all right
um
I think everything is good
um
yep okay so I think we're good to go
um yeah so let's uh this is going to
give it a few minutes
you see uh how many people join in
hi guys uh thanks for joining in so just
thought I'd do a live stream on this
particular topic because it's quite long
or rather what I would like to cover is
going to be quite lengthy
um
so I'll sort of go over what I'll be
covering on this live stream my sort of
like delivering live training because
that's what I've been doing over the
last couple of months or rather for the
most part of this year
uh
uh so yeah apologies the lack of delays
or the delays with uploading I hope
everyone is doing well uh staff will be
resuming this is just one of them so
this will be sort of a long-ish uh type
of stream I thought why not do it on
um
you know
do it on a Saturday night uh for those
of you who have joined I appreciate it
I'll continue uploading web app and
testing next week
um been working a lot on that there's a
lot of labs that I need to set up or
needed to set up but yeah so we'll
primarily be taking a look at the mighty
attack framework
primarily sort of operationalizing it
for offensive or defensive operations
um so yeah
ss7 is pretty much banned on uh on
YouTube uh you know you need to abide by
the guidelines
something that I sort of explained
um yes I'll be taking a look at the chat
uh occasionally so
just gonna give it a couple of minutes
for everyone to join in
um
so just a second
okay looks like we have a good amount of
viewers
uh yeah this is the best time I can come
live uh
because it's also one almost one am for
me
uh so
yeah I'll be doing the web app and
testing stuff as I said uh
that's already been developed most of it
just a lab spot that I want to get right
because without practice or without
doing it yourselves it's uh pretty much
not worth it so
yep uh good to see this uh let me know
if the stream quality is okay I'll
pretty much wait for like a couple of uh
minutes probably like three actually
four minutes
ss7 requires a serious level of
knowledge of infrastructure regarding
mobile networks so again I'm not going
to deviate from the topic being
discussed today because there's a ton of
resources like tons of resources you can
find online regarding this
um so
I'll try and share it maybe it was the
end of the live stream but again as I
said it's not something that I can cover
um
on YouTube
yeah so there'll be some pivoting stuff
that I'll cover next week so next week
we'll pretty much start off with web app
and testing which is what we were
currently going through and then for the
red team series we'll also be doing some
um
pivoting so I want to cover pivoting
with Metasploit and then pivoting with
other tools uh you know that uh
essentially come in handy when you're
dealing with different types of
environments
yeah I don't know I haven't checked on
that I think there is uh a way to
install uh black arch with a GUI
installer I think it's a black Arch slim
uh let me just show you that to you
right now uh
so there's a standard version of black
Arch and then they now have like a slim
version
uh yeah there we are that's the one here
so
um the slim version essentially contains
or essentially provides you the GUI
installer uh and it's actually fairly
good the only thing is it doesn't come
with you know pretty much all of the
tools that you get with the full version
of black Arch I think they had it sort
of on the blog let me just check the FAQ
and guide here because I haven't used
that in a long time
so black Arch Linux guide
let me just see this here I don't know
whether they've updated or sort of added
the slim the slim section to their docks
uh so let me just take a look at the FAQ
here
um so just give me a second by the way
if you have any background noise I
apologize for that
uh yeah it doesn't look like it's
highlighted I know they highlighted that
on their blog somewhere uh let me just
check that right now in fact
um give me a second guys
yeah so if I install the slim then you
can actually block blog doesn't seem to
have anything there let me just make
sure I'm going through this here
uh so supported platforms
installation
doesn't have the section on
just one second
platforms
on second let me just see it here
installing packages that's fine we now
use black man
um one second I know that they actually
have this so under the OVA images that's
the full version and then uh just one
second see it in here
if I go home
yeah so this is essentially What Slim
looks like of the new version looks like
they've sort of changed the theme to a
bluish type of theme it's actually
pretty good they still offer the the
whole gamut of desktop uh
environments or tailing window manager
so if you like I3 Etc uh with a few you
know Conkey Scripts
but you can sort of play around with and
they also have KDE I believe if I'm not
wrong uh that was sort of one of the
reasons why I tried it out recently
um but yeah this uh let me just see if I
can find that post to there I believe I
also have the
um the iso the slim ISO
uh quick guide one second this just
covers net installs here so this is the
the previous one using the installer so
you can take a look at this here if
you're having a difficult time with the
terminal uh installer the installer
script itself
yeah so as most of you know from what
I'd like uh said in my update video
which not a lot of people watched which
was kind of sad I currently now uh you
know work on a platform called cyber
ranges where we have quite a lot of
adversary emulation stuff that we're
working on
uh so I'll just show it to you here
which I was probably gonna cover a
series for the free labs uh but but
again I don't want to deviate too much
on adversary emulation which I'll cover
today to a certain extent but yeah this
is pretty much the best platform to do
red teaming stuff which again I'll cover
when we get this lovely a lot of
exciting stuff I'm working on
um
all right so let me check some of your
questions here
uh Abdul Samad yes we will cover uh API
or endpoint testing as I said we're
pretty much following the OS testing
guide I think 2017 and then also the
latest version
uh 2021 I think it was yeah uh so yeah
we will be doing API and uh or brother
endpoint testing
uh let's see any more questions
um
so there is asking do you recommend Arch
over Kelly I I personally don't I I use
black Dodge for a while but I personally
did not like it uh
I I mean of course I'm gonna trigger a
lot of people here but it's just not one
that I use for pen tests anymore I mean
as I said I think I've mentioned this
quite a few times before we currently
have our own distribution in-house
distribution uh called Viper Linux which
we haven't made public yet but we have
the website uh set up
um it's one that we've developed
in-house and it's sort of built for the
purposes of stability uh we are probably
going to work on releasing it next year
I haven't had a lot of time this year to
sort of set up the
uh the repos Etc uh or rather repo
server if you will because we have our
own packages that we sort of maintain to
ensure that they're stable but it's sort
of designed for stability because in our
particular case you know using Kelly
vanilla version of Cali for pen test is
not really uh what we look for we really
like specific variants of specific tools
like you know if we're using something
like Armitage or you know double strike
is commercial but when we do end up
using something like Armitage uh we have
our own like uh maintained version of
that and uh
we sort of have that set up into a
distro of Our Own
um and uh yeah ideally at some point
we'll release it to the public we're not
really looking to compete with any pen
testing distribution uh it's just uh you
know myself as a pen test and red team
it's something that I like uh in my pen
testing distribution one of those things
is stability and performance because I
typically you know we are typically
using laptops uh or in some cases we
also spin up a few Cloud uh instances
uh or servers on AWS or linued or
something like that if you're doing some
external testing and uh the reason why
we have our own I'll just go through it
really quickly is primarily because
number one most of the tools if you're
running a ruling distribution you're
installing the latest version of tools
you're going to have issues with the
tool itself not working properly and
then dependencies not always but it's
typically the case
and then um
the second issue that you have is
performance and uh specifically
performance on
I wouldn't say lower end Hardware but we
essentially have like you know different
devices we take
for red team engagements and with with
our own District sort of works really
well because we maintained the images
um and the releases of the distro so
yeah
um okay so yeah Viper is not yet
released
as I said there's no download links so
if you click on downloads there aren't
any links yet so we're still going to
add that primarily because as I said we
have our own like repos
um
but the main focus is around performance
and it really is much better not to like
toot my own horn here
uh but uh yeah it's uh fast uh stable
which is something we really like uh but
yeah also return to my uh to the topic
here I'll just answer a few more
questions and we can begin
um
what tool do I recommend for pen testing
what aspect of pen testing pen testing
is made up of like various phases uh you
know so the pen testing life cycle so
you know you have information gathering
stuff like that uh enumeration scanning
and footprinting exploitation
vulnerability assessment exploitation or
initial access post exploitation which
comprises of enumeration discovery
uh prevask persistence credential access
lateral movement so what phase are you
referring to
Cobalt strike is like the commercial
version of Armitage Armitage is like a
graphical user interface for Metasploit
so I don't know whether you guys have
seen this um I'll just show it to you
here it's pretty much what we use as in
red teams so if you've used Armitage
Linux which is sort of the free version
of
uh you know Cobalt strike if you will
it's sort of a GUI uh very powerful
framework that the easiest way I can
describe it is a GUI
uh for Metasploit in that you
essentially visualize uh your pen test
or your red team operations but also
very cool because you can configure uh
stuff around beacons
um wait time Etc so it works like a C2
framework it is a C2 framework
um
yeah
uh okay
all right let's see a couple of other
questions here Alexander asks say what
are your thoughts on track me for
newbies is it good enough to start with
the move Vector box fold knob and noscp
yeah I don't know uh my thoughts on
track may have changed because I've
recommended to I've recommended it to a
few students uh in University as well as
people looking to get into pen testing
the problem with triacme is it doesn't
really teach you anything the reason I
say that is because pretty much
everything is documented for you
um so
if you ever want to learn something
there has to be a period where you learn
how to research stuff on your own uh
hacking is about research you're never
going to have documentation next right
beside you when you're doing a pen test
so I'm not really keen on that model the
model that track me uses I really prefer
at this point in time after all my
analysis after like three or four years
of lap so I think hack the box is still
the best option what we're working on
with cyber ranges is even going to be
much better because
uh there's a lot of exciting stuff you
can do now again I'm not hating on
triach me I just I'm just saying that
I've used their Labs before and
um
yeah it's even when with video
walkthroughs I mean why would I make a
video walk through
off a track me room one especially one
with the walkthrough it's something that
I ask myself like a lot of times
because if there's documentation then a
video walkthrough is like pretty
moribund or redundant
yeah and again for those of you who like
uh through hated me for hitting on track
May I mean I've developed quite a few
certifications now ejpt version 2 is one
of them so I know what I'm saying uh
when I'm talking about learning and uh
vent testing
uh it's you know just my experience and
my opinion
um so I personally prefer if students
get to do at least some of the research
themselves I mean
you know it like a track meet lab will
say I'll tell you like to open a file or
edit a file on a Linux system and then
they'll they'll they'll teach you about
women and they'll explain that and
they'll they'll dive into all of the
things it's like pretty much thinking
for you
which is I know that for a beginner
someone who's like fresh to cyber
security that's very helpful uh but once
you pass a certain threshold uh it's
um it doesn't make any sense
um primarily because the the complexity
of the environments don't change even
with some of the advanced ad Labs that
I've taken a look of I've taken a look
at it's pretty laughable uh ad
environments are much more complex uh
much more well secured so you're not
really looking for vulnerabilities or
cves in Windows uh you're pretty much
looking for misconfigurations in the
ACLS Etc so
um
I'll release my distro sometime next
year it's not really my district soccer
split to this draw
a CTS versus bug Bounty do bug bounties
uh again I don't know why people are so
focused on bug bounties uh primarily
because that's where back pain testing I
mean if you're looking to get into
redeeming or pen offensive operations uh
you you need to learn more so active
directory if you are looking into web
app and testing then yeah definitely do
bug bounties like bug bounties are like
a thousand times better than they're
doing ctfs uh primarily because you get
real world experience on how web apps
work in the wild how environments are
configured how to write a report uh the
process of submitting uh
you know disclosure to whatever you know
organization or company so it gives you
real tacit experience that's very useful
in the real world
um
yeah all right
one second let me just check a few of
the other questions here
yeah so I think we'll begin with the
monitor attack framework stuff shortly
no I haven't done the pnbd yet uh
been really busy this year
crto is a great set from zero points uh
that's a really good one
primarily because they cover the tools
that you're going to be using in a red
team operation anyway so
they're really good
yeah so Abdul Samad if you're looking to
make money doing bug bounties then
there's no point in looking to get a job
as a red team
because if you if you're if you're
making good money from bug bounties and
there's no really a real need to
transition uh that that response was
specifically towards people are getting
into red teaming uh
so you're not doing Red Team Ops Etc
because most organizations you'll be
doing Ops for all pretty much around 80
even 80 on Azure or Azure ID that's
where most companies are switching to
Ada is not going anywhere anytime soon
there's a huge push now to move on to
Azure or the cloud and have the ad
environments up there
foreign
you can connect to the labs via both uh
you'll have a attack machine and a VPN
it's entirely up to you
I've already covered how to uh to do
resource development for developing
malicious Excel sheets
uh in my Red Team Series where I covered
windows initial access techniques I
covered the process of setting up a
malicious Excel sheet or generating a
malicious macro
uh with uh Lucky Strike and then
sort of embedding the Powershell Empire
Stager in that document
uh very few people are actually making
money from bug bounties I don't know
about that I mean I'm not really into
bug bounties uh primarily because I
don't have the time and uh whenever you
go and submit uh you know submission or
a report if you will
uh the companies take like however
belong they want to take uh the the
response is yeah it's not for me I don't
have that much time I usually try and do
it on weekends but the way I do bug
bounties is I don't go to platforms and
look for bounties there uh because a lot
of focus is directed they typically do
bug bounties for websites in my region
um you know sort of look for
vulnerabilities in the sites that I use
so you know shopping sites government
websites uh you know Payment Processing
sites Etc that's what I find is useful
because I'm making an impact a you know
where I live uh or you know
geographically speaking firstly so if
I'm helping companies secure the
websites locally that improves security
where I am as opposed to you know doing
bug bounties for companies uh you know
around the world that may not really
affect me and doing that for money you
know I'm much more
I've changed my perspective on security
but again if you're doing bug bounties
to learn I mean it's a great great
experience uh there are people making
tons of like a lot of money off bug
bounties uh they're really good at it so
again that's I think that that has
actually become a job now not really a
Gateway into another career uh and you
know why would you work for a company if
you could earn you know let's say if you
doing maybe like one or two every month
and you're getting like five or tenk uh
you know why would you go and do or you
know work for someone else if you're
doing that independently so
uh yeah they're good at bug bounties
then that's I think it's becoming a
career now it is actually a career in my
mind it's not no longer a Gateway as
people once thought
uh because
yeah you know websites are constantly
coming up security is very important
it'll only grow the industry will only
grow from this point in time
there's no best C2 for apt groups uh as
you'll see you know what I'm going to
cover today
uh apt groups usually do a lot of
research and resource development with
regards to what they need for their Ops
as well as the target infrastructure but
you typically see the use of uh you know
