware
is
using
ip
addresses
game
over.
It's
a
different
tactic
that
I
would
need
to
get
at
so
develop.
The
script
invoke
sync
code
domain
and
very
simple:
straightforward:
we're
going
to
execute
it.
We
can
then
download
a
a
list
of
blacklisted
domains
from
a
reputable
site
or
we
can
feed
it
a
list
of
domains
that
we
just
want
to
block
it's
going
to
create
a
forward
lookup
zone
for
those
domains,
create
a
records,
pointed
at
quad,
zeros
or
quad
a
records
for
ipv6
right,
and
when
we
see
it.
B
When
we
look
at
that
lookup
zone,
we
see
all
those
domains,
essentially
those
records
in
which
we
are
now
becoming
authoritative.
For
so
now,
when
the
system
tries
to
notificate
out
to
that
domain,
we're
going
to
feed
it
back,
quad
zeros,
it's
not
going
to
be
able
to
resolve
it,
we're
starting
to
contain
this
in
my
environment
now
I
would
also
look
to
do
it
from
a
network
perspective
and
we've
all
heard
of
defense
in
depth
right.
B
Prevent
all
right
so
looking
at
event
logs,
you
already
know
two
different
ways
to
look
at
it.
We
have
our
classic
log
way.
We
have
our
get
one
event
where
we're
gonna
do
classic
vlogs
and
event
tracing
of
sorts
and
really
what
we're
trying
to
get
to
with
event
logs
is
they
provide
a
wealth
of
knowledge
and
information,
but
when
we
just
call
upon
it
straight
out
gives
us
this
table
view.
This
isn't
very
useful.
4688
is
an
event.
B
Log
id
is
probably
one
of
the
best
event
ids
that
windows
has
available,
but
unfortunately,
isn't
enabled
by
default.
But
nonetheless,
from
this
view,
I
get
that.
Essentially
there
were
20
instances
of
so
of
this
event
id
being
triggered,
but
I
don't
really
get
the
guts
of
what's
going
on
now,
when
I
look
at
it
and
I
expand
that,
I
see
these
properties,
but
really
what
I'm
looking
for
is
in
the
message
field,
particularly
I'm
looking
for
something
like
the
account
name.
B
Maybe
the
process
name,
maybe
the
creator
process
command
line
and
every
event
id
might
be
slightly
different.
Luckily,
for
me,
there's
properties
within
the
properties
that
I
can
then
dial
into
to
be
able
to
call
upon
them,
because
right
now,
if
I
just
called
upon
message,
I
would
essentially
be
looking
at
the
contents
of
that,
essentially
as
a
string,
but
when
I
can
utilize
the
properties
of
the
properties,
I
can
essentially
take
those
sub
properties
and
call
upon
them
specifically
and
start
to
reshape
my
object
and
or
make
my
own.
B
B
In
this
case
I
see
netcat
running
and
I
see
it
going
out
to
an
ip
address
on
quad
fours
right
quad
four
is
typically
associated
with
metasploit,
okay
awesome,
so
I'm
starting
to
find
things
that
I
may
possibly
would
have
missed
otherwise,
and
then
I
can
utilize
our
grid
view
of
that's
my
thing
or
I
can
just
pipe
that
data
back
into
my
scene.
So
I
can
then
do
some
enriched
analysis
of
it,
but
garbage
out
right
is
going
to
be
garbage
back
in.
B
So
I
need
to
be
able
to
filter
that
data,
specifically
what
I
need
again
going
back
to
that
thing
of.
When
I
come
to
your
environment,
I
may
want
to
install
an
agent
well
developed
a
edr
if
you
will
in
powershell
now
the
unfortunate
thing
about
this
is
with
an
agent
the
agent
utilizes
a
push
method
where,
as
stuff
happens
on
the
endpoint,
the
agent
pushes
it
back
to
the
server.
B
So
you
get
much
more
near
real-time
analysis,
utilizing
the
method
in
which
I've
done
it
in
powershell
we're
doing
a
pull
method
where,
on
some
pre-described
time
on
our
server,
we're
going
out
to
the
endpoints
and
pulling
that
information.
What's
the
so
what
of
that?
Well,
the!
So
what
is?
We
may
miss
some
information
based
upon
us
utilizing
this
pull
method.
So
it's
not
near
real
time.
It's
just
really
based
upon
how
often
we
do
it
of
sorts,
but
we
get
some
enterprise,
wide
visibility,
quick
identification
of
anomalies-
and
this
is
modular
in
nature.
B
So,
there's
about
20
items
of
interest
that
we
already
pull
but
you're
more
than
willing
to
create
more
modules
and
incorporate
it
in
there.
The
data
comes
back
in
csvs,
but
also
in
a
sql
database.
So
you
can
look
historically
as
to
what
you
previously
have
gotten
and
it
utilizes
a
network
log
on
so,
if
you're
concerned
with
throwing
credentials
all
over
your
environment
and
people
using
a
malicious
tool
like
mimi
cats.
B
Well,
the
network
logon
doesn't
isn't
susceptible
to
mimikats
and
when
we
look
at
some
of
the
items
that
we
retrieve
well,
these
are
a
number
of
things
that,
from
a
incident
response
perspective
or
just
a
analysis
perspective
things
that
we
would
want
to
go
after
and
look
at
right
and
again,
it's
modular
nature.
So
you
can
add
more
to
the
framework
and
continue
to
build
it
out.
If
you
so
choose
all
right.
So
we're
going
to
take
a
second
here
and
we're
going
to
actually
execute.
B
B
Hey,
I
don't
even
know
what
it's
called.
Okay,
sorry,
all
right.
There
we
go
so
x,
cube
posh
r2.
I
can
either
pull
stuff
from
the
domain
listed
based
upon
the
domain
in
which
these
computers
are.
This
computer
is
already
in,
and
I
can
just
pull
it
out
of
a
d.
I
can
import
the
computers
or
ips
from
a
file.
I
can
input
a
computer
or
ip
mainly
or
I
can
just
run
it
against
them.
B
That
data
is
going
to
come
back
in
a
folder
of
that
of
that
date
and
time
right.
So
we
see
we're
running
it
right
now,
my
clock's
at
207,
and
that
data
is
slowly
but
surely
coming
back
now
we're
running
it
on
one
miss
one
machine.
So
it
looks
to
wait
for
10
machines
to
come
back
before
it
starts
to
consolidate.
So
it
does
it
in
tin,
machine
chunks.
B
So
it's
trying
to
give
it
a
second
to
see
if
there's
anything
else
before
it
starts
to
do
its
consolidation,
and
we
see
that
it's
already
going
now.
The
database
is
a
sql
database.
You
see
it's
already
at
9
000
kilobytes,
because
we're
cumulatively
just
adding
stuff
to
it,
and
I
can
use
something
like
sqlite
and
just
read
that
database
and
actually
we're
going
to
go
ahead
and
stop
it
from
adding
to
it.
B
B
B
We
don't
necessarily
need
to
use
this
database,
but
this
is
going
to
come
back
in
a
number
of
formats
in
which
should
make
it
easier
for
you,
the
analyst
to
be
able
to
analyze
it
and
conduct
analysis,
and
that's
really.
What
we
wanted
to
be
able
to
incorporate
here
is
granularity
of
sorts
of
what
we
can
do
to
be
able
to
really
find
malicious
actors,
and
we
don't
necessarily
have
to
have
an
edr
or
go
through
change
management
to
get
something
added
to
a
domain.
B
B
Okay,
well
cool
I'll,
just
terminate
that
process
and
that
would
terminate
that
binary
from
running
sounds
like
an
easy
one.
What
happens
when
somebody
injects
malicious
content
into?
