All right, so in our last lectures, we explored our Windows 10 target.
Now we're going to instrument the endpoint.
This assessment is awesome.
If you haven't heard of it, it's great.
It's an excellent way to forward your logs and monitor and log all of the activity on an incline.
And it provides a lot of detail, information about what's happening.
It's very, very good from a incident response and a blue team perspective.
This is what you want if you're looking to get visibility into your endpoints.
OK, so what we're going to do is we're just going to kick it off now.
I'm going to show you the best way to do this.
Right.
So, you know, you may Google around and how to install systems and you'll see tutorials, but I'm
going to show you the most current techniques for installing this mom with the best configuration.
Are we going to do this?
We're just going to go ahead and click download this one.
And it's really, really small, so I can right click show and folder.
Very cool.
I'm just going to say extract all.
I'm going to put this in a folder called Systema, so let's go and browse.
Let's see.
See, we'll put it in our files.
It's good to me.
Extract.
Of course, we need elevated rates to do this because we're writing to the program files directory.
Right, that was really fast.
Now, here we go, we're in program files and we have Sismondo.
Now that step is done also now what we need to do is we need to get a system configuration.
So I'm going to go over to all of Hartong systems modular.
So this is a sort of a guess.
You can call it a branch from Swift on security, which is a very popular system configuration.
But I like all of Hartong Sesemann modular better because it's just it breaks down each of the different
events that you want to see.
Into sort of a modular framework, and it just makes it really, really easy to collect all this stuff
right.
We can see create process access.
You know, image loads, right, people create times, everything is here, process creation, the one
is the event ID that you're going to see in the log.
So, for example, Event ID 22 is a DNS query to all DNS queries.
You'll see that here process and you'll see an event idea five.
And I like this repro because it's current and this is the most updated rebo that I've seen for this
modern configuration.
OK, so the way we get it is we just download it, right?
I'm just going to go ahead and click code.
I'm going to say download ZIP.
All right, we've got zip, very cool show info there.
Open this guy up.
All right, and we're just going to extract oil and we're going to put it in that folder we created
earlier I'm program.
That's right.
C program files.
And is Sismondo there it is so nice.
OK, let's give it a go.
Extract continue.
All right, so we're going to let this run in, once it finishes, we'll come back and we'll start the
configuration of this one, right.
So the extraction finished in a few minutes.
We're just going to make sure everything is in the same folder.
So I'm going to go inside of here.
Control a control export control act to put the clipboard.
And then it will be the Paiste will continue.
Do this for all current items.
Yes.
Then I'm just going to tweet that since my Modula master folder.
All right, so it's looking good now we need to do is get power, show up and running here, so I'm
going to go to the command prompt.
I believe I can press control shift, enter to open an elevated command prompt, yes, that was straight
up from memory, which is pretty cool.
Control shift and turn gives you that power, so.
All right, so we are running Paracha, and let's now go to this directory and what we're going to do
that.
So I control seed and then I right.
Click inside the window to paste it into this window.
What happened here, I will say that is a weird error message.
And I'm guessing the reason I did that is because I didn't put it in quotes, so this space was causing
problems.
So I thought that filesystem on this right here after the space with an argument to some application
called Seacombe Backslash Program.
All right.
So now what do we do once we get here?
Well, we could look at all the files and the ones we really care about.
Is this the system on modular script?
So you should see this one right here.
And the way you run it is we first need to disable our execution policy.
Right?
Because right now, if I try to run it, parshall's like, nope, scripts are disabled.
Right.
And this is not really a security boundary.
This is just power shell preventing people from making silly mistakes.
So what we can do is disable that right.
So I can say set execution to complete.
Right.
And then tack and hit tab every time a tab shows me any parameter, if I hold down shift and press tab
go backwards.
It's execution policy set to unrestricted.
Very, very cool.
And now I can outsource this.
I had a dog that had another dog and a backslash in the name of the script, and that -- load it into
memory.
All right.
I'm going to say run once.
Very, very cool.
And now the last step is just to merge all six ximo.
You can see now it is in our path.
Now, where am I getting all this magic from.
I'm not some super guru really.
All these commands just came from this GitHub page.
Right.
So you can see what I'm doing and in fact I'm going to make things easier by just copying and pasting
this.
So control see.
Enemy, back to that right click into.
Let's see what happens.
Very cool, so now you can see it produced this Tessmann config XML file, right?
So that's the fire we just created.
Now let's go ahead and install this man as a service so that it can survive a reboot and start with
the operating system.
I'm going to accept the other.
I think we need one single tick not to OK, and then I'm going to install.
This is Michael Vick.
And again, you can see that right here, right?
I'm not doing anything special.
I'm just reading the instructions, to be honest with you guys.
That's minimize that it's minimize all this clean things up a little bit.
Here we go.
What's up?
Sweet Sesemann has started, antisemite is configured, that's it somehow.
Let me show you something if I open up the here.
Let's show you the hard work that we did, all right.
Right, click open administrator.
All right, expand this window.
I'm just going to go to applications and services logs.
It's a little bit bigger.
All right, that finally loaded, we're going to expand Microsoft, we're going to go to Windows.
And we're going to go all the way to the bottom.
And we should seize this moment here and we do that is really cool.
Now, I've got this operational log.
We'll get all kinds of juicy events, right, so we can already see some of code 12.
And again, if you don't know these events, codes are.
And by the way, this is really cool.
It's mapping everything to you.
See the technique called.
And by the way, this is something else that's really cool.
Notice I'm having right now, we have no malware on this box.
It's a completely fresh image, but the logs are showing.
Activity that's mapped to the MIETEK framework, specifically this this technique idea, right?
So this is where cybersecurity gets really complicated.
T one, five, four, three.
Right.
Because filtering out the noise, right.
T one, five, four, three.
Lyter, how do you know what's good and what's bad?
And that's why context is everything.
If I pack this in here.
Let's see, look, create or modify system process adversaries may create or modify systems processes
to repeatedly execute malicious payloads.
Right.
So if you don't really know what you're doing and you're looking at logs, maybe these logs are being
sent into a SIM and you see this, you might think, oh, no, we're under attack.
No, we're not under attack.
This is part of normal.
Usage of the operating system and you can see here the image is Valmar tools, right?
So few more tools is doing what it's supposed to do.
It's really, really, really, really, really important that, you know, normal.
How can you detect what's abnormal unless you know what is normal?
And I'm going to harp on that a lot during this training.
But the good thing is we have all of our vets coming in here.
If you need some help with these other and what they mean, you can read the task category or you can
just go back to the page.
That we came from and you can actually go down to the bottom and it will tell you what.
All right, that's what we have here in the next lecture, are going to up the ante with power show.
I see guys in the next lecture right by.