How we looked for hackers in network traffic at the Standoff

Summary of attacks from PT NAD for the entire period of the cyber battle The Standoff
Summary of attacks from PT NAD for the entire period of the cyber battle The Standoff





We continue to cover the work of the SOC team (more about it in our previous article ) at the last cyber battle The Standoff . Today we will talk about the results of monitoring using the PT Network Attack Discovery (PT NAD) NTA system , developed by Positive Technologies and detecting attacks on the perimeter and within the network.





In six days, PT NAD recorded more than 8 million attacks, of which 778 were unique. Most of the attacks detected are the result of the activity of various network scanners and automated vulnerability scanners. In our case, an attack means triggering a detection rule on malicious network traffic. 





Internal network penetration

. : 29 , . .





2020 FF , , , , , , .   , / .





. 340 000 , 313. , , , .





-15 , . HTTP- , Emerging Threats.













1





NERVE





2





gobuster





3





Fuzz Faster U Fool





4





DirBuster





5





Nmap





6





SQLmap





7





OpenVAS-VT





8





Nuclei (github.com/projectdiscovery/nuclei)





9





Hydra





10





Nessus





11





MEDUSA1.0





12





Brutus/AET2





13





Nikto





14





Ruby WinRM Client





15





Burp Suite





-15 ,





L7 PT NAD . , , , Nuft. , . , 445- . . NTLM- Nuft.





Successful connection from an external network to a server under a local account via SMB
SMB

 





OS Credential Dumping: DCSync . . nuft\scanmaste, . .  





DCSync attack
DCSync

 





GitLab- Bank of FF SSH. SSH . 





Password guessing for SSH server
SSH-





Successful SSH Interactive Session
SSH

. , .





Retrieving information about local users on a domain controller 
 

, RDP RDG-. , . , , , . HTTP. IP-, . URL - . POST, , - .





Authenticating against a fake web server
-

, -.





. , standoff356[.]com. , -. .





 





Reverse shell to a server masquerading as part of the organizers' infrastructure, part 1
- , , . 1





Reverse shell to a server disguised as part of the organizers' infrastructure, part 2
- , , . 2

- . , DMZ Nuft, RAW TCP -. 





- . . , : . SOCKS5. - olololo. DCERPC- nuft\Administrator. Impacket WMIExec. , -. WSUS.





Remote command execution via WMI 
WMI 

, Exchange- , 172.20.62.6.





Destination address in the SOCKS5 tunnel
SOCKS5-

. , PT Sandbox -.





Email with a malicious attachment

. — . . , , . , , , . PT NAD . — MaxPatrol SIEM, PT Application Firewall PT Sandbox — , . 





: , Positive Technologies (PT Expert Security Center)








All Articles