I
don't
know
a
critical
service
like
lsats
like
explore,
we're
not
just
going
to
go
in
there
and
start
terminating
that
and
guess
what
malware
authors
realize
that
so
they
want
to
get
into
those
critical
processes.
Well
invoke.
Suspend
process
allows
us
to
suspend
the
process
and
essentially
tend
to
the
maliciousness
that's
injected
into
a
profile
without
terminating
the
profile.
B
Excuse
me
the
process
itself,
so
when
we
look
at
like
ransomware
that
gives
us
this
ability
to
try
to
go
after
ransomware
keys
of
sort,
so
we
don't
always
having
to
go
and
pay
a
ransom.
We're
also
not
breaking
critical
services
from
within
a
windows
machine
because
we're
able
to
suspend
that
process
so
we'll
come
up
we'll
come
in
and
we'll
run
this.
A
So
kind
of
for
those
who
aren't
too
familiar
so
the
idea
of
suspending
a
process
is
then
you
can
then
access
the
the
memory
of
the
existing
process
and
do
other
things
with
it.
So
you
don't
necessarily
want
to
kill
the
process.
You
want
to
inspect
the
process
and
do
other
things
with
it.
A
running
process,
correct,
correct.
B
Right
because
I,
if
I
terminate
the
process,
if
it's
a
critical
service,
I'm
going
to
have
other
implications
on
the
box,
if
I
just
leave
it
running
well,
it's
still
actively
terrorizing
my
machine
or
doing
whatever
its
beck
and
call
is
so
I
want
to
suspend
it.
So
I
don't
terminate
the
process,
but
I
don't
actually
still
have
the
malware
running
and
then
I
can
actually
do
some
form
of
interrogation
of
storage
right
and
actually
tear
it
apart.
B
A
B
So,
depending
on
the
rights
that
you
have
so
in
my
current
right
sys
system,
I'm
sorry
as
administrator
no,
I
would
need
to
elevate
the
system
to
be
able
to
affect
lsas.
But
if
I
wanted
to
terminate
explorer
absolutely
I
could
terminate
that
right
now
or
I
could
affect
it
and
pause
it.
If
you
will
cool
thanks,
don't
worry
so
we
have
this.
B
This
demo
binary
running,
I'm
going
to
get
the
pid,
that's
going
to
be
8096
and
then
we're
going
to
come
in
here
and
we're
going
to
suspend
it
we're
going
to
feed
it
the
id
and
now
we
see
that
our
iterations
have
stopped.
The
process
is
still
running.
It's
just
in
a
suspended
state,
because
we've
added
a
debugger
now
I
can
go
in
here.
I
can
create
a
copy
of
that
process.
Dump
the
memory.
I
can
do
some
analysis.
B
I
can
do
some
live
analysis
on
it
or
I
can
just
pause
it,
so
it
doesn't
actually
continue
to
do
its
malicious
intent.
While
I
try
to
figure
out
what
to
do
next
of
sorts
right,
this
is
really
geared
towards
doing
some
forensics
malware
analysis.
If
you
will
from
a
powershell
perspective
now,
when
I'm
ready
to
continue
on
because
I've
gotten
it
to
a
point
where
I'm
just
ready,
I
can
then
go
in
there
and
resume
this
right.
B
So
we
got
two
functions
here
and
I'm
gonna
feed
it
the
process
id
again
and
when
we
start
that,
then
it
just
continues
to
run
again.
I
need
to
be
able
to
have
rights
to
it.
Some
protected
processes
require
I
have
system,
so
I
would
need
to
elevate
to
system
level
rights
to
be
able
to
affect
those
those
services.
If
you
will
and
then
there's
a
number
of
other
ones,
I
can
do
with
my
elevated
rights
on
a
system.
C
Hey
nano:
why
don't
we
pause
for
two
seconds
there,
because
I
have
a
feeling
if
we
paused
people
would
probably
ask
some
questions.
There's
been
a
few
things
in
the
chat
which
we
could
pass
along,
but
guys,
if
you
have
a
few
questions,
you
want
to
pass
them
along
or
jump
on
mic.
You
can.
I
saw
someone
want
to
know
about
how
does
lsas
react
to
being
paused.
B
Oh,
it's
going
to
jack
up
the
system
right,
so
elsas
was
a
was
a
was
a
bad
example.
Elsas
is
a
really
bad
example:
it's
going
to
jack
up
right,
but
but
but
taking
lsas
out
of
it.
If
there's
other
services
of
sorts
or
processes
that
we
can't
terminate
for
one
reason
or
another,
then
we
could
suspend
it
yeah,
but
lsas
was
a
bad
example.
B
C
So
so
guys,
why
don't
we
take
a
two
minute
breather
here?
I'm
sure
you
kept
up
with
everything
nando's
covered
right.
It's
all
just
very
basic
knowledge
that
everybody's
absorbed
already
right,
I'm
kidding.
If
you
have
questions,
please
we
encourage
you
to
ask
them.
So
if
you
want
to
throw
them
in
chat,
we'd
be
happy
to
try
to
get
to
them.
Nano
can't
see
the
chat
right
now.
So
if
you
want
to
jump
on
mike
and
just
ask
you
a
question,
feel
free
and
just
know
if
you're
wondering
like
is
my
question
appropriate.
C
It
is,
unless
you're
doing
the
voice
recordings
that
rocky
gondohar
was
doing
earlier,
but
we
want
everybody
have
a
chance
to
chime
in
so
we're
going
to.
Let
him
go
in
a
few
minutes
because
he's
going
to
go
and
he's
got
more
to
do,
but
if
you
have
questions
about
what
we've
done
so
far,
try
to
get
him
in
now
anybody
yeah
this
is
mark.
Hey.
A
B
B
This
is
a
dead
box
analysis
if
you
will
so
just
drive
slave
to
whatever
my
forensics
machine
is
but,
but
I
haven't,
I
haven't
witnessed
it
being
so
intensive
where
I
couldn't
utilize
it,
because
it's
actually
just
pulling
the
mft
file
itself.
It's
it's
not
trying
to
assemble
some
other
variation
of
the
mft.
A
Right
I
understand
but
but
on
my
laptop
I
I
found
that
that
yeah
my
memory,
my
memory
footprint
while
I
was
while
I
was
reading
the
the
mft
into
a
in
a
power
shell-
it
it
really
ballooned
so
and
I
don't
have-
and
I
don't
have
nearly
that
much
on
my
on
my
laptop
and
I
was
thinking.
Oh
my
gosh,
you
got
a
500
gig,
you
know,
500
gig
drive
with
you
know,
that's
similarly
packed.
B
C
B
Okay
yeah,
then
my
good
catch
yeah.
This
is
essentially
the
box
over
here
is
malicious
or
I'm
not
malicious
has
some
some
suspicious
stuff
on
it.
We've
unplugged,
it
turned
it
off,
took
this
drive
out,
put
it
in
the
right,
blocker
hooked
it
up
to
my
forensics
machine
and
yeah.
It
appears
as
if
it's
an
external
drive
at
that
point.
B
A
So
yeah,
so
that's
the
go-to
place,
it'll
be
updated
and,
as
things
get
updated,
that's
where
to
go
perfect.
So
fernando
I
had
a
question
from
way
back
when
you
were
looking
at
the
processes
stuff.
Okay,
that
looked
like
something
that
would
be
really
useful
to
watch
more
in
real
time.
Do
you
usually
like
set
up
like
a
scheduled
task
for
that?
Or
do
you
have
like
a
watcher
service?
That's
executing
that
to
watch
processes
as
they
get
built
up.
