Other

Latest News From Blog

Other

Android Malware: Infection & Spread

The Impact of Android MalwareCybercriminals who want to get into your Android device only have to do one thing to make that happen: Convince you to download a game. In mid-2017, a type of malware known as a trojan virus hid in plain sight in the form of a game called ''Colourblock'' on the Google Play Store. Unknowingly, more than 50,000 people downloaded what they thought was a game, but was really malware (short for malicious software).Malware can spread through Android devices in a number of ways.Android, malware, infection, virus, trojan, spread, impactThe trojan, called Dvmap, made it possible for cybercriminals to monitor devices on which it had been installed and even put new applications, or software programs, on the phone. And, it worked because the masterminds behind it first uploaded a clean version of the app to the Play Store, before subbing in the malicious version.You may be asking yourself, ''Why isn't this lesson about both iOS AND Android malware?'' Well, the answer is hidden in the example you just read. The Google Play Store ecosystem has fewer security measures in place when developers are introducing their apps to the public. This is unlike Apple's App Store, which has more rigid controls in place. Add to that Android consumers' ability to install apps downloaded from the internet, and you have an environment ripe for cyber attacks. Now, that's not to say that malware is unheard of on Apple devices, but the focal point of this lesson is malware and Android phones.What is Android Malware?Android malware is really no different than the different types of malware you may be familiar with on desktop or laptop computers. It's simply targeted at Android devices. Mobile malware is any type of malicious software or code designed to harm a user's device, such as trojans, adware, ransomware, spyware, viruses, or phishing apps.Where does it come from? A host of places! As we've already discussed, third-party app stores, where users go to download new games, for example, hide malware inside different types of apps. An Android user, unlike an Apple user, may also do what's known as sideloading an app. This does require the device owner to change security permission, usually labeled 'unknown sources. Users can then download content directly from the internet onto their device, or via their computer, bypassing the Play Store altogether.And, of course, there are a host of traditional places malware can come from, including malicious downloads in emails, visiting suspicious websites, or clicking links from unknown senders. Once malware invades your Android's space, it can do all types of things, from the mischievous to the downright fraudulent, including showing you ads continually or stealing and selling your sensitive data.How Android Malware SpreadsJust a few years ago, experts believed that a majority of the malware present in the mobile space was targeted specifically at Android devices. Why? The looser controls on Androids make it more likely cybercriminals can gain access. Here are a few ways that malware can spread on an Android device. See if you recognize any of these.

Other

What is the Cyber Security Kill Chain?

There are several other cyber kill chain models developed by other companies, but for the sake of simplicity, we’re going to stick with the Lockheed Martin model, which is the best-known framework in the industry. We’ve included explanations as well as brief solutions for each one so you can better understand the process hackers take to breach a target.Step 1: ReconnaissanceLike any form of traditional warfare, the most successful cyber attacks start with lots of information gathering. Reconnaissance is the first step in the cyber security kill chain and utilizes many different techniques, tools, and commonly used web browsing features including hackers take to breach a target.Search enginesWeb archivesPublic cloud servicesDomain name registriesWHOIS commandPacket sniffers (Wireshark, tcpdump, WinDump, etc.)Network mapping (nmap)DIG commandPingPort scanners (Zenmap, TCP Port Scanner, etc.)There is a wide range of tools and techniques used by hackers to gather information about their targets, each of which exposes different bits of data that can be used to find doors into your applications, networks, and databases which are increasingly becoming cloud-based. It’s important that you secure your sensitive data behind cloud-based SASE defenses, encryption, and secure web pages in order to prevent attackers from stumbling on compromising information while browsing through your publicly-accessible assets, including apps and cloud services. Step 2: WeaponizeOnce an attacker has gathered enough information about their target, they’ll choose one or several attack vectors to begin their intrusion into your space. An attack vector is a means for a hacker to gain unauthorized access to your systems and information. Attack vectors range from basic to highly technical, but the thing to keep in mind is that, for hackers, targets are often chosen by assessing cost vs. ROI.Everything from processing power to time-to-value is a factor that attackers take into account Typical hackers will flow like water to the path of least resistance, which is why it is so important to consider all possible entry points along the attack surface (all of the total points in which you are susceptible to an attack) and harden your security accordingly.The most common attack vectors include:Weak or stolen credentialsRemote access services (RDP, SSH, VPNs)Careless employeesInsider attackersPoor or no encryptionSystem misconfigurationTrust relationships between devices/systemsPhishing (social engineering)Denial of service attacksMan-in-the-middle attacks (MITM)TrojansSQL injection attacksAnd many othersRemember: a hacker only needs one attack vector to be successful. Therefore, your security is only as strong as its weakest point and it’s up to you to discover where those potential attack vectors are. Ransomware attacks continue to exploit remote access services to gain entry, make lateral movements, and detect sensitive data for exfiltration, all before encrypting and making ransom requests.So typically once an attacker is in, their next move is to find different ways to move laterally throughout your network or cloud resources and escalate their access privileges so their attack will gather the most valuable information, and they’ll stay undetected for as long as possible. Preventing this kind of behavior requires adopting “Zero Trust” principles, which, when applied to security and networking architecture, consistently demand reaffirmation of identity as users move from area to area within networks or applications.

