Untainted By Design: How Our MITRE ATT&CK Results Demonstrate the Resilience of Carbon Black

I started my career in cybersecurity 10 years ago as a Technical Operations Officer in the US Intelligence Community, where I had a first-hand view into the most sophisticated ongoing cyber operations in the world. One thing was always clear: attackers always found ways to stay a step ahead of th...

NRCC Email Hack Highlights Lack of Visibility & Proactive Threat Hunting at Political Organizations

Earlier this week, Politico reported that the National Republican Congressional Committee NRCC suffered a major attack prior to the 2018 U.S. midterm elections, with thousands of sensitive emails from four senior aides exposed to an outside intruder. While the impact of this breach is still...

Why I’m Ecstatic About the MITRE ATT&CK Results

Yesterday, MITRE published the results of its first public evaluation of endpoint detection & response EDR vendors based on its increasingly-popular ATT&CK framework. The ATT&CK evaluations are a new approach to EDR testing - open, sophisticated, rigorous, and reflective of the real world. We...

ATT&CK +osquery = Love

I had the ability to live-stream MITRE's ATT&CKcon, a two-day event where organizations came together as a community to share their best practices with leveraging the ATT&CK framework. At this conference, Scott Lundgren, Chief Architect at Carbon Black ,presented “ATT&CK + osquery = Love,” where ...

How The ATT&CK™ Framework Can Mature Your Threat Hunting Program

The truth about threat hunting is that it’s a process that matures with your security team. The more you learn more about the threat landscape, the more you can operationalize that knowledge. Because of this, it is important to work within a framework that can help you track the growth of your...

Using MITRE ATT&CK When Researching Attacker Behavior in a Post-Compromise World

MITRE ATT&CK is arguably one of the best assets available to security professionals who want to dive into the intricacies of detecting and preventing adversary behaviors. Why is that? It’s a great knowledge base of known adversarial behaviors overlayed with attacker TTPs and their state in the...

SANS THIR Summit Wrap Up – “We Have 15 Minutes”

Heading back to San Diego before I get on another flight 30 hours later. Lots of people say "what are you crazy? Why do that?"…to which I say: "we cannot achieve any mission without sacrifice." Going to events like the SANS Threat Hunting IR summit remind just how many dedicated people we have on...

Comparison of Open Source Adversary Emulation Tools

PenTestIT RSS Feed If you liked my older post titled "List of Adversary Emulation Tools", I am sure you must want to know what is the difference or comparison between the different tools. This post is an attempt to do just that -to list down the comparison of open source adversary emulation tools...

Apply MITRE’s ‘ATT&CK’ Model to Check Your Defenses

ARCHIVED STORY Apply MITRE’s ‘ATT&CK’ Model to Check Your Defenses By Trellix · June 18, 2018 Every week we read about adversaries attacking their targets as part of online criminal campaigns. Information gathering, strategic advantage, and theft of intellectual property are some of the...

Invoke-ATTACKAPI - A PowerShell Script To Interact With The MITRE ATT& CK Framework Via Its Own API

A PowerShell script to interact with the MITRE ATT&CK Framework via its own API in order to gather information about techniques, tactics, groups, software and references provided by the MITRE ATT&CK Team @MITREattack. Goals Provide an easy way to interact with the MITRE ATT&CK Framework via its o...

RTA - Framework Designed To Test The Detection Capabilities Against Malicious Tradecraft

RTA provides a framework of scripts designed to allow blue teams to test their detection capabilities against malicious tradecraft, modeled after MITRE ATT&CK. RTA is composed of python scripts that generate evidence of over 50 different ATT&CK tactics, as well as a compiled binary application th...

List of Adversary Emulation Tools

PenTestIT RSS Feed Every once in a while, the security industry brings forth a new buzz word and introduces terminologies that sound über cool and generate lot's of interest. One such word going around now-a-days is automated "adversary emulation". Let's first understand what this really means...

Partner Perspectives: Red Canary ATT&CKs (Part 1): Why We’re Using ATT&CK Across Red Canary

Editor's Note: This blog originally appeared on RedCanary.com Information security is grounded in risk management. And, because what gets measured gets managed, we rely on a variety of frameworks and key performance indicators to tell us whether we’re moving in the right direction. Frameworks lik...

Automated Adversary Emulation System: CALDERA

CALDERA is an automated adversary emulation system that performs post-compromise adversarial behavior within enterprise networks. It generates plans during operation using a planning system and a pre-configured adversary model based on the Adversarial Tactics, Techniques & Common Knowledge ATT&CK...

iFTP 2.21 - Buffer Overflow Crash (PoC)

!/usr/bin/python Exploit Title:iFTP 2.21 Buffer OverFlow Crash PoC Author: dogo h@ck Date Discovered : 12-5-2015 Vendor Homepage: http://www.memecode.com/iftp.php Software Link: http://www.memecode.com/data/iftp-win32-v2.21.exe Version: 2.21 Tested on : Windows XP Sp3 Crash : Go to Connect Host...

PHPBoost 4.0 <= (FileUpload/Disclosure) Multiple Vulnerabilities

PHPBoost 4.0 Multiple Vulnerabilities - Remote File Upload - Full Informations Disclosure 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database separated by exploit 0 0 // type...

StyleDesign CMS SQL Injection

Exploit Title : styledesign Cms Sql Injection Vulnerabilitiy Author : MiHaNHaCK.Com Discovered By : s3ri0s bl@ck Home : http://MiHaNHaCK.Com Software Link : http://www.styledesign.com.ar/ Security Risk : High Version : All Version Tested on : GNU/Linux Ubuntu - Windows Server - win7 Dork :...

WordPress Comment Rating SQL Injection

No description provided by source. Exploit Title: Wordpress comment rating plugin multiple Vulnerabilities Google Dork: 1- inurl:"/wp-content/plugins/comment-rating/" 2- inurl:"/ck-processkarma.php?id=" Date: 2/1/2012 Author: The Evil Thinker Contact : [email protected] Software Link:...

WordPress Comment Rating Cross Site Scripting / SQL Injection

Exploit Title: Wordpress comment rating plugin multiple Vulnerabilities Google Dork: 1- inurl:"/wp-content/plugins/comment-rating/" 2- inurl:"/ck-processkarma.php?id=" Date: 2/1/2012 Author: The Evil Thinker Contact : [email protected] Software Link: www.wordpress.com Vulnerable plugin: Comme...

Wordpress Comment Rating plugin Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Wordpress comment rating plugin multiple Vulnerabilities Google Dork: 1- inurl:"/wp-content/plugins/comment-rating/" 2- inurl:"/ck-processkarma.php?id=" Date: 2/1/2012 Author: The Evil Thinker Contact : email protected Software...