B
I
I
don't,
I
I
think
that's
a
great
idea
if
I
was
if
I'm
focused
on
one
machine
or
even
my
own
machine
generally,
I'm
trying
to
do
it
across
a
subset
of
systems
of
sorts
and
I
haven't
ran
across
the
the
initial
use
case
to
do
it,
but
absolutely
I
think
that
would
be
super
great
to
have
it
just
watching
these
things
pop
up
and
bam.
Some
little
you
know
window
in
the
bottom
right
of
sorts
sounds
like
sounds
like.
C
B
B
Yeah
absolutely,
and
for
that
now
I
got
to
think
about
some
type
of
agent-based
thing
on
the
endpoint,
where,
as
things
happen,
the
endpoint
calls
back
to
the
server
with
that
information
that
could
easily
be
another
script
of
sorts.
That
serves
that
the
quicker
thing
for
the
use
case
that
I
had
was.
I
stand
up
the
server.
I
have
an
account,
that's
associated
with
my
actions.
B
We
monitor
for
the
actions
of
that
account
on
our
scene,
providing
overwatch,
and
then
we
utilize
network
logon
to
go
to
the
machines
and
pull
and
then,
when
I'm
done
in
your
environment,
the
cleanup
is
removal
of
my
account.
You
continue
to
monitor
in
your
scene
for
usage
of
the
account
which
nobody
should
be
using
at
that
point,
when
I
look
at
possibly
doing
it
from
an
endpoint
solution
pushing
to
the
server
we're
just
going
to
have
to
extend
that
code
and
touch
more
machines
but
yeah.
B
A
B
I
I
don't
I'm
more
concerned:
did
the
process
start
not
to
say
that
termination's
not
bad
either,
but
a
lot
of
times?
You
know
I
get
on
this
system
and
it's
like
hey
this
clicker
possibly
executed.
Did
it
well,
let's
go
look
at
the
event
id
and
if
we
have
some
other
journaling
of
sorts,
do
we
have
it
there
or
this
thing
is
bad.
Where
has
it
executed
at
well,
let's
pull
our
46.88
event
ids
and
then
let's
look
from
that
perspective.
A
B
C
Cool
all
right,
I
think
nando
has
charged
himself
up
a
little
bit
he's
ready
to
go
so,
let's,
let's
let
him
fire
off.
So
you
guys
can
complain
about
too
much
information
coming
at
you
again,
that's
what
that's
what's
in
the
chat
just
so
you
know
it's
a
bunch
of
omg
omg.
I
stopped
taking
notes,
I'm
just
going
to
wait
for
the
recording.
B
A
B
Yeah,
absolutely
okay,
so,
as
we
pick
back
up
fail
to
ban
if
you're
managing
a
mix
based
server
or
system
unix,
if
you
will-
and
it's
publicly
facing,
I
don't
have
to
tell
you
that
people
are
trying
to
brute
force
it
every
second
of
the
day.
And
if
that's
news
to
you
that
people
are
trying
to
brute
force
your
publicly
facing
server
or
system
every
second
of
the
day,
I'm
sorry
to
be
the
bearer
of
bad
news,
but
those
logs
are
very
interesting.
B
You
can
tell
when
it's
automated
and
you
can
kind
of
tell
when
somebody's
sitting
at
the
keyboard
of
sorts,
but
you
probably
don't
want
people
trying
to
log
into
your
server
at
their
own
free
will
for
as
long
as
they
want
to.
You
probably
want
to
be
able
to
identify
when
such
things
are
happening
and
then
have
some
type
of
automated
response
in
place.
So
you
can
then
be
a
little
bit
more
rest
assured
well
from
a
linux
or
unix
perspective.
B
There's
an
open
source
product
program
called
fail
to
ban
and
it
works
well,
and
it
does
exactly
what
it
says
right.
So
you
can
pre-configure
a
number
of
times
in
which
a
failed
logon
happens,
whether
it's
ssh
or
actually
interactive
through
the
actual
gui.
If
you
will
and
then
after
that
threshold
is
met,
it
will
automatically
block
all
communication
from
that
ip
for
a
predetermined
period
of
time.
B
B
Every
second
of
the
day
with
no
recall
well
fast
forward
a
little
bit
and
we're
dealing
with
windows,
and
you
know
we
have
some
public
facing
windows,
type
servers
and
systems
and
guess
what
people
are
doing
the
same
thing
on
those
machines
as
they
do
on
unix
machines
go
figure.
Well,
I
wanted
to
be
able
to
utilize
fail
to
ban
on
windows,
but
it's
not
for
windows,
there's
a
couple
of
instances
where
people
try
to
port
it
over
the
windows,
but
largely
they
didn't
do
what
I
needed
them
to
do.
B
So
guess
what
you
know,
we
took
the
power
shell
and
just
made
our
own.
So,
yes,
we
can
configure
our
own
threshold.
We
can
set
the
band
timeout
set
up
some
auto
removed
if
you
will
and
then
we're
going
to
commit
the
ips
that
we
block
to
the
event
law,
because
largely
speaking,
events
in
the
event
log
are
not
just
staying
there
right,
because
somebody
of
red
team
descent,
if
you
will,
could
start
to
wipe
their
tracks,
you
want
to
be
able
to
move
those
event
logs
offline
somewhere
else.
B
We
got
the
guy
on
the
right.
The
gun
on
the
left
is
malicious.
The
guy
on
the
right
is
a
good
guy.
The
guy
on
the
left
is
trying
to
log
on
as
admin
with
the
password
of
one
two
three.
He
continues
with
admin
any
subsequent
number
of
other
passwords
and
finally,
after
the
sixth
time
or
so
he
is
successful.
B
In
some
cases,
this
is
unbeknownst
to
the
person
who
actually
owns
the
server
and
if
they
would
have
put
something
in
place,
they
could
have
prevented
that
from
happening.
So
with
something
like
invoked,
failed
the
ban,
we
would
have
set
a
measure
of
let's
say
three
and
after
that
person
had
had
three
failed
authentication
attempts.
We
would
have
prevented
any
communication
from
that
person.
B
Well,
you
may
be
saying:
well,
let's
say
they're
using
admin,
3
and
admin
3
doesn't
exist,
that's
just
going
to
be
a
failed
logon.
In
your
event,
log
no
harm
no
foul.
If
admin
exists
and
they're
trying
to
log
on
this
admin,
they
may
actually
lock
that
account,
and
then
you
might
be
saying
where
they
can't
get
in
anyway,
because
they
lock
the
account
and
then
I,
the
admin
is
tipped
to
it
and
I'm
just
going
to
unlock
it
or
whatever
the
case.
B
We
want
to
prevent
this
person
from
having
any
communication
with
us
and
if
they're
the
run
of
the
night,
I'm
just
trying
to
brute
force
whatever's
out
there,
they're,
probably
going
to
move
on
to
the
next
server,
actually
there's
a
pretty
high
chance
of
sort,
and
if
you
block
them
for
a
substantial
period
of
time,
then
you're
no
longer
a
threat.
They're,
no
longer
a
threat
to
you.
If
you
will
so,
let's
demo
this
and
actually
go
through.
B
B
B
In
this
case,
I'm
going
to
say
to
no,
I
don't
want
to
add
any
more
to
my
white
list
and
then
I
get
a
list
of
those
ips
that
are
being
added
now.
I
have
this
set
up
rather
aggressively,
where
it's
something
like
four
authentic
failure.
Failure
failed
authentication
attempts
in
30
seconds
of
sorts.
If
I'm
running
this
in
production,
I'm
definitely
not
running
this
aggressive,
but
for
the
purpose
of
this
talk
again,
it's
going
to
be
rather
aggressive
and
I
have
it
spitting
back
out
to
the
screen.
So
we
can
see
it.
