We continue to cover the work of the SOC team (more about it in our previous article ) at the last cyber battle The Standoff . Today we will talk about the results of monitoring using the PT Network Attack Discovery (PT NAD) NTA system , developed by Positive Technologies and detecting attacks on the perimeter and within the network.
In six days, PT NAD recorded more than 8 million attacks, of which 778 were unique. Most of the attacks detected are the result of the activity of various network scanners and automated vulnerability scanners. In our case, an attack means triggering a detection rule on malicious network traffic.
Internal network penetration
. : 29 , . .
2020 FF , , , , , , . , / .
. 340 000 , 313. , , , .
-15 , . HTTP- , Emerging Threats.
№ |
|
1 |
NERVE |
2 |
gobuster |
3 |
Fuzz Faster U Fool |
4 |
DirBuster |
5 |
Nmap |
6 |
SQLmap |
7 |
OpenVAS-VT |
8 |
Nuclei (github.com/projectdiscovery/nuclei) |
9 |
Hydra |
10 |
Nessus |
11 |
MEDUSA1.0 |
12 |
Brutus/AET2 |
13 |
Nikto |
14 |
Ruby WinRM Client |
15 |
Burp Suite |
-15 ,
L7 PT NAD . , , , Nuft. , . , 445- . . NTLM- Nuft.
OS Credential Dumping: DCSync . . nuft\scanmaste, . .
GitLab- Bank of FF SSH. SSH .
.
. , .
, RDP RDG-. , . , , , . HTTP. IP-, . URL - . POST, , - .
, -.
. , standoff356[.]com. , -. .
- . , DMZ Nuft, RAW TCP -.
- . . , : . SOCKS5. - olololo. DCERPC- nuft\Administrator. Impacket WMIExec. , -. WSUS.
, Exchange- , 172.20.62.6.
. , PT Sandbox -.
. — . . , , . , , , . PT NAD . — MaxPatrol SIEM, PT Application Firewall PT Sandbox — , .
: , Positive Technologies (PT Expert Security Center)