you typically see the use of couple
strike uh the new C2 framework Havoc uh
there's a couple of other ones like
Mythic sliver Etc
but APD groups don't really choose one
there is no best option for a C2
framework it's what you're comfortable
with what will work with the target
infrastructure what your objectives are
so on and so forth
I'm not really into as I said I'm not
into blockchain and smart contracts and
stuff like that I haven't done any like
not the last time I did blockchain stuff
is when I was developing
ethereum d-apps uh
uh which then off at that point I did
not touch I know that's a big thing now
uh you know for companies doing a lot uh
you know a lot of NFD stuff sort of
auditing their smart contracts on and so
forth uh but again I haven't done that
it's not really my area of expertise
I'm uh primarily the area that I'm I've
moved into now is cloud pen testing so
that's usually where I operate uh
whether it's I you know infrastructure
as a service or
software as a service so
yes I am still with INE as a red team
instructor so as I said uh just recently
finished the development of ajpt version
2 which will come later this month I
can't say exactly when but uh yeah it's
gonna drop soon
thank you
Cobalt strike is paid it's a commercial
tool by rapid7 the apparent company that
owns Metasploit
um yeah I'll probably be teaching cloud
pen testing uh it's still relatively new
but mostly AWS because that's where my
focus has been on but I've also been
doing some Azure stuff Azure ID
specifically
how many hours do I get asleep do I
sleep per night for four to five hours
stands this is oscpe I think they're
both good in their own rights uh it
depends on various factors like your
budget I think the new version of oscp
is really good I really like that
version
um
but yeah anyway uh I think we can
finally begin I've answered quite a few
questions hi everyone
yeah I don't really care about whether
my channel has been Shadow banned uh I'm
not after views or traffic or engagement
I'm into producing quality content as I
said I've really changed my perspective
I'm not chasing any views topics ideas
latest trends I pretty much have moved
to the original model
uh which is I produce what I think is
important uh and what I think is
valuable to the community
so yeah I haven't uploaded in a while
because now my focus is on quality and
uh and not quantity so that's why I'm
now covering more specialized topics so
I think we can get started today
yeah for me YouTube has never been about
views or subscriber counts I'm very
grateful to you guys for subscribing to
the channel I mean it means a lot I look
at agasploit as a community and I do not
type my identity to hack exploit I mean
and I think you guys already know that
like what YouTuber with 700k subscribers
isn't uploading every day uh and and
most of you might think that's a bad
thing but I'm sort of staying uh in the
original mold of content development I'm
not really into short videos or shorts
or Tick Tock or any of that because the
yeah that's that that stuff is uh seldom
useful uh I'm uh you'll actually see it
over the next couple of weeks and months
uh the type of content I'm talking about
uh which takes time to develop with its
quality
yeah hope uh hopefully uh
uh yes George I am in Kenya at the
moment well I was born in Kenya so
that's another thing you guys might not
have known
um
all right I think
we can begin
uh so yeah I'll try and answer a couple
of questions this will be quite a long
live stream we've already been going for
like
I don't know uh how long has it been so
far
uh let's see if I can check the
analytics uh uh 30 minutes
yeah my parents uh well I can't really
say much but uh yeah ethnically speaking
yes uh primarily from Egypt uh a lot
shared much more than that but yeah
yeah you should be able to find that
Discord in the
uh description section of this live
stream
we have a Discord link there
yeah I'll probably share the slides once
this stream is published but anyway I
think we're ready to go so I'll be
answering questions after every section
uh and there's quite a lot of stuff I
want to cover so
let me just maximize that uh
Alonso just like a a few more questions
um so uh what do I prefer Windows Mac
for cyber security no don't really have
a preference I have a Mac I recently got
a Mac just to see how that works out
last time I tested a Mac was 2012. uh
Mac is great uh it's good for many
things like video editing I mean that
that is actually insane how good a Mac
is for video editing I've done a lot of
testing on it you know developing
payloads Etc I personally you you know
switch between operating systems I
recently made like a tweet on
I recently tweeted about the fact that
you know I did not like Windows 11
primarily because aesthetically or
visually speaking it was trying to like
copy uh Mac OS uh to a certain extent uh
but again I don't have a problem with
Windows 11 I tested a doubt uh it had a
huge memory leak uh insofar as the
version that I had installed at that
time
is concerned so I I pretty much have
like a system my main workstation for
recording uh most of my heavy duty work
which uses Windows uh the reason I use
Windows uh most of you might you know
get get pissed and say oh well I thought
hackers use Linux well firstly there's
virtual machines secondly if you've ever
done video production
I would highly recommend you try doing
it on Linux before you tell me to switch
to Linux editing videos recording videos
using external audio interfaces uh using
an elgato's scene switcher pretty much
doesn't work so I can't really record
videos on Linux when I was recording
videos on Linux I used to get comments
this was this is like probably four or
five years ago I used to get comments
telling me that the video quality sucked
the audio and video wasn't in sync
that's essentially the level of editing
then of course people will tell me oh
why don't you use something like Hayden
live or DaVinci Resolve uh uh you know
so to edit your videos uh again if I can
render a video on a Mac or Windows in 10
minutes and on Linux is taking 40
minutes uh unfortunately I'm gonna stick
to the operating systems that do it well
so I use Linux on my personal laptop
because that uh that particular case I
don't really require you know some of
the additional software that are useful
to me when making videos and stuff like
that
uh on my main workstation where I'm
doing like I have like a Synergy of
activity ranging from doing you know
documents and reports to video recording
video editing doing a bit of pen testing
reverse engineering uh in my opinion
Windows is pretty much the best
yeah so sorry if I went into a rant
there I was primarily referring to this
specific tweet and the responses I got
to it so what I essentially said was
I didn't like Windows 11 and the reason
I didn't like it is because Windows
whenever Windows has tried to copy Mac
like they did with Vista it's never been
good whenever Windows has gone back to
its roots which is just doing things
that Windows does best
or just doing things
keeping things simple with regards to
the interface that the taskbar
Windows is flourished a good examples of
this are Windows 7 Windows 8.1 as well
Windows 10 and so I said I'm thinking of
switching to Linux on my main
workstation which I did as I said
there's like a ton of issues and
unfortunately when I'm working like 20
hours a day I can't be spending time
fixing issues on on a Linux distro I
need an operating system that works so I
can get my job done in my personal time
my personal operating system I use uh I
use Linux you know but
uh that's because it works for my
particular use case I'm not hating on
Linux I love Linux but my workload is
shifted now what I'm required to do is
shift it and it includes you know
different things so I need an operating
system that supports all of that
yeah I I tend to agree with Docker Berry
uh
I've been using computers for probably
15 years at this point more than 15
years uh I've used Linux Linux was my
first operating system unfortunately
unfortunately Linux on desktop the
market share will never increase this is
an unfortunate truth because it doesn't
do it well Linux was designed is really
good for servers but the moment you get
into specialized uh workloads
that the real world utilizes it'll never
increase because there's a few reasons
for this number one Linux still hasn't
sorted out their package uh package
management issues there's like 5 000
distros uh there's like four the
different uh package managers uh that
they try to solve it with snaps which
they've done a great job but then
there's the whole issue of performance
on snaps
utilizing Linux is
at this point is so fragmented just the
way it is on Android one of the issues
that a lot of people have with Android
and why it's such a it's a platform that
as as I had issues over over the last
couple of years with Securities because
it's so fragmented
there you have like many manufacturers
Google controls the Android open source
project they they keep it up to date so
you have latest releases but then
vendors or manufacturers like Samsung uh
let's say I can't really think of any
others at the moment uh you know you
have Samsung uh let's see uh I can't
believe I can't think of another Android
phone but you have all of these
manufacturers uh you know who utilize
Android they have their own versions of
Android so they have their own you know
desktop uh or uh you know whatever you
want to call it
the problem with this is Samsung doesn't
update you know along the same channel
as Google does and then you have
fragmented versions so at any given
point in time
you have people using like if you
distribute the market share of Android
users you have different people using
version you know whatever there's it's
so divided that
there has never been a consensus around
this um which is why
and I'll explain why
why Apple did something really brilliant
so Apple's operating system Macos is
based on Unix right uh specifically you
it's the closest you can compare it to
is something like BSD so they were
likely going to experience the same sort
of issues so how did they counter that
they said we're going to build our own
Hardware so that the software is in line
with that right and we can control both
of those things which means we can
optimize the software we'll stick to one
package management system so on and so
forth so I'm not hating on Linux it's
just a truth that will come to you once
you've seen enough of computing when
you've had enough experience you'll come
to that realization that uh
it Linux works really well for
specialized uh workloads with regards to
tooling and uh you know a good example
of this is pen testing distributions but
beyond that once you move into audio
video document editing a lot of other
workloads
it doesn't do well now I'm not hating on
Linux because a lot of you will say uh
you know a Linux doesn't have a good
support from third parties which is true
uh you know Microsoft has has never
actually published anything uh for Linux
apart from maybe their team's
application which is still in beta uh
but again I'm just speaking the truth
because I think it's finally time I
start demystifying this stuff uh there's
no way there is no company apart from
maybe a few governments who want to look
cool
there is no company that will uh and
again I'm talking about general
just generally speaking there's no
company
that will give the employees a laptop
with Linux and I'll explain why
commercially speaking companies always
look for something called insurance
right and whenever they buy laptops from
oems or they're buying a subscription to
a piece of software like Windows or
whatever
what they want
is support which means if something goes
wrong they want to have someone to blame
or someone to call
the only company that's been able to do
this on the Linux front is red hat and
is it a surprise that they've been this
successful I mean red hat is making a
killing uh you know of their they
essentially sell support in training
that's that's what they do because they
they know that when it comes to Linux
the the most important thing is support
when things go wrong when servers go
down even though you may have system
administrators they know that that's the
most important thing and that's why
companies utilize Red Hat more than they
utilize any other distribution now you
may say Google has their own version of
Ubuntu or Debian that they give
employees that's true however they also
give the employees a choice and again
remember
Google employees are Engineers Linux is
great for development and that type of
stuff right I'm not arguing about that
I'm talking about
when you look at just the general
landscape
um
I I don't think it will ever increase
yeah that's fine they can give Linux uh
but you look at all proper organizations
uh
um that stick to standard operating
procedures have a security policy in
place uh it's very rare unless they have
like a partnership with Ubuntu or some
of these Linux laptop manufacturers like
system 76 or something like that but I
can tell you that uh
or 95 percent of companies that I've
worked with operated with done pen test
for
it's very rare they typically offer you
a ThinkPad with Windows or they offer
you a Macbook that's typically what
you'll see
all right so I'll stop getting into the
uh
uh into the whole um
uh rants here so I apologize for that
it's just something I think is very
important
um
Linux is a fantastic absolutely
fantastic kernel uh the Linux slash gnu
project as it were and all the
distributions are great I pretty much
learned Computing on Linux so I know
it's important I'll never hate Linux I'm
just saying
realistically speaking from a statistic
perspective
um
the the problem has always been uh
distributions and package managers or
package management utilities and the
fact that we still cannot settle on one
Linux has had these issues where they
can't even decide on a particular init
system there's also a split there so you
have systemd
and CIS V right so I mean
it's it's just at this point it's so
confusing even to me you know you have
all of these distributions different
philosophies then you have distributions
of distributions where you have like
three spins or for Ubuntu itself and
then there's rare spins of those
particular variants of Ubuntu is like
why are you doing this man I mean that's
insane now I'll give you the final
example when it comes down to an
organization like ours where we needed a
distribution for our particular use case
internally speaking then it makes sense
right but when it's simply just
re-spinning and changing icons and
themes and the desktop environment and
playing around with kernels or the
kernel modules
uh
uh you know
I mean I use Linux so I know what I'm
talking about I've used Arch I've used
Debian I've used Fedora I've used Centos
I've I've used red hat
uh
so
yeah I mean I think what purism is doing
is a great thing I understand their
objectives with regards to open source I
think what they're doing is actually
really good because
they control the software and the
hardware and they're committed to
you know the open source principles
around it and I think if it got more
backing
um it'll be a really good alternative to
Android and iOS
so as I said
with regards to Mobile Android as one
like by far and I have no problem with
that but they still have that issue of
fragmentation where the market is so
divided with regards to devices because
there's multiple tiers of android
devices you have your low end device
your low end devices your mid tier and
then the height here now I don't have a
preference because for me a phone is
essentially a phone but
if you you know different manufacturers
have different release Cycles some don't
even update their versions of Android
that version becomes deprecated it uh
security research is uh identify
vulnerabilities it's never patched
that's an issue so that that's
continually been uh an issue
I'm not a Linux hater
uh in fact if you go on pretty much
sixty percent of my videos I recorded
them on Linux as I said I am speaking
about facts that are well known to
anyone who works in the industry even
Linus tovils will will Pro right if you
go you can go and watch some of his
latest interviews around this he'll tell
you the same thing I mean
on desktop there's no way there's no way
because again you can say well I'm going
to install Linux on all computers in my
house that's fine but remember not
everyone is looking to do terminal stuff
on on their computer they're looking to
send a few emails on Outlook they're
looking to do a few stuff in the browser
and that's it and Linux doesn't even
have an Outlook client you just people
say use Thunderbird well what about all
the features that they've used with
Outlook before that they like like the
integrated calendar
I mean these are the things that I'm
telling you to look at don't look at
things from your perspective with all
the knowledge that you have when I'm uh
trying to convince my for example my own
father to use Linux he'll tell me okay
this is what I use uh can you please
install that I say it doesn't exist on
Linux says okay so what am I supposed to
do now
that's what I'm talking about standard
users standard users paper pushes as
they're called as people like to make
fun of them
you know
all right cool so this is one of the
arguments that I really love you know
people always hate on Windows like
really they they just love hating on
Windows saying oh Windows is spying
there's a lot of telemetry which is true
which is true and I'll explain why I'm
not supporting what they do but uh a lot
of people who say this stuff will then
go ahead and spend two hours racing
their distro and on Windows if you just
use something like um I'll just show it
to you here if you view something like
um the
like a program like WPD for Windows here
I'll just give you an example once it
launches here one second you can pretty