B
B
And
we're
gonna
fail
right
and
here
in
a
second
we're
gonna
see
it
kick
in,
it's
cool,
it
kicked
in,
it's
gonna,
add
this
firewall
rule
and
we
see
it
there.
We
also
seen
it
that
it's
committed
to
the
event
log
and
I
just
gave
it
an
event
id
of
one
three,
three
seven
and
then,
when
I
come
over,
I
see
that
I
can
no
longer
communicate
with
that
machine.
That's
gonna
time
out
once
my
jail
time
has
surpassed.
B
A
But
I
think
one
of
the
magics
is
that
this
is
powershell,
so
you
could.
Basically
you
could.
You
know
fork
it
from
there
and
you
could
add
a
little
code
here
to
say:
hey
just
do
a
particular
port.
You
want
because
you're
just
adding
a
firewall
rule.
That's
that's
across
all
ports,
but
you
can
say
across
you
know,
you're
blocking
the
the
ip
as
opposed
to
then
the
port
right,
yeah,
yeah.
Typically
sorry
in
a
typical
enterprise
environment.
What
rights
are
the
end
users
going
to
need
to
be
able
to
do
that
functionality?
B
Yeah,
I
think
that's
going
to
be
environment
dependent,
but
I
I
my
use
case
and
everybody's
use
case
is
going
to
be
different.
My
use
case
wasn't
built
upon
a
true
enterprise
environment
because
I
don't
assess
in
my
enterprise
that
somebody
is
is
doing
this
form
of
lateral
movement
where
they're
attacking
another
machine,
I
would
already
prevent
lateral
communication
of
sorts.
This
is
more
for
that
system,
that's
alone
and
unafraid
that's
publicly
facing
out
on
the
interweb
somewhere
of
sorts.
B
In
his
current
stance,
it
does
not
look
at
cookies,
it's
purely
ip
based
not
in
this
talk.
I
also
wrote
a
packet
capture
in
powershell,
so
we
could
actually
dive
a
little
bit
deeper
into
the
actual
traffic
itself
to
your
point,
whether
it
will
be
behind
a
low
balance
or
not.
I,
I
think
that's
network
dependent
right,
because
every
environment
is
going
to
run
things
a
little
bit
different.
A
B
Yeah
absolutely
good
questions,
I'm
interested
to
see,
see
how
you
would
use
it
in
your
environment
or
maybe
it's
not
fitting
for
it
of
sorts,
but
I
think
combining
the
packet
capture
with
something
like
this.
You
can
get
a
little
bit
more
granular
if
you're
behind
a
load,
balancer
or
maybe
it
just
doesn't.
Suffice
there
other
questions
or
comments.
B
Okay
awesome,
so
we
talked
about
a
subset
of
blue
team
type
stuff.
We'll
talk
about
a
couple
of
things
from
a
red
team
perspective
right
again,
a
couple
of
things
from
a
lot
of
things
that
we
could
actually
do
from
a
red
team
perspective.
Well,
foulless
malware
is
the
name
of
the
game
these
days
right.
If
I
can
put
code
on
your
box
that
provides
some
type
of
malicious
intent
without
putting
a
binary
there,
I'm
going
to
absolutely
do
it
and
I
think
most
people
would
agree.
So
how
do
we
get
to
that
point?
B
Well,
we
take
that
binary
and
then
we
would
convert
it
to
bytes
a
string
of
bytes
and
then
we
might
base
60
for
it
and
once
we
have
it
in
that
base64
code,
we
can
then
store
it
somewhere
on
your
system
and
as
we
need
it,
we
could
retrieve
it,
and
then
we
could
just
reverse
that
process.
Some
people
would
say:
well,
I
don't
want
to
base
64.
I
want
to
go
from
bytes
to
hex.
B
I
say
it's
like
a
reese's
pieces
where
you
could
do
it,
however,
makes
sense
for
you
based
upon
the
environment
or
if
people
get
to
a
point
or
people
have
the
next
gen
edr,
where
they
start
to
identify
this
in
an
automated
fashion.
Maybe
you
go
data
bytes,
base64,
to
hash,
to
bytes,
to
base64
right
so
you're,
just
extending
that.
Recognizing,
though,
when
you
get
ready
to
use
it,
you're
gonna
have
to
reverse
that
whole
process
before
you
get
to
that
point,
so
some
places
that
we
would
look
to
store
this
code.
B
Well,
it
could
be
the
registry
because
no
admin
out
there
knows
every
registry
key
or
value
right.
I'm
not
gonna
would.
But
I
don't
know
any
that
do
active
directory
and
that's
kind
of
one
of
the
examples
will
show
as
well.
We
could
put
it
in
event
logs
where
we're
writing
to
the
event
log,
and
then
we
go
read
that
event
log
and
then
take
the
data
from
it
and
actually
convert
it
and
then
run
it.
B
The
bad
thing
about
the
event
log
is
we
stand
the
chance
of
it
aging
out
or
rolling
out,
so
we
may
want
to
look
to
want
to
use
one
that
doesn't
necessarily
get
data,
so
our
stuff
has
a
good
chance
of
staying
there.
Much
more
longer.
We've
used
alternate
data
streams
and
when
I
tell
you
this
is
an
old
technique
to
just
hide
stuff.
In
alternate
data
streams,
it
still
works.
It's
like
a
trend
from
the
80s,
that's
just
continuously
coming
back.
We
got
group
policy
objects
as
well.
B
There's
an
ability
for
us
to
put
a
description
and
group
policy
objects
that
description
largely
isn't
used.
So
we
can
put
data
in
there
put
enough
spaces
in
there
where
we're
pushing
our
data
off
the
screen,
and
then
you
have
to
actually
interact
with
the
object
of
sorts
to
be
able
to
see
that
full
data
and
I'll
take
my
chances
depending
on
the
network
and
what
I
know
about
that
admin
that
they
won't
be
able
to
see
that
or
won't
even
interact
with
it.
So
utilizing
something
like
active
directory.
B
We
already
recognize
is
going
to
be
based
upon
objects,
users,
computers
and
groups
and
from
an
enterprise
perspective.
This
is
going
to
be
great
on
the
right.
We
have
the
gui
aspect
of
it
and
we
largely
have
about
50
or
so
properties
that
are
available.
There's
a
number
of
other
properties
that
are
not
visible
by
default
and
we'd
be
able
to
see
those
in
attribute
editor
again,
I
would
do
have
done
some
reconnaissance
on
this
network
in
the
admins
to
know.
B
A
A
B
Now
admins
and
I'm
and
I
gotta-
I
gotta,
take
my
my
chances
here
and
also
understand
the
admin.
Would
an
admin
and
when
scrolling,
through
looking
at
objects,
notice
that
the
telephone
number
had
some
random
text
in
there.
He
probably
wouldn't
know
it
was
base64,
but
would
he
notice
it
well
again?
I
think
that
depends
on
your
environment.
B
Where
I
look
to
go
is
something
like
the
division
property,
maybe
employee
id
employee
number,
because
those
are
not
shown
by
default
when
I'm
just
looking
at
that
object
from
a
gui
perspective,
I'd
have
to
look
in
attribute
editor
specifically
for
those
things
to
be
able
to
see
it
hints
the
division
property,
what
I'm
showing
there.
So,
even
if
an
admin
when
attribute
editor
started
scrolling
through
for
whatever
reason
on
a
particular
property,
a
particular
object
rather
and
started
to
see
stuff
that
was
unfamiliar
to
them
and
started
to
interact
with
it.
B
B
This
is
making
it
a
little
bit
more
stealthier
already
considering
what
type
of
administrator
that
I'm
working
with
and
in
some
cases
and
I'll
tell
you
whoever
just
mentioned
about
the
telephone.
