Amateur Security Archaeologists, trying not to break things.

Tag: Cyber (Page 1 of 6)

Discovery: Now what do we have here?

The 9th tactic in the MITRE ATT&CK Enterprise Matrix is a fun one. ATT&CK’s Discovery is essential in any operation. No matter how solid the recon efforts are prior, circumstances change. All of the preparation in the world can’t replace updated intelligence. To be effective and achieve the end goals, adversaries need to dig deeper and gain knowledge of the environment. Both physical adversaries and cyber adversaries practice this behavior, but with slightly different stakes. In both cases, the discovery efforts not only help refocus the operation and steer towards objectives, but it also offers intel that can help the adversary cover their tracks. Let’s take a look at how discovery happens and what it can bring!

Continue reading

Credential Access: Why make logging in so easy?

When we look at the sheer number of vectors an adversary uses to compromise or breach their target, credential compromise is right up there with phishing as the two leading sources of compromise. In fact, phishing’s primary objective is to obtain credentials. Threat actors get a lot of press for creating new exploits, but isn’t it easier to just log in? Stats show that detecting a breach that leveraged stolen credentials takes ~50% longer over other primary methods (exploits, misconfiguration, etc.). Why is that? And what can we do to make it harder? Let’s talk about MITRE ATT&CK‘s 8th tactic, Credential Access!

Continue reading

What’s causing Mike’s Indigestion now? Drop it like it’s hot (2 May 2024)

Good morning, folks! Another week, another threat surface gets its turn in the press! While I have been working hard to prepare for the upcoming Cisco Live (2-6 June in Las Vegas!) news seems to be picking up before RSA Conference next week. This week we saw a lot of continued fallout from breaches past, variations of perimeter defense vulns, and more. We even see yet another tool essential to many get hacked – is nothing sacred! Let’s get into it!

Continue reading

What’s causing Mike’s Indigestion now? Double Trouble (26 April 2024)

Hello folks! It seems that there is never a dull week. To almost make that point abundantly clear, we have a large number of newly announced firewall vulns, some more ransomware hitting critical targets, and more state sponsored mayhem. So let’s get started and see what is going on!

Continue reading

What’s causing Mike’s Indigestion now? Everybody Hurts (19 April 2024)

I was on the road until yesterday, but I wanted to get back on the blog and update horse. So here we are! After learning about and supporting the launch of a new solution, I got sucked into some saved news articles and blogs on the trip home that convinced me we need to rethink a lot of things to get caught up with adversaries. Ransomware operators are constantly evolving, we should too! And no one has it figured out, as we’ll see in a couple of paragraphs. So let’s think outside of the magic quadrants and waves about new ways to solve our problems.

Continue reading
« Older posts
Verified by MonsterInsights