It's time to stop ignoring prevention. A thread:
Point #1: Red teamers know how year after year the same tools and methodologies can be used to take over almost any organization running Active Directory. Sometimes even the same exact attack path steps find their way into reports year after year.
We shouldn't be satisfied with doing the same attacks against our clients for years (even decades) and collecting paychecks - what exactly is the point of all this tailchasing if things aren't getting better?
The reliability of tools like Mimikatz, Responder, and BloodHound is a huge problem. I love Responder. Responder came out in October of 2012. If we are still reliably using Responder in October of 2022, a full decade after its initial release, that's a failure that we all own.
Point #2: No control is a panacea, including detection. Investing heavily into detection is an attractive proposition because detection almost never means needing to change the status quo: users keep privileges, networks remain flat, and dangerous configurations go ignored.
Investment in detection becomes dangerous when it comes at the cost of other critical security controls, like prevention. You don't expect detection to protect you from Eternal Blue, HeartBleed, and $exploitoftheday. Why do you expect it to protect you from PSExec, WMI, and RDP?
Point #3: Vulnerability Management has given us the tools, methodologies, and vocabularies to effectively mitigate and manage the risks brought on by vulnerabilities. But historically, the same tools, methodologies, and vocabularies haven't existed for identity-based prevention.
Graph-based tools like FOSS #BloodHound, Stormspotter by @mcohmi, and Microburst by @kfosaaen have finally made it possible to easily understand outbound, inbound, and effective permissions against any securable object.
As those tools, their commercial counterparts, and associated methodologies and vocabularies mature, I believe we will finally see a fundamental shift in post-exploitation tactics. This will be a good thing for everyone involved: defenders, red teams, detection vendors, etc.
Will this happen overnight? No.
But will it be easy? Also no.
But will it be easy? Also no.
But I believe we're on the right track with things like BloodHound Enterprise, Attack Path Management, and others we compete with and complement who are loudly saying the same thing we are saying: it's time to get serious about prevention. /thread
• • •
Missing some Tweet in this thread? You can try to
force a refresh
