The unique combination of behaviors that define guardrailing – and their order – can be used to detect it.
Pitfalls: stage 1 recon, confusing with broader AV/tech evasions, and "legitimate" guardrailing...
And now for the first 3 awards for technical achievement in adversary guardrailing! #Guardies 🏆
Roll out the red team carpet for @buffaloverflow and the amazing, creative, & inspiring Demiguise HTA payload encryption tool!
My award for the best guardrails in an APT group's close access operation: virustotal.com/gui/file/3fab3… 👀 enjoy!
Installs a hard-coded attacker-controlled wireless access point to a victim with a specific TP-LINK USB WiFi adapter 📶
Wonder if they got the USB stick at a conference 🔥
The lifetime achievement in guardrailing goes to #APT41 🐉🐉
You have heard of their connection to supply chain compromises with payloads restricted by MAC address.
How about DPAPI with keys tied per user & system?
Volume serial ID keying? Oh my.
See the APT41 talk #FireEyeSummit
Here's coverage of Ray Leong & @MrDanPerez's #APT41 presentation – including guardrail usage:
The value of our (+@cglyer) real-time attacker technique collaboration with absolute beasts in the industry @doughsec 😶🌫️, @penninajx + @srunnels 💻 cannot be overstated bringing together puzzle pieces for the RE wizards on each side
From the new @WIRED article: wired.com/story/the-unto…
———
While Mandia conferred with the government, Charles Carmakal, the CTO of Mandiant Consulting, contacted some old friends. Many of the hackers’ tactics were unfamiliar, and he wanted to see whether two former Mandiant… twitter.com/i/web/status/1…
We've been tracking DEV-0537 since 2021 (overlaps: Lapsus$, UNC3661). Here's a comprehensive 🆕 BLOG 📰 covering observed TTPs: microsoft.com/security/blog/…
#MSTIC and Defender threat intel collab
➕#DART 👻 incident response team experience from the trenches [1/3]
The blog highlights varied initial access vectors and a slew of [inconsistent?] end goals: data theft, extortion, chaos...
One way to interpret "this actor's TTPs and infrastructure are constantly changing" is that they are loosely-organized (see:
DEV-0537 / Lapsus$ shows that 𝘢𝘵𝘵𝘢𝘤𝘬𝘦𝘳𝘴 can be creative opportunists and still be successful.
Luckily, the same goes for 𝘥𝘦𝘧𝘦𝘯𝘥𝘦𝘳𝘴.
Use this opportunity to strengthen your security controls to protect far beyond this threat actor [3/3] microsoft.com/security/blog/…
But then what?? Let’s talk about some post-compromise techniques...
Please read the above blog to appreciate multiple backdoors used, careful & unique tradecraft used on-premise...
We just published more details on what we’ve been finding post-compromise: blogs.microsoft.com/on-the-issues/…
ADFS key material compromise, SAML shenanigans, OAuth keys added...
Yes - it's hardcoded for netblocks released in the #MSTIC report (microsoft.com/security/blog/…)
This is just extra coverage on top of existing cred harvesting logic
That said, the logic posted there finds some high fidelity #STRONTIUM campaigns from at least June through... recently (more details in above blog).
You'll see a User-Agent, first/last attempt, # of total attempts, # of unique IPs & unique accounts attempted + a list of accounts
As shipped, it's looking over the past 30 days. But if you have #AzureSentinel, I recommend pasting that same KQL in & searchings logs w/ expanded timeframe.
The # authAttempts can stay where it's at ... #STRONTIUM activity is approx 100 attempts per IP per account