Hacking Articles Tips Tricks Videos Tutorials

6 views11:37

KitPloit - PenTest Tools!
Threatest - Threatest Is A Go Framework For End-To-End Testing Threat Detection Rules

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiMUhm2uT2ltnEQvEcgG6dWPNcos-X4Lda7bnmLlvFMXDG7KPRiGxhBI3PH-pTApjJtheZ16SYXEKzrm-aK7Hd-qBxyj40Ui3i1s8UFNc5hws554S4VDnQndYceZTHDjBTsgIeSP9XaY90GU6vh-74gdCTmfc_itmh3kDOMSDojd_1MYZBpb1ZhTouGrw/w640-h374/go_threat.png
Threatest is a Go framework for testing threat detection end-to-end.

Threatest allows you to detonate an attack technique, and verify that the alert you expect was generated in your favorite security platform.

Read the announcement blog post: https://securitylabs.datadoghq.com/articles/threatest-end-to-end-testing-threat-detection/
Concepts

Detonators

A detonator describes how and where an attack technique is executed.

Supported detonators:

* Local command execution
* SSH command execution
* Stratus Red Team
* AWS detonator

Alert matchers

An alert matcher is a platform-specific integration that can check if an expected alert was triggered.

Supported alert matchers:

* Datadog security signals

Detonation and alert correlation

Each detonation is assigned a UUID. This UUID is reflected in the detonation and used to ensure that the matched alert corresponds exactly to this detonation.

The way this is done depends on the detonator; for instance, Stratus Red Team and the AWS Detonator inject it in the user-agent; the SSH detonator uses a parent process containing the UUID.

Sample usage

See examples for complete usage example.

Testing Datadog Cloud SIEM signals triggered by Stratus Red Team
Console login without MFA").WithSeverity("medium")). WithTimeout(15 * time.Minute) assert.NoError(t, threatest.Run())" dir="auto">

threatest := Threatest()

threatest.Scenario("AWS console login").
WhenDetonating(StratusRedTeamTechnique("aws.initial-access.console-login-without-mfa")).
Expect(DatadogSecuritySignal("AWS Console login without MFA").WithSeverity("medium")).
WithTimeout(15 * time.Minute)

assert.NoError(t, threatest.Run())

Testing Datadog Cloud Workload Security signals triggered by running commands over SSH
Metadata Service Accessed via Network Utility")) assert.NoError(t, threatest.Run())" dir="auto">

ssh, _ := NewSSHCommandExecutor("test-box", "", "")

threatest := Threatest()

threatest.Scenario("curl to metadata service").
WhenDetonating(NewCommandDetonator(ssh, "curl http://169.254.169.254 --connect-timeout 1")).
Expect(DatadogSecuritySignal("EC2 Instance Metadata Service Accessed via Network Utility"))

assert.NoError(t, threatest.Run())

Download Threatest

7 views11:37

Hacking Articles Tips Tricks Videos Tutorials

5 Brain Hacks That Made me one among the Top 15 Security Researchers!

Continue reading on ILLUMINATION »
Read more...

6 views11:54

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
I wrote a blatantly brazen keylogger using only the Windows C API and almost no anti-virus flagged it as malicious?

I compiled it and checked it worked, doesn't even need elevated permissions which is great. Thought I'd throw it up on Virus Total to see what would happen.

Out of the 4 that flagged it as malicious, only one of them actually picked up that it was a keylogger. I was pretty astounded that the other 70 didn't see it as malicious in any way whatsoever?

I'm fairly new to hacking so excuse my ignorance, but I thought it would get flagged by almost every AV haha. (My background is software engineering, so putting this together wasn't too difficult despite my newbieness).

submitted by /u/OutrageousSundae8270
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

I wrote a blatantly brazen keylogger using only the Windows C API...

I compiled it and checked it worked, doesn't even need elevated permissions which is great. Thought I'd throw it up on Virus Total to see what...

8 viewsedited 12:15

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Changing a registration’s time

Hello. I got a question. There is this website that I registered in and it’s for student housing but it’s based only on your date of registration. If you have registered back maybe a couple years from now your preliminary position for an accommodation is better. My question is is it possible to change my date of registration in the site in any way, legally or illegally as well. Mostly curious. Thank you

submitted by /u/barbariell
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Changing a registration’s time

Hello. I got a question. There is this website that I registered in and it’s for student housing but it’s based only on your date of registration....

5 viewsedited 12:15

Hacking Articles Tips Tricks Videos Tutorials