{"id":15513,"date":"2022-07-14T13:09:34","date_gmt":"2022-07-14T12:09:34","guid":{"rendered":"https:\/\/www.ignition-technology.com\/me\/?p=15513"},"modified":"2024-02-02T11:00:12","modified_gmt":"2024-02-02T11:00:12","slug":"the-dark-side-of-pen-testing","status":"publish","type":"post","link":"https:\/\/www.ignition-technology.com\/me\/blog\/the-dark-side-of-pen-testing\/","title":{"rendered":"The Dark Side of Pen Testing"},"content":{"rendered":"

The Brute Ratel C4 (BRc4) red-teaming and adversarial attack simulation tool was released in December 2020. The most recent \u201cSicilian Defense\u201d version was released in May 2022. Similar to Cobalt Strike, this tool has been embraced by legitimate adversary groups (APT actors and alike).<\/p>\n

It provides a framework for developing pen testing tools, using a wide variety of techniques and attack vectors. All known Indicators of Compromise (IoCs), including samples, are convicted by CylancePROTECT.<\/p>\n

The Force of BlackBerry Cylance<\/b><\/p>\n

CylancePROTECT is the world’s first math- and machine learning-based endpoint protection product that detects previously \u201cunknown\u201d malware and prevents it from executing. It operates by analysing potential file executions for malware in less than 100 milliseconds.<\/p>\n

Memory Protection<\/b><\/p>\n

CylancePROTECT\u2019s memory protection abilities are similar to those found in modern host intrusion prevention systems, but without the configuration complexity. Memory protection adds an additional layer of security and strengthens the OS\u2019s basic protection features like data execution prevention, address space layout randomisation and enhanced mitigation experience toolkit.<\/p>\n

BlackBerry Protect\u2019s MemoryProtection is a great defense against attacks employing red-teaming tools such as BRc4 or Cobalt Strike, particularly considering payloads often execute in-memory and without the use of CMD.exe or PowerShell.exe. Script Control can also help prevent the delivery of red teaming stagers.<\/p>\n

BlackBerry\u2019s Recommendations<\/b><\/p>\n

Due to the degree of configurability, BlackBerry recommends customers activate as many of the MemoryProtection options as they can (excluding any which may impact their environment), but in particular, the following options:<\/p>\n