Blog: Blueteam

PsExec. I thought we were friends…

A couple of weeks ago we were talking a lot about monitoring and the wonderful world of Windows with a few delegates at BruCON. A valid point was raised regarding the monitoring of PsExec (and in general, service creation events) and false alarms. We recently wrote a blog detailing certain detection metrics that could be… Read More

Getting Started with Sysmon for Linux

If you’ve been paying close attention to social media late last week you may have seen a stream of posts relating to the release of Sysmon for Linux, marking the 25th anniversary of the Sysinternals toolset. In this post I’m going to take a brief look at Microsoft’s latest contribution to the Linux world. Before… Read More

What the Heck PsExec!

We were talking internally about the infamous PsExec during a recent delivery of our Defending Enterprises training when we stumbled across this tweet from BlackMatter23. Service creation and related events can be caught using existing methods, but having an accurate correlation between service creation and deletion events would allow even more activities to be reliability… Read More

Detecting Lateral Movement via WinRM Using KQL

Over the past few months we’ve been looking a little more into the detection methods we might use to identify strange activity within a given environment. A lot of this research stems from questions asked by our clients following a technical engagement, or questions from students that have taken our Hacking Enterprises training. With the… Read More

Using Kibana and Packetbeat to map DNS queries

Overview: In this short post we’re going to show one visual method of mapping, and potentially identifying malicious DNS traffic within a network. We’re not going to walk through the configuration of Elastic, beats agents or Kibana and there is an assumption that UDP 53 traffic is being logged by Packetbeat on the endpoint(s). Visualisations:… Read More

An intro into abusing and identifying WMI Event Subscriptions for persistence

Overview: Windows Management Instrumentation (WMI) Event Subscriptions are one of many ways to establish persistence on a network. The technique, IDT1084 on Mitre ATT&CK, can be fairly discreet and has been used by APT29 to establish backdoors. We’re not going to dig into too much detail about WMI Event Subscriptions themselves, as some good material… Read More

Using Auditbeat and ELK to monitor GTFOBins binaries

At our training courses are developed not only to provide the theory and hands-on understanding of a multitude of offensive techniques,  but with the added extra of being able to see, study and understand the attacks from a blue team perspective by viewing self-generated artefacts left within our in-LAB ELK stack. This type of… Read More