Blackhat 2020 Arsenal - C2 Matrix

•

0 likes•388 views

Jorge Orchilles

Slides from @jorgeorchilles and @brysonbort talk at Blackhat 2020 - Arsenal covering the C2 Matrix. Website: https://thec2matrix.com Blackhat: https://www.blackhat.com/us-20/arsenal/schedule/#c-matrix-comparison-of-command-and-control-frameworks-20768 Video: https://youtu.be/2i9KjHCR6ik Command and Control is one of the most important tactics in the MITRE ATT&CK matrix as it allows the attacker to interact with the target system and realize their objectives. Organizations leverage Cyber Threat Intelligence to understand their threat model and adversaries that have the intent, opportunity, and capability to attack. Red Team, Blue Team, and virtual Purple Teams work together to understand the adversary Tactics, Techniques, and Procedures to perform adversary emulations and improve detective and preventive controls. The C2 Matrix was created to aggregate all the Command and Control frameworks publicly available (open-source and commercial) in a single resource to assist teams in testing their own controls through adversary emulations (Red Team or Purple Team Exercises). Phase 1 lists all the Command and Control features such as the coding language used, channels (HTTP, TCP, DNS, SMB, etc.), agents, key exchange, and other operational security features and capabilities. This allows more efficient decisions making when called upon to emulate and adversary TTPs. It is the golden age of Command and Control (C2) frameworks. Learn how these C2 frameworks work and start testing against your organization to improve detective and preventive controls. The C2 Matrix currently has 41 command and control frameworks documented in a Google Sheet, web site, and questionnaire format.

C2 Matrix
@JorgeOrchilles
@BrysonBort

@C2_Matrix
thec2matrix.com
@JorgeOrchilles
@BrysonBort
#BHUSA
@BLACKHATEVENTS
• Chief Technology Officer - SCYTHE
• C2 Matrix Co-Creator
• Purple Team Exercise Framework (PTEF)
• 10 years @ Citi leading offensive security team
• Certified SANS Instructor: SEC560, SEC504
• Author SEC564: Red Team Exercises and
Adversary Emulation
• CVSSv3.1 Working Group Voting Member
• GFMA: Threat-Led Pen Test Framework
• ISSA Fellow
• NSI Technologist Fellow
T1033 – Jorge Orchilles

@C2_Matrix
thec2matrix.com
@JorgeOrchilles
@BrysonBort
#BHUSA
@BLACKHATEVENTS
• CEO/Founder - SCYTHE
• C2 Matrix Co-Creator
• Founder – GRIMM
• Co-Founder – ICS Village
• R Street Senior Fellow, National and Cybersecurity
• Advisor to the Army Cyber Institute
• NSI Senior Fellow
T1033 – Bryson Bort

@C2_Matrix
thec2matrix.com
@JorgeOrchilles
@BrysonBort
#BHUSA
@BLACKHATEVENTS
• Proliferation of Offensive Security Tools
• Empire went EOL (it is now maintained by BC-
Security)
• Compendium of C2 frameworks
• Added other capabilities
• Began evaluating them to find the ideal one for red
team engagement
• Realized it can be used by Red and Blue Teams
Why did we build this?

@C2_Matrix
thec2matrix.com
@JorgeOrchilles
@BrysonBort
#BHUSA
@BLACKHATEVENTS
• Comparison of Command and Control (C2)
Frameworks
• Google Sheet of C2s
• GUI: https://www.thec2matrix.com/
• Find ideal C2 for your needs:
https://ask.thec2matrix.com
• Gitbook on how to install and use the C2; setup
lab environment; contribute; and defend:
https://howto.thec2matrix.com
• SANS Slingshot C2 Matrix Virtual Machine
• @C2_Matrix & #C2Matrix on Twitter
C2 Matrix

@C2_Matrix
thec2matrix.com
@JorgeOrchilles
@BrysonBort
#BHUSA
@BLACKHATEVENTS
TheC2Matrix.com

@C2_Matrix
thec2matrix.com
@JorgeOrchilles
@BrysonBort
#BHUSA
@BLACKHATEVENTS
GUI

@C2_Matrix
thec2matrix.com
@JorgeOrchilles
@BrysonBort
#BHUSA
@BLACKHATEVENTS
Golden Source: Google Sheet
https://docs.google.com/spreadsheets/d/1b4mUxa6cDQuTV2BPC6aA-GR4zGZi0ooPYtBe4IgPsSc/edit#gid=0

@C2_Matrix
thec2matrix.com
@JorgeOrchilles
@BrysonBort
#BHUSA
@BLACKHATEVENTS
Ask.thec2matrix.com

@C2_Matrix
thec2matrix.com
@JorgeOrchilles
@BrysonBort
#BHUSA
@BLACKHATEVENTS
Howto.thec2matrix.com

@C2_Matrix
thec2matrix.com
@JorgeOrchilles
@BrysonBort
#BHUSA
@BLACKHATEVENTS
SANS Slingshot C2 Matrix Edition

@C2_Matrix
thec2matrix.com
@JorgeOrchilles
@BrysonBort
#BHUSA
@BLACKHATEVENTS
howto.thec2matrix.com/contribute

@C2_Matrix
thec2matrix.com
@JorgeOrchilles
@BrysonBort
#BHUSA
@BLACKHATEVENTS
Feedback

C2 Matrix
Demo
@JorgeOrchilles
@BrysonBort

More Related Content

What's hot

Threat Intelligence has become increasingly important as the number and severity of threats is growing continuously. We live in an era where our prevention technologies are not enough anymore, antivirus products fail to detect new or sophisticated pieces of malware, our firewalls and perimeter defenses are easily bypassed and the attacker’s techniques are growing in complexity. In this new landscape, sharing threat intelligence has become a key component to mitigate cyber-attacks. In this session we will define what Threat Intelligence is and discuss how to collect and integrate threat intelligence from public sources. In addition, we’ll demonstrate how to build your own Threat Intelligence data using Open Source tools such as sandboxes, honeypots, sinkholes and other publicly available tools. The industry’s reticence to share information about attack vectors gives the adversary a huge advantage. Using Threat Intelligence we can reduce this advantage and enable preventative response. We will guide you through the different standards (OpenIOC, STIX, MAEC, OTX, IODEF…) to describe and share cyber intelligence, as well as Open Source Frameworks such as CIF (Collective Intelligence Framework) that allows you to combine different threat sources. One of the biggest problems with Threat Intelligence is finding out how to take advantage of the data you have to actually improve the detection/prevention capabilities in your environment. We will describe how to leverage Threat Intelligence to detect threats and provide defenses, and we will focus on how to use Open Source Tools (Suricata, OSSIM, OSSEC, Bro, Yara…) to get the most of your Threat Intelligence. Presenters: Jaime Blasco and Santiago Bassett Cornerstones of Trust 2014: https://www.cornerstonesoftrust.com

Threat Intelligence with Open Source Tools - Cornerstones of Trust 2014

Threat Intelligence with Open Source Tools - Cornerstones of Trust 2014

Threat Intelligence with Open Source Tools - Cornerstones of Trust 2014

Santiago Bassett

IOT Security FUN-damental

IOT Security FUN-damental

IOT Security FUN-damental

Satria Ady Pradana

Slides for EDUCAUSE - Security Professionals Conference Online https://www.educause.edu/ by https://twitter.com/jorgeorchilles References: Definitions: https://medium.com/@jorgeorchilles/ethical-hacking-definitions-9b9a6dad4988 MITRE ATT&CK https://attack.mitre.org/ ATT&CK Navigator: https://mitre-attack.github.io/attack-navigator/enterprise/ C2 Matrix: https://www.thec2matrix.com/ VECTR: https://vectr.io/ 2 Day Red Team Exercises and Adversary Emulation SANS Course SEC564: https://www.sans.org/course/red-team-exercises-adversary-emulation

Adversary Emulation and Red Team Exercises - EDUCAUSE

Adversary Emulation and Red Team Exercises - EDUCAUSE

Adversary Emulation and Red Team Exercises - EDUCAUSE

Jorge Orchilles

Riscure Introduction

Riscure Introduction

Riscure Introduction

5 Things You Should Know About Ethical Hacking

5 Things You Should Know About Ethical Hacking

5 Things You Should Know About Ethical Hacking

Koenig Solutions Ltd.