much disable all of that Telemetry with
just a few clicks
so you'll see this for yourself
um so yeah there we are Telemetry you
can disable all of the stuff that
Windows does in the background in a
couple of minutes
um there we are like the way I have done
uh you can install you can disable or
block windows Telemetry you can disable
the extra applications like Skype you
can block Windows updates uh you can go
into apps you can uninstall all the
default apps like I've done so that
nothing is running in the background or
you can install Windows Enterprise
Edition which doesn't have all of that
stuff so
while it does collect the information uh
guess what other distribution also
collects information Ubuntu Ubuntu is
owned by canonical canonical collects a
ton of information from their
distribution no one talks about that
uh I understand what you're saying with
regards to knowing what's running in the
background but this stuff can all be
disabled like Microsoft while what
they're doing is predatory with regards
to having ads in your start screen
having the you know the the the bloated
software installed like Candy Crush and
of that garbage that stuff can all be
installed uh uninstalled sorry so
I don't this argument that uh it can't
be disabled or it's hard it's hardwired
into the operating system you know I'm
not I'm not going to buy that
anyway I just thought people should know
that they always use that argument
against Windows oh Windows is collecting
data on on what I'm doing or user
activities like what exactly are you
doing that you're so afraid of of people
checking up on you the reason Microsoft
collects data is because they they have
the hugest the largest market share
their operating system is running on so
many different types of devices with
different configurations they collect
that data to find a lot to identify a
lot of patterns so like firstly is the
latest update of Windows crashing is it
causing issues if so it sends that data
back so that they know this it's
something that a lot of software a lot
you know a lot of software providers do
because they want to improve the
software now as I said that can be
disabled
with that being said I think we can
finally start I apologize for those
rants as I said I'm not a hater of Linux
I have never hated Linux
I was making the argument that Linux on
the desktop was never going to increase
I I can I can almost swear by that fact
and if I'm wrong then I'll be proven
wrong
it's just something that they've been
trying to do for a very long time I know
this myself
because I was there when distributions
like Ubuntu came into were actually
developed I was alive and I saw that
happen and their mission was to to take
that and to install it on every computer
or laptop in the world and so far they
have not even hit one percent of that
so I don't know whether it's going to
take 50 years or 100 years or something
like that but I know why it's not going
to happen until those fundamental issues
are sorted until one organization does
it remember one in order for this to be
commercially viable
it's it's not going to happen even if
they do it in universities all of this
stuff you want to play games you're
going to install Windows you want to do
video editing professionally you're
going to get a Mac that's just the way
it is
yeah I mean data collection by the way I
can show you where you can get that tool
it's it's actually easier than
customizing your distribution
who would have thought
you just search for WPD Windows the
Privacy dashboard for Windows there we
are this is it here so a smart a small
but powerful portable tool that works
Through the Windows API WPD is the most
convenient way to configure various
privacy settings in Windows it works on
all versions of Windows there we are you
can also check their docs violated all
of this by the way they're open source
so you can check the source for yourself
because the next the next thing that
people are going to say oh it's it's
closed Source it's proprietary we don't
know what bad stuff it's doing in the
background all this hope this fully open
source
you can go ahead and take a look at the
FAQ and the resources uh pretty much
disables it at the registry level
because you can check it for yourself so
very simple just download install it's
not even an installer it's a portable
executable so you just click it it's
portable you do it you do what you need
to do that's it Telemetry gone and you
can also monitor this in the background
via the API to see whether those calls
are still being made
foreign
that's
as simple as it is so
all I'll say to end my argument is let's
stop
the BS arguments against operating
systems and let's finally look at things
clearly all right what I'll say is I use
all three operating systems I am
completely operating system agnostic
I've spent a lot of time on 4chan image
boards on the technology board I was
once a Linux and evangelist until I had
to go into the real world where my
perception was finally changed where you
need to get work done every day and the
experimentation the tinkering the rising
the kernel modification has to stop and
at that point
you need you need something that works
when I turn on my computer every day I
don't have to deal with uh you know init
issues or config issues within uh you
know all of that stuff I have a laptop I
use Ubuntu I've always been a fan of
Ubuntu that's it I've also used Manjaro
because I like the KDE desktop
environment but those guys have done it
the best with regards to stability
that's it I don't touch any other
distribution apart from peppermint OS
which is one of my favorite
distributions I actually use that on one
of my older laptops uh that that's
actually one that will remain my
favorite for a very long time I used I
recorded like probably 40 or 50 videos
that are on the channel on peppermint OS
yeah that's fine gaming has
significantly improved I want you to
watch a video I I just wanted to watch
this right and I'll actually show this
to you here
I'll show you this by Linus Tech tips
right so LTT Linux I just wanted to see
uh how hard it was just to get the game
running
at the end of the day
even some of the most experienced
YouTubers who are like Linux evangelists
I'll tell you what they'll do for gaming
they have like really powerful rigs
they'll install Linux and then they'll
use something like KVM with GPU pass
through and they'll send that to a
Windows VM and play their games on
Windows
I'm I'm not playing around with wine or
emulation I'm not emulating games to get
bad performance because I am too blind
to see the truth I don't play games
anymore I I've played games on Linux uh
firstly most online games with
anti-cheat can't be played on Linux uh
because even game developers know there
isn't a system of tracking processes and
threads uh so you know
anyway I think we can begin with a
presentation if I've triggered anyone I
apologize for that
I as I said uh what I'm saying is
Despicable maybe maybe it's despicable
or maybe it's the truth
uh and we'll see maybe I'll be proven
wrong I could be proven wrong uh you
know in the next 100 years or something
like that
oh boy
I mean I can't really uh argue further
you know
I'm not someone who started out with an
I9 processor my first laptop had a
processor called centrino 2 Duo so I
know about uh you know dual booting and
all of that
um
if you want to use Linux please use
Linux I'm not meant to offend anyone uh
I was just I just needed to make a few
things clear regarding my stance
um
and unfortunately I'm not one of those
people who will never criticize anything
because I like it things that I like can
be flawed and I'm I think I'm allowed to
uh yet yet until uh you know sort of or
you know Free Speech changes I think I'm
allowed to make my own criticisms based
on my experience with all of these
operating systems
no that's right yeah yeah yeah
you can run games with proton yeah I
forgot about that you may want to check
on the anti-cheat stuff uh on online
games especially Shooters Valor and
stuff like that and that's also why
proton has a uh proton also has that
thing I can't remember what it's called
it's called a compatibility uh level or
the uh sort of what they use is of the
Baseline of performance on Windows
against how it performs on Linux now
again
yes you can play games on Linux that's
no problem
that's fantastic
uh hopefully everyone moves on to Linux
and plays games on Linux I'm sure
the process will be as seamless as it
has ever been and there won't be any
issues uh but yeah
anyway it looks like I've triggered a
lot of people which is a good thing
because now for the first time I'll have
haters which is something I've been
looking to do for quite a long time uh
because I you know at some point
um you know the the truth has to come
out and I'm open to being uh refuted uh
because a lot of people seem to be sort
of backing out of their arguments not
you guys uh a lot of people in the wild
out there uh influencers Etc because
they'll install Linux as their base
operating system then for some weird
reason they have a virtual machine with
windows I don't know why I don't
understand why that is the case why why
even touch windows again because it's
constantly spying on you and it's like a
shitty operating system why do we go
back
to Windows VMS I wonder why
if everything works works really well
says there really is no need for
virtualization
ah yeah yeah yeah
a lot of you
I I didn't want to annoy anyone man uh
anyway uh I do apologize if I've
offended anyone that's not what I set
out to do but I think everyone should be
open to listening to everyone's point of
view I'm not saying mine is above
anyone's and I'm again I'm willing to
listen to you
uh to anyone's opinion and take them in
wholeheartedly so what I'm gonna do just
to show you that I'm not I'm not someone
who is against these ideas
is I will install Linux as my base
operating system on another hard drive
or SSD and I will try and do what I do
on a daily basis and I'll record The
Experience right this is going to be an
experiment I'll also install proton
and then I'll compare the performance
and I'll see if I have any issues and
it's going to be completely unbiased all
right it's going to be
it's going to be absolutely unbiased no
uh I'm not gonna pick any side I'm just
going to look at it logically I'm and by
the way when I'm using Linux I'm not
going to do I'm not going to write
customize anything no custom kernels
just a stock version of Linux and not
one that's been optimized for gaming
just Debian whatever variant of Debian
it could be Ubuntu I'll even do it maybe
on Arch as well RJ actually is quite
good with performance and I'm just gonna
compare it now if I'm wrong if I'm wrong
I'll wholeheartedly admit in fact we're
going to have a live stream every
Saturday
and I'm going to do it this week and if
if I'm wrong I'll admit that I'm wrong
and you guys will be right
all right is that fair and by the way
I'm we're gonna test it on all fronts
and I'm gonna separate all the tests
before we get started with today's
session so I'm gonna do document editing
I'm going to do video and image editing
I'm going to do audio engineering I'm
then going to do gaming I'll do
programming and development
I'll do some devops stuff so that I'm
fair to everyone
and we'll do a few other tests just to
see which one comes out on top with
regards to stability and performance
because that's those were the calls that
was the core of my main argument
now I don't want to install tweaks I
don't install tweaks because you guys
you guys made the argument against me
when I said download this Windows tool
that will allow you to tweak and say no
no no but when it comes to Linux then I
should be allowed to make tweaks I'm not
going to work harder for something to
work as it should work
at the end of the day former gamer I
just want a game to work I mean I I'm
tired of getting into configs and all of
that at this point I might as well just
buy a console because uh anyway I don't
play games anymore but to be fair to
everyone here and also to prove myself
wrong because I think I might be wrong
here based on on the reaction that
people have given me
yeah in fact we'll try cyberpunk that
that'll actually be really awesome
that'll be perfectly fitting
and and by the way as an additional
point
as as an additional point just to be
fair you guys can also tell me or
provide me with additional workloads
that Linux does very well so I'll also
include them in the tests right and in
in the case when we're talking about uh
you know server performance and stuff
like that I'll also do a like for like
comparison with Windows server so again
just being fair I don't want and but by
the way the the specs will be the same
I'm going to run it on the same system
so sort of like a dual bench uh
Benchmark and I'll share all the log
files all the output for from all the
diagnostic files I'll use the same
version of the drivers and again we'll
come into the same issue on Linux where
if I have an Nvidia card there's two
drivers that I can install open source
and then the version by Nvidia to make
it fair I'll also run tests on both of
those drivers or both of those versions
of the driver
and then I also have an AMD card and
we'll test that out so that at the end
of this experiment we'll come to the
truth and if I'm wrong I'll admit that
I'm wrong and you guys will love this
live stream as vindication
all right so if if that's okay I do
apologize Mr Ray or anyone that I may
have offended uh but just to make it
fair
uh I'll I'll use one of my Nvidia cards
maybe like something that a standard
okay I'll use the one that uh the one
that I have on on my other workstation
which we can use either GTX 1050 TI or a
GTX 1060 right
uh and then I also have another AMD card
which I can I can probably get it's
probably RX 480 I think uh we can then
do those those benchmarks so let me
actually take a note of this because I
think this would be a good idea
with that being said with all of that
being said uh
I will I'll then post up the reports
just the way Linus tactics uh Tech tips
does will have like a full-on report
with graphs and if I'm wrong which again
I know a lot of you want me to be wrong
here because I've talked bad about Linux
which for some reason isn't allowed
anymore
uh but you can talk bad about Windows
and then install a Windows VM or set up
a Windows VM I mean that's when when I
see that I know that there's some
hypocrisy going on here
like what has Windows ever done to
anyone sure they collect data but that
can be disabled I mean anyway I sound
like a real chill right now which I'm
not I can almost guarantee you that
Microsoft hasn't paid me to show Windows
I'm just making an argument
uh and I think it's a well-grounded
argument
ha ha
we're we're one now in and uh well
actually more than one hour but I think
we can finally begin all right so is
everyone cool is everyone cool
can we finally begin
all right all right yeah
no no no no no no no no eggplant no no
man we have to be fair here remember
it's vanilla I'm I'm going I'm going to
do this like I I have some computer
experience I'm gonna say it's not my
first time using Linux but I'm not doing
any custom stuff I'm going directly to
proton and steam or whatever and we're
gonna do just a direct install as it is
I'm not gonna tweak anything we're going
to use the same NVIDIA drivers and then
I'll switch to the Open Source One the
new vote driver as they call it and
we'll see the performance
all right I think we're good to go I
think we are good to go
oh man
yeah this is gonna be awesome this is
gonna be awesome man I can already tell
oh boy someone's telling me I'm
delusional oh boy
Maybe
all right I think we mean so welcome
everyone uh to the mighty attack
fundamentals uh live stream if you will
uh we will be taking a look at how to
operationalize the mighty attack
framework for both offensive and uh
defensive operations
right so this is pretty much what I
intended to cover now I might I may not
complete all of this today we might have
another live stream but if we can then
I'll definitely go through all of this
so
the objectives here to introduce you to
the mighty attack framework uh sort of
explain the different matrices that make
up the mighty attack framework and sort
of show you how to use them and when to
use them we'll then take a look at uh
you know what tactics are and how
they're used by apt groups so we'll get
an understanding of what ttps are and
how they utilize by apt groups are
understand what apt groups are and how
they impact the might attack framework
and vice versa how the might attack
framework impacts apt group so it can be
used to profile apt groups
um will then understand what mitigations
are in the context of the mighty attack
framework and all they can be used to
prevent a technique or sub technique
from being successfully executed I will
also talk about cyber threat
intelligence and how to use the mighty
attack navigator for threat hunting and
cyber threat intelligence we learn how
to map an individual thread group to
navigator how to take a heat map
analysis and combine it with CTI and
I'll show you different use cases
whether you're doing adversary emulation
planning a red team operation or if
you're on the blue team side uh you know
cyber threat intelligence or if you know
if your threat intelligence analyst how
to use it
um to do to essentially set up a heat
map where you combine different dtps
utilized by different thread groups
we'll then you know take a look at how
to use the mighty attack framework to
perform cyber threat intelligence using
a practical case study of an
organization how to map multiple apt
groups to the Navigator and how to
analyze the multiple thread groups how
to analyze multiple thread groups and
determine priority techniques used by
these groups or by the said groups in
question
so any questions before we begin
