Fragger hacked windows#

So lets try to build some detections for LDAPFragger, since at this of writing the story, no public information except from the blog-post about detections for this tool is available.įirst I went through the sourcecode on Github to understand how it is operating and how it does work. So its worth having any many little detections, as small as they shine, in total they may give you different big picture.

Fragger hacked windows#

Any data or Windows event we can catch up for our SIEM is a good thing, the more light bulbs (alerts/detections) we define, the more we can explain and correlate to later to - in the end even combine this with your own risk-scores, draw your own conclusions on the way of building the final MITRE attack chain for your best detections. Always try to be one step ahead!Īs the official blog-post at gave several insight points on how LDAPFragger works, it would be worth testing it in a lab environment myself- as it seem to create some ETW noise - as even the author explained.

That could lead to new techniques being born, improving existing tactics. Creating yet unknown or not public available detection rule from scratch will allow you to put up an early light bulb (alert) and catch attackers using even early-adopted techniques, or maybe even techniques with - which were known before (by harmj0y) - but are now improved and maybe used in a different way. Understanding attack vectors (used for initial access) and communication channels (used for command and control) according to the MITRE ATT&CK Matrix by hacking tools is one of your fundamental knowledge for building new detection rules. Keeping up with knowledge about attack vectors and corresponding detections for it is very important one of your required steps to stay ahead. When a new tool for red-teamers has being released, our job as blueteamer is to get up, understand it, test it in a lab and find ways to detect it.

find an efficient detection rule which can be implemented in large scale environment quicklyĪfter LDAPFragger ( introduction blogpost ) has been at Github (03–19–2020) I immediately took some views into its capabilities and design.

trying to find further detections as blueteamer for an newly released tool.

trying to understand how the tool works.

Detecting LDAPFragger - A newly released Cobalt Strike Beacon using LDAP for C2 communication (blueteamers approach)