Security experts from Mediacurrent, Townsend Security and Lockr uncover how you can protect your site from the growing cybercrime business by starting off on the right foot. This interactive webinar will get you the foundation you need to protect your site and your organization when using Drupal. YOU'LL LEARN: Security by design in Drupal Site audit and security best practices Encrypting sensitive data Key management (encryption & API) Resources to improve security

Security by Design: An Introduction to Drupal Security

Security by Design: An Introduction to Drupal Security

Security by Design: An Introduction to Drupal Security

Skills For Career In Security

Skills For Career In Security

Skills For Career In Security

The emergence of next generation technology into the cyber security space has added complications and challenges on several levels. When we talk about next generation technologies we should mean those associated directly with artificial intelligence (AI) and associated components such as machine learning (ML). Unfortunately, many organizations opt to hype current generation products as next gen. In this workshop we will begin by exploring what we need to know about AI and its components. We will dispense with the marketing hype and get down to the facts. Then we will look in detail at a few available tools that truly are next gen - and what makes them next gen - followed by a discussion of where the adversary is going with AI, ML and other next gen technologies. We will wrap up with research from my upcoming book which discusses the collision between the law and cyber science. In this section we also will address some governance issues that you need to know

Managing Next Generation Threats to Cyber Security

Managing Next Generation Threats to Cyber Security

Managing Next Generation Threats to Cyber Security

This session discusses Deloitte’s purple teaming approach which is using ATT&CK as a guiding principle to help both teams improve. This session shows how this works in a customer scenario, how to scope that scenario, how to plan the scenario and choose the various TTPs to be covered to how we assist the customers blue team in understanding the TTPs and helping them design detective capabilities for them. When the Blue Team is able to connect the dots from offensive activities in the network and what they see in their logs, firewalls, SIEMs, etc. they have the ability to fully understand what adversaries do and what the TTP’s of attackers actually look like if they are active in their network. It’s much easier to find the needle in the haystack if you know there is a needle to find to begin with. Purple teaming is providing this pointy needle, used to accelerate the Blue Team.

MITRE ATT&CKcon 2018: From Red VS Blue to Red ♥ Blue, Olaf Hartong and Vincen...

MITRE ATT&CKcon 2018: From Red VS Blue to Red ♥ Blue, Olaf Hartong and Vincen...

MITRE ATT&CKcon 2018: From Red VS Blue to Red ♥ Blue, Olaf Hartong and Vincen...

MITRE - ATT&CKcon

Say incident response to 10 people and odds are you'll get 10 different opinions on how to do it right. When evaluating tools and procedures for enterprise Incident Response it's helpful to understand how to approach this in a way that will cause the adversary maximum pain. This talk will review the essential requirements for IR tools and procedures in a vendor / tool neutral approach. Find out the right questions to ask and the strategies to make sure you get the most out of your incident response team.

Jim Wojno: Incident Response - No Pain, No Gain!

Jim Wojno: Incident Response - No Pain, No Gain!

Jim Wojno: Incident Response - No Pain, No Gain!

centralohioissa

The objective of this talk is to inspire defensive strategies designed to impact cost incurred by adversaries to perform compromises. It explores targeting economic considerations when defending against techniques used by adversaries. Diving into economics for adversaries to use or build certain techniques and tools over others. How can defenders defend against specific techniques by increasing the adversaries cost per intrusion. How can ATT&CK be used to make strategic risk management decisions.

ATT&CKcon Power Hour - ATT&CK-onomics - gert-jan bruggink

ATT&CKcon Power Hour - ATT&CK-onomics - gert-jan bruggink

ATT&CKcon Power Hour - ATT&CK-onomics - gert-jan bruggink

Gert-Jan Bruggink

Open Source Intelligence Gathering (OSINT) is growing in popularity among attackers and defenders alike. When an attacker comes knocking on your network's front door, the warning lights go off in multiple systems (IDS, IPS, SIEM, WAF). More sophisticated attackers, however, spend considerable time gathering information using tools and techniques that never touch any of your systems. As a result, these attackers are able to execute their attacks and make off with proprietary data before you even know they are there. This presentation provides an introduction to many OSINT tools and techniques, as well as methods you can use to minimize your exposure.

Jerod Brennen - What You Need to Know About OSINT

Jerod Brennen - What You Need to Know About OSINT

Jerod Brennen - What You Need to Know About OSINT

centralohioissa

Slides from Defcon IoT Village Workshop Ever wondered how people get shells via hooking up to chips or pins on a board? Or how to dump the firmware off a device you own at home? How chips that send those bits, bytes, and nibbles flying across traces on a board can be analyzed for profit? The Pwning IoT Devices via Hardware Attacks workshop is focused on a hands-on learning experience, of how people use hardware attacks to get initial access IoT Devices for security research. This workshop is designed for people new to hardware hacking, looking to have fun exploiting the Internet of (broken) Things. So come on out if you're looking to join the embedded system & IoT exploitation party!

Pwning Iot via Hardware Attacks - Chase Schultz - IoT Village - Defcon 23

Pwning Iot via Hardware Attacks - Chase Schultz - IoT Village - Defcon 23

Pwning Iot via Hardware Attacks - Chase Schultz - IoT Village - Defcon 23

⚛️ Building a cyber threat intelligence knowledge management system using Grakn Knowledge of cyber threats is a key focus in many areas of cybersecurity. Adapting intrusion detection systems, building relevant red team scenarios, guiding incident response activities, providing a more effective risk assessment through better knowledge of threat agents: all of these require a deep understanding of the issues related to the relevant cyber threats and its associated human and technical elements. During this talk, we will describe how we are using the hyper-relational data model, the logical inferences and the core features of Grakn to build an application (openCTI) allowing organizations to manage their cyber threat intelligence knowledge and technical observables. We will go through the data model, the implementation of nested relations and give you an overview on how you can create powerful applications using Grakn. Don't forget to check out the openCTI project here --> www.opencti.io

Building a Cyber Threat Intelligence Knowledge Management System (Paris Augus...

Building a Cyber Threat Intelligence Knowledge Management System (Paris Augus...

Building a Cyber Threat Intelligence Knowledge Management System (Paris Augus...

Adversary Emulation is a type of Red Team Exercise where the Red Team emulates how an adversary operates, following the same tactics, techniques, and procedures (TTPs), with a specific objective (similar to those of realistic threats or adversaries). Adversary emulations are performed using a structured approach, which can be based on a kill chain or attack flow. Methodologies and Frameworks for Adversary Emulations are covered. Adversary Emulations are end-to-end attacks against a target organization to obtain a holistic view of the organization’s preparedness for a real, sophisticated attack.

Adversary Emulation - DerpCon

Adversary Emulation - DerpCon

Adversary Emulation - DerpCon

Jorge Orchilles

2019 FRecure CISSP Mentor Program: Session Two

2019 FRecure CISSP Mentor Program: Session Two

2019 FRecure CISSP Mentor Program: Session Two

Command and Control is one of the most important tactics in the MITRE ATT&CK matrix as it allows the attacker to interact with the target system and realize their objectives. Organizations leverage Cyber Threat Intelligence to understand their threat model and adversaries that have the intent, opportunity, and capability to attack. Red Team, Blue Team, and virtual Purple Teams work together to understand the adversary Tactics, Techniques, and Procedures to perform adversary emulations and improve detective and preventive controls. The C2 Matrix was created to aggregate all the Command and Control frameworks publicly available (open-source and commercial) in a single resource to assist teams in testing their own controls through adversary emulations (Red Team or Purple Team Exercises). Phase 1 lists all the Command and Control features such as the coding language used, channels (HTTP, TCP, DNS, SMB, etc.), agents, key exchange, and other operational security features and capabilities. This allows more efficient decision making when called upon to emulate and adversary TTPs. It is the golden age of Command and Control (C2) frameworks. Learn how these C2 frameworks work and start testing against your organization to improve detective and preventive controls. The C2 Matrix currently has 35 command and control frameworks documented in a Google Sheet, web site, and questionnaire format. https://docs.google.com/spreadsheets/d/1b4mUxa6cDQuTV2BPC6aA-GR4zGZi0ooPYtBe4IgPsSc/edit#gid=0 https://www.thec2matrix.com/matrix https://ask.thec2matrix.com/ Learn how Red Teams and Blue Teams work together in virtual Purple Teams Leverage Cyber Threat Intelligence to understand adversary tactics, techniques, and procedures Perform adversary emulations in Red or Purple Team Exercises Choose which command and control to use for the assessment to provide the most value Measure and improve people, process, and technology

Adversary Emulation and the C2 Matrix

Adversary Emulation and the C2 Matrix

Adversary Emulation and the C2 Matrix

Jorge Orchilles

The modern web-scale network is a pretty complicated place. Modern techniques in Systems Management have made it trivial to create, destroy and repurpose any number of instance types. These instances can span the range from bare metal machines sitting in a datacenter, to 3rd party virtual machines on demand, and now these new containers and microservices seem to be all the rage. Instances are cattle, they are no longer pets. All of this perpetual churn and flexibility is exactly what you want in a constantly changing, highly available, and efficient infrastructure. The ability to create or destroy nodes on demand, or continuously and automatically scale up, down, and re-deploy applications as part of a continuous integration pipeline, have become necessary and an integral part of daily operations. However these systems can generate terabytes of network logs a day. And if your job is detecting, correlating, and alerting on the correct anomaly in all that data, the analogy of the needle in the haystack really doesn’t do it justice, something closer would be akin to finding a needle in the windstorm. How do you begin to collect, store, analyze, and alert on this much data without costing the company a small fortune? What are some practical steps you can take to reduce your overall risk and begin to gain more insight, visibility, and confidence into what is actually taking place on your network? This talk aims to give the attendee a solid understanding of the problem space, as well as recommendations and practical advice from someone who built their own ‘big data’ network and security monitor. It really is easier than it sounds.

Practical network defense at scale Or: Protecting the “Eierlegende Wollmichsa...

Practical network defense at scale Or: Protecting the “Eierlegende Wollmichsa...

Practical network defense at scale Or: Protecting the “Eierlegende Wollmichsa...

DevSecCon Asia 2017 Pishu Mahtani: Adversarial Modelling

DevSecCon Asia 2017 Pishu Mahtani: Adversarial Modelling

DevSecCon Asia 2017 Pishu Mahtani: Adversarial Modelling

What is Threat Intelligence? It's more than raw source feeds and technical information. If you ask most vendors, they talk about their lists of "bad" IP addresses and domain names, which don't enable the business to make informed decisions on assessing risk and taking action; it lacks -- well, intelligence. We'll cover what Threat Intelligence is, why analysis is an important factor and methods available to analyze raw data.

Ed McCabe - Putting the Intelligence back in Threat Intelligence

Ed McCabe - Putting the Intelligence back in Threat Intelligence

Ed McCabe - Putting the Intelligence back in Threat Intelligence

centralohioissa

What's hot (20)

Threat Intelligence with Open Source Tools - Cornerstones of Trust 2014

Threat Intelligence with Open Source Tools - Cornerstones of Trust 2014

Threat Intelligence with Open Source Tools - Cornerstones of Trust 2014

IOT Security FUN-damental

IOT Security FUN-damental

IOT Security FUN-damental

Adversary Emulation and Red Team Exercises - EDUCAUSE

Adversary Emulation and Red Team Exercises - EDUCAUSE

Adversary Emulation and Red Team Exercises - EDUCAUSE

Riscure Introduction

Riscure Introduction

Riscure Introduction

5 Things You Should Know About Ethical Hacking

5 Things You Should Know About Ethical Hacking

5 Things You Should Know About Ethical Hacking

Security by Design: An Introduction to Drupal Security

Security by Design: An Introduction to Drupal Security

Security by Design: An Introduction to Drupal Security

Skills For Career In Security

Skills For Career In Security

Skills For Career In Security

Managing Next Generation Threats to Cyber Security

Managing Next Generation Threats to Cyber Security

Managing Next Generation Threats to Cyber Security

MITRE ATT&CKcon 2018: From Red VS Blue to Red ♥ Blue, Olaf Hartong and Vincen...

MITRE ATT&CKcon 2018: From Red VS Blue to Red ♥ Blue, Olaf Hartong and Vincen...

MITRE ATT&CKcon 2018: From Red VS Blue to Red ♥ Blue, Olaf Hartong and Vincen...

Jim Wojno: Incident Response - No Pain, No Gain!

Jim Wojno: Incident Response - No Pain, No Gain!

Jim Wojno: Incident Response - No Pain, No Gain!

ATT&CKcon Power Hour - ATT&CK-onomics - gert-jan bruggink

ATT&CKcon Power Hour - ATT&CK-onomics - gert-jan bruggink

ATT&CKcon Power Hour - ATT&CK-onomics - gert-jan bruggink

Jerod Brennen - What You Need to Know About OSINT

Jerod Brennen - What You Need to Know About OSINT

Jerod Brennen - What You Need to Know About OSINT

Pwning Iot via Hardware Attacks - Chase Schultz - IoT Village - Defcon 23

Pwning Iot via Hardware Attacks - Chase Schultz - IoT Village - Defcon 23

Pwning Iot via Hardware Attacks - Chase Schultz - IoT Village - Defcon 23

Building a Cyber Threat Intelligence Knowledge Management System (Paris Augus...

Building a Cyber Threat Intelligence Knowledge Management System (Paris Augus...

Building a Cyber Threat Intelligence Knowledge Management System (Paris Augus...

Adversary Emulation - DerpCon

Adversary Emulation - DerpCon

Adversary Emulation - DerpCon

2019 FRecure CISSP Mentor Program: Session Two

2019 FRecure CISSP Mentor Program: Session Two

2019 FRecure CISSP Mentor Program: Session Two

Adversary Emulation and the C2 Matrix

Adversary Emulation and the C2 Matrix

Adversary Emulation and the C2 Matrix

Practical network defense at scale Or: Protecting the “Eierlegende Wollmichsa...

Practical network defense at scale Or: Protecting the “Eierlegende Wollmichsa...

Practical network defense at scale Or: Protecting the “Eierlegende Wollmichsa...

DevSecCon Asia 2017 Pishu Mahtani: Adversarial Modelling

DevSecCon Asia 2017 Pishu Mahtani: Adversarial Modelling

DevSecCon Asia 2017 Pishu Mahtani: Adversarial Modelling

Ed McCabe - Putting the Intelligence back in Threat Intelligence

Ed McCabe - Putting the Intelligence back in Threat Intelligence

Ed McCabe - Putting the Intelligence back in Threat Intelligence

Similar to Blackhat 2020 Arsenal - C2 Matrix

Root the Box - An Open Source Platform for CTF Administration

Root the Box - An Open Source Platform for CTF Administration

Root the Box - An Open Source Platform for CTF Administration

Christopher Grayson

TestBoss November 2018 - Ghost in the machine, how hackers break software

TestBoss November 2018 - Ghost in the machine, how hackers break software

TestBoss November 2018 - Ghost in the machine, how hackers break software

Corecom Consulting

Presented at the DEFCON27 Red Team Offensive Village on 8/10/19. From the dawn of technology, adversaries have been present. They have ranged from criminal actors and curious children to - more modernly - nation states and organized crime. As an industry, we started to see value in emulating bad actors and thus the penetration test was born. As time passes, these engagements become less about assessing the true security of the target organization and more about emulating other penetration testers. Furthermore, these tests have evolved into a compliance staple that results in little improvement and increasingly worse emulation of bad actors. In this presentation, we will provide a framework complementary to the Penetration Testing Execution Standard (PTES). This complementary work, the Red Team Framework (RTF), focuses on the objectives and scoping of adversarial emulation with increased focus on the perspective of the business, their threat models, and business models. The RTF borrows part of the PTES, adding emphasis on detection capabilities as well as purple team engagements. We believe this approach will better assist organizations and their defensive assets in understanding threats and building relevant detections.

Red Team Framework

Red Team Framework

Red Team Framework

Red Team Framework

Red Team Framework

Red Team Framework

Adrian Sanabria

Vault: Beyond secret storage - Using Vault to harden your infrastructure

Vault: Beyond secret storage - Using Vault to harden your infrastructure

Vault: Beyond secret storage - Using Vault to harden your infrastructure

Global Azure Bootcamp 2017 - Azure Key Vault

Global Azure Bootcamp 2017 - Azure Key Vault

Global Azure Bootcamp 2017 - Azure Key Vault

Alberto Diaz Martin

[Hackersuli] Élő szövet a fémvázon: Python és gépi tanulás a Zeek platformon

[Hackersuli] Élő szövet a fémvázon: Python és gépi tanulás a Zeek platformon

[Hackersuli] Élő szövet a fémvázon: Python és gépi tanulás a Zeek platformon

This talk will be focused on discussing war stories from a product architect/engineer who lives within an information security department and is passionate about driving change. Attendees will get to experience a few different routes that have lead to success and others that might need to avoided. As an ever-evolving space, when reducing risk and deploy safe products to the market, we all have to find the correct gear to get us down the road.

ShiftGearsWithInformationSecurity.pdf

ShiftGearsWithInformationSecurity.pdf

ShiftGearsWithInformationSecurity.pdf

March cybersecurity powerpoint

March cybersecurity powerpoint

March cybersecurity powerpoint

Become a Software Developer (144 hours)

Become a Software Developer (144 hours)

Become a Software Developer (144 hours)

The learning curve for security is severe and unforgiving. Specifications promise infinite flexibility, habitually give old concepts new names, are riddled with extensions, and almost seem designed to deliberately confuse. For a back-end REST developer, choking all this down for the first time is mission impossible. With an aggressive distaste for fancy terminology, this session delves into OAuth 2.0 as it pertains to REST and shows how it falls into two camps: stateful and stateless. We then detail a competing Amazon-style approach called HTTP Signatures, ideal for B2B scenarios and similar to what is use to secure all Amazon AWS API calls. Each approach will be explored analyzing the architectural differences, with a heavy focus on the wire, showing actual HTTP messages and enough detail to have you thinking, "I could write this myself." As a bonus at the end, well peak into a new IETF Internet Draft launched this year that combines JWT and HTTP Signatures into the perfect two-factor system that could provide a one-stop shop for business as well as mobile REST scenarios. Come to this session if you want to go from novice to expert with a bit of humor, a big picture perspective and wire-level detail.