uh with regards to the might attack
framework uh not really tied towards uh
the previous discussion that we've been
having
all right no questions
okay no question so we can begin so let
me give you guys an introduction to the
mighty attack framework
um so the mighty attack framework is a
globally accessible knowledge base of
adversary tactics and techniques uh
based on real world threats and threat
actors also known as apt groups but
we'll discuss their categorization once
we get there it was developed to improve
the understanding of how cyber attacks
are performed and when you break that
down uh if you take a look at the
abbreviation attack attack is
essentially an abbreviation for
adversarial tactics techniques and
common knowledge so the might attack
framework is typically employed or used
as a Baseline and model for adversarial
behavior and highlights the various
phases of an adversary or threat attack
life cycle what software they employ and
what operating systems they target it is
mostly used by penetration testers and
red teamers to plan Implement and
orchestrate engagements based on
specific threat a specific threat actors
or apt groups ttps also known as
adversary emulation in most cases it is
also valuable a valuable resource for
blue teamers as it details the various
dtps used by specific threat actors and
provides companies with valuable cyber
threat intelligence that can
consequently be used to implement
defenses and mitigations and then of
course finally the miter attack
framework categorizes adversarial
techniques into a collection of tactics
that are further organized into
techniques sub techniques and procedures
collectively these are known as ttps so
more on that shortly
and I've just highlighted a screenshot
of what they might attack Enterprise
Matrix looks like when you head over to
the miter attack website and we'll take
a look at that shortly and before we do
that let me sort of go over the
importances of uh you know the might
attack framework and why lots of
organizations uh pen testers blue
teamers all utilize the miter attack
framework so firstly it provides
attackers and Defenders with a common
knowledge base of adversarial Behavior
based on behavioral analysis of attacks
and threat campaigns what does that mean
it's a centralized Source or a
centralized source of knowledge where
you as a blue team or red team where you
can always go and get information about
the different dtps utilized by a a
specific apt group or even another
threat group and more more so when
you're talking about the ttps of let's
say apt-38 uh you have the ability to
sort of view the the ttps in detail with
regards to techniques and sub techniques
and then from the perspective of a
Defender the might attack framework also
lists out how you can detect and
mitigate a particular technique or the
execution of a particular technique or
subtechnic
secondly they might attack framework
organizes categorizes and contextualizes
adversarial Behavior based on the
different phases of the attack life
cycle and it utilizes a common and
standardized nomenclature or language
when referencing ttps and apt groups now
a lot of you might be wondering why my
my focus is around apt groups well
that's of course because while the
mighty attack framework also has a
different threat groups individual
thread groups cataloged as well as
uh software uh you know it's essentially
highlights different pieces of malware
and software like uh C2 Frameworks rats
Etc
we can utilize the APT group
categorization or sorting uh to
essentially get a better idea of the the
life cycle of Apt groups typically speak
uh typically typically speaking as well
as the software that they use in each of
those uh phases or each of those tactics
uh now when taking a look at the
technique and we'll get to this shortly
when we take a look at the framework in
depth a technique will typically have
the following data associated with it or
rather metadata so you'll say that a
technique will have the parent tactic so
this will represent the tactic that the
technique falls under so if we're taking
a look at the initial axis
tactic under the initial access tactic
for Enterprise you may see a technique
like initial access via spear phishing
right and um
when you click on that technique uh
it'll essentially highlight the parent
tactics so it's just a good way of
identifying where this falls under it's
also important because a specific
technique or sub technique can fall
under more than one tactic at uh at any
given time
you then have the platform this is very
important right as you know the mighty
attack Matrix for Enterprise
uh by default will display the ttps for
the for pretty much all of the operating
systems so you know Windows Linux Mac
and then also
infrastructure as a service and software
as a service platforms
Cloud platforms containers Etc which you
can sort through but this essentially
tells you uh if you click on a
particular technique it'll tell you what
operating system this technique can be
executed on
you then have the permissions required
metadata or identify which essentially
tells you or represents the permissions
required for an adversary to execute the
technique so this tells you for example
if you wanted to execute a particular
technique let's say we were taking a
look at the technique OS credential
dumping with mimikats as an example this
field here would tell you what
permissions are required in order for
you to execute that technique and in
this case you would need to have on
Windows admin or you know anti-authority
system privileges
and then you have effective permission
this is very useful for the privileged
escalation tactic where it'll tell you
after the execution of a particular
technique what permissions you will
obtain right so very important stuff
there and then finally this is uh very
important for blue teamers and Defenders
you love the data source right so this
will outline the data or logs to be
collected in order to Aid the detection
and mitigation of this particular
technique so there's it's uh it's
twofold
um
cool uh
of course the applications I've already
mentioned uh are red teaming and
adversary emulation cyber threat
intelligence and then of course
detection and response which can uh tie
into incident response and uh you know
incident response detection so on and so
forth
now a lot of uh the reason why I wanted
to cover the mighty attack framework is
specifically because it's uh at least in
my eyes it's one of the most important
resources that I've used and one that
has been very beneficial to me as a red
teamer primarily because when it comes
down to the the the different tactics or
the different phases within the the kill
chain for the mighty attack framework
and then of course when you compare it
to the Cyber kill chain you can see why
it's much better because while this is
targeted towards mapping the dtps for a
particular thread group or apt group uh
this is also very useful because it sort
of gives you an idea as to you know the
different phases that make up the the
typical life cycle for apt groups but
also AIDS you in understanding uh uh
sort of really good techniques that you
can Implement in your own pen tests
right and I'll get into this shortly now
do we have any questions to this point
or up to this point here
um just a quick second I'm just gonna
pause here so I'll be back in a second I
just need to check on something
apologies for that but we'll continue on
shortly and then we can switch over to
the miter attack framework and then the
Navigator so I'm just going to pause my
webcam here uh and then I'll be back in
a second
all right sorry about that guys uh
someone at my door
um
so I think we can resume so
what I was uh talking about specifically
was taking a look at the mighty attack
framework uh kill Chain versus this your
traditional cyber kill chain
uh and
again this sort of highlights
um why the might attack framework is so
well also highly regarded with regards
to both red teamers and also blue
teamers primarily because it has or
gives you a holistic view of all the
potential activities or tactics that a
thread group adversary uh could possibly
utilize or
go through you know and again it's best
not to think of this sequentially but
the first three phases uh typically
follow each other sequentially so you
know you have reconnaissance and then
resource development and I'll explain
each of these tactics as we proceed uh
initial axis which is exploitation and
then there's a couple of other tactics
um right away and of course all of these
tactics change relatively speaking uh
but most of the techniques and sub
techniques because when the might attack
framework gives you a different Matrix
uh different matrices to view it from
based on what type of environment you're
targeting as a red teamer or what type
of environment you're protecting as a
blue team
now before I uh sort of introduce you to
apt groups what I'm going to do is I'm
just going to switch over to the might
attack framework website right over here
so
this is the website it's uh accessible
on
attack.myta.org right and you can see on
the website very very simple I have sort
of already given you ideas to what the
framework is but they have a really
great definition here
and the key area that I want you to
focus on is this one right over here so
the attack knowledge base is used as a
foundation for the development of
specific threat models and methodologies
in the private sector government and in
the cyber security product and service
community
so with the creation of a of attack
Maita is fulfilling its mission to solve
problems for a safer World by bringing
communities together to develop more
effective cyber security right and is
accessible is open and available to any
person or Organization for use at no
charge fantastic so by default
the website will display the attack
Matrix for Enterprise what do they mean
when they say Enterprise well this is
for Enterprise environments right and
you can sort of change out the layouts
you can change it to a flat layout or
the site layout and you can also show
the different sub techniques that fall
under the techniques that fall under
particular tactics right and I'll
explain all of this now in my particular
case here you can see there's a couple
that I can view additionally if I just
zoom out there we are so starts off from
Recon resource development initial
access execution persistence privilege
escalation defensivation credential
access
Discovery lateral movement collection
command and control acceleration and
impact so I'll explain each of those
tactics and what they mean most of these
you should already be familiar with but
before I do that let me explain why or
what other matrices exist and how they
differ or you like actually see the
differences so if you take a look at the
matrices page right at the top here I'll
just wait for this to load up you can
now see that you have the Enterprise
Matrix which is cons which consists by
default of all of these platforms right
so you can see it includes Windows Mac
Linux Cloud Network containers and then
they added the pre category here but
this essentially just highlights that
the different tactics and techniques
for the Preparatory stage of an
offensive operation so you know this is
you typically have reconnaissance and
resource development I don't know why
they added it but anyway it's here but
what this means is under the Enterprise
Matrix you can filter by operating
system so let's say you're only looking
for ttps that affect uh Windows you just
click on Windows and you can see it's
it's going to be highlighted here so
these are the dtps for Windows you can
also limit it to Macos same thing here
you can see changes slightly not with
regards to the tactics but more so the
techniques and sub techniques you can do
the same for Linux same thing here
for cloud which you can expand into
Office 365 Azure ad so if I click on
Azure ID you can see that the techniques
uh and sub techniques have greatly
reduced as well as the uh the actual
number of tactics so in the case of
azure ID you only have initial access
via valid accounts as a particular
technique and I'll get into how
techniques and sub techniques work but
uh you can see that you can expand the
technique into the different sub
techniques here so you typically gain
access via Cloud accounts or default
accounts and then you you know establish
persistence Prevost Etc uh and then for
AWS that's typically represented by
either software as a service or
infrastructure as a service and of
course that gives you a totally
different uh view or different
techniques and sub techniques the same
thing for network and containers so if
you're if as a red team or penetration
tester if you're looking to Target
containers and I think this is one of
the questions one of you asked this is
this essentially provides you with the
methodology you can use to perform an
assessment or a pen test on a
containerized environment or an
environment that heavily utilizes uh
containers so for example you can see
start off with initial access as most
offensive operations would so exploiting
public facing applications external
remote Services valid accounts Etc and
then you can see on the execution you
have container Administration command
deploy container scheduled task or job
but more so if you take a look at
privilege escalation you can see that
the next logical step is to escape to
the host so if you're if you've
exploited or gained access to a Docker
container
the next step is to to perform a
container breakout so that you can now
gain access to the host operating system
kernel and then you can also compromise
the rest of the containers running on
that host so on and so forth so really
really useful
um categorization here based on the
platform but at the top level the way to
look at it is you have Enterprise Mobile
and in industrial control system uh
environments also known as ICS
Enterprise if you click on Enterprise it
sort of explains
um the differences but the way to look
at Enterprise is to look at it as a
standard Enterprise configuration right
so on the Enterprise you have all of
these operating systems and uh
means of deploying infrastructure that
typically fall under the Enterprise
working environment you then have mobile
because people also perform
uh you know offensive operations against
mobile platforms applications so on and
so forth so if you click on mobile these
are all the ttps
um for mobile more specifically in this
case Android and iOS you can then filter
by Android techniques and sub techniques
and iOS techniques in subtechnics which
are marginally less than Android
and I'll take a look at your question
shortly but the one that I was really
interested in specifically is industrial
Control Systems which is still heavily
under development but um
I think this is one of the great things
that attack has done is also you know
sort of provide you with a matrix
that essentially lays Out All the known
techniques and sub techniques uh you
know for either attacking an ICS
environment or defending it so any
questions thus far
all right let's see
all right so first quickly can we use
the might attack framework for making
steps to perform uh pen test yes you can
that's exactly you can use it for
whatever you want I'm gonna be showing
you how to do it for primarily adversity
emulation on the offensive side and then
on the defensive side cyber threat
intelligence
um
so yeah
that is correct VJ
foreign
I worked in the blue team when I began
uh that time it was not there wasn't
really the categorization we see today
at that time what I was probably working
in as a department was information
security but yeah I worked in what you'd
Now call a sock uh sock is really
difficult for various reasons because
there's all infrastructure and
deployment side of things so as
essentially ensuring that sensors are
correctly working on all the assets that
the company owns whether it be public
facing assets internal assets Etc
ensuring that you've set up logging for
all the operating systems and you're
getting the right type of logs that have
been passed in the correct way and then
building dashboards making sense of the
data so it's it's really hard uh working
in the sock I wouldn't say it's that
hard but uh it involves a lot of uh I
say a combination or a Synergy of
um different types of uh let's say you
need to know a lot about Windows and
windows logging Windows event logs uh
you need to know about uh you know how
to parse logs how to ship logs how Linux
where does Linux log or save all of its
logs
um you know how to set up logging for
third-party applications whether it be a
web server
uh you know so on and so forth so I
would say generally speaking based on my
experience it's much more of a
um strenuous or stressful job then then
red teaming is
um yeah
I wouldn't be covering any IR stuff uh
uh yeah I'll I'll get into the
mitigations and detection I'm not
covering any IR stuff I'm covering uh
cyber threat intelligence
uh probably a caviar in another stream
so again the way to look at this as is a
methodology so if someone was new to pen
testing containerized environments
what I would recommend is for them to
look at all of these techniques here so
it sort of gives you a methodology start
initial access and then once you gain
access you move on to execution right
then persistence privilege escalation so
on and so forth so it sort of gives you
like a a flow of techniques that you can
utilize right from the beginning all the
way to the end whatever your end is in
the case of a pen of a pen test there's
never going to be impact so
that's one thing to take into
consideration now that I've shown you
the the different matrices let me
explain each of these tactics right so
reconnaissance makes sense to everyone
here I assume reconnaissance is
essentially the Gathering of information
which is broken down into two active and