Other

How Do You Prevent Cyber Attacks?

What Is A Cyber Attack?A cyber attack is performed with malicious intent when a threat actor attempts to exploit a vulnerability or weakness in a system or individuals of an organization. These attacks threaten to steal, alter, destroy, disable or gain access to or make use of an unauthorized asset.Cyber attacks, threats, and vandalism are dangerous and increasing problems for businesses. Nearly all modern-day companies require a network of computers, servers, printers, switches, access points, and routers to operate.Businesses also deploy software tools to streamline functions, like QuickBooks for handling bookkeeping. Unfortunately, while these devices and applications provide a huge benefit to the company, they also represent a risk. All it takes is one employee to click on a malicious link that then gains access to your network and infects your systems.How Do You Prevent Cyber Attacks?Preventing a breach of your network and its systems requires protection against a variety of cyber attacks. For each attack, the appropriate countermeasure must be deployed/used to deter it from exploiting a vulnerability or weakness.The first line of defense for any organization is to assess and implement security controls.However, there are a number of ways to prevent cyber-attacks which include:           Creating a cyber security strategyDeveloping cyber security policiesConducting a security risk assessmentPerforming vulnerability assessmentsConducting employee phishing campaignsImplementing security awareness trainingInstalling spam filters and anti-malware softwareDeploying Next-Generation Firewalls (NGFW)Installing endpoint detection & response (EDR)Using a VPN or SD-WAN solutionImplementing a Virtual desktop infrastructure (VDI) solutionThe different types of cyber-attacks are:Network attacksWireless attacksMalware attacksSocial engineering attacks It’s important to note that no system is 100% vulnerability-free or “hacker-proof”. If a threat actor has enough time, resources, and manpower to launch an attack then chances are they will find a way in.This is especially true of advanced persistent threat groups.Cyber attacks come in all shapes and sizes from deploying an application-specific attack against a database server to sending phishing emails with malicious attachments or URLs.While knowing the purpose of a cyber attack can be helpful it isn’t the main priority. What takes priority is knowing how the attack occurred and how to prevent them from succeeding in the future.The next sections will go in-depth on the different types of cyber-attacks and threats and includes the steps you can take to prevent them from compromising your systems.

Other

Mobile Application Security

Mobile security is a constant issue among many enterprises. As companies continue to go digital and offer online and mobile platforms to their consumers, the rate of mobile security threats multiplies by the day.Having a mobile application is another means of ensuring that the product and services your company offers are readily available for your customers to consume. Connectivity, accessibility, and convenience are among the many factors entrepreneurs must prioritize to deliver in order to establish a good relationship with their market.However, if you fail to properly secure your mobile application and open your consumers – along with your company – the risk of having sensitive and vital information compromised, it will definitely damage your reputation and trust in your brand among consumers significantly.To help you avoid this, we have provided a comprehensive and in-depth checklist of ways to ensure the utmost security for your mobile application and reduce the probability of encountering external cyber threats penetrating your application.What is Mobile Application Security?Before diving into the checklist, allow us to establish the definition of mobile application security to get a wider understanding of the matter.Mobile Application Security is a comprehensive mobile security solution for applications on mobile devices such as smartphones, tablets, smartwatches, and the like.It is a practice where you ensure that your product is safe from various cyber attacks, such as malware, reverse engineering, keyloggers, and other forms of manipulation or interference, by implementing the best mobile application security practices available in the market.Moreover, it involves examining the structures of mobile applications and how they work. It also involves checking the major areas of the application and analyzing what hackers or any external threats want to accomplish by penetrating your application.As the world gradually becomes more digital and technology-centric, prioritizing mobile security should be mandatory among businesses.Why is Mobile Application Security Important?At present, there are over 6.64 billion people who own smartphones today. This means that approximately 83% of the population is connected to the internet and is likely to utilize two or more mobile applications and have incorporated them into their daily functions.These substantial numbers showcase the potential and importance of implementing application security on active mobile applications worldwide. The lack thereof can compromise your company’s sensitive data, along with the important data and digital properties owned by your consumers.Since the emergence of the COVID-19 pandemic and its plethora of social distancing and quarantine regulations, the world has shifted into digitization and adopted its methods into their lifestyles such as work, education, communication, and the like.The primary reason for its importance concerns the safety and security of digital properties, such as identities, finances, and sensitive data, to name a few. Ensuring that your business's mobile application is fully equipped with the right security protocols can help you prevent security breaches that can place you and your consumers at risk.

Other

Building an Active Directory Pentesting Home Lab in VirtualBox

Active Directory is often one of the largest attack services in Enterprise settings. In fact, the OSCP Exam was recently updated to have less emphasis on buffer overflows but added a section dedicated to Active Directory.AD can be confusing at first to learn, but one of the best ways to learn anything in software, is by installing and setting it up ourselves.Downloading Windows Server 2019Find the Windows Server 2019 download from the Microsoft Evaluation Center. Scroll down to the option "Windows Server 2019", and select the ISO download option, which Microsoft is apparently labeling as "Please select your experience:"Before the download will start, you'll be prompted to fill out some personal information. It asks for a work email, but a personal email (ie gmail, etc) should work fine too. Finally select your language, then start the download.After clicking download, you should see the file pop up in your downloads bar, and the webpage will update to reflect the file name of the Windows Server 2019 Eval version you're downloading.Installing Windows Server 2019 in VirtualBoxIn VirtualBox, start by clicking the New VM button, the blue spikey looking thing. In the VM Options pop-up, for Name type in "Windows Server 2019", for Machine Folder select a folder on your host computer where you want to store your VM files. Select "Microsoft Windows" for Type, and for Version select "Windows 2019 (64-bit)". Then click "Continue".In the next options panel, "Memory size", you can leave the default at 2048MB, aka 2GB, which is the minimum required memory amount for Windows Server 2019, or. But if you have the host RAM to spare, bumping up the VM memory to 4096MB or a little more is reccommended.(For our pentesting lab, these small values are fine, obviously though in a production setting you'd need significantly more RAM to run smoothly)For the "Hard disk" panel, select "Create a virtual hard disk now", then select "VDI (VirtualBox Disk Image)" and hit Continue. For "Storage on physical hard disk" I'm selecting the "Dynamically allocated" option.The "File location and size" should default to a new folder with your VM name from earlier, in the directory you also specified in the earlier step. I'd reccommend leaving this default so that all the VM files are contained in a single location. I'm leaving my VDI size at 50.00GB.After clicking through that, our new VM should appear in the left-hand sidebar, I have a few other VM's already installed which is why my machine appears further down on the list.Now that we have a VM created, we still need to install Windows Server 2019 onto our Virtual Machine. With the new VM highlighted (the background color should be a light blue) click the settings button.In the new pop-up, select "Storage", then under the "Storage Devices" window, click the empty disc icon. On the right-hand windows "Attributes", click the blue disk icon, click "Choose a disk file", then find the Windows Server 2019 .iso file we downloaded earlier. The filename will probably be the same or similar to: 17763.737.190906-2324.rs5_release_svc_refresh_SERVER_EVAL_x64FRE_en-us_1.iso. If the iso is loaded up correctly, you should see the "Empty" next to the disk icon change to the .iso file name. Click "OK" to save changes and close the pop-up.In VirtualBox, the steps that we just took are equivalent to inserting an install CD (or in this day and age, an install USB). So now we'll need to turn on the VM so we can actually install Windows Server from that .iso.With the new VM still highlighted, click the green "Start" arrow. A new window should pop-up on your host machine. This is our Server 2019 VM. After it finishes initially booting up, you'll see the Windows Server 2019 installation prompt.Leave the default settings as-is, and click next. You should see a new tab with a single "Install Now" button. Click that, and on the "Windows Setup" tab that appears, You should see 4 different versions of Server 2019. The option that we want is "Windows Server 2019 Standard Evaluation (Desktop Experience)".It's important to select the "Desktop Experience" version of Server 2019, this is the version of Windows Server that has a GUI similar to a standard Windows 10 install. In prior versions of Windows Server, you were able to install a GUI after initial installation, but that is no longer the case, so let's make sure we're installing the GUI version from the start.After selecting the correct version, you'll need to accept Windows License terms. Then select the "custom install" version, since this is a fresh machine and we're not upgrading from any previous versions. Our VirtualBox VDI should appear in the Windows Install tab as "Drive 0 Unallocated Space", it should be selected by default, so click the Next button.This will start the actual installation of Windows Server 2019 Desktop Experience. Like the download step from earlier, this process will take a little bit of time to run, so let Windows do it's thing through the install process. You'll probably notice that the Virtual Machine restarts a couple times through the install. This is normal.Initial Login & SetupOnce the install is finished, you'll need to supply a few more configuration settings to complete setting up your Windows Server VM. The built-in administrator username is pre-selected as "Administrator", for a password, I'm using P@ssw0rd!, not very secure, but it'll work for a small-scale home lab.Additionally, back in the VirtualBox manager, you can save the Administrator password for this machine by clicking "Settings", in the "General" tab, select "Description" then add some notes with our machine credentials.Once you've entered and saved our Administrator password, Windows should finish applying those new settings, and then open up a to a standard lock screen which should look familiar to you if you've used Windows 10 before.To login to our Windows Server VM, we'll need to hit "Ctrl + Alt + Delete". I work on both macOS and Windows Hosts, and trying to figure out the equivalent keys between various hosts can be a pain. Fortunately, VirtualBox has a nice built-in feature that allows us to input "Ctrl + Alt + Delete".On a macOS host, make sure you have your Windows Server 2019 VM selected, then in the upper menu bar, select "Input", hover over the "Keyboard" option, then click "Insert Ctrl-Alt-Delete". That dropdown will also show you what the keyboard shortcut on your host is to enter that without having the select the menu bar option.Once that's entered, you should be able to type in our Administrator password, P@ssw0rd! and login.On initial login, I got an automatic prompt asking if I wanted to turn on "Network Discovery", I went ahead and turned that on.Side Note: To the best of my knowledge, enabling "Network Discovery" doesn't affect ICMP settings. Ie, if you were to try to ping your Server 2019 VM from another host in your VirtualBox network right now, it wouldn't work. That's skipping ahead a couple steps though, so don't worry too much about it right now if that doesn't make sense to you.You'll also most likely see that the "Server Manager" program starts up by default. The astute readers among you might have noticed a tiny bright Orange "1" followed by a large heading labeled "Configure this local server". I think that means Windows wants us to click on it.Clicking on that link takes us to the "Local Server" configuration page, which can also be access via the left-hand sidebar.There's two main settings to take note of at the moment, the first is our Computer Name: "WIN-K3SDKO5BM8I", the second is the name of our Workgroup: "WORKGROUP".I won't go into too much detail about the differences between a Workgroup and a Domain but one of the key differences for our use case is that in a Workgroup, user accounts are managed by individual computers, whereas in a domain user accounts are managed by a central server or servers, called domain controllers.You might also hear it explained that in a Workgroup, all the various computers in that Workgroup are essentially peers, and no one single computer has elevated or admin credentials above the others in that Workgroup. Domains, conversely, have that central domain controller as the top-level administrative component, and as such have admin rights over the various user accounts within the Domain.Active Directory Domains is what you're more likely to see in larger scale, or Enterprise environments, and that's what we're trying to set up (albeit on a smaller scale) for our local pen-testing environment.With that explanation out of the way, let's go ahead and get started on our AD setup.Installing Active DirectoryTo start, let's rename our Windows Server 2019 Computer Name to something reflective of the fact that this will become our Domain Controller. Click the light-blue computer name, then in the "System Properties" pop-up, select the "Change..." button down next to the "To rename this computer...." text.I'm renaming my computer the very creative name, ADAMDC. Adam, for my name, and DC to reference the fact that this is our domain controller.Hit "OK" and after a few seconds that should update. You'll also see a pop-up stating that you'll have to restart in order for our name change to take effect. Hit "apply" in the "System Properties" window to save the changes. But choose the "restart later" option, to delay the automatic restart.We still need to setup some VirtualBox networking options, something we can't do while our VM is running, so this is a good opportunity to shutdown our VM.Click the "Windows" button in the bottom left-hand screen, then the power button icon and select "Shut down". This should be very familiar if you're used to working with Windows 10. What might not be familiar is the next pop-up, selecting a reason for shutting down.In our case, we'll just select "Other (Planned)" as the reason every time we shutdown our Windows Server VM. This isn't a production server, so it's not really important or even necessary to log reasons for shutdown.If you do shutdown without go through that process (ie you just close your virtual machine window) you'll get a mildly annoying pop-up the next time you turn on the vm. It's kinda like Microsoft's version of Mr. Resetti.Once that completes shutting down, click back into your "VirtualBox Manager".Installing Active Directory - VBox Network ConfigurationWe haven't look too much into our actual VirtualBox setup so far, other than what was absolutely needed to get our Windows Installation up and running. Now though, we're going to want to make sure we have our networking options setup and configured correctly before we move onto to actually installing Active Directory.VirtualBox has a couple different types of virtual networking options, but the one we're going to focus on is a "Host-Only" adapter. TODO MORE INFOFirst, ensure that you have a network setup in VirtualBox.Click "Tools" and then the hamburger menu looking thing to the right of it. You should see 4 options pop-up, "Welcome", "Media", "Network", "Cloud". Network is the option we want so click on that.If you don't already have a network click the "Create" button to make a new one, otherwise click properties to edit your existing one. Make sure the "DHCP Server" option is disable, and also select "Configure Adapter Manually"Give your adapter the settings of:IPv4 Address: 192.168.56.1IPv4 Network Mask: 255.255.255.0Still in VirtualBox Manager, select your Windows Server VM again, and select the options for that VM.In the Options pop-up, choose the "Network" tab, I have a NAT adapter in the Adapter 1 slot, so in Adapter 2 I've checked "Enable Network Adapter", set the Attached to: value as "Host-only Adapter", and for Name:, that's the name of the network we just created, I've selected my VBox network.Save those settings, and it's time to start up our Windows Server VM Again. Click the green start arrow. Then login with our administrator credentials.When you login, Server Manager should pop-up automatically again. Confirm that our computer rename from earlier successfully completed, then minimize Server Manager, and open up Command Prompt.In command prompt, type the following:ipconfig You should see an output with two network adapters listed (Virtualbox treats these as Ethernet connections). The first Network should be your NAT. That's how your VM gets external internet access. The second adapater should be the host only adapter we just setup, so you should notice that the IP will be in the range of the subnet that we specified when setting up the network a few moments ago.Now we need to manually assign our Windows Server Computer a static IP for our host-only network. Open up Control Panel, then select "Network and Internet", then "Network Sharing Center". You should once again see our two networks listed.Click the host-only network Ethernet (should most likely be Ethernet2), then select "Properties", then in the properties pop-up select the "Internet Protocol Version 4 (TCP/IPv4)" so that it is highlighted. Then click properties for IPv4.A new window should popup, and "Obtain an IP address automatically" is most likely pre-selected. Choose "Use the following IP address:"IP Address: 192.168.56.2Subnet mask: 255.255.255.0Default gateway: 192.168.56.1Preferred DNS server: 192.168.56.2With those settings inputted, click through the various "OK" buttons to apply the changes.Back in command prompt type cls to clear out previous ipconfig command. Then, re-run ipconfig.New IP, who dis?With all that setup out of the way, we now have a local network (the host-only network) that our VirtualMachines can use to talk to each other. We also assigned our server a static IP in that network which is recommended before setting up Active Directory. Finally, we pointed the preferred DNS server to our Windows Server Machine. We'll install a DNS server later to handle DNS for our AD Domain.Installing Active Directory - Back to Windows ServerSo, we now have our domain controller ready (not entirely true but we'll fix that shortly), but we still need a domain for it to be in control of.Return to the Server Manager Dashboard, and this time, select option 2 from the middle list. It's the "Add Roles and Features" link. The "Add Roles and Features Wizard" should pop up.Click "Next >" on the "Before You Begin" page, then on "Installation Type" ensure the first option "Role-based or feature-based installation" is still selected and click "Next >"On the "Select destination server" page, you should see our Windows Server 2019 Machine, named ADAMDC, in the Server Pool list, and click next.In the "Server Roles" you'll want to check the "Active Directory Domain Services" box. (This is the whole thing we've been working towards).When you click that box, a new pop-up will appear confirming that you want to add the additional required services for AD.We do. Click "Add Features".Click "Next" through the "Features" page.That'll bring you to the Active Directory Domain Services information page. Give it a quick read, then click "Next >"This is it, the confirmation page. As Uncle Ben said, "With great power comes great responsibility." When you're ready, click "Install".The installation will start and run for a little, you can close out of the installer window if you want, but since we're already in a VM you can also just open up a different window on your host to watch youtube while we wait.After the installation completes, we still have a little more work to do. Remember earlier when I said we had our "domain controller" ready? Well, I might've lied a little bit, back then it was still just a lowly server. But I think our server has performed admirably so far, and is worthy of a promotion.Click the "Promote this server to a domain controller" link. If you closed out of the installation wizard, you can also find this link back in Server Manager.That will pull up the "Active Directory Domain Service Deployment Configuration Wizard" Select "Add a new forest" radio button, and I'm using the Root domain name: adamdomain.com. Which for the record, is a domain I do not own. This isn't something you'd want to do in a real-world install, but since this is just for our home lab I think it'll be fine.Leave Forest & Domain functional level at "Windows Server 2016", and add a (DSRM) password, I'm going to use P@ssw0rd! again since this isn't a real AD install. Then go to the next page.On DNS Options, uncheck "Create DNS delegation" and click "Next".Wait for the NetBIOS domain name to automatically detect your domain name then click "Next".Click "Next" again on the Paths page to accept the defaults.On the "Review Options" page, there isn't much for us to do, click "Next" and the Configuration Wizard will run a check script to ensure the Active Directory install can complete successfully on your machine.On mine, I got a warning about weak cryptography algorithms and a warning about our first network adapter (the VirtualBox NAT) not having a static IP.We can ignore those and click "Install". This will initiate the rest of the Active Directory installation process. This process might take a while to complete, and like some of the previous stages, will lock out and reset while it runs.Once the server finishes install AD and resets, you'll see the lock screen again. Enter "Ctrl + Alt + Delete", but this time, you should notice the login page looks different than before.This is part of the change from our Server being in a WORKGRUP into a Domain. Log in with our adminstrator credentials, those are still valid. Then when "Server Manager" starts up again, click "Local Server". It will take a couple moments for the information on the Local Server panel to update. but you should see that it now reflects our AD install.With that done, we now have Active Directory installed, we don't have any other users, or other computers connected to our Domain yet, but we can do those things in another write-up.One other thing that I noticed and found interesting through the install is that after the install was finished ICMP was enabled when prior to that it was not. If you had tried to ping our Windows Server Prior to the AD installation, you would've gotten "Destination Host Unreachable".Here's a ping from kali to our Windows Server post-install:It's easy enough to configure Windows Server to enable ICMP pings, but I always thought it was counter-intuitive (although probably a sensible default for security reasons) that it was blocked by default.Nmap still seems to have issues running a ping against our windows host though, a default scan returns "Host Seems Down", but adding the -Pn flag does show that our Windows AD Server is up and running, here's the results of a standard nmap -sC -sV -Pn scan from Kali.┌──(kali㉿kali)-[~] └─$ nmap -sC -sV 192.168.56.2 -Pn Starting Nmap 7.92 ( https://nmap.org ) at 2022-03-03 16:39 EST Nmap scan report for 192.168.56.2 Host is up (0.00074s latency). Not shown: 989 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2022-03-03 21:40:22Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: adamdomain.com0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: adamdomain.com0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped Service Info: Host: ADAMDC; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: |_nbstat: NetBIOS name: ADAMDC, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:a9:d5:db (Oracle VirtualBox virtual NIC) | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required | smb2-time: | date: 2022-03-03T21:40:23 |_ start_date: N/A Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 64.26 seconds