2018 Boulder JUG Deconstructing and Evolving REST Security

2018 Boulder JUG Deconstructing and Evolving REST Security

2018 Boulder JUG Deconstructing and Evolving REST Security

CTFs, Bugbounty and your security career

CTFs, Bugbounty and your security career

CTFs, Bugbounty and your security career

Ibrahim El-Sayed

HashiCorp User Group Paris: Consul & Inversion of Control for Infrastructure

HashiCorp User Group Paris: Consul & Inversion of Control for Infrastructure

HashiCorp User Group Paris: Consul & Inversion of Control for Infrastructure

Best cyber security certifications 2017

Best cyber security certifications 2017

Best cyber security certifications 2017

Koenig Solutions Ltd.

Would you drive over a Bay Bridge built from an amateur building architect's blueprints? What if the architect passed a multiple choice test first - is that good enough? Society's answer to these questions is obviously NO. But unlike building architects, security architects are not always required to have Certificates or Degrees and standards for such are lacking. As information gains value, and we move from "information security" to also securing the Internet of Things, security architecture becomes increasingly consequence-laden and the question of required training and accreditation more pressing. The slides are from a webinar in which Linked In Security Architecture group participants collaboratively explored the Future of Security Architecture Certification.

The Future of Security Architecture Certification

The Future of Security Architecture Certification

The Future of Security Architecture Certification

Deliver Value to Empowered B2B Customers for Japan TFM&A

Deliver Value to Empowered B2B Customers for Japan TFM&A

Deliver Value to Empowered B2B Customers for Japan TFM&A

HaleResume28June2016

HaleResume28June2016

HaleResume28June2016

Privacy. Winter School on “Topics in Digital Trust”. IIT Bombay

Privacy. Winter School on “Topics in Digital Trust”. IIT Bombay

Privacy. Winter School on “Topics in Digital Trust”. IIT Bombay

In 2015 alone, over 3000 cyber attacks were reported globally – with many more never reported or even detected. Enterprises deploy security point solutions in the hopes of stopping a data breach, while savvy attackers work to exploit the whitespace between them. In this webcast, Garrett Bekker, Senior Analyst, Enterprise Security of 451 Research and Stephen Cox, Chief Security Architect of SecureAuth explored how the Connected Security Alliance is bringing together best-of-breed cyber security vendors to close the gap between isolated security products. Originally presented October 19, 2016.

SecureAuth & 451 Research Webinar: Connected Security - A Holistic Approach t...

SecureAuth & 451 Research Webinar: Connected Security - A Holistic Approach t...

SecureAuth & 451 Research Webinar: Connected Security - A Holistic Approach t...

Similar to Blackhat 2020 Arsenal - C2 Matrix (19)

Root the Box - An Open Source Platform for CTF Administration

Root the Box - An Open Source Platform for CTF Administration

Root the Box - An Open Source Platform for CTF Administration

TestBoss November 2018 - Ghost in the machine, how hackers break software

TestBoss November 2018 - Ghost in the machine, how hackers break software

TestBoss November 2018 - Ghost in the machine, how hackers break software

Red Team Framework

Red Team Framework

Red Team Framework

Red Team Framework

Red Team Framework

Red Team Framework

Vault: Beyond secret storage - Using Vault to harden your infrastructure

Vault: Beyond secret storage - Using Vault to harden your infrastructure

Vault: Beyond secret storage - Using Vault to harden your infrastructure

Global Azure Bootcamp 2017 - Azure Key Vault

Global Azure Bootcamp 2017 - Azure Key Vault

Global Azure Bootcamp 2017 - Azure Key Vault

[Hackersuli] Élő szövet a fémvázon: Python és gépi tanulás a Zeek platformon

[Hackersuli] Élő szövet a fémvázon: Python és gépi tanulás a Zeek platformon

[Hackersuli] Élő szövet a fémvázon: Python és gépi tanulás a Zeek platformon

ShiftGearsWithInformationSecurity.pdf

ShiftGearsWithInformationSecurity.pdf

ShiftGearsWithInformationSecurity.pdf

March cybersecurity powerpoint

March cybersecurity powerpoint

March cybersecurity powerpoint

Become a Software Developer (144 hours)

Become a Software Developer (144 hours)

Become a Software Developer (144 hours)

2018 Boulder JUG Deconstructing and Evolving REST Security

2018 Boulder JUG Deconstructing and Evolving REST Security

2018 Boulder JUG Deconstructing and Evolving REST Security

CTFs, Bugbounty and your security career

CTFs, Bugbounty and your security career

CTFs, Bugbounty and your security career

HashiCorp User Group Paris: Consul & Inversion of Control for Infrastructure

HashiCorp User Group Paris: Consul & Inversion of Control for Infrastructure

HashiCorp User Group Paris: Consul & Inversion of Control for Infrastructure

Best cyber security certifications 2017

Best cyber security certifications 2017

Best cyber security certifications 2017

The Future of Security Architecture Certification

The Future of Security Architecture Certification

The Future of Security Architecture Certification

Deliver Value to Empowered B2B Customers for Japan TFM&A

Deliver Value to Empowered B2B Customers for Japan TFM&A

Deliver Value to Empowered B2B Customers for Japan TFM&A

HaleResume28June2016

HaleResume28June2016

HaleResume28June2016

Privacy. Winter School on “Topics in Digital Trust”. IIT Bombay

Privacy. Winter School on “Topics in Digital Trust”. IIT Bombay

Privacy. Winter School on “Topics in Digital Trust”. IIT Bombay

SecureAuth & 451 Research Webinar: Connected Security - A Holistic Approach t...

SecureAuth & 451 Research Webinar: Connected Security - A Holistic Approach t...

SecureAuth & 451 Research Webinar: Connected Security - A Holistic Approach t...

More from Jorge Orchilles

Join Tim Schulz, Adversary Emulation Lead at SCYTHE, for a three hour Hands-On Purple Team Workshop on Wednesday, March 10, 2021! ***REGISTRATION REQUIRED*** ***Use a real email address*** In this three hour hands-on workshop you will play the role of Cyber Threat Intelligence, the red team, and the blue team. We have set up an isolated environment for each attendee to go through a Purple Team Exercise. Attendees will: - Learn the basics of Command and Control (C2) - Consume Cyber Threat Intelligence from a known adversary - Extract adversary behaviors/TTPs - Play the Red Team by creating adversary emulation plans - Emulate the adversary with SCYTHE 3.2 in a small environment consisting of a domain controller, member server, and a Linux system - Play the Blue Team and look for Indicators of Compromise - Use Wireshark to identify heartbeat and jitter - Enable Sysmon configurations to detect adversary behavior - All mapped to MITRE ATT&CK - Have FUN! What do you need? All you need is a web browser on a workstation/laptop (no iPads, sorry). If you want to come better prepared, download, read, and watch the free Purple Team Exercise Framework (PTEF) and webcast: https://www.scythe.io/ptef https://www.scythe.io/library/ptef-workshop How will it work? We are using VMware learning platform to give everyone their own isolated environment. This means we need your real email upon registration so we can provision your environment before the start of the workshop.

SCYTHE Purple Team Workshop with Tim Schulz

SCYTHE Purple Team Workshop with Tim Schulz

SCYTHE Purple Team Workshop with Tim Schulz

Jorge Orchilles

So you want to be a red teamer

So you want to be a red teamer

So you want to be a red teamer

Jorge Orchilles

Everyone has heard of Purple Team by now, but how many have been able to quantify the value? In this talk, we cover all the roles of a Purple Team: Cyber Threat Intelligence, Red Team, Blue Team, and Exercise Coordination. We were asked to emulate various adversaries, with an increasing order of sophistication, while implementing defenses for the adversary TTPs. We were also asked to not spend any money on new technology. Instead, we had to tune the current security controls. See the results!