I
might
just
put
it
right
there
in
the
telephone
property,
because
the
admin,
although
he
may
feel
like
he's
a
top
tier,
doesn't
see
it
or
has
not
seen
it.
If
I
got
a
guy,
that's
a
little
bit
more
stealthy
right.
B
Like
some
of
you
guys
on
here,
I
might
try
to
go
a
little
bit
deeper
and
I
gotta
pull
out
some
other
tactics
of
sorts.
But
nonetheless,
when
I
go
to
interact
with
it,
I
wouldn't
do
it
from
a
gooey
perspective.
I'd
actually
utilize
powershell
read
that
property
and
then
store
it
in
a
variable
of
sorts.
B
I'm
right
here,
nearly
at
the
top
of
hklm
under
software
within
the
7zip
key.
I'm
created
two
things,
one
of
them
actually
not
here,
but
here
under
software
I
created
a
value
called
updater32
right.
It
may
sound
legit,
it
may
not
sound
legit
and
in
there
I
got
basic
decor
code
sitting
there
again.
The
registry
is
deep
and
I
wouldn't
go
one
level
deep
in
hklm.
I
would
go
much
deeper
and
I
probably
wouldn't
just
store
the
code
just
like
I
did.
B
Instead,
I
would
prepend
it
with
those
spaces
that
I
talked
about
in
additional
to
that
in
the
registry.
We
noticed
that
the
default
value
has
a
value
data
of
value
not
set.
So
I
also
started
mine
with
value
not
set
and
then
pushed
it
off
160
spaces
before
I
then
put
in
my
actual
base64
and
if
you
notice
at
the
end
of
that
line,
I
got
three
dots
right,
so
insinuating,
there's
more
to
what
I
just
see
there.
B
So
an
admin
one
would
have
to
find
my
key
with
this
value
and
then
he
would
too
have
to
double
click
on
it
to
interact
with
it.
I'll
take
my
chances
of
sorts
right
now.
This
is
a
place
where
I
start
to
store
data
for
me
to
expel.
Maybe
this
is
a
a
rat
or
an
implant
that
I
didn't
have
on
pre
some
pre-designated
time
frame
where
it
goes
to
read
this
value
executes
it
and
then
that
rant
that
malware.
B
If
you
will
creates
communication
back
to
my
server
and
then
brings
the
value
back
as
far
as
the
next
instruction
of
sorts
but
notice,
this
isn't
a
running
process,
that's
just
sitting
there.
This
is
going
to
be
raw
code
of
sorts
right
now
with
powershell,
depending
on
the
version
we
start
to
get
into
some
command
line,
arguments
of
sorts
that
we
can
get
after
we've
got
some
other
logging
in
there
we've
got
people
who
are
still
utilizing,
v2
or
they've
upgraded,
and
they
still
have
b2
there.
B
So
people
downgrade
to
version
two
right,
there's
a
number
of
things
that
we
can
do
and
really
when
we
say
well,
when
do
we
use
this
versus
the
next?
It
all
depends
on
the
environment.
As
I
go
to
put
in
a
sink.
I
have
my
tool
kit,
but
really
I
don't
know
exactly
what
I
need
until
I
see
what
type
of
thing
that
I
have
to
remove
or
not
remove
so
I'll
pause
there.
So
we
can
discuss
boundless
malware
a
little
bit
with
powershell.
C
So
I
got
I
got
an
interesting
sort
of
point
or
question
for
you,
so
you
know
I'm
the
admin,
I'm
the
guy
who's
supposed
to
try
to
defend
the
menses,
and
I
just
feel
powerless.
I
feel
like.
I
would
never
even
know
where
to
begin
to
look
at
that
stuff
right.
So
I
I
see
the
techniques
that
you
use
and
I
kind
of
feel
that
you're
in
the
point
now
where
this
is
stuff
that
people
are
not
going
to
detect
on
their
own.
I
mean
an
admin
may
stumble
across
this
when
he's
going
to
look.
B
Yeah,
there's
there's
there's
a
there's:
there's
different
tools
out
there
that
could
could
highlight
it
right.
If
you
have
a
good
edr
endpoint
cyber
security
solution,
you
possibly
could
configure
it
to
monitor
for
registry
key
creation,
maybe
that'll
be
too
loud
for
you.
You're
gonna
have
to
tune
it.
Maybe
you
could
then
configure
or
utilize
event
logs
of
sorts,
because
it's
still
a
powershell
process,
that's
being
called
upon.
It's
just
I'm
feeding
it
that
data
and
it's
going
to
be
a
command
line
argument.
B
So
what
I'm
really
trying
to
say
here
is
from
a
defense
perspective,
it's
tough
right
and
I
face
it
every
day,
but
defense
is
really
one
based
upon
defense
and
depth
right.
So
maybe
I
see
somebody
coming
in
from
our
border
firewall
or
what
have
you?
I
got
something
that's
monitoring
there.
We
got
a
a
a
firewall
or
some
type
of
ids.
B
It
gets
to
a
point
where
it
gets
to
an
endpoint,
and
then
we
have
a
number
of
things
that
are
happening
there
and
really,
I
think
every
organization
needs
to
have
somebody
or
some
element
proactively.
Looking
there's
been
a
number
of
times,
I've
been
in
somebody
else's
machine
from
a
red
team
perspective
right,
I
got
authorization
and
the
admins
just
don't
know
we're
there
right.
Imagine
that
feeling
where
you're
like
yep
my
machine's
running
well,
I
got
no
logs
or
whatever,
and
all
is
well.
B
Security
starts
to
go
down
a
little
bit
and
with
covet
and
everything
else
and
people
are
starting
to
telework
a
little
bit
more
man
there's
some
people
whose
organizations
are
not
necessarily
built
for
that
and
they
had
to
in
an
emergency
fashion
transition
over
to
telework.
But
did
they
really
test
out
these
services
that
they're
really
utilizing?
B
Do
they
have
monitoring
in
place
where
they
could
understand
that
people
are
actually
bypassing
security
or
they
are
being
targeted?
Are
they
using
some
form
of
multi-factor
authentication?
Are
they
even
looking
at
the
logs,
where
mike
usually
logs,
on
nine
to
five
eastern,
but
now
all
of
a
sudden,
we
get
them
logging
on
weird
times
of
the
night
right
understanding
that
persona
of
sorts?
Hopefully
that
was
helpful.
I
went
off
into
tangent
a
little
bit.
C
B
B
Right
so
we
start
to
see
things
that
could
be
done
now.
Unfortunately,
if
we
walk
away
and
say
I'm
going
to
specifically
monitor
for
this
again,
every
environment
is
going
to
be
different
as
a
red
teamer
you're,
going
to
have
a
different
subset
of
things
that
you
can
pull
out
your
bag
of
sorts.
But
who
knows
you
might
catch
somebody
doing
this
and
you
feel
pretty
good
about
yourself.
Absolutely.
B
Okay,
so
we
can
also
do
port
scanning
with
powershell
as
well.
I
don't
necessarily
need
in-map
or
I
don't
necessarily
need
ncad
or
netcat.
I
can
utilize
powershell.
I
got
access
to
this
box.
I
now
want
to
see
what's
in
the
realm
of
possible
in
a
sense
of
what
else
can
I
touch
in
this
subnet?
Maybe
I'll
do
something
like
nl
test
binary
resident
on
the
windows
box,
so
I
can
understand
domain
trust,
maybe
I'll
start
to
poke
around
look
at
art
tables
and
everything
else.
B
But
more
importantly,
I
want
to
be
able
to
port
skin
a
little
bit
and
see
what
else
is
open
in
my
reach.