passive so if you click on a particular
tactic you can see this is where the
whole knowledge base side of the mighty
attack framework comes into play so
essentially what this entails is the
adversary is trying to gather
information they can use to plan future
operations so reconnaissance consists of
the techniques that involve adversaries
actively or passively gathering
information that can be used to support
targeting right and then the techniques
that fall on their reconnaissance are
active scanning and you can see that
every technique and sub technique has a
unique ID right so you can see t1595
active scanning we already know that
active scanning has sub techniques so
when you talk about active scanning what
do you mean scanning IP blocks
vulnerability scanning word list
scanning or Brute Force if you will
and then you have a gathering the victim
host information so adversaries May
gather information about the victim's
hosts that can be used during the
initial targeting information about the
host may include a variety of details
including administrative data so on and
so forth so you know Hardware info
software client configurations so
essentially you guys should be pretty
familiar with reconnaissance
the area that I want to focus on
specifically this is where apt groups
come into place resource development now
whenever there is a red team Operation
Red Team engagement or when you're
taking a look at how an apt group
conducts its operations they spend a
huge amount of time and money on
resource development right and what this
entails is essentially the adversary is
trying to establish resources they can
use to support operations because the
operations are very complex and in the
case of Apt groups they're very long
term APD groups typically stay in an
environmental Network for a very long
time so that means that you need a very
stable underlying infrastructure whether
you're talking about C2 Frameworks uh
you know proxy
um web proxies so on and so forth and
I'll explain all of this but you can see
that it consists of techniques that
involve adversaries creating purchasing
compromising or stealing resources that
can be used to support targeting such
resources include infrastructure
accounts or capabilities
uh what this means is that we firstly
start off with acquiring infrastructure
so you know buying servers or buying
access to servers command and control
servers on you know various Cloud
providers in the case of APD groups they
pay in Bitcoin or on traceable currency
setting up the underlying infrastructure
so if you set up a C2 C2 server what
they typically do in the case of good
apt groups is they have proxies that
proxy the traffic so that the source IP
of the C2 server cannot be found
what falls under acquiring
infrastructure is let's say
the initial access technique that you go
for is phishing right or maybe you want
to yeah let's use an example of fishing
in that case you need to buy a domain
that looks quite legitimate with regards
to the Target or or the organization
that you're targeting you'd also need
the DNS server a virtual private servers
uh botnets web services
Etc and then of course you also have the
ability to compromise accounts social
media accounts email accounts
compromise infrastructure and then more
this is really really where stuff uh
starts getting interesting and is really
specific for apt groups this is where
you have developing capabilities right
so adversaries May build capabilities
that can be used during targeting rather
than purchasing freely downloading uh
freely downloading or stealing
capabilities adversaries May develop
their own capabilities in-house this is
the process of identifying development
requirements and Building Solutions such
as malware exploits and self-signed
certificates adversaries May develop
capabilities to support their operations
throughout numerous phases of the
adversary life cycle this is very
important apt groups need
firstly they need to avoid any detection
so most of the APT groups will typically
take the source code of tools like
mimikats as an example they'll modify it
uh they will obfuscate it essentially
change around the code to the point
where it's unrecognizable or
undetectable generally speaking or
combine it with another tool I'm using
very simple examples here
and they essentially at this phase or
under this technique what they're doing
is they're preparing all the malware all
the payloads that they will require for
the entire course of the operation right
so they pretty much take a look at the
Target environment based on what they
know from the Recon phase so they know
that for example the target network is
an ADA is an ad Network so they say okay
uh what will what tools will we need
well once we're in uh we'll need a tool
to perform local enumeration so that we
can move laterally or identify
misconfiguration so on and so forth so
we'll need something like Ad Finder for
example just as an example right we'll
need Ad Finder okay what else do we need
we may need to access credentials mimic
ads might be easily detected especially
if they have an EDR how about something
like the windows credentials editor or
WCE how about that that could work
do we want to use Powershell once we
gain initial access as our Command and
scripting interpreter that might be
better although that could cause
potential issues because we don't know
what version of Powershell is running on
the workstations so stuff like that
they're essentially preparing all their
gear right and they have to prepare it
for every phase because the last thing
an apt group will do is they let's say
get again initial access and they don't
know what to do next right so
uh that's what developing capabilities
is all about now before I take a look at
techniques and sub techniques in detail
let me cover some of the other tactics
that may be new to you so you have the
initial axis which is exploitation and
for the Enterprise Matrix you can see
you have a drive by compromise as a
technique exploiting public facing
applications external remote Services
Hardware editions phishing which has
several sub techniques so here the spear
phishing attachment a spear phishing
link or spearfishing via service
and then of course you have a supply
chain compromise which most of you
should be familiar with with the
solarwinds hack where you essentially
compromise the software supply chain
and you pretty much you know are able to
get in that way and then of course valid
accounts so under execution this is a
very important tactic that goes uh
overlooked most of the time so this is
when the adversary is now trying to run
malicious code it usually comes after
initial access right so execution
consists of the techniques that result
in adversary controlled code running on
local or a remote system techniques that
run malicious code are often paired with
techniques from all the other tactics to
achieve product goals the most important
technique and sub techniques under
execution are as I said the command in
scripting interpreter so you may gain
access to a standard Windows command
shell
uh or you may gain access uh via let's
say a Powershell Empire Stager
uh that you had set up and uh you may
want to decide on what command and
scripting interpreter you're going to
use which consequently affects what
scripts you're going to use generally
speaking so in the case of partial which
is mostly used by PT groups you can see
that adversaries May abuse partial
commands and scripts for execution
partial is a powerful interactive
command line interface Etc adversaries
can use partial to perform a number of
actions including discovery of
information and execution of code
examples include start process the start
process commandlet which can be used to
run the executable invoke command so on
and so forth and of course you can say
windows commercial standard Unix shell
in the case of Linux a python shell if
you will uh JavaScript so on and so
forth
uh but yeah I'll go into this once we're
taking a look at an APD group and then
of course we have persistence Prevost
defensive Asian which you know makes
sense credential access which is you
know credential dumping looking for
passwords hashes uh dumping hashes Etc
and also a 2fa
authentication which I'll also explain
Discovery is when you're trying to know
the the phase that comes before lateral
movement or pivoting where you're
essentially performing local enumeration
That's What discovery is so once you've
gained access to the Target system you
start performing enumeration you're
trying to identify more information
about the target system you've just
compromised as well as the target
Network and then you have lateral
movement which is pivoting and now
uh these two phases are of these three
phases command and control
uh exfiltration and impact these are
more so very specific towards apt group
so pretty self-explanatory exfiltration
is you know getting out or transferring
the data that they've identified as
important out of the target systems and
doing so in a way that is undetectable
so you know for example exfiltration
over C2 Channel and then in some cases
some apt groups like causing impact
right what this means is they destroy
data wipe drives ransomware so on and so
forth so
one thing that I want to say is apt
groups do not all follow or you know
this exact flow this just gives you a
holistic view of all the known ttps that
have been ever been utilized by apt
groups right and then you'll typically
see that most apt groups will have
reconnaissance resource development
initial access execution they may go for
some persistence like creating a
backdoor account prevask uh they may
skip over credential access move on to
Discovery lateral movement uh collection
command and control in the next
filtration and some may only go through
a few uh
a few ttps or a few techniques and or
sub techniques
so any questions
yeah so they they don't use public Cloud
uh they usually use like very
um
I would say
very nefarious Cloud hosting providers
one that accept Bitcoin uh well you know
the ones that are registered the
companies are registered in the you know
in in the in Panama or the Cayman
Islands or stuff like that where they
they really isn't any jurisdiction to
access the service legally speaking in
the event that the authorities do find
that you know the servers were hosted
there so the entire process is
completely Anonymous if it's a good apt
group and if it's a Chinese apt group uh
then they're typically hosting it in
China and that means that it's uh you
know there's a very low chance that
you'll be able to identify the
individuals behind it you may be able to
geographically identify the data center
if you get the APT
uh if you get the actual IP address
sorry
but that's another reason why most of
the APT groups like apt-38 onwards all
have a proxing system that prevents you
from ever identifying the uh the source
IP of the C2 server some also have
failed back C2 server set up which they
constantly switch to and from
um right okay
the next thing that I wanted to cover
uh looks like
um let me see if we have any other
questions before provocative because uh
the best way to visualize this will be
through this spreadsheet that I have
here
uh that sort of covers all apt groups
and the operations so they're sorted
geographically or based on geolocation
so China Russia North Korea Iran Israel
NATO Middle East so on and so forth
I'll go through this shortly a really
cool spreadsheet that I use especially
for adversary emulation
um if there are no more questions I
think I can proceed so just one second
all right so
yeah yeah I'll post I'll post a link to
the spreadsheet
um so
no
um before we actually proceed to APD
groups one thing that I wanted to
highlight was the individual techniques
which I think most of you are already
familiar with so if I click on a
particular technique you can see that
you have the sub techniques if it does
have sub techniques but this was the
metadata that I was referring to
now one thing to note is if you've used
the mighty attack framework from its
Inception in 2013 or 2014 I would say
early 2014.
because this data or knowledge base is
constantly being updated so you can see
we also have
attack version 12. the the current one
we're using is uh uh the current one
we're using is V12 but you can see the
the updates there the IDS uh for some
new techniques will change uh the old
ones I haven't seen any changes to uh
but what's very important or interesting
to understand is the nomenclature right
and how IDs are used by red teamers and
also blue teamers to refer to a
particular technique and most tools like
Wazoo or uh if you're talking about
seems like
um you know Q Raider Fortinet oxide all
have the mighty attack framework
embedded into them so that you can
identify or map techniques uh you know
based on the logs that you're getting
you can map them onto the mighty attack
framework and see what you're dealing
with and then you can juxtapose those
techniques against let's say an apt
group to see if there's any similarity
and that's where the Navigator comes
into play so I'll be explaining all of
this now the the metadata that I was
referring to you can see you have the
IDS any sub techniques the tactic it
falls under the platforms whether it's
Sports remote the version when it was
created and when it was last updated
so
what that means is looks like we have a
few
network issues let me just check this
here
I'm just going to remove reduce my audio
bitrate
um
you can see that my audio bitrate is
good here
let me know if there's an issue with the
connection
all right no issues anyway
so
with regards to the blue team which is
what I wanted to cover shortly when we
talk about
um if you take a look at a particular
technique you can see that you have
procedure example this is very important
because it highlights the groups that
have used it so you have for example apt
19 has used this particular technique
and it sort of gives you a basic
description saying apt 19 downloaded and
launched code within an SCT file and you
also have here right if you click on the
hyperlink that'll take you I'll just
wait for it to load up but that takes
you to the actual
uh to the actual submission or a
reference link here and in this
particular case uh if I uh I don't think
we're ready to explore this yet but um
I'll get to that shortly uh so you can
see all the APT groups or thread groups
that have utilized this before uh this
technique
the important thing is the mitigation so
it less might attack framework will
essentially tell you how to mitigate
this particular technique so for example
Behavior prevention on endpoint on
Windows 10 enable attack surface
reduction ASR rules to prevent Visual
Basic and JavaScript scripts from
executing uh potentially malicious
download malicious downloaded content
and in the case of Powershell the best
way is to of course prevent or disable
uh essentially set the execution policy
to restrict it to essentially prevent
anyone from bypassing the execution
policy which is highlighted here in the
case of Powershell as an example and
then for for those of you in incident
response and detection you can see that
it tells you how to detect this
particular technique more importantly it
tells you that the actual data source so
you can see in this case the data source
here is a command and the data component
is command execution so monitor command
line Arguments for script execution and
subsequent Behavior actions may be
related to network or system information
Discovery collection or other scriptable
post-compromised behaviors and could be
used as indicators of a detection
leading back to the source script anyway
at the bottom you have resources or
sorry references
um and by the way at the top here you
can actually go through each of all of
these sections that I've covered so you
have data sources
right over here data sources represent
various subjects or topics of
information that be that can be
collected by sensors or logs so this is
where you have now the uh The Blue Team
come into play and then the same for
mitigations and then you have groups
which I've covered these are all the APT
groups or thread groups that have been
cataloged here
uh you also have software which is where
you get to see stuff like all the rats
here
um someone asked like what's the most uh
I don't know let me see if I can see
that question here
oh I think it was with regards to a rat
if I'm not wrong
let me see if I can find that question
here
anyway I don't think I can see it here
anyway yeah this is where you can see
like all the software that has been
catalog that's been cataloged by uh you
know on the mighty attack framework here
and so for example you have all the
different types of rats and of course at
once that question the most popular of
course is Poison Ivy at the moment which
is uh really cool uh C2 framework it's
heavily used heavily modified by most
um
apt groups at least now
um you can see all the groups that use
this software a lot of them have not
been cataloged so
some of the most recent apt groups like
if we take uh you know a North Korean
apt group like Lazarus they have used
poison ivy but I heavily modified one
um
so in this case you'll not see it here
but if you click on any of the
techniques and or sub techniques that
are used by this or associated with this
particular C2 framework uh then um you
know you should be able to find it there
um yeah anyway let's move on to apt
groups because that's the next logical
step here
so what is an apt group uh or what is an
apt well apt stands for an advanced
persistent threat right it is a targeted
attack on an organizational company
where an adversary gains access to the
organization's Network establishes
persistence and remains undetected for
an extended period of time typically
speaking right the objective of an apt
is heavily centered on latex filtration
and not impact now again this is