Purple Team Use Case - Security Weekly

Purple Team Use Case - Security Weekly

Purple Team Use Case - Security Weekly

Jorge Orchilles

Main site: https://thec2matrix.com Golden Source: https://docs.google.com/spreadsheets/d/1b4mUxa6cDQuTV2BPC6aA-GR4zGZi0ooPYtBe4IgPsSc/ How-To: https://howto.thec2matrix.com SANS Slingshot C2 Matrix Edition VM: https://howto.thec2matrix.com/slingshot-c2-matrix-edition YouTube: https://youtube.com/playlist?list=PLfgStsuvpUpoEG3BDuUqV-ipeUff4ImYm Feedback: https://thec2matrix.com/feedback Command and Control is one of the most important tactics in the MITRE ATT&CK matrix as it allows the attacker to interact with the target system and realize their objectives. Organizations leverage Cyber Threat Intelligence to understand their threat model and adversaries that have the intent, opportunity, and capability to attack. Red Team, Blue Team, and virtual Purple Teams work together to understand the adversary Tactics, Techniques, and Procedures to perform adversary emulations and improve detective and preventive controls. The C2 Matrix was created to aggregate all the Command and Control frameworks publicly available (open-source and commercial) in a single resource to assist teams in testing their own controls through adversary emulations (Red Team or Purple Team Exercises). Phase 1 lists all the Command and Control features such as the coding language used, channels (HTTP, TCP, DNS, SMB, etc.), agents, key exchange, and other operational security features and capabilities. This allows more efficient decisions making when called upon to emulate and adversary TTPs. It is the golden age of Command and Control (C2) frameworks. Learn how these C2 frameworks work and start testing against your organization to improve detective and preventive controls.

C2 Matrix Anniversary - Blackhat EU 2020

C2 Matrix Anniversary - Blackhat EU 2020

C2 Matrix Anniversary - Blackhat EU 2020

Jorge Orchilles

In this three hour hands-on workshop you will play the role of Cyber Threat Intelligence, the red team, and the blue team. We have set up an isolated environment for each attendee to go through a Purple Team Exercise. Attendees will: - Consume Cyber Threat Intelligence from a known adversary - Extract adversary behaviors/TTPs - Play the Red Team by creating adversary emulation plans - Emulate the adversary in a small environment consisting of a domain controller and member server - Play the Blue Team and look for Indicators of Compromise - Use Wireshark to identify heartbeat and jitter - Enable Sysmon configurations to detect adversary behavior - All mapped to MITRE ATT&CK - Have FUN! What do you need? All you need is a web browser on a workstation/laptop (no iPads, sorry). If you want to come better prepared, download and read the free Purple Team Exercise Framework (PTEF): https://scythe.io/ptef How will it work? We are using VMware learning platform to give everyone their own isolated environment. This means we need your real email upon registration so we can provision your environment before the start of the workshop.

Purple Team Exercise Workshop December 2020

Purple Team Exercise Workshop December 2020

Purple Team Exercise Workshop December 2020

Jorge Orchilles

External Threat Hunters are Red Teamers

External Threat Hunters are Red Teamers

External Threat Hunters are Red Teamers

Jorge Orchilles

Evolution of Offensive Assessments - SecureWV Conference

Evolution of Offensive Assessments - SecureWV Conference

Evolution of Offensive Assessments - SecureWV Conference

Jorge Orchilles

Purple Team Exercise Hands-On Workshop #GrayHat

Purple Team Exercise Hands-On Workshop #GrayHat

Purple Team Exercise Hands-On Workshop #GrayHat

Jorge Orchilles

Evolution of Offensive Assessments - RootCon

Evolution of Offensive Assessments - RootCon

Evolution of Offensive Assessments - RootCon

Jorge Orchilles

DEFCON Safe Mode - Red Team Village - Emulating Evil Corp and WastedLocker

DEFCON Safe Mode - Red Team Village - Emulating Evil Corp and WastedLocker

DEFCON Safe Mode - Red Team Village - Emulating Evil Corp and WastedLocker

Jorge Orchilles

Purple Team exercises are an efficient and effective method of adversary emulation leading to the training and improvement of people, process, and technology. Red Teams and Blue Teams work together in a live production environment, emulating a selected adversary that has the capability, intent, and opportunity to attack the target organization provided by Cyber Threat Intelligence. Purple Team exercises are ‘hands on keyboard’ exercises where Red and Blue teams work together with an open discussion about each attack procedure and how to detect and alert against it. Purple Team Exercise Framework #PTEF: https://www.scythe.io/ptef Ethical Hacking Maturity Model: https://www.scythe.io/library/scythes-ethical-hacking-maturity-model Definitions: https://medium.com/@jorgeorchilles/ethical-hacking-definitions-9b9a6dad4988 #ThreatThursday: https://www.scythe.io/threatthursday #C2Matrix: https://thec2matrix.com/ Atomic Purple Team: https://github.com/DefensiveOrigins/AtomicPurpleTeam SCYTHE Playbooks: https://github.com/scythe-io/community-threats #ThreatHunting Playbooks: https://threathunterplaybook.com/introduction.html VECTR: https://vectr.io/ Unicon: https://www.scythe.io/unicon2020

Purple Team Exercise Framework Workshop #PTEF

Purple Team Exercise Framework Workshop #PTEF

Purple Team Exercise Framework Workshop #PTEF

Jorge Orchilles

Offensive security and Ethical Hacking is about providing business value. One of the most efficient and effective ways to improve security is through Adversary Emulation Purple Team Exercises. Adversary Emulation is a type of ethical hacking engagement where the Red Team emulates how an adversary operates, leveraging the same tactics, techniques, and procedures (TTPs), against a target organization. The goal of these engagements is to train and improve people, process, and technology. This is in contrast to a penetration test that focuses on testing technology and preventive controls. Adversary emulations are performed using a structured approach following industry methodologies and frameworks (such as MITRE ATT&CK) and leverage Cyber Threat Intelligence to emulate a malicious actor that has the opportunity, intent, and capability to attack the target organization. Adversary Emulations may be performed in a blind manner (Red Team Engagement) or non-blind (Purple Team) with the Blue Team having full knowledge of the engagement. In this talk, we will cover how to run a high-value adversary emulation through a Purple Team Exercise. https://www.scythe.io/library/threatthursday-apt33

Purple Team Exercises - GRIMMCon

Purple Team Exercises - GRIMMCon

Purple Team Exercises - GRIMMCon

Jorge Orchilles

Adversary Emulation is a type of ethical hacking engagement where the Red Team emulates how an adversary operates, leveraging the same tactics, techniques, and procedures (TTPs), against a target organization. The goal of these engagements is to train and improve people, process, and technology. This is in contrast to a penetration test that focuses on testing technology and preventive controls. Adversary emulations are performed using a structured approach following industry methodologies and frameworks (such as MITRE ATT&CK) and leverage Cyber Threat Intelligence to emulate a malicious actor that has the opportunity, intent, and capability to attack the target organization. Adversary Emulations may be performed in a blind manner (Red Team Engagement) or non-blind (Purple Team) with the Blue Team having full knowledge of the engagement. In this talk, we will learn about APT29 “Cozy Bear”, how they operate and what their objectives are. We will create an adversary emulation plan using C2 Matrix to pick the best command and control framework that covers the most TTPs. We will spend at least half the talk live demoing the attack with various tools that emulate the adversary behaviors and TTPs.

Cuddling the Cozy Bear Emulating APT29

Cuddling the Cozy Bear Emulating APT29

Cuddling the Cozy Bear Emulating APT29

Jorge Orchilles

Presentation at DEF CON Red Team Village - Mayhem Virtual Summit 2020 Adversary Emulation - Red Team emulating APT19 with Empire3 and Starkiller Connect: https://twitter.com/jorgeorchilles https://twitter.com/c2_matrix References: https://mitre-attack.github.io/attack-navigator/enterprise/ https://attack.mitre.org/groups/G0073/ https://www.thec2matrix.com/ https://howto.thec2matrix.com/slingshot-c2-matrix-edition https://howto.thec2matrix.com/c2/empire#red-team-village-mayhem-demo-of-apt19 https://vectr.io/ https://www.scythe.io/

Adversary Emulation - Red Team Village - Mayhem 2020

Adversary Emulation - Red Team Village - Mayhem 2020

Adversary Emulation - Red Team Village - Mayhem 2020

Jorge Orchilles

Ethical Hacking Definitions: https://medium.com/@jorgeorchilles/ethical-hacking-definitions-9b9a6dad4988 Ethics isn't just permission: https://github.com/redteamethics/redteamethics Petition to support ethical hackers: https://www.change.org/p/organizations-support-ethical-hackers Vulnerability scanning tool used, Tenable Nessus: https://www.tenable.com/products/nessus Exploitation framework used: https://www.metasploit.com/ Vulnerability Management is hard: https://medium.com/@jorgeorchilles/vulnerability-management-is-hard-how-do-you-prioritize-what-to-patch-1fc8e163d740 Example vulnerability discussed (CVE-2020-0796 SMBGhost/CoronaBlue): https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0796 https://nvd.nist.gov/vuln/detail/CVE-2020-0796 https://attackerkb.com/topics/2LCXe3EPAZ/cve-2020-0796---smbghost?referrer=home Evolve from CVE to TTP with MITRE ATT&CK: https://attack.mitre.org/ Threat Intelligence with ATT&CK Navigator: https://mitre-attack.github.io/attack-navigator/enterprise/ Choosing the correct Command and Control Framework: https://www.thec2matrix.com/ Virtual machine with 8 command and controls tools: SANS Slingshot C2 Matrix Edition: https://howto.thec2matrix.com/slingshot-c2-matrix-edition

Ethical Hacking Definitions Matter - Covering Vulnerability Scanning, Vulnera...

Ethical Hacking Definitions Matter - Covering Vulnerability Scanning, Vulnera...

Ethical Hacking Definitions Matter - Covering Vulnerability Scanning, Vulnera...

Jorge Orchilles

Adversarial Emulation with the C2 Matrix - Wild West WebCastin Fest

Adversarial Emulation with the C2 Matrix - Wild West WebCastin Fest

Adversarial Emulation with the C2 Matrix - Wild West WebCastin Fest

Jorge Orchilles

Open source tool release and updates: this is information for the community and a call to action! We have created an open-source C2 evaluation framework so that teams can easily determine what’s the best tool for penetration testing/red teaming particular scenarios. We’ll talk through why we built the framework, the components (server/agent languages, team vs user types, communication channel coverage, operating systems, capabilities, and support), the decision matrix (a workflow tool we call Ask the Matrix to help you sift through the data for what you need) and how to emulate an adversary (to be announced) across multiple frameworks highlighting the pro’s / con’s of each: infrastructure setup and host/network emulation.

Adversarial Emulation and the C2 Matrix - Presented at Wild West Hackin Fest ...

Adversarial Emulation and the C2 Matrix - Presented at Wild West Hackin Fest ...

Adversarial Emulation and the C2 Matrix - Presented at Wild West Hackin Fest ...

Jorge Orchilles

Command and Control is one of the most important tactics in the MITRE ATT&CK matrix as it allows the attacker to interact with the target system and realize their objectives. Organizations leverage Cyber Threat Intelligence to understand their threat model and adversaries that have the intent, opportunity, and capability to attack. Red Team, Blue Team, and virtual Purple Teams work together to understand the adversary Tactics, Techniques, and Procedures to perform adversary emulations and improve detective and preventive controls. The C2 Matrix was created to aggregate all the Command and Control frameworks publicly available (open-source and commercial) in a single resource to assist teams in testing their own controls through adversary emulations (Red Team or Purple Team Exercises). Phase 1 lists all the Command and Control features such as the coding language used, channels (HTTP, TCP, DNS, SMB, etc.), agents, key exchange, and other operational security features and capabilities. This allows more efficient decisions making when called upon to emulate and adversary TTPs. It is the golden age of Command and Control (C2) frameworks. Learn how these C2 frameworks work and start testing against your organization to improve detective and preventive controls. The C2 Matrix currently has 35 command and control frameworks documented in a Google Sheet, web site, and questionnaire format. Google Sheet (Golden Source): https://docs.google.com/spreadsheets/d/1b4mUxa6cDQuTV2BPC6aA-GR4zGZi0ooPYtBe4IgPsSc/edit#gid=0 Website: https://www.thec2matrix.com/matrix https://ask.thec2matrix.com/ Follow on Twitter for updates: https://twitter.com/c2_matrix

C2 Matrix A Comparison of Command and Control Frameworks

C2 Matrix A Comparison of Command and Control Frameworks

C2 Matrix A Comparison of Command and Control Frameworks

Jorge Orchilles

Purple Team - Work it out: Organizing Effective Adversary Emulation Exercises

Purple Team - Work it out: Organizing Effective Adversary Emulation Exercises

Purple Team - Work it out: Organizing Effective Adversary Emulation Exercises

Jorge Orchilles

Windows Phone 8 Security and Testing WP8 Apps

Windows Phone 8 Security and Testing WP8 Apps

Windows Phone 8 Security and Testing WP8 Apps

Jorge Orchilles

More from Jorge Orchilles (20)

SCYTHE Purple Team Workshop with Tim Schulz

SCYTHE Purple Team Workshop with Tim Schulz

SCYTHE Purple Team Workshop with Tim Schulz

So you want to be a red teamer

So you want to be a red teamer

So you want to be a red teamer

Purple Team Use Case - Security Weekly

Purple Team Use Case - Security Weekly

Purple Team Use Case - Security Weekly

C2 Matrix Anniversary - Blackhat EU 2020

C2 Matrix Anniversary - Blackhat EU 2020

C2 Matrix Anniversary - Blackhat EU 2020

Purple Team Exercise Workshop December 2020

Purple Team Exercise Workshop December 2020

Purple Team Exercise Workshop December 2020

External Threat Hunters are Red Teamers

External Threat Hunters are Red Teamers

External Threat Hunters are Red Teamers

Evolution of Offensive Assessments - SecureWV Conference

Evolution of Offensive Assessments - SecureWV Conference

Evolution of Offensive Assessments - SecureWV Conference

Purple Team Exercise Hands-On Workshop #GrayHat

Purple Team Exercise Hands-On Workshop #GrayHat

Purple Team Exercise Hands-On Workshop #GrayHat

Evolution of Offensive Assessments - RootCon

Evolution of Offensive Assessments - RootCon

Evolution of Offensive Assessments - RootCon

DEFCON Safe Mode - Red Team Village - Emulating Evil Corp and WastedLocker

DEFCON Safe Mode - Red Team Village - Emulating Evil Corp and WastedLocker

DEFCON Safe Mode - Red Team Village - Emulating Evil Corp and WastedLocker

Purple Team Exercise Framework Workshop #PTEF

Purple Team Exercise Framework Workshop #PTEF

Purple Team Exercise Framework Workshop #PTEF

Purple Team Exercises - GRIMMCon

Purple Team Exercises - GRIMMCon

Purple Team Exercises - GRIMMCon

Cuddling the Cozy Bear Emulating APT29

Cuddling the Cozy Bear Emulating APT29

Cuddling the Cozy Bear Emulating APT29

Adversary Emulation - Red Team Village - Mayhem 2020

Adversary Emulation - Red Team Village - Mayhem 2020

Adversary Emulation - Red Team Village - Mayhem 2020

Ethical Hacking Definitions Matter - Covering Vulnerability Scanning, Vulnera...

Ethical Hacking Definitions Matter - Covering Vulnerability Scanning, Vulnera...

Ethical Hacking Definitions Matter - Covering Vulnerability Scanning, Vulnera...

Adversarial Emulation with the C2 Matrix - Wild West WebCastin Fest

Adversarial Emulation with the C2 Matrix - Wild West WebCastin Fest

Adversarial Emulation with the C2 Matrix - Wild West WebCastin Fest

Adversarial Emulation and the C2 Matrix - Presented at Wild West Hackin Fest ...

Adversarial Emulation and the C2 Matrix - Presented at Wild West Hackin Fest ...

Adversarial Emulation and the C2 Matrix - Presented at Wild West Hackin Fest ...

C2 Matrix A Comparison of Command and Control Frameworks

C2 Matrix A Comparison of Command and Control Frameworks

C2 Matrix A Comparison of Command and Control Frameworks

Purple Team - Work it out: Organizing Effective Adversary Emulation Exercises

Purple Team - Work it out: Organizing Effective Adversary Emulation Exercises

Purple Team - Work it out: Organizing Effective Adversary Emulation Exercises

Windows Phone 8 Security and Testing WP8 Apps

Windows Phone 8 Security and Testing WP8 Apps

Windows Phone 8 Security and Testing WP8 Apps

Recently uploaded

IoT Analytics Company Presentation May 2024

IoT Analytics Company Presentation May 2024

IoT Analytics Company Presentation May 2024

The Epson EcoTank L3210 is a high-performance and cost-efficient printer designed to meet the printing needs of both home users and small businesses. Equipped with Epson’s revolutionary EcoTank ink tank system, the Epson eliminates the need for traditional ink cartridges, thereby significantly reducing printing costs and plastic waste. With its PrecisionCore technology, this printer delivers sharp, vibrant prints for both documents and photos. Its user-friendly design ensures easy setup and operation, while its compact form factor saves valuable desk space. Whether it’s everyday printing jobs or creative projects, the Epson EcoTank L3210 provides a reliable and eco-friendly printing solution.

