Mark J Cox

What I learned today. Nice - I wasn't aware of the InstallProduct method from PowerShell to fetch a remotely hosted MSI file and subsequently install it. Invoke-WebRequest is one of the more popular methods, at least in our incident response cases. As always, there is more! Matthew Green wrote about PowerShell Download Cradles a few years back, with a ton of information from a detection engineering standpoint 🫶 [1] Elastic does not let us down, either. The rule here would detect the PowerShell code from the image below. [2] And here is the link to the full article from Recorded Future, where I took the screenshot from [3] [1] https://lnkd.in/eey77Yyh [2] https://lnkd.in/eCp8P4DP [3] https://lnkd.in/eUc39xt8

342

12 Comments

🚨 We just released a new blog: GoldMelody’s In-Memory IIS Exploits Uncovered Unit 42 uncovered a campaign by an initial access broker, linked to Gold Melody (UNC961), exploiting leaked ASP.NET Machine Keys to gain in-memory access to IIS servers via View State deserialization. This stealthy technique enabled code execution without touching disk — making detection extremely difficult. Victims span finance, tech, and manufacturing sectors across the U.S. and Europe. 👏🏼 Kudos to Tom M. and Chema García for their outstanding work. 📖 Read more: https://lnkd.in/dtJwwxPN #Unit42 #GoldMelody #InitialAccessBroker #IIS #Cybercrime #ThreatIntel #MDR #ThreatHunting #MTH

73

1 Comment

UDRL + Sleepmask is pretty powerful... with it you can extend Cobalt Strike's BeaconGate capability to any API you want. The attached graphic demonstrates how HttpOpenRequestA can be forwarded through BeaconGate even though it is not one of the officially supported API's. Another neat feature for the UDRL and Sleepmask Development course!

290

10 Comments

Let's talk about Non-Certification Assessments in CMMC. 🥇 Possibly the top question I get lately with clients is whether your C3PAO who's performing your L2 Cert Assessment can also do a 'Readiness Assessment' with you As always - IT DEPENDS! (yayy - our favorite) ❓But Matt - why the quotes on 'Readiness Assessment'? Because that's the whole point. One company's 'Readiness Assessment' doesn't necessarily mean the same thing as another's It's a non-official term. And depending on what they're doing in that assessment, that will dictate if they can still perform your L2 Cert Assessment 📄 So, what IS allowed? Well on page 12 of the CyberAB's Code of Professional Conduct, the term "Non-Certification Assessments" is defined: "A non-certification assessment is the conduct by a C3PAO of a full or partial cybersecurity assessment of an OSA that does not result in the issuance or denial of a formal certification." 😎 Okay, so there is a thing that the CyberAB allows C3PAOs to do outside of a formal cert assessment, but wouldn't that impede their independence? Lucky for us, the CoPC defines the exact scenario that needs to happen so that there is no conflict of interest!   Basically, to be regarded as a true mock assessment that does not create a conflict of interest the C3PAO must: A) Follow official assessment processes outlined in 32 CFR Part 170 B) C3PAO shall not provide recommendations, advice, or consulting C) OSA shall receive an official document with the results So it really comes down to - if they're doing A, B, and C of the above, there is no conflict of interest and you CAN use that C3PAO to still do the official Level 2 Certification 💡So, if a C3PAO proposes doing a gap, mock, or readiness assessment AND your Level 2 Certification - just make sure you understand what they are and aren't doing in that assessment before engaging

69

18 Comments

I haven't seen any announcement about this, but the PCI Security Standards Council has published an update in the last few days to the "Guidance for PCI DSS Requirements 6.4.3 and 11.6.1" Information Supplement. In the original version, it said "Note that PCI DSS Requirements 6.4.3 and 11.6.1 do not apply to merchants with webpages that redirect to a TPSP’s page (for example, via an HTTP 30x redirect, a meta redirect tag, or a JavaScript redirect)." That's been removed, and in its place it now says "Note that, where scripts are used as part of a redirection mechanism, PCI DSS Requirements 6.4.3 and 11.6.1 will apply to those scripts." The thing is, by fully-redirecting to a PCI DSS-compliant payment service provider or processor to take payments, the merchant doesn't have a payment page - and it's only the payment page (or parent page when iframes are used) that these requirements apply to. While I think protecting all JavaScript on a website is a really good security best practice - whether that's using CSP+SRI, Jscrambler's Webpage Integrity product, or something else, I'm currently scratching my head as to how this change to the guidance - which "does not replace or supersede requirements in any PCI SSC Standard" - currently applies. I'm curious to hear what others think...

54

17 Comments

It's easy to find online resources on how to exploit an exposed Docker socket in a containerised environment, but a lot harder to find information on how to do the same for the alternative containerd runtime. Given that Ive spent a bit of time figuring out how to do this, I thought Id share. This is part one: https://lnkd.in/g-7sPSFC

31

🔥 "What is going on with all these weird IDs in our IAM policies?" - A colleague recently came to me concerned something horrible was happening in our AWS accounts. Policies that used to have ARNs now had IDs he couldn't decipher like "AIDAJQABLZS4A3QDU576Q". Were we hacked? 🥳 Nope, everything was fine. Here's why. When IAM creates a user, user group, role, policy, instance profile, or server certificate, it assigns a unique ID to each resource. For the most part, we use friendly names and ARNs when we work with IAM resources. That way, we don't need to know the unique ID for a specific resource. Except when an IAM principal is deleted. That's when Amazon rides in all knight-in-shining-armor like, to protect us from ourselves. It uses magic to replace every reference to the deleted principal with its unique ID. You can no longer tell what the ARN or friendly name of the principal in the policy was, BUT you also can't accidentally re-enable access when someone recreates a principal with the same name. Obviously, we'd all like to have good hygiene and remove these dangling references, but who has time for that?

41

5 Comments

Britain's National Cyber Security Centre recently issued a lukewarm verdict on passkeys as an authentication solution. On the Root Causes Podcast, Jason Soroko and I explore the problems with WebAuthn, including account recovery, spotty availability, inconsistent implementation, and lack of Linux support.  Audio: Video: https://lnkd.in/g6uHKii6

29

3 Comments

If you think Russian cyber actors are a threat, the time to start increasing your native CTI capability is NOW. As of last week, it's clear the federal government has its fingers on the attribution scale. Even commercial attribution is suspect given retribution against contractors.

87

4 Comments