So
I
can
then
look
at
what
exploits
are
available
and
do
some
weapons
pairing
and
start
to
do
some
exploitation
of
sorts.
So
we
utilize
this
in
the
reconnaissance
phase.
This
is
going
to
help
us
understand
what
services
are
running
on
a
system
and
if
we
can
understand
that
we
can
start
to
profile
the
system,
but
also
look
to
get
something
publicly
available
for
exploit
and
leverage
it.
B
I
wouldn't
necessarily
worry
about
zero
days
as
much
because
there's
things
that
have
been
out
for
years
that
organizations
are
still
susceptible
to
right.
So
we
can
do
this
port
scanning
utilizing
a
net
class.
We
can
already
also
utilize
the
command
line
from
a
v5
perspective.
Now
this
command
does
some
pinging
with
it.
So
it's
a
little
bit
slower.
It's
going
to
do
a
full
connect
scan
if
we
were
talking
about
netcat,
but
it
also
doesn't
auto
close,
so
it
opens
it.
B
B
B
What
type
of
version
is
running
right
and
not
only
does
it
help
the
rent
team
because
they're
in
the
reconnaissance
phase,
if
the
blue
team
would
actually
do
this
from
time
to
time,
they
could
identify
not
only
rogue
systems
but
misconfigurations
hey,
I
didn't
know
we
had
this
running
right.
There
was
a
time
where
an
entity
had
a
vtc
that
was
being
infiltrated.
Actually,
there
was
an
actor
already
on
that
system.
B
So
when
I
called
the
organization
about
it
and
told
them,
they're
like
hey
this
ip
isn't
a
vtc,
it's
a
router,
I'm
like
no,
it's
a
vtc
fast
forward
and,
of
course,
it's
a
vtc
and
I'm
telling
them
that
the
person
is
ssh
in
the
admins,
like
there's
no
ssh
on
here,
guess
what's
on
there
ssh,
but
if
we're
doing
some
proactive
analysis
to
be
like
hey,
ssh
is
open
on
this
thing,
I
did
not
know
that.
Well,
let's
go
ahead
and
fix
that,
so
somebody
else
isn't
taking
advantage
of
it.
B
All
right,
so
I'm
going
to
come
through
and
we're
going
to
do
a
port
scan,
I'm
going
to
do
it
on
dot
200
and
I'm
going
to
specify
2280
135
443
445
right,
I'm
not
going
to
do
all
65
000
in
odd
ports,
I'm
going
to
do
something
very
targeted
enough
to
fly
under
the
radar.
If
you
will,
and
what
I
get
back
is
essentially
tcp
test
succeeded.
That's
going
to
mean
that
the
port
is
open
if
it's
false.
That
signifies
that
it's
closed.
Okay,
awesome!
B
I
now
see
that
this
system
has
four
ports
open,
but
I'm
not
necessarily
in
a
position
to
figure
out
if
it's
linux
or
windows
or
what
have
you
so
I'm
gonna
do
a
couple
of
other
things
in
which
we'll
look
to
do
that
in
this
case.
We'll
just
try
to
do
a
banner
grab.
We
may
get
some
information
back.
We
may
not.
I
could
also
do
some
small
things
like
actual
pinging,
so
we
see
that
with
our
ttl
right.
We
see.
B
Look
that
up
that'll
help
me
confirm
that
this
is
actually
a
windows
box,
or
maybe
it
could
be
a
linux
box
as
well
that
maybe
it
is
ported
over.
If
that's
not
enough,
I
look
at
what's
listening
on
port
80.
It
is
microsoft,
iis
and
I
see
the
version
now,
I'm
at
a
point
where
I
can
confirm
that
this
is
a
windows
box.
B
I
see
some
software,
that's
running,
that's
accessible
to
me
and
then
I
start
to
look
at
what
exploits
are
out
there
publicly
that
I
can
then
weaponize,
I.e
utilize
for
me
to
exploit
this
machine,
or
maybe
it's
something
that
I
can
change
around
a
little
bit
to
then
exploit
the
machine.
There
may
be
some
script
kitty
stuff
already
available
in
the
sense
of
metasploit
of
sorts
right,
but
we
went
from
essentially
fingerprinting
the
machine
to
information
gathering
fairly
quick,
all
right,
so
I'll
pause
there
for
questions
comments.
B
Okay,
nothing
heard
you
probably
heard
of
the
simple
http
server
right
where
we
can
stand
up
a
python
web
server
very
quickly,
very
hasty,
to
serve
data.
Well,
we
can
do
the
same
thing
in
powershell
and
we're
going
to
do
it
from
an
http
perspective,
but
we
could
do
it
as
https
utilizing
something
like
let's
encrypt
or
our
own
certificate
somewhere
or
we
can
do
some
self-signed
certificate.
B
Now,
when
we're
doing
a
well-known
port,
we
have
to
have
admin
rights,
but
if
we're
doing
in
a
high
ephemeral
port,
we
don't
have
to
have
admin
rights.
So
that's
good.
We
can
stand
it
up,
tear
it
down
as
needed
and
it
will
serve
content
from
our
desktop.
We
can
configure
that
to
serve
content
from
wherever
we
need
and
where
we
would
use.
This
is
typically
post
exploitation.
I've
already
got
on
the
box.
I've
done
a
survey
of
the
machine.
B
Ie
I've
gone
around
and
made
sure
that
there's
no
other
malicious
actor
on
this
system
and
there's
no
type
of
antivirus
or
defensive
tool
on
here.
That
would
then
illuminate
the
thing
that
I'm
about
to
bring
afterwards
it's
almost
like
breaking
in
somewhere
and
then
doing
a
reconnaissance
and
then
saying
okay,
boys,
the
close
the
the
coast
is
clear,
come
on
in
so
from
this
perspective,
we'll
look
to
bring
on
additional
malware,
payloads
or
additional
aspects
of
our
toolkit.
B
Let's
go
ahead
and
walk
through
this,
so
we
can
see
this
in
action
all
right,
so
I've
actually
have
it
running.
I
meant
to
stop
it
beforehand
right.
I
wanted
to
make
sure
the
demo
guides
did
get
me,
but
I'm
running
this
globally
and
I'm
gonna
run
it
and
bind
port
9000,
and
it's
very
hasty
in
the
sense
that
we're
talking
like
85
or
so
lines
and
without
formatting.
We
can
condense
this
a
lot
more.
This
is
running
as
a
job,
so
I
get
my
my
terminal
back.
B
If
you
will
so
we'll
come
over
to
my
other
machine
and
we're
gonna
navigate
out
to
that
system
on
port
9000
and
we'll
have
what's
on
the
desktop,
being
hosted
or
accessible
to
us
and
we
can
come
down
and
we
can
start
to
download
whatever
we
need.
Maybe
I'm
going
to
come
back
and
grab
a
netcat,
maybe
we'll
come
down
and
grab
whatever
this
pick
is
or
what
have
you
well,
my
ap
detected
it
right.
B
That's
probably
good
all
right,
let's
come
down
and
grab
this
one,
my
av
didn't
trigger
on
that
one
right,
and
this
is
the
good
thing
about
us
writing
in
powershell.
What
did
it
trigger
on
because
of
its
raw
code?
I
can
go
back
in
there
and
alter
it
in
this
case.
Netcat
is
heavily
signature
and
good
on
a
b
for
finding,
but
once
I'm
done
with
this,
I
can
come
back
in
here
and
I
can
essentially
stop
this
job.
B
Right
and
essentially
tear
down
that
server
right,
making
it
inaccessible.
Now
I've
just
stood
up
a
very
quick
http
server,
so
I
can
access
data
when
I'm
done.
I
turn
it
off
and
we'll
find
that
malware
authors
do
this,
where
they
have
their
malware
on
a
system
scheduled
to
beacon
back
I.e,
create
communication
back
to
a
home
base
or
a
c2
server
on
some
predetermined
schedule.
So
the
malware
author
wouldn't
keep
that
server
running
24
7.
They
would
just
turn
it
on
around
the
time
in
which
they
expect
the
system
to
call
back.
B
Allow
the
system
to
call
back,
give
it
a
new
instruction
and
then
they
would
tear
it
down
right.
They
do
that,
because
if
a
dco
or
defensive
person
finds
it,
they
don't
want
them
just
out
there
trying
to
fingerprint
or
touch
that
server
right,
we'll
probably
have
some
other
authentication
methods
associated
with
it,
but
we
see
that
we
can
stand
up
this
web
server
for
the
purpose
of
red
team
activities
very
quickly,
all
right
and
I'll
pause
there
for
questions
and
comments.
A
B
And
good
question
and
honestly
speaking
on
my
c2
server,
I
wouldn't
do
it
on
9000.
I
would
do
it
on
something
a
little
bit
more
well
known
like
80
or
443,
and
I
probably
would
encrypt
it
right.
If,
if
I
had
the
time
and
opportunity,
the
real
question
is
do
client
workstations.
Would
it
look
suspicious
if
client
workstations
were
navigating
using
web
on
port
9000
and
I
think
again
that's
going
to
be
environment.
B
You
know
specific,
but
the
safe
bet
is
to
host
that
malicious
server
on
a
well-known
port
like
80
or
443,
and
then
absolutely
no.
It
would
not
look
suspicious
because
it
looks
like
web
traffic
and
your
client
reaching
out
to
the
web.
Well,
that's
what
clients
do,
but
if
you're
monitoring
for
traffic,
yes,
you'd
see
that
client
talking
to
a
server
on
9000,
absolutely.
B
Okay,
so
moving
on
this
brings
us
to
the
summary
right,
so
I
don't
have
to
tell
you.
Powershell
is
powerful
right,
specifically
used
for
assist
admins,
but
we
can
do
so
much
more
with
it,
and
people
are
doing
so
much
more
with
it.
From
a
blue
team
perspective,
we
could
build
an
edr
out
of
it.
We
could
use
the
incident
response
doing
some
iocs.
We
can
do
some
disk
and
memory
for
forensics
with
it
from
a
red
team
perspective.
We
can
do
things
like
malware
stagers
file,
this
malware.
B
If
you
will,
we
can
create
implants
kind
of
like
what
we
were
just
doing
where
we
have
the
endpoint
communicate
with
our
server.
We
can
inject
into
memory
port
scanning
and
it
just
kind
of
continues
on
so
much.
We
can
do
with
it
now
if
you're
still
wanting
more
of
powershell,
which
are
all
power
shells
which
I
love,
here's
something
else
for
you
under
the
wire.
So
myself
and
two
other
people
developed
this
in
2015.
B
We
have
75
challenges
on
here,
they're
linear
in
nature,
so
you
have
to
do
one
to
get
to
the
next
five
different
games
and
to
date
we
got
about
140
000,
unique
people
who
have
played
for
from
84
countries.
We
make
no
money
off
of
this
and
we
sit
off
in
slack
if
somebody
ever
needs
assistance
and
when
we
look
at
using
this,
it
may
be
something
like
this
right,
so
you're
able
to
go
to
the
site
under
the
wire.tech
you'll
go
to
war
games,
we'll
give
you
a
little
bit
about
them.
B
There's
five
games
here,
we'll
start
off
with
century,
because
that's
going
to
be
the
first
one,
and
essentially
it's
telling
you
to
register
on
our
slack
channel
because
that's
where
we
put
the
credits,
but
that's
also
where
we
want
you
to
come
for
help.
The
first
thing
you're
going
to
do
is
you're
going
to
ssh
into
our
server
right
and
from
there
you're
good
to
go
once
you've
ssh
in
there
you're
good
to
go
so
I'm
gonna
come
in
and
I'm
gonna
do
ssh.
B
Right
and
I
know
when
I'm
in
there,
because
my
path
is
going
to
change
right,
so
I'm
in
there
under
the
wire
power
shell
training
for
the
people.
I
finished
this
challenge
so
now
I'm
going
to
move
on
to
the
next
one-
and
here
is
telling
me
the
password
for
century
2-
is
the
build
version
of
this
instance
of
powershell
installed
on
the
system.
I
get
some
notes
associated
with
it,
so
each
one
of
the
users
is
a
new
level,
I'm
logged
on
as
the
user
century
one,
but
that's
really
level
one.
B
When
I
get
the
challenge
password
or
finish
the
challenge
here,
whatever
that
challenge
answer
is
becomes
the
password
for
century
two
I'll
do
whatever
the
challenge
is
there
when
I
get
that
answer
that
becomes
the
password
for
century
three
and
you
just
continue
on
right.
So
we're
gonna
get
the
build
version
here,
build
version,
I'm
gonna
come
in
and
I'm
gonna
do
ps
version.
B
And
then
we're
going
to
log
in-
and
I
know
I'm
good
because
my
path
has
changed-
I'm
logged
onto
century
2
I'm
going
to
terminate,
and
you
can
play
this
from
any
system
that
has
a
ssh,
client
and
internet
access,
so
now
that
I'm
logged
onto
century
2
I'll
just
move
on
right
and
it
continues
on
and
on
and
on
until
I
get
to
the
end
and
then
I'd
log
into
the
next
game.
So
that's
under
the
wire.
B
This
is
more
focused
on
getting
comfortable
with
powershell
of
sorts
and
less
about
defense
and
offense
getting
comfortable.
Now
the
bad
thing
is
and
I'll
acknowledge
that
is
that
it's
linear
in
nature,
so
you're
going
to
have
to
complete
one
to
get
to
the
next.
If
you're,
beyond
that,
we
also
have
posh
hunter.
So
I
developed
posh
under
2017
over
90,
interactive
challenges,
non-linear
in
nature,
blue
and
red
team,
focused
and
guess
what
you
can
jump
on
and
do
whatever
it
is.
B
You
need
to
do
you're
going
to
end
up
downloading
a
virtual
machine
that
already
has
the
artifacts
in
there
I
do
a
number
of
customizations
one
of
them
is.
I
take
away
the
gui
if
you
will
so
the
minute
you
log
on
it's
almost
like
you're
on
a
windows,
server
core,
where
all
I
give
you
is
a
terminal,
if
you
will
so
you're
going
to
get
the
isc
you're
going
to
get
the
powershell
console
but
we'll
log
into
the
web
ui.
So
you
can
see
this
site
all
right,
so
you
come
out
to
poshunder.com.
B
You
would
register
we
validate
your
email
of
sorts
and
then
you'd
be
able
to
log
in
once.
You're
logged
in
we
got
categories
like
encryption,
cipher
file,
system
registry,
logs
tasks,
enterprise
services,
dns
data,
manipu,
manipulation
and
question
and
answer
right.
Maybe
you
want
to
do
some
question
and
answer
kind
of
get
your
juices
flowing
and
get
out
the
gate,
but
you'll
notice
there's
a
number
on
each
one
of
them
and
that's
based
upon
how
difficult
it
is.
B
So
we
see
something
like
this
rogue
web
server
and
really
each
one
of
these
puts
you
in
a
scenario
of
sorts
of
you
being
either
a
red
team
person
or
a
blue
team
person.
So
in
this
case
you're
a
red
team
person
right.
You
look
over
some
notes
from
another
penetration
tester
on
your
team.
They
mentioned
not
seeing
some
information,
blah
blah
blah,
and
then
you
have
a
task
once
you
get
that
answer.