Buy Epson EcoTank L3210 Colour Printer Online.pdf

Buy Epson EcoTank L3210 Colour Printer Online.pdf

Buy Epson EcoTank L3210 Colour Printer Online.pdf

EasyPrinterHelp

I'm excited to share my latest predictions on how AI, robotics, and other technological advancements will reshape industries in the coming years. The slides explore the exponential growth of computational power, the future of AI and robotics, and their profound impact on various sectors. Why this matters: The success of new products and investments hinges on precise timing and foresight into emerging categories. This deck equips founders, VCs, and industry leaders with insights to align future products with upcoming tech developments. These insights enhance the ability to forecast industry trends, improve market timing, and predict competitor actions. Highlights: ▪ Exponential Growth in Compute: How $1000 will soon buy the computational power of a human brain ▪ Scaling of AI Models: The journey towards beyond human-scale models and intelligent edge computing ▪ Transformative Technologies: From advanced robotics and brain interfaces to automated healthcare and beyond ▪ Future of Work: How automation will redefine jobs and economic structures by 2040 With so many predictions presented here, some will inevitably be wrong or mistimed, especially with potential external disruptions. For instance, a conflict in Taiwan could severely impact global semiconductor production, affecting compute costs and related advancements. Nonetheless, these slides are intended to guide intuition on future technological trends.

Future Visions: Predictions to Guide and Time Tech Innovation, Peter Udo Diehl

Future Visions: Predictions to Guide and Time Tech Innovation, Peter Udo Diehl

Future Visions: Predictions to Guide and Time Tech Innovation, Peter Udo Diehl

Peter Udo Diehl

Syngulon’s technology expands the capacity for selection of microorganisms. The ability to select individual microbes with a behavior of interest is essential, whether for simple cloning at the bench, or for industry-scale production. Synthetic biology uses the concept of “bioengineering” to improve or modify existing genetic systems to create microbes with desired behaviors, and Syngulon uses this approach to develop its selection technologies. This selection technology is based on bacteriocins, ribosomally-produced peptides naturally made by most bacteria to kill competitive microbial species. These bacteriocins can have a limited or wide target range against other microbial species. This technology offers advantageous over antibiotic selection for several reasons: it avoids the use of antibiotics in the first place, helping to reduce the spread of antibiotic resistant microbes. The technology also increases product yield; as bacteriocins are generally smaller peptides, they do not impose a heavy metabolic burden on the producing cell. They can have a wide target specificity, helping to avoid genetic drift. Finally, our system is 100% plasmid-based (e.g. without chromosomal mutations), making it applicable for use in any E. coli strains.

Syngulon - Selection technology May 2024.pdf

Syngulon - Selection technology May 2024.pdf

Syngulon - Selection technology May 2024.pdf

Welcome to UiPath Test Automation using UiPath Test Suite series part 2. In this session, we will cover API test automation along with a web automation demo. Topics covered: Test Automation introduction API Example of API automation Web automation demonstration Speaker Pathrudu Chintakayala, Associate Technical Architect @Yash and UiPath MVP Deepak Rai, Automation Practice Lead, Boundaryless Group and UiPath MVP

UiPath Test Automation using UiPath Test Suite series, part 2

UiPath Test Automation using UiPath Test Suite series, part 2

UiPath Test Automation using UiPath Test Suite series, part 2

Intrigued by why some of the world's largest companies (Netflix, Google, Cisco, Twitter, Uber etc) are using gRPC? In this demo based talk we delve into the world of gRPC in .Net, what it does and why we should use it. We compare the interface with both Rest and graphQL. We will show you how to implement grpc server-side in .net and in the web. Finally, I will show you how the tooling helps you deliver powerful interfaces and interact with them quickly and simply.

Demystifying gRPC in .Net by John Staveley

Demystifying gRPC in .Net by John Staveley

Demystifying gRPC in .Net by John Staveley

You’ve heard good data matters in Machine Learning, but does it matter for Generative AI applications? Corporate data often differs significantly from the general Internet data used to train most foundation models. Join me for a demo on building an open source RAG (Retrieval Augmented Generation) stack using Milvus vector database for Retrieval, LangChain, Llama 3 with Ollama, Ragas RAG Eval, and optional Zilliz cloud, OpenAI.

Introduction to Open Source RAG and RAG Evaluation

Introduction to Open Source RAG and RAG Evaluation

Introduction to Open Source RAG and RAG Evaluation

Intro in Product Management - Коротко про професію продакт менеджера

Intro in Product Management - Коротко про професію продакт менеджера

Intro in Product Management - Коротко про професію продакт менеджера

Linux Foundation Edge _ Overview of FDO Software Components _ Randy at Intel.pdf

Linux Foundation Edge _ Overview of FDO Software Components _ Randy at Intel.pdf

Linux Foundation Edge _ Overview of FDO Software Components _ Randy at Intel.pdf

Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...

Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...

Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...

The presentation underscores the strategic advantage of treating design systems not just as technical assets but as vital business components that require thoughtful management, robust planning, and strategic alignment with organizational goals. Key Points Covered: - Understanding Design Systems as Business Entities: Conceptualizing design systems as internal business entities can streamline their integration and evolution within a company. - Adoption and Expansion: Elaborating on the importance of tactical adoption across organizational structures, enhancing product suites to cater to user needs and broadening scope to mobile and content authoring solutions. - Data-Driven Development: Utilizing data insights for component development ensures that resources are allocated to create valuable, widely used features. - Financial Modeling for Design Systems: Developing sustainable funding models is crucial for long-term support and success of design systems. - Promoting Internal Buy-In: Stressing on strategies for promoting design systems within the organization to increase engagement and investment from internal stakeholders.

A Business-Centric Approach to Design System Strategy

A Business-Centric Approach to Design System Strategy

A Business-Centric Approach to Design System Strategy

Designing inclusive products is not only a social responsibility but also a business imperative. This talk delves into the journey of creating accessible hardware products that cater to diverse user needs. Key Topics Covered: 1. Introduction to Inclusive Design - Importance of accessibility in product design - Overview of Comcast's commitment to making products accessible to a wide audience 2. Case Study: Xfinity Large Button Voice Remote - Initial challenges and the evolution of the product - User research and feedback that shaped the design - Key features of the final product and their benefits 3. Designing for Diverse Needs - Understanding human-centered design and its historical context - The impact of designing for people with disabilities on overall product quality - Examples from other industries, such as architecture and industrial design 4. Integrating Accessibility from the Beginning - The cost and efficiency benefits of designing for accessibility from the start - The process of embedding accessibility as a core trait rather than an optional feature 5. Real-World Impact and Continuous Improvement - Insights from in-home studies with users having assistive needs - How continuous feedback and iterative design lead to better products - The role of inclusive research and development practices

Designing for Hardware Accessibility at Comcast

Designing for Hardware Accessibility at Comcast

Designing for Hardware Accessibility at Comcast

Unlock the mysteries of successful Salesforce interviews in this insightful session hosted by Hugo Rosario (Salesforce Customer), a seasoned hiring manager that leads the Salesforce Department of multinational company with over 100 interviews under their belt. Step into the manager's chair and gain exclusive behind-the-scenes insights into what makes a Salesforce consultant stand out during the interview process. From deciphering the unspoken cues to mastering key strategies, we'll explore the intricacies of the interview process and provide practical tips for consultants looking to not only pass interviews but also thrive in their roles. Whether you're a seasoned professional or just starting your Salesforce journey, this session is your backstage pass to the secrets that hiring managers wish you knew.

Behind the Scenes From the Manager's Chair: Decoding the Secrets of Successfu...

Behind the Scenes From the Manager's Chair: Decoding the Secrets of Successfu...

Behind the Scenes From the Manager's Chair: Decoding the Secrets of Successfu...

Simplified FDO Manufacturing Flow with TPMs _ Liam at Infineon.pdf

Simplified FDO Manufacturing Flow with TPMs _ Liam at Infineon.pdf

Simplified FDO Manufacturing Flow with TPMs _ Liam at Infineon.pdf

Already know how to write a basic SOQL query? Great! But what about an *aggregate* SOQL query? You know, the kind that uses aggregate functions like COUNT & MAX along with GROUP BY and HAVING clauses? No? Well, get ready to learn how to slice & dice your org’s data right inside your own dev console. From finding duplicate records to prototyping summary & matrix reports, learn the ins and outs of aggregate queries during this fast-paced but admin-friendly session on advanced SOQL concepts.

SOQL 201 for Admins & Developers: Slice & Dice Your Org’s Data With Aggregate...

SOQL 201 for Admins & Developers: Slice & Dice Your Org’s Data With Aggregate...

SOQL 201 for Admins & Developers: Slice & Dice Your Org’s Data With Aggregate...

This talk focuses on the practical aspects of integrating various telephony systems with Salesforce, drawing on examples from implementations in the Czech scene. It aims to inform attendees about the spectrum of telephony solutions available, from small to large scale, and their compatibility with Salesforce. The presentation will highlight key considerations for selecting a telephony provider that integrates smoothly with Salesforce, including important questions to support the decision-making process. It will also discuss methods for integrating existing telephony systems with Salesforce, aimed at companies contemplating or in the process of adopting this CRM platform. The discussion is designed to provide a straightforward overview of the steps and considerations involved in telephony and Salesforce integration, with an emphasis on functionality, compatibility, and the practical experiences of Czech companies.

