We frequently find much of our effort is spent creating and testing payloads against various OS versions/architectures and against the most commonly used EDR (Endpoint Detection and Response), anti-virus and sandboxing solutions. Obtaining initial access is often one of the most complex and time-consuming aspects of an adversary simulation. The tool has been used to bypass “next generation” endpoint protections include Cylance, Palo Alto TRAPS and Fireeye amongst others. This talk describes opensource tooling for generating advanced payloads to be used during red team engagements. * Ideas for future research and wiki for more modules * Basics of Volatility and Useful Commands * Introduction to Rogue Wi-Fi Access Point (WAP) * Discussion about Jayson Street and others’ methods of introducing USB devices and the goals of such attacks. * *ishing, Spear Phishing, Whaling, Baiting, Dumpster Diving, etc * General discussion about the methods of social engineering Since defense is just as (if not more) important as the attack itself, we will also discuss mitigations (technical and procedural) and relevant windows detections for these attacks. During this presentation, we will walk through the steps to perform each attack. This is a two-pronged attack, consisting first of collecting a memory image for offsite offensive forensic analysis, the second being a rogue Wi-Fi access point attack. While this attack sometimes proves our point, it is the tip of the iceberg that can be done. In the past, we have worked on getting users to plug in USB devices to drop malicious documents and executables. This presentation outlines a new twist on an existing social engineering attack.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |