Hello and congratulations
on the successful completion of
another module in
our discussions on the application
of the minor attack framework.
Today's summary is with
respect to defense,
evasion and everything
that we have looked at within it.
So, as
usual, what should we
know now?
What have we gone over?
Well, we're going to really
summarize everything into one slide
today because there has been a
common theme in all
of these areas.
We looked at what they should be
or what they are based on what minor
has. So clearing command history,
getting rid of information,
compiling after delivery, putting
it together once it gets to an end
user system, disabling security
tools, hidden files and directories,
hidden users, process hollo software
packing, all of these things
designed to keep a
threat actor hidden and to
keep them out of your
purview.
Now, mitigation factors
here ranged from heuristic
and signature based antivirus
and malware detection all the
way through to end user awareness
training, API
detection, any number
of things within these areas really.
Again, our focus being
at least privilege for end
users and good
awareness training.
If those two things are the core
you can build from there and really
have a program in place that's going
to reduce the impact
and capability of a threat
actor on your network and
reduce that dwell time from
hopefully 50 days,
six months, three hundred days,
whatever the case may be, down
to maybe
minutes, maybe seconds, whatever the
case may be, they're depending on
your capabilities and what you're
doing.
Again, a lot of these techniques
are difficult to spot process
Halloween and software packages are
going to be a little bit more
difficult to spot.
Then hidden users and hidden files
and directories.
We can usually spot security
tools that have been disabled.
If we're paying attention to
systems, compile after delivery
may be difficult to detect, as
well as clearing the command history
in certain instances.
But if we do
see that threat, actors are
disabling those things or they're
getting rid of our command history,
we may at least have a point in time
that we can work back to with
respect to finding them and figuring
out what is going on.
So with that in mind, I want to
thank you for your time today, and
I look forward to seeing you again
soon.