Integrating Telephony Systems with Salesforce: Insights and Considerations, B...

Integrating Telephony Systems with Salesforce: Insights and Considerations, B...

Integrating Telephony Systems with Salesforce: Insights and Considerations, B...

Measures in SQL (a talk at SF Distributed Systems meetup, 2024-05-22)

Measures in SQL (a talk at SF Distributed Systems meetup, 2024-05-22)

Measures in SQL (a talk at SF Distributed Systems meetup, 2024-05-22)

IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx

IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx

IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx

In this session, we will showcase how to revolutionize automated testing for your software, automation, and QA teams with UiPath Test Suite. In part 1 of UiPath test automation using UiPath Test Suite – developer series, we will cover, Software testing overview What is software testing Why software testing is required Typical test types and levels Continuous testing and challenges Introduction to UiPath Test Suite UiPath Test Suite family of products Speaker: Atul Trikha, Chief Technologist & Solutions Architect, Peraton and UiPath MVP Deepak Rai, Automation Practice Lead, Boundaryless Group and UiPath MVP

UiPath Test Automation using UiPath Test Suite series, part 1

UiPath Test Automation using UiPath Test Suite series, part 1

UiPath Test Automation using UiPath Test Suite series, part 1

IESVE for Early Stage Design and Planning

IESVE for Early Stage Design and Planning

IESVE for Early Stage Design and Planning

Recently uploaded (20)

IoT Analytics Company Presentation May 2024

IoT Analytics Company Presentation May 2024

IoT Analytics Company Presentation May 2024

Buy Epson EcoTank L3210 Colour Printer Online.pdf

Buy Epson EcoTank L3210 Colour Printer Online.pdf

Buy Epson EcoTank L3210 Colour Printer Online.pdf

Future Visions: Predictions to Guide and Time Tech Innovation, Peter Udo Diehl

Future Visions: Predictions to Guide and Time Tech Innovation, Peter Udo Diehl

Future Visions: Predictions to Guide and Time Tech Innovation, Peter Udo Diehl

Syngulon - Selection technology May 2024.pdf

Syngulon - Selection technology May 2024.pdf

Syngulon - Selection technology May 2024.pdf

UiPath Test Automation using UiPath Test Suite series, part 2

UiPath Test Automation using UiPath Test Suite series, part 2

UiPath Test Automation using UiPath Test Suite series, part 2

Demystifying gRPC in .Net by John Staveley

Demystifying gRPC in .Net by John Staveley

Demystifying gRPC in .Net by John Staveley

Introduction to Open Source RAG and RAG Evaluation

Introduction to Open Source RAG and RAG Evaluation

Introduction to Open Source RAG and RAG Evaluation

Intro in Product Management - Коротко про професію продакт менеджера

Intro in Product Management - Коротко про професію продакт менеджера

Intro in Product Management - Коротко про професію продакт менеджера

Linux Foundation Edge _ Overview of FDO Software Components _ Randy at Intel.pdf

Linux Foundation Edge _ Overview of FDO Software Components _ Randy at Intel.pdf

Linux Foundation Edge _ Overview of FDO Software Components _ Randy at Intel.pdf

Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...

Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...

Secure Zero Touch enabled Edge compute with Dell NativeEdge via FDO _ Brad at...

A Business-Centric Approach to Design System Strategy

A Business-Centric Approach to Design System Strategy

A Business-Centric Approach to Design System Strategy

Designing for Hardware Accessibility at Comcast

Designing for Hardware Accessibility at Comcast

Designing for Hardware Accessibility at Comcast

Behind the Scenes From the Manager's Chair: Decoding the Secrets of Successfu...

Behind the Scenes From the Manager's Chair: Decoding the Secrets of Successfu...

Behind the Scenes From the Manager's Chair: Decoding the Secrets of Successfu...

Simplified FDO Manufacturing Flow with TPMs _ Liam at Infineon.pdf

Simplified FDO Manufacturing Flow with TPMs _ Liam at Infineon.pdf

Simplified FDO Manufacturing Flow with TPMs _ Liam at Infineon.pdf

SOQL 201 for Admins & Developers: Slice & Dice Your Org’s Data With Aggregate...

SOQL 201 for Admins & Developers: Slice & Dice Your Org’s Data With Aggregate...

SOQL 201 for Admins & Developers: Slice & Dice Your Org’s Data With Aggregate...

Integrating Telephony Systems with Salesforce: Insights and Considerations, B...

Integrating Telephony Systems with Salesforce: Insights and Considerations, B...

Integrating Telephony Systems with Salesforce: Insights and Considerations, B...

Measures in SQL (a talk at SF Distributed Systems meetup, 2024-05-22)

Measures in SQL (a talk at SF Distributed Systems meetup, 2024-05-22)

Measures in SQL (a talk at SF Distributed Systems meetup, 2024-05-22)

IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx

IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx

IOS-PENTESTING-BEGINNERS-PRACTICAL-GUIDE-.pptx

UiPath Test Automation using UiPath Test Suite series, part 1

UiPath Test Automation using UiPath Test Suite series, part 1

UiPath Test Automation using UiPath Test Suite series, part 1

IESVE for Early Stage Design and Planning

IESVE for Early Stage Design and Planning

IESVE for Early Stage Design and Planning

Blackhat 2020 Arsenal - C2 Matrix

1. C2 Matrix @JorgeOrchilles @BrysonBort

2. @C2_Matrix thec2matrix.com @JorgeOrchilles @BrysonBort #BHUSA @BLACKHATEVENTS • Chief Technology Officer - SCYTHE • C2 Matrix Co-Creator • Purple Team Exercise Framework (PTEF) • 10 years @ Citi leading offensive security team • Certified SANS Instructor: SEC560, SEC504 • Author SEC564: Red Team Exercises and Adversary Emulation • CVSSv3.1 Working Group Voting Member • GFMA: Threat-Led Pen Test Framework • ISSA Fellow • NSI Technologist Fellow T1033 – Jorge Orchilles

3. @C2_Matrix thec2matrix.com @JorgeOrchilles @BrysonBort #BHUSA @BLACKHATEVENTS • CEO/Founder - SCYTHE • C2 Matrix Co-Creator • Founder – GRIMM • Co-Founder – ICS Village • R Street Senior Fellow, National and Cybersecurity • Advisor to the Army Cyber Institute • NSI Senior Fellow T1033 – Bryson Bort

4. @C2_Matrix thec2matrix.com @JorgeOrchilles @BrysonBort #BHUSA @BLACKHATEVENTS • Proliferation of Offensive Security Tools • Empire went EOL (it is now maintained by BC- Security) • Compendium of C2 frameworks • Added other capabilities • Began evaluating them to find the ideal one for red team engagement • Realized it can be used by Red and Blue Teams Why did we build this?

5. @C2_Matrix thec2matrix.com @JorgeOrchilles @BrysonBort #BHUSA @BLACKHATEVENTS • Comparison of Command and Control (C2) Frameworks • Google Sheet of C2s • GUI: https://www.thec2matrix.com/ • Find ideal C2 for your needs: https://ask.thec2matrix.com • Gitbook on how to install and use the C2; setup lab environment; contribute; and defend: https://howto.thec2matrix.com • SANS Slingshot C2 Matrix Virtual Machine • @C2_Matrix & #C2Matrix on Twitter C2 Matrix

6. @C2_Matrix thec2matrix.com @JorgeOrchilles @BrysonBort #BHUSA @BLACKHATEVENTS TheC2Matrix.com

7. @C2_Matrix thec2matrix.com @JorgeOrchilles @BrysonBort #BHUSA @BLACKHATEVENTS GUI

8. @C2_Matrix thec2matrix.com @JorgeOrchilles @BrysonBort #BHUSA @BLACKHATEVENTS Golden Source: Google Sheet https://docs.google.com/spreadsheets/d/1b4mUxa6cDQuTV2BPC6aA-GR4zGZi0ooPYtBe4IgPsSc/edit#gid=0

9. @C2_Matrix thec2matrix.com @JorgeOrchilles @BrysonBort #BHUSA @BLACKHATEVENTS Ask.thec2matrix.com

10. @C2_Matrix thec2matrix.com @JorgeOrchilles @BrysonBort #BHUSA @BLACKHATEVENTS Howto.thec2matrix.com

11. @C2_Matrix thec2matrix.com @JorgeOrchilles @BrysonBort #BHUSA @BLACKHATEVENTS SANS Slingshot C2 Matrix Edition

12. @C2_Matrix thec2matrix.com @JorgeOrchilles @BrysonBort #BHUSA @BLACKHATEVENTS howto.thec2matrix.com/contribute

13. @C2_Matrix thec2matrix.com @JorgeOrchilles @BrysonBort #BHUSA @BLACKHATEVENTS Feedback

14. C2 Matrix Demo @JorgeOrchilles @BrysonBort