Yeah, and so when it uses things like EternalRomance or
EternalBlue to move around the network,
it's using that to spread from system to system.
It also has the ability to do brute forcing of the administrator.
Right, you had mentioned that. So if you have a very easy administrator
password, like password or admin or something else like that,
it'll try to brute force that if it can't get in.
And then finally,
we've also seen some TrickBot instances that will go through and they'll
dump credentials from memory using MimiKatz or something very similar. And
so that if you're not protected properly,
as soon as you log into a system,
those credentials are stored in memory in Windows somewhere, you can grab
them out, and TrickBot will do that and then use that to move laterally in
your network and just start infecting other systems.
Right. And so while we're looking at network‑based detections,
if you're only looking at internal or external,
you're not going to see that lateral transmission,
right?
So this is stuff that there should be updated threat signatures in
Suricata and Snort for these kinds of things, but if you're not
capturing at the right point in your enterprise, then you're not
going to see it anyway. Yeah,
and that's one thing that I think a lot of people see in their
organization where they're really good at looking at the traffic
that's leaving or coming in from the internet, but they're not
really good at watching internally.
They don't have that network visibility inside their network,
which is a huge disadvantage.
Sometimes that is even more important than watching what's going in and out of
the network. Especially if somebody has already gotten into your network, how
else are you going to find what they're doing?
You need to have host visibility and network visibility,
and if you don't have those,
then it's really difficult to figure out the extent of an attack.
Yeah, absolutely.
So,
even talking about that and how your network is set up, what
are some mitigations we can have in place?
There's pretty common stuff,
probably sys control level things that can help prevent the, not just the
infection, but the spread of TrickBot. Right. I think one of the best ways
to do that is to just segment your network.
Usually you don't have to have workstations talking directly to workstations,
so make it so that they can't. You can set up ACLs or other configuration
options in routers and switches and hubs and whatever you have to prevent
your workstations from talking to workstations.
You can even do things like preventing, let's say,
departments from talking to other departments.
So in other words,
do computers within HR need to be talking directly to computers in accounting.
Probably not.
They probably only need to be talking to where your file server
is at and where Active Directory is at. So doing that is going
to help prevent lateral movement.
It's going to make it more difficult for the attacker
to get from one system to the other.
They're going to have to find that intermediate system that everybody has
access to and attack that, and then you just make sure that you're really
monitoring that system as well. And a lot of people,
when they talk about that, they start going down this
road of like role‑based network access, right?
And yes, that is absolutely something you can do. That's great.
There's complicated solutions.
People are going to try to sell you a bunch of solutions.
You can also just use VLANs, and you can use ACLs and
free things to segment your network.
I want to say it one more time, segment your network. Absolutely.
Because if someone clicks the document in HR,
it doesn't mean that all your engineering devices have to
be infected as well. Right, exactly.