generally speaking based on all the data
we have available we do know that nation
state nation-sponsored apt groups like
the ones from Russia
uh and their attacks uh their preemptive
attacks before the Ukraine War uh and
also after were heavily focused on
impact right so they wanted to disrupt
uh you know
critical infrastructure like they did
before with pettia not petia Etc where
they you know essentially tried to take
down their whole uh Transportation grid
uh you know the the subway system so on
and so forth uh and I'm specifically
speaking about
um
uh Ukraine here and the impact that the
state-sponsored APT groups uh you know
Gru groups or FSB groups uh were able to
do theirs was specifically on impact
um and also another example would be
stocksnet the earliest I can think of
where we all know the U.S uh and is uh
yeah Israeli certain Departments of uh
the Mossad
uh what involved in developing stuxnet
which was designed to
gradually degrade the uranium
enrichments centrifuges
you know that Iran had in its uh uranium
nuclear enrichment plants which was
that's an example of an apt group that
is focused on impact so their job was
not really acceleration of data I'm also
degrading the quality of essentially
reducing the lifespan of the centrifuges
which are very expensive
um but yeah
so given the nature of Apt attacks a lot
of human and financial resources are
required to successfully plan Implement
and execute an apt attack right so while
the objective generally speaking is the
acceleration of data API groups usually
have varying interests ranging from
long-term reconnaissance and
interception of communication channels
to this theft of intellectual property
in the case of many Chinese APD groups
that have targeted a lot of U.S
companies the U.S government as well and
their job primarily has been to either
steal intellectual property from
companies uh and or you know steal
information from governments
um
and one of the really important
categorizations nowadays is the
additional categorization of Apt groups
and that comes in the form of groups
that are sponsored by nation states
which I explained typically for the
theft of intellectual property State
intelligence disruption of business
operations and interference with
elections another good example of this
in the case of interference with
elections was fuzzy bear and cozy bear
from Russia which were specific threat
groups that fell under the FSB and Gru
so they typically this was actually
quite hilarious where they tried to
essentially influence the 2016 election
and both of these groups were able to
infiltrate uh most I think a part of the
the demographic party's Network I
the Democratic party's uh Network I
can't remember
what exactly they compromise but both of
them were in and their Prem their
primary objective was to
essentially exfiltrate data and to
somehow influence the outcome of the
election so yeah there we are uh you
know Gru FSB fuzzy bear and cozy bear
which I'll explain how the APT groups
are named based on their geographic
location uh apt-28 so you know
reportedly they reportedly compromised
the Hillary Clinton campaign and the
Democratic National Committee the
Democratic Congressional Campaign
Committee in 2016
in an attempt to interfere with the U.S
presidential election
now
um
let's take a look at apt groups and I
want to explain a couple of things here
uh but before we do that I want to
explain cyber threat intelligence
because
it sort of ties into what we'll be doing
so threat intelligence is the
informational data that is collected and
analyzed to better understand and
adversaries motivations targets and ttps
this intelligence is used by companies
and Defenders to make better informed
decisions when it comes to defending
against threats so threat intelligence
is you know also enables Defenders to
take a more proactive approach when it
comes to actively defending against
evolving threats and disciple threat
intelligence is only effective if the
intelligence is evidence based as a
result research and Analysis analysis
performed to develop the intelligence
must be rigorous so let's take a look at
an example now uh before we take a look
at CTI further
specifically through the Navigator
because this is really really cool and
quite important
um
so what I'll do is let's say I'm uh I'm
a red team I want to do some adversary
emulation I can utilize the Navigator
which is available on the miter Dash
attack dot github.io forward slash
attack Navigator I'll just change the
theme to light here and I'll create a
new layer for the Enterprise Matrix here
so this will give me a modifiable canvas
of the might attack framework the
Enterprise Matrix specifically
and what I can do now the great thing
with Navigator is I can if I'm already
my can specifically plan out my
operation the way I want to do it or
alternatively I can also map a
particular apt groups ttps but firstly
let's start off with let's say I was
planning my own pen test or red team
engagement so I could say we want to do
active scanning and once I select it I
can add a color right so I can add a
background color to it so let's say red
in this case I'll just say green I'll
use green as a technique that I want to
use we also want to do
uh victim gather victim Network
information and I can do a multi-select
so I'll just say this one here gather
victim organization information let's do
some phishing and search for you know
open websites domains and I'll just
highlight that there all right I can
then say under resource Dev we'll
acquire some infrastructure
um obtain capabilities instead of
developing them ourselves
initial access we're going to Target
their public facing applications
external remote services and we'll do
some fishing more specifically
will try and gain initial access via
spear phishing attachment
and let's highlight that there
um as for execution
let us utilize Powershell all right so
uh I will set that up there and then I
can head over to persistence because
this is a Windows environment we're
going to create some accounts
a local account on the first system we
are then want to
set up a scheduled task
there we are
and yeah that's pretty much it for in
this particular case so again I'm just
going through a very simple example here
and
um under prevask
uh what to do you can probably do some
bypassing of UAC in the event we need it
so we might need this
in this case
uh we also want to do some token
impersonation there we are
uh and that's pretty much it with
regards to previsc and then we can move
on to credential access as the final one
just as an example here let me just get
rid of that there so in this case what
we would be looking for specifically is
OS credentialed dumping more so the lsas
memory
that's with mimikatz okay so that's what
that's one example of what I could do if
I'm simply planning a red team operation
remember not adversary emulation now
um
if I was uh doing adversary emulation
let me create a new layer here I could
head over into search and multi-select
and let's say I was trying to emulate
apt-38
as an example actually let's do 41. I've
done a lot of research on 41 so I can
say select that's going to select all
the dtps and now instead of coloring
them specifically I can set up a color
setup or a color scoring gradient
where
I can set up a base score and a high
score so low and high and I can I can
specify the color scheme I want to use
based on what I'm sort of doing with
this in this case we can say let's map
out the dtps used by
apt-41 first and then
we can use other colors based on our
scoring system uh to sort of specify
what specific techniques we're going to
use you know as opposed to using all of
them so in this case I'll set the preset
as uh let's say red to green and the low
value will be zero and the high value
will be three okay
now with all of these ttps selected I
will head over into the scoring gradient
and I'll say let's set the score to zero
okay so that will give a base score to
all the ttps so visually speaking let me
just close this up here
you can now see that these are all the
ttps used by apt group 41 all known ttps
right
and now from this point onwards I can
now specify based on my own campaign
because we're doing adverse regulation
we don't need to emulate it completely
because the target environment may not
allow for that accurate level of
emulation I can say okay
uh we can definitely do exploiting
public facing applications because the
company has them external remote
Services valid accounts I'm going to I'm
going to select all of these
uh exploitation for client execution yes
that sounds like a good idea uh
external remote services and then I can
head over into my scoring system I can
say set these three so now I can utilize
the navigator to essentially see or you
know identify and visualize what
techniques I'm going to use and sort of
juxtapose them against the dtps that
apt-41 utilizes so from a planning
perspective or you know adversary
emulation perspective this is how you
can use the Navigator now from a blue
team perspective uh you know when you're
doing cyber threat intelligence
it's essentially the same process
however there's a few differences right
so we take we go back here uh what I'm
going to do is
we're going to take a look at an example
let's say
you have been assigned
as a cyber threat intelligence analyst
to essentially come up with ttps for all
apt groups that fall within the industry
or all apt groups that Target the
industry that your organization operates
in a good example of this is a financial
let's say that the company you work for
is a financial organization so firstly
you have to identify apj groups that
Target Financial organizations and then
you're supposed to map out all of their
ttps and build a heat map so how would
you do this well firstly we know that if
we use a general nomenclature from the
miter attack framework we can
specifically say we're looking for fin
groups right so if we set thread groups
let's say the fin group we want to use
let's say fin six first so we can say
fin 2 is one of them uh well sorry sorry
that's fin six here so thread groups
let's start with fin six so I'll say
select
and now
remember when you're generating a heat
map you're trying to see
uh the overlap between all of the APT
groups in this in this case we're taking
a look at Finn groups right fin groups
are essentially Financial uh groups that
Target Financial Service organizations
companies Etc
so we can start with fin six uh and uh
in this particular case I will set up
the color setup and we'll use the red or
green to Red set up here so low value
will be zero
uh high value will be three
in this case we'll just take a look at a
very simple example here and the scoring
will set to zero and you'll see how this
works this may be a bit confusing but
just give me a second and I'll show you
this in a bit all right so that's fin
six so we can rename this here
uh where do we rename this there we are
so we can say fin six okay
there we are and you can also add
metadata and links here and I'll also
show you how to annotate specific uh
techniques here it's very simple you
just right click here and then you can
pretty much annotate here or add a
comment so there we are I can annotate
but I'll take a look at this shortly
here so one second I'll now create
another layer
and in this particular case we can also
look for another
pin group here so we'll say thread
groups let's see one that's going to be
particularly interesting here so we can
do fin four
fin five
fin six those might be all potentially
interesting so I'll select that
and then
I will set up the same uh color setup
here the scoring gradient so I'll say
the preset is green to red and some of
you may already know what I'm doing now
so zero to three we'll set the scoring
to zero
so that's uh
uh one second let me just close this
here
uh yeah that is pin I let me just see
this again here
we select we're using fin 4 in this
particular case uh
yeah we can use fin four in this case so
that's fin four
I'm just going to deselect that one
there
and if I say deselect this one here
there we are so that's fin four
I just wanted to confirm that so I'm
going to rename this to fin 4.
and we'll also do one more just so that
I can show you what this will look like
uh we can say create a new layer
Enterprise and in this case let us look
for
uh fin five okay so select set up the
same scoring
gradient here so we'll set this to Green
to red
uh zero to three and we'll set the score
to zero now
you may be asking yourself well how do
we combine all of this to see where they
overlap or what techniques all of these
apt all of this uh fin groups have in
common well firstly let me rename this
to fin five
this is where the Navigator is really
powerful so I can create a layer from
other layers so I can create there we
are I can use the Enterprise attack
version 12 and then under the scoring
impression I can combine all of these
layers so I can say a plus b plus C
right very simple and I can hit create
now you will see something very
interesting here all right the first
thing I need to do
is I need to set the color setup for to
Green to Red here and I'll set this to
three
and I'll show and then one one thing
that I need to highlight here uh one
second uh let me just close that up here
uh
one moment I just want to see this here
let me just deselect all those
techniques any questions so far before
um
move forward
oh well it looks like we have quite a
few questions
all right let me try and go through them
okay these are quite a few questions
which I'll get to shortly now one thing
I wanted to show you is that this will
sort of highlight all of them now if you
wanted to see their commonalities what I
could do is I can go into all of these
here and you can see them here and if I
just uh
select them here which ones were
selected uh all right so let's just
select and I'll set the scoring to
one
and in this particular case you can see
the score is one here
and I'll just close them up here I'll
just show you how to get a sort of a
commonality uh and then in this one here
we can set the scoring
these are all set to one
that's weird there we are okay
uh there we are that's looking good
and the same for this I will set the
score to 1. and we can now close that up
there
so now I'll create a
there we are a plus b plus C gradient uh
we don't want to pick any gradient there
coloring
uh
uh we can use the default one and change
it I'll just say create here there we
are fantastic so I'll just revert this
to the scoring gradient we were using
so that is green to Red okay so now what
does this mean
what does this mean
well if you take a look at each of these
you can see we have green red and yellow
all right so in the case of green ones
that means they have a score of one all
right which means that this technique is
quite unique all right to either one of
them
and it's not is not really common
between these three fin groups the ones
in yellow have occurred or have An
Occurrence in at least uh in at least
two of these groups that we've just uh
that we've just mapped and then the ones
in red are common amongst all three so
you can see on the initial axis they
really go for valid accounts that's
really a technique that they're
interested in if we take a look at some
of the other ones we can see valid
account sort of repeats itself here
quite a lot if we took a take a look at
some of the yellow ones like for example
remote system discovery which falls
under Discovery itself but I just wanted
to see whether they were on any other
ones here so the commonalities between
the three groups reveal quite clearly
that okay in the case of maybe fin six
and fin five this and fin four there's
not really a lot of overlap but with
regards to the initial axis techniques
there's quite a bit now of course we can
repeat this for an apt Group which will
sort of show this much better but uh you
can now start to see how powerful the
um the Navigator is because you can now
take this you can export this and you
can essentially say okay so this is
essentially what all of these fin groups
here
utilize and from a defensive perspective
you can now give this to you know the
sock or your engineers to essentially
Implement detection capabilities and
mitigations
um
now any questions regarding this because
there's a lot of use cases here and we
can take a look at a lot of examples
um
I want to go through all your questions
because I know there's quite a few and
we've been going for I don't know two
and a something hours
okay so
um let's see
can you show a quick works of
identifying malware in an endpoint or
trying to expand the attacker's single
print I as I said I'm uh the the focus
of today's session was on might attack
now I can have these sessions if you
guys want them every day like live
streams I'm completely happy doing live
streams because for me they're much
easier uh to do plus I can set up these
sessions as well as Labs as well
uh if you guys want that
um we can probably cover that you know
do I have a job yes I have a job I
run a pen testing company called
hackersploit we do pen testing red
teaming I'm also an instructor at ine
and an instructor or rather the lead of
the Cyber ranges community
so yeah that's essentially what I do
well as I said uh friend that's a very
good question the thing about this
framework is it's so holistic and so
encompassing of every technique that
they're likely to use what will happen
is that companies like crowdstrike
Kaspersky mandiant mandian does a really
good job at cataloging all of these
groups if they find a technique or sub
technique that doesn't exist yet they'll
just submit it to the mighty attack
framework and they'll add it so that's
one of the reasons why Maite is so
powerful is because it's kept it's
frequently updated all of the uh you
know all of the groups like Mandy and
crowdstrike Etc who analyze the activity
of these groups you know long term
and identify all their ttps if they find
a new technique that's never been
implemented or they've never seen they
can add it to the mighty effect
framework it doesn't exist already now
yeah so I'm going to share this
spreadsheet with you guys I mean I use
it quite a lot the first thing I would
like to explain
is the naming systems now with a
crowdstrike is pretty much the the
they're pretty much the ones who came up
with it uh so they'll typically see
under their naming nomenclature uh they
typically call groups from China they'll
have a prefix which is just a name and
then uh you know in any name and then
they the the suffix is typically going
to be Panda so groups named by
crowdstrike from China will typically
have the name Panda around it which
makes sense you know Panda pandas are
native to China so they use animals to
identify these groups the for Russia
it's going to be a bear so if you take a
look at uh let's see if I can find it
here there we are fancy bear Cozy Bear
uh that's actually angry anger bear here
but uh they pretty much use the bear
naming system uh North Korean
uh let's see if I can show you this here
we'll actually get into North Korea very
shortly but
um they usually they usually go for a
Colima uh and then under Iran this is a
kitten there we are so they typically
use the kitten
naming system
um there we are Israel doesn't have its
unique name yet
uh you then have NATO
same thing here Middle East right over
there
but typically use Jackal I've seen a lot
of Jackal before
uh but uh yeah that's
um crowdstrike uh mandiant is the one
that has given the names that all of you
are familiar with like apt one apt
whatever 41 Etc
um you can see a lot of their you know
some of the the uh the APT groups that
have been cataloged very recently like
apt-41 and also apt-42 which is uh I
think is is the analysis is currently
ongoing
uh you can see I'm mostly from China but
we also have a lot from North Korea
recently so most of you are familiar
with Lazarus
let's see if that's been highlighted
here let's see if I can find that
Lazarus group should be highlighted here
but it one of the cool things with this
particular spreadsheet is it also
highlights the tools or malware that
they used in a particular operation so
you can see operation one two three four
Etc so ghost net was Operation two
and then of course the other names for
that particular group
um and then of course you have the
target so who they targeted here their
modus operandi which can be very
important to understand what their
motivations are and then of course
different links to references here or
rather reference links posted here so
I'll share this in the chat you guys can
go ahead and take a look at for yourself
um
I'm just going to post it in here
it's uh you should you should be able to
publicly access it
yeah definitely you guys can reach out
to me I mean I'm I'm trying to like also
um
empower the industry by sort of giving
guys jobs uh you know in cyber security
so
there's a lot of things we're doing
attack exploit and we're open to
positions uh for different roles whether
Beyond offensive defensive side of
things
yeah I'm probably going to upload it uh
after the live stream is concluded
because by default it's not set on my
YouTube settings here so I'll post it
after it's been published
yes of course I'm always open to
mentorship I mean this is why I do these
sessions and this is why I'm going to
continue doing these sessions if you
guys need mentorship our guidance I'm
always open I think most of the people
on LinkedIn will tell you this I pretty
much answer all of the questions give
you guys guidance and by the way I know
about the earlier rant I do apologize I
mean I'm just trying to look out for
people and essentially prevent them from
getting into siled thinking and into an
ideological way of looking at technology
because the thing about cyber security
is you can't be rigid about your
thinking you have to be constantly
Dynamic and you need to you know
essentially look at the the truth and
facts
Quantum encoding I'm not sure I
understand your question Vincent could
you like elaborate further
I think that's pretty interesting we can
continue like for I think the next one
hour I mean the live stream has
proceeded way longer than I would have
expected it to but I'm happy you guys
are here thank you very much for being
here I know it's a Saturday everyone's
someone has pretty idea I would assume
most of you have something better to be
doing with your time than watching me uh
talk about the mighty attack framework
but hey
foreign
cool so I think we can continue with why
I wanted to cover cyber threat
intelligence and we can take a look at a
couple of other examples with um
oh yeah that's one one thing I wanted to
highlight so
the same thing will apply to TTP so you
can actually see like if we take a look
at one here like on the valid accounts
yeah so it just highlights that specific
technique and not any specific sub
techniques but what I wanted to point
out
is if I select uh
uh actually I don't need to select in
this particular case but uh what I'll do
is you can essentially display all the
sub techniques and then
and this is where you can now give it to
your blue team or your Defenders I can
essentially export this into an Excel
sheet right so there we are and of
course I would have renamed that to
something better
but you can see I essentially highlights
it in a way that's consumable however
what you can also do
is you can also annotate specific ones
so what I like doing to make it easier
if I right click on a particular
technique or sub technique
I can view the technique on the mighty
attack framework right and I can copy
this link
if I'm if I'm exporting it to a
spreadsheet right and then I can
annotate on here so I can click on uh
sorry comment and I can just paste in
the link there or I can click on link so
I can add a link to this particular one
here so I can say URL there
and I can just say might uh uh technique
uh you know just as an example there we
are uh and then now uh if I export this
again which I'll just change the name
here I'll just say fin groups all right
oh yeah uh export that to excel
layoff in groups
there we are so what was I can't even
remember it but we're taking a look at
command and scripting interpreters
let's take a step back here so execution
command and scripting interpreters that
should have a link a hyperlink so let me
just enable editing
in if in the event it doesn't then I
said the best way to add it would be
through The annotation system where you
can I'm just going to switch over here
sorry about that uh so you can pretty
much add a comment I'll just show you
this as an example let me just add the
comment there
uh that is there that's weird that it
doesn't but the other export options
that you have are the ability to render
it to an SVG I typically do this in
reports for uh when I'm doing red
teaming for adverse regulation campaigns
and how successful they were so this is
this was the final example that I wanted
to show you and I'm sorry that I'm
bouncing around right now uh but um
one thing that I usually like doing when
i'm doing adversary emulation is I'll
just use a simple example now so I'll
create a new layer
let's say I'm emulating apt 21 not 21
let's do
let's do 28 okay
all right so I'll select uh what I'll do
now is again I'll just use the color
setup here so we'll say red to Green
uh yeah red to Green that that'll work
in this case
and then I'll set the score to zero
uh actually
uh let's revert that to Green to red
hold on hold the phone I set that to
grid let's set red to Green all right
there we are fantastic so
if I'm emulating this group verbatim if
I'm utilizing in adverse emulation tool
like Caldera uh Maita Caldera which I've
covered on the channel before and we're
essentially emulating all the ttps who
have installed the agents on the target
systems then what I would do then is I
would then go ahead and say okay uh was
the company well the defender is
successful in defending against
you know attacks against the external
remote Services if they were then I'll
select that particular technique and I
would say let's give this a score of
three all right what that means is that
the company defended against that
particular technique successfully if
they didn't then I leave it as red and
then and I'll just do it for a few more
I'll do it randomly just to show you an
example
so I'll say all of these ones they were
able to defend successfully I can then
take this and I can give it to the
company and say Okay so
this was apt-28 uh the ones in red were
the ones you failed to defend against
and the one in green the ones in Greens
were were the ones that you're able to
successfully defend against so this
information now can be ingested into the
whole CTI life cycle and used to
implement uh mitigations and detections
for this specific ttps
oh yeah get yourself a glass of wine man
that's always a good one I have to
I am pretty much on uh uh Monster Energy
here
um anyway let's return to the slides
briefly so I wanted to touch on the
importance of cyber threat intelligence
and uh you know to whom this information
or this process is important the first
one of course is sock right whether
you're talking about sock tier one
analysts all the way to Sock tier three
so it essentially helps them identify
and prioritize incident based on risk
and impact
so going back to that example where I
combined the ttps of the different Finn
groups if we use that same color grading
system
that's that color uh gradient or color
scoring system could have told them
which techniques to focus on based on
how much they repeat themselves or how
many times or you know how many
occurrences of that technique exist
between all of these fin groups in the
case of the security analyst it's used
to continually improve detection
capabilities and fine-tune defenses I
just showed you the final example on the
might attack Navigator shortly in the
case of the intelligence analyst it's
used to identify track and analyze
threat actors targeting the organization
as we've already done and then for the
c-suite or management executive level of
the organization it helps them improve
the understanding of risks the
organization is facing and what can be
done to mitigate these threats and or
risks
now the CTI lifecycle and this is very
important this is typically what it
looks like or what it entails right so
the first stage involved in cyber threat
intelligence is the direction right what
does this mean that the direction stage
is used to plan out the roadmap for the
exercise
so this is essentially where the CTO or
the Seesaw comes and tells you okay
this is what I need to know this I
essentially need to know uh what our
defense our defenses look like
with regards to apt-38 or our
capabilities our detection
capabilities with regards to apt-38 so
that's just one example they tell you
you know who are the threats or the
attackers
uh the attack surface actions needed uh
you know to be taken to improve defenses
all right so that this is where you set
out the goals of the entire operation
right so
that's the direction you then have
collection so this involves collecting
information based on the requirements
you then have processing this of course
involves the processing of collected
data you then have analysis which again
is analysis of data collected to
adequately answer the requirements
dissemination is essentially the
reporting of the findings identified
during the analysis phase for the
consumption of the c-suite executives
and stakeholders and then feedback
feedback obtained from the report is
analyzed to make improvements on the
entire CTA
life cycle or process uh this will make
sense shortly once you understand the
types of cyber threat intelligence which
is where you now start to understand why
I was specifically focused on
operational cyber threat intelligence in
this video
all right so we have tactical cyber
threat intelligence this is where you
identify iocs so
stuff like uh logs malware analysis
you're essentially trying to identify
indicators of compromise similar to what
mandiant or and or crowdstrike is doing
right but not for a specific apt group
You're simply trying to better improve
your detection capabilities the
operational cyber threat intelligence is
where you track and profile
ttps or the dtps of a particular threat
group to obtain an improved
understanding of adversaries
consequently improving your ability to
detect the to detect it you know the
ttps that they use as well as mitigate
those specific ttps and then you have
strategic CTI so strategic intelligence
shows how Global events foreign policies
and other long-term and international
movements can potentially impact the
cyber security of an organization
and we've already talked on the miter
DAC Navigator
so I have a few other examples now
before we move on to those examples and
that's pretty much it for the slides do
we have any other questions
thank you Nate I really appreciate that
yeah so ioc is already well highlighted
on the attack framework so let's say
you're looking for indicator of iuc for
uh let's see
hmm yeah let's take a look at abuse uh
the sub technique is bypassing UAC right
so if you take a look at
detection here it will tell you the ioc
is here so for Windows registry as the
data source you can see some USC bypass
methods will rely on modifying specific
user accessible registry strings for
example The Event Viewer so yes it's
essentially telling you what to monitor
so the Event Viewer bypasses the hkey
current user software classes Etc
registry key so it's already told you
what to look out for and then in the
case of the data source being command or
you know command execution you can
essentially monitor executed commands
and set up depending on what signature
tool you're using you can you can
generate a signature to detect the
execution of this you know specific
commands tied to bypassing of UAC
uh and then more specifically when
you're talking about tools or software
like uh let's see if I can find that
here
I think I'll have to find it
individually but if you talk about tools
like uh
uh UAC me as an example let's see if
it's actually cataloged here
uh
let's see it should be there we are
there we are there's a tool that's
typically used to bypass UAC now
um
you can see it highlights the technique
and sub technique so you can pretty much
get an idea of uh there we are in this
particular case it's highlighted the
procedure examples which is not limited
to just groups but also software but I
wanted to Showcase uh uacme as an
example the point being you have
mitigations so it'll tell you a
potential mitigation here is to check
for common UAC bypass weaknesses on
Windows systems the easiest thing you
can do is essentially
increase this here under user account
control settings just set this to always
notify right so bypassing UAC only works
when the security level is Set uh to
this particular level here
and anything lower than that if it's not
enabled then you don't need to bypass
UAC so
so again
remember
groups like uh I'm not going to get too
much into
CTI but guys like crowdstrike if you
take a look at one of their references
um
let's see if I can give you an example
here let's take a look at this one here
uh yes go ahead
what they typically do
they typically have long-standing
operations that last for a very long
period of time and they essentially have
malware analysts so I I know a lot of
guys who work in CTI
it takes a lot of time to sort of
catalog the ttps that they've used I
mean it really takes a long time which
is why even with apt-42
that still hasn't come out yet their
ttps yet
um
but what they do is a combination of uh
It's a combination of malware analysis
so firstly they need to identify what
samples the samples are typically shared
by the guys who are responding to the
incidents you know whatever organization
was targeted
you know they catalog the malware and
then these guys get the malware sample
they start off with that uh and then of
course additional information is
reported I can't really share where they
get their sources because I don't really
do cyber threat intelligence uh intently
I primarily utilize cyber threat
intelligence to better my adverse
regulation campaigns
uh so hopefully that uh answered your
questions uh
I don't know whether you wanted me to
highlight anything with regards to the
Navigator what uh yeah I think I can
actually cover I think I'd covered this
before
but uh what I used to automate
adverse regulation and die essentially
all the ttps for a specific apt group is
miter Caldera which I've covered on the
channel before
it essentially allows you to pretty much
automate uh adverse formulation for
whatever ttps you want
uh and I think there's a new version but
um
very very cool stuff here
um
and then of course for manual red team
engagements it essentially can help you
automate the specific aspects of red
teaming I would say I I only really use
it for adverse emulation uh for specific
ttps
yeah yeah that that that's true uh
Atomic red is also very very good
um
I'm just I'm just more familiar I mean I
have used the the one of the things that
I really like about uh Atomic red is
that they actually give you the the yaml
files for each technique sub technique
Etc
which means you can pretty much modify
it and you know do whatever you want
all right
any other questions
um otherwise I don't know uh stream has
been running for quite long at this
point I don't even know how long it's
been it's almost three hours now
okay so uh just to to actually put it
out there that experiment is still gonna
proceed uh the ones that the one that I
pointed out at the beginning of the
stream the one we spent an hour
discussing that experiment is still uh
proceeding uh it's on its own course
because you know what I also want to
prove myself wrong