You're
gonna
put
that
in
you're,
gonna
click
submit.
If
it's
green,
you
guessed
it
you
get
it
right.
B
If
it's
red
you
guessed
it
you
get
it
wrong.
Now,
if
you
want,
you
could
actually
request
for
a
hint
and
you'd
lose
five
points
of
sorts
off
of
that
so
90
or
so
challenges
non-linear
in
nature
and
you'd
be
good
to
go.
So
some
of
you
who
are
like
man,
I
don't
really
do
some
of
this
dco
stuff,
but
guess
what
you're
like
stand
up,
assist
admins.
So
surely
you
can
come
in
here
and
I
don't
know,
get
the
total
number
number
of
users
and
ask
the
director
right.
B
The
sysadmin
is
trying
to
just
make
sure
the
person's
account
isn't
locked
or
his
attributes
are
good
to
go.
Or
what
have
you
right
so
postural
allows
us
to
get
that
granularity
to
kind
of
get
after
some
of
those
blue
and
red
team
tactics
and
with
that
we're.
Finally,
at
the
end,
sometime
tonight
or
in
the
morning,
I'm
going
to
post
these
slides
at
this
link
where
you'll
get
it
there's
my
github.
B
If
you
want
to
continue
to
communicate
via
twitter,
you
have
it
here
and
I
will
tell
you
you
want
to
talk
about
powershell,
I'm
game.
You
want
to
talk
about
security,
I'm
game!
If
you
want
to
talk
about
gardening,
that's
not
my
cup
of
tea
right,
so
I
look
forward
to
possibly
meeting
every
one
of
you
guys
one
day
and
definitely
interacting
with
you
more
to
the
people
who
put
on
this
again.
I
really
really
appreciate
it.
A
whole
group
dedicated
to
powershell.
This
is
amazing.
B
A
B
Yeah,
that's
an
important
factor.
Excuse
me!
Oh
I
I
don't,
however,
that
property
is
writable,
so
we
could
absolutely
write
to
the
last
modified
time
or
last
utc
time
or
last
whatever
time
right.
So
we
can
actually
do
what's
called
time
stump
in
that
fashion,
so
yeah
we
can
do
that
fairly,
quick
and
easy.
Absolutely.
A
Yeah
so
yeah.
My
comment
to
clem
is
that
that
that's,
actually
you
know,
there's
not
really
a
script
for
that,
it's
just.
Actually,
you
write
directly
to
the
attribute.
We
do
that
pretty
pretty
frequently
in
you
know
the
client-side
stuff
so
like
moving
files
around
and
stuff
like
that
sometimes
file.
If
you
move
it
from
folder
depending
upon
who
you
move
from
across
networks,
you
may
rewrite
the
file
and
how
you
move
or
copy,
and
so,
if
you
need
the
file
to
be
exactly
the
same,
you
know
icals
or
acls
iacos.
A
You
know
changes
some
of
that
some
of
the
attributes,
but
it's
just
straight
up
in
powershell.
You
just
get
the
file
and
you
write
it
back
out
so
yeah,
it's
an
easy
thing
to
do.
I'm
just
trying
to
think
of
things
that
could
possibly
be
added
as
forks
to
this
project
they've
been
out.
Looking
at
github,
oh
yeah,
oh
yeah
adds
to
your
thing.
Well,
I
think
it's
a
great
idea.
B
B
This
is
where
the
adversary
or
a
red
team
person
really
wins
out,
because
the
depth
and
scope
of
machines
that
one
would
have
to
defend
is
so
deep
that
unless
somebody
is
triggered
to
go
look
there,
they
might
not
ever
notice
it
right
think
about
the
people
who
are
serial
killers
in
neighborhoods.
You
know,
like
I
lived
next
to
john
bob
for
40
years
and
never
knew
it
because
something
had
to
trigger
the
police
or
law
enforcement
to
go
look
into
john
bob
and
that's
when
they
realized
that
he
has
bodies
in
the
basement.
B
C
First
off,
thank
you
so
much
for
spending
time
with
us
tonight,
and
I
know
I
mean
it's
amazing
and
in
the
comments,
if
you
haven't
had
a
chance
to
see
them
are,
are
fantastic,
a
few
programming
notes,
so
fernando
we'd
like
to
have
jeremy
brown
who's.
One
of
the
gentlemen
that
runs
our
group
reach
out
to
you
and
take
your
stuff
and
also
put
it
on
on
our
github
reco
repo.
So
people
have
a
central
spot
so
we'll
do
that.
B
Yeah
so
cyberpunkers.com
is
is
actually
my
blog.
I
think
I've
written
one
article-
I've
written
one
article
this
year
right,
so
I'm
not
as
active
on
there
as
I
as
I
used
to
be,
but
I
like
to
think
I'm
somewhat
active
in
the
twitter
sphere,
much
more
than
actual
blog
of
sorts
right
now
and
that
may
change
in
the
future.
Right
now,
while
we're
dealing
with
covid,
forensics
and
malware
analysis
is
actually
peaked
right,
so
I'm
stressed
that
work
a
little
bit
so.
C
But
on
on
a
separate
note
for
the
east
coast,
people
fernando,
is
a
frequent
speaker
at
a
lot
of
the
conferences
when
they
ramp
back
up
and
I'm
sure
a
lot
of
the
conferences
are
virtual.
Now,
but
I
I
mean
I've
followed
him
and
I
see
him
constantly
doing
stuff
georgia
back
up
to
baltimore,
senior
and
and
everywhere
in
between
so
there's
opportunities
to
come,
see
his
talks
and
get
more
knowledge,
obviously
his
website.
What
I
wanted
to
ask
you
a
little
bit
related
to
this.
C
B
Yeah,
so
I
I
would
be
remiss
if
I
didn't
mention
the
godfather
lee
holmes
right.
So,
if
you're
not
following
lee
holmes,
you
definitely
want
to
do
that.
There's
other
folks
that
are
just
super
duper
awesome
in
powershell
mike
you
do
great
stuff.
I
know
you,
you
probably
humbly
say
that
you're
you're
not
great
right
and
the
same
thing
with
your
battle.
B
Buddy
of
sorts
jeff
hicks
is
super
good,
but
when
we
start
talking
about
from
a
defense
or
a
cyber
perspective,
we
got
folks
like
matt
griber
who's
super
duper
good.
We
got
folks
like
gosh,
I
don't
even
know
his
real
name.
It's
like
ben,
but
he
goes
by
he's,
got
some
handle
of
like
big
enigma
something
right.
These
are
twitter
people
yeah.
These
are
twitter.
People
like
like
matt
griber,
is
his
real
name
right,
he's
the
guy
who
actually
wrote
powersploit.
B
Who
actually
wrote
powersploit
a
full-fledged
metasploit
like
capability
in
powershell,
right,
highly
signaturable
of
sorts,
but
the
other
guy?
The
enigma
person
I
was
talking
about.
He
does
a
lot
of
memory,
injection
of
sorts
there's
another
guy.
I
don't
remember
his
name,
but
he
wrote
actually
what's
called
power
forensics,
so
a
whole
forensic
suite
in
powershell
of
sorts.
So
when
we
look
at
parsing,
the
mft
by
itself
he's
actually
written
a
module.
B
C
So
recommendation
to
the
people
who
are
still
on
the
call
tonight
or
if
you're
watching
this
at
home
follow
wired
underscore
pulse,
and
maybe
we
can
ask
fernando
to
shout
out
some
of
the
people
that
he
recommends
and
then
you
guys
will
get
the
names
from
when
he
shouts
them
out
in
in
the
upcoming
days
or
weeks,
and
we
can
do
that.
So
why
don't
we
wrap
here?