Other

What is Threat Hunting?

Threat Hunting is a security function that combines proactive methodology, innovative technology, and threat intelligence to find and stop malicious activities.For companies that are ready to take on a more proactive approach to cyber security – one that attempts to stop attacks before they get too deep – adding threat hunting to their security program is the next logical step.After solidifying their endpoint security and incident response strategies to mitigate the known malware attacks that are inevitable today, organizations can then start to go on the offensive. They are ready to dig deep and find what hasn’t yet been detected – and that’s exactly the purpose of threat hunting.Threat hunting is an aggressive tactic that works from the premise of the “assumption of the breach;” that attackers are already inside an organization’s network and are covertly monitoring and moving throughout it. This may seem far-fetched, but in reality, attackers may be inside a network for days, weeks, and even months on end, preparing and executing attacks such as advanced persistent threats, without any automated defense detecting their presence. Threat hunting stops these attacks by seeking out covert indicators of compromise (IOCs) so they can be mitigated before any attacks achieve their objectives.The Key Elements of Threat HuntingThe goal of threat hunting is to monitor everyday activities and traffic across the network and investigate possible anomalies to find any yet-to-be-discovered malicious activities that could lead to a full-blown breach. To achieve this level of early detection, threat hunting incorporates four equally important components:Methodology. To be successful at threat hunting, companies must commit to a proactive, full-time approach that is ongoing and ever-evolving. A reactive, ad hoc, “when we have time” perspective will be self-defeating and net only minimal results.Technology. Most companies already have comprehensive endpoint security solutions with automated detection in place. Threat hunting works in addition to these and adds advanced technologies to find anomalies, unusual patterns, and other traces of attackers that shouldn’t be in systems and files. New cloud-native endpoint protection platform (EPP)s that leverage big data analytics can capture and analyze large volumes of unfiltered endpoint data, while behavioral analytics and artificial intelligence can provide extensive, high-speed visibility into malicious behaviors that seem normal at the outset.Highly skilled, dedicated personnel. Threat hunters, or cybersecurity threat analysts, are a breed of their own. These experts not only know how to use the security technology mentioned, but they also combine a relentless aspiration to go on the offensive with intuitive problem-solving forensic capabilities to uncover and mitigate hidden threats.Threat intelligence. Having access to evidence-based global intelligence from experts around the world further enhances and expedites the hunt for already existing IOCs. Hunters are aided by information such as attack classifications for malware and threat group identification, as well as advanced threat indicators that can help zero in on malicious IOCs.Research from the 2018 Threat Hunting Report from Crowd Research Partners confirms the importance of these threat-hunting capabilities. When asked to rank the most important capability the survey found:69% chose threat intelligence57% chose behavior analytics56% chose automatic detection54% chose machine learning and automated analyticsThreat hunters look for attackers that get in under the radar, through vulnerabilities a company may not even know exists. These attackers spend considerable amounts of time planning and performing reconnaissance, only acting when they know they can successfully penetrate the network without notice. They also plant and build malware that has yet to be recognized or use techniques that don’t rely on malware at all, to set themselves up with a persistent base from which to attack.A Profile of a Prolific Threat HunterSo what does it take to outsmart even the smartest attackers?Cyber threat hunters are relentless and able to find even the most minute trace of what cyber attackers leave behind.Threat hunters use their highly tuned skills to zero in on the slight changes that occur as the attackers make their moves inside a system or file.The best threat hunters rely on their instincts to sniff out the most nefarious attacker’s stealth moves.