Send a textIn todays episode of TLP - Traffic Light Protocol, Clint Marsden talks about Defending Against Scattered Spider: Understanding Their Tactics, Techniques, and Procedures.Key Takeaways Understanding Scattered Spider: Scattered Spider, also known as Roasted Octopus or Octo Tempest, utilizes various legitimate tools for malicious purposes. Common Tools and Techniques: They employ tools for reconnaissance (PingCastle, ADRecon), credential dumping (Mimikatz, Lazagne), Remote access (Screen Connect, Team Viewer), and VPN (Tailscale).Social Engineering Tactics: Their methods include impersonation, MFA fatigue (MFA bombing), and SIM swapping to gain access.Persistence Mechanisms: They maintain access through methods like automatic account linking and adding additional MFA tokens Defense Strategies: Implement strong identity verification, monitor for unusual activity, and educate users social engineering & smishingQuotes"By understanding their tactics, techniques, and procedures, or TTPs, you can better defend your network and improve its security posture." "There's a lot of push on recognizing phishing emails and hovering over links and verifying the sender, but not enough focus on social engineering training for staff"Action PointsReview Service Desk Processes: Ensure robust identity verification to prevent social engineering.Monitor for Unusual Activity: Regularly audit and set up automated alerts for suspicious MFA changes or logins.Educate Users: Conduct training on recognizing phishing and social engineering techniques.Test Tools in a Lab: Use the mentioned tools to simulate attacks and improve defensive measures by analyzing security logs and infrastructure.Mentioned ResourcesRemote monitoring and management or RMM toolsFleetdeck.ioLevel.io Ngrok Mitre Ref: [S0508] Screenconnect Splashtop Teamviewer Pulseway Tactical RMMReconnaissance:PingCastle - https://www.pingcastle.com/ADRecon - https://github.com/sense-of-security/ADReconAdvanced IP Scanner - https://www.advanced-ip-scanner.com/Govmomi - https://github.com/vmware/govmomiCred dumpers:Mimikatz - https://github.com/ParrotSec/mimikatzHekatomb - https://github.com/ProcessusT/HEKATOMBLazagne - https://github.com/AlessandroZ/LaZagnegosecretsdump - https://github.com/C-Sto/gosecretsdumpsmbpasswd.py - (as part of Impacket) - https://github.com/fortra/impacket/blob/master/examples/smbpasswd.pyLinPEAS - https://github.com/peass-ng/PEASS-ng/tree/master/linPEASADFSDump - https://github.com/mandiant/ADFSDump VPN:Tailscale - Provides virtual private networks (VPNs) to secure network communications

Ask this episode

“What did the council decide on item 42?” — answered with the speaker and the moment.

Transcript

Related