and I also want to play valorant on
Linux you know which is interesting
because
the last time I checked it required the
installation of uh anti-cheat
but entity that operates at the kernel
level
so I don't know how
I don't know how we're gonna
we're gonna emulate the NT kernel for
the installation of that kernel level
anti-cheat last time I checked I mean I
don't know about valent anymore I don't
play valorent I'm just uh
I don't know I
by default I wouldn't say that Windows
has bad logging
I would say that most people haven't
configured the the auditing correctly
like you know by default Windows
auditing is is really bad like the local
uh local security policies really really
um so yes you'll have to you know you'll
have to revert to cismon
um
obviously
um which is much better
so
yeah I agree with you this this one is a
is is uh really really uh a step ahead I
just don't think that Windows
um by default the local security
policies configured correctly
foreign
yeah that's that's fine constantinos
you're right but the experiment the
experiment is to see whether we can run
native remember
setting up a VM and doing GPU pass
throughs on Linux with with chemo and
KVM all of that stuff is is uh is sort
of counter-intuitive because you can't
rail on an operating system like Windows
and then use it if I mean if you're if
you're going if you're an Ardent
supporter of Linux as most of the people
were telling me and they are calling me
a Linux hater
I'm talking about Native out of the box
operation and performance anyway I'm not
going to get baited into that all I said
is I'll perform the experiment and by
the way I'm open to learning I haven't
gamed on Linux for like two years so my
exp actually it's been less than two
years I would say one year and maybe six
months something like that
uh but um
all I'll say is I'll be very fair and at
the end of it if I can you know if I can
switch over to to Linux and then you
know do GPU pass through I mean I might
as well do that because I have done it
before
uh even with with Mac
um because it's actually pretty cool to
edit videos on Mac uh I'll probably do
that I mean again I don't I don't want
you guys to take me that serious I mean
I was just talking
uh I was just talking man you know
a lot of people got pissed off at the
beginning of the stream man I mean I
shouldn't have gone I shouldn't have
spoken about Linux that was a really bad
idea
yeah I mean constantinos I'm I'm like
I'm well aware of GPU passthroughs what
what we were discussing
was
I was essentially saying that uh it's
kind of counterproductive
to go on to Linux
for you to only then
or if or for you to turn around and then
virtualize Windows if you are hating on
Windows to begin with remember remember
if like
the worst thing that you could stand was
Windows and then you go over to Linux
and then you want to play games and
realize that you need to do you need to
set up a gaming VM and pass through a
GPU uh
oh thank you thank you finally someone
who understands what I'm saying
constantinos thank you
that's exactly my perspective all I was
saying was that I use the operating
system that helps me get a majority of
my work done that's all I was saying
oh yes oh yes I mean another good
example is is presentations I mean I
don't know where I I mean I've I've
tried also I don't know what it's called
on Mac but they have their own
presentation writing software I mean I
still like PowerPoint and I know you can
use it in the cloud I have an Office 365
account I know I can use office in my
browser I'm not I'm not not installing
Linux to use Office it's just that as I
was saying in my case I need an
operating system for video editing so on
and so forth uh
and
um I also know that Linux hasn't got
good support from third-party vendors
like Adobe Microsoft Etc so I'm not
railing on Linux all I'm saying is
and again there's no hate here
I'm just saying that
for Linux and I do want Linux to grow on
desktop for Linux to work they need to
get a grip on on the package Management
Systems they're just too many I mean I I
don't understand there's snaps there's
you know Debian packages there's uh you
know or it's just too much it's just too
much for an average user and then
there's the package management utilities
freaking yum and aptitude and or you
know just in insane insane
yeah I mean you know all I'm saying and
again I'm not this is this is not my uh
my take I'm simply saying what someone a
normal person would say I gave you the
example previously of like me telling my
dad to install Linux on his laptop right
and he said okay I need this piece of
software uh can you install it for me on
Linux and I said no because it doesn't
exist and he says well I okay I can't
switch to Linux so the point I was
making is for Linux to grow on desktop
which I wanted to
there needs to be some organization with
regards to philosophy I mean it can't
just be Linus working on the Kernel and
then he works on the Kernel the kernel
is great and then uh you know the the
software on top of that the whole uh you
know the whole gnu toolkit is is
fantastic I'm not I'm I swear to God
like the gnu toolkit the GCC compiler
absolutely phenomenal utilities I mean I
I can't I can't lie there uh Unix uh
Slash Linux utilities best ever I'm not
gonna rail on that all I'm saying is
software support and package management
that's all that's all that needs to be
fixed
I prefer using VMware uh I also have
like a a server that I set up that's
using esxi but also proxmox is really
good I've used proxmox uh a lot I also
have a another proxmoxbox setup when I'm
when I'm setting up like quite a lot of
VMS for testing
yeah I mean Linus does like a a great
job on the Kernel I mean I I can't hate
on the Linux kernel the absolutely
fantastic
the area where I have a problem is
firstly and again this is not my take I
I know what distributions to install but
if I was looking at it from someone who
is totally new I mean I would be
absolutely confused I would be in a
state of uh of mental uh in you know
state of mental mess and confusion
like okay you go to oh you go head over
to distro watch I mean honestly
right
and this is what I do frequently I
frequently you know take a look at this
watch I mean look at how many distribute
and by the way these are all about
distributions MX Linux great Endeavor
mint Manjaro pop fedoro Ubuntu Debian
light Garuda great distribution open
Susa zorin these are all good
distributions the question is as a
beginner and that's the perspective I'm
looking at this from
is like this is too much
yeah I mean if if Linux is supported
like I'll give you an example
if I get like any of my video editing
software working correctly on Linux I'll
switch I'll switch like tomorrow
it's just that that's holding me back
that's the only thing because I can't
really I've tried working with the video
editors I've also tried using DaVinci
Resolve on Linux which works great
but the performance you can't compare it
to even a Macbook like exporting a video
the same software
and but by the way the PC I'm using is
quite powerful I mean I have 32 gigs of
RAM here I mean it's this is this is not
like on Windows it takes 10 minutes on
Linux it takes 30 to 40 minutes
yeah absolutely learning Linux was the
greatest thing I ever did in my career
like absolutely but
what I'm again I'm I want you to look at
this specific Persona and this
represents a lot of people
I'll just use the you know uh a very
simple Persona look at someone who uses
their computer for sending emails uh web
browsing writing documents I want Linux
to run on their computer the question is
how do we do that that's what I was
saying I'm not saying I never want Linux
to reach that stage I'm saying that's
what we want we want everyone to use
Linux but how do we get normal people to
use Linux because I speak to normal
people I've made them use Linux laptops
and they ask me very important questions
that I hadn't thought of and that was
why is there a different package when I
click download this package had Debian
and then the other one had a DOT run
extension it's all of these things that
are so damn confusing that I think we
need to fix because
again when I I've used Linux for as I
said it's it's been over 15 years now uh
at this point so
for me this is natural like it's not a
problem I have no problem tweaking a
system I have no problem installing a
custom kernel that's not a problem for
me I'm still always learning about Linux
you know I've done a lot of crazy things
with Linux but
I think that's like leaving me ignorant
you know to the fact that other people's
look at Linux very differently and I
want to like change the perception of
how Linux is viewed as something that is
uh you know mishmash of the kernel
itself the glue toolkit and then some
third-party stuff that's written that
you know third-party open source stuff
that's written by uh you know different
groups of people who have done a
phenomenal job I mean you talk about KDE
the KD desktop environment absolutely
phenomenal desktop environment I think
probably the best desktop environment
that's been created we talk about
productivity that's that's the top of
the range you know top of the line but
the question is the perception you know
yeah but the point of making Jared is
what if we could get normal users to use
Linux what if we could make
the normal operating system Linux
instead of Windows because again it's it
pains me to use Windows which I am right
now I have Linux on my laptop whenever
I'm watching like I'm doing my own stuff
uh writing scripts programming doing my
own pen testing on hack the box I'm on a
Linux laptop
again because I don't need those
additional pieces of software but the
moment I I need to I need to collaborate
or
uh you know I need to use something like
Microsoft teams because
the organization that I work for
utilizes it then that becomes a problem
so
if they get software support as I said
and I'm willing to help in this because
I'm not just someone who criticizes I
can I see these these points as ways we
can improve
we can improve this and again credit to
Ubuntu credit to Linux Mint they've made
it like as easy as possible for a normal
user to to get into Linux
and by the way I'm not saying that we
need to get rid of Arch Linux I love
Arch Linux I love installing arsenics
installing Arch Linux is like
therapeutic for me but again if we want
to grow on the desktop side
we need to make we need to sort of
demystify things and we need to make
things much more standardized and
streamlined with regards to doing the
important things like installing
software like writing documents stuff
like that
yeah I mean I've installed open BSD
actually I'm more of a dragonfly BSD guy
I mean I really like dragonfly BSD
that's a that's a really cool uh variant
of BSD you guys should check it out man
dragonfly BSD really really cool stuff
there uh but yeah I I installed BSD
awesome stuff but you know the and this
is a question for bsd1 so I mean Mac did
it Mac in fact Macos is our answer here
because Mac is running Unix right or at
least some variant of BSD and they have
done exactly what I've said they've
simplified the package management and
package installation and they have
software support I mean if you just give
that to Linux that's it I don't think
anyone else will use Windows
irregardless of the performance issues
ETC
yeah I mean there's no way we can stop
this because again I don't I don't want
this to ever end distributions are
awesome because it essentially allows
people to you know to do their own thing
however I think we need to sort of
categorize Linux to set up like a system
of differentiation between distributions
that are let's say well maintained well
supported that have good software
support and then if you choose to if you
choose to to create a spin-off then you
know you can pretty much do whatever you
want uh and if the if that whole
software support uh
functionality is incorporated into those
spin-offs and that's fine but I think
there needs to be a focus on just a few
distributions I really hope that someone
builds this new distro on Arch I think
that'll be absolutely fantastic you get
rid of that bloat and all that
unnecessary stuff just start from
vanilla Arch and then
you know stick to one init system let's
stop this debate over system D and again
I don't want to get into all of that but
you can already see where the problems
are I mean even within Linux users
themselves there's always a divide with
everything
sorry I didn't get your question Ghost
spirit
oh let me see uh could you post it again
you do not talk about coding any
specific what what do you mean about
coding specifically could you like uh
clarify your question so I can answer it
what about python like what my thoughts
are on python I mean I think python is
great I use it a lot actually now
I've been developing a lot of stuff a
lot of automation scripts in Python uh
but of over the last one month I've
primarily been doing a lot of implant
development for some red team Ops so
been mostly doing C sharp
on Windows
um
I'm primarily a c developer I started
off crazily enough with C plus plus
which doesn't make sense and then I went
to see uh and then C sharp of course
uh but yeah Python's awesome
I wouldn't say you need to know
programming to get into site I would say
you need to know how to script how to
automate stuff so you know batch
scripting a bit of python scripting
because
at a fundamental level you need to know
how to read other people's scripts
firstly
you need to know to automate a few
things and then I would say you need to
know in the case of exploits you need to
know to read exploits so in the case of
you know windows and Linux you're
typically talking about say C C plus
plus C sharp uh so as long as you can
read I would say that's good enough
unless you want to get into exploit
development
yeah I mean python in fact another
language that I've seen a lot inside but
now is go like golang is like really
taken off man
also some crazy people have been using
rust I mean those are some real you know
it's impossible to imagine anyway I'm
not hating on Rust before anyone gets
triggered I'm just cracking a joke
about uh
rust programmers
oh yeah yeah yeah Ruby is pretty good
actually you know what that comment was
right because if you if you think about
it
like nmap scripts are written in Lua
Metasploit modules are written in Ruby
uh you know most uh Scripts
either you're doing enumeration maybe
even basic web exploitation written in
Python Windows yeah you pretty much all
you pretty much need an understanding of
all I would say rudimentary
understanding but I would say focus more
specifically on scripting also
Powershell Powershell is really really
important because
uh when you especially are dealing with
um
you know with Windows pen testing
specifically like Powershell is really
cool
oh boy oh boy C plus plus or rest I I'm
afraid I can't answer that question
otherwise I I'm almost 100 sure I'm
gonna get sorted tonight uh even though
we don't have a SWAT unit uh
uh so I'm I'm declining politely
declining to answer that particular
question
oh yeah uh
in fact they'd actually seen a post uh I
can't remember where it was earlier
today where
um I can't remember what company posted
it but they were essentially encouraging
guys to leave C and C plus plus because
of insecure encoding practices
uh is really really interesting
um
ah no no I I didn't answer anything I
did not answer anything at all man
no answer
I
no comment
oh my God compilers compilers
again
I can neither confirm nor deny
I refused one
oh yeah so uh by the way you know the
podcast has been up in the air and this
is where I wanted your feedback because
I really had like an idea for it you
want me to get guests on the podcast you
want me to discuss topics like this
uh what what would you like to see on
the podcast because you guys had really
liked those episodes like the one we did
with gosec are we can probably interview
like a couple of um you know anyway I
would like to hear your perspective
yeah because we either like do
interviews and focus on specific topics
or we do like deep Dives with maybe one
or two hosts
uh I was thinking about it because I'm
not sure what structural format you guys
enjoy and uh
I mean I primarily listen to malicious
life malicious life is uh you know it's
sort of like a narrative based podcast
where he sort of goes over you know
different attacks uh hacks Etc
um but
oh you know what it'll be cool you know
it will be really really cool
imagine imagine this and I think I can
make this happen I think so imagine if
we got like Richard stallman on the
podcast and then uh we can have this
really heated interesting debate on
Linux uh or gnu Linux I should say
that'll be really really interesting you
know
um
okay so if you guys want me to show you
how to set up an ad pen Testing Lab I'm
gonna do that
wait is today Sunday already yeah it's
it's Sunday so I'll probably release it
later Sunday evening
if you guys want that
all right Rodrigo or nice nice
started off with freaking man awesome
all right but I warn you this lab setup
video is gonna be it's gonna be uh it's
gonna be long because I'll show you like
how to set up a proper lab I'm not just
talking about one domain controller and
one Windows system
like this is gonna be I'm also showing
you how to set up like vulnerabilities
that you can then test exploiting uh
I'll talk about hardening Etc all of
that stuff okay so let me take a note of
that so there's two video projects in
addition to web app pen testing and the
pivoting video uh so let me just take
note of that in my notebook here
uh
my ignou slash Linux notebook uh
all right so we have number one is
pivoting
uh second one
ad lab setup
third we're back pain testing which we
already have the videos done
and then finally the big one the finale
Linux versus Windows
I still haven't decided on that title
for that video but uh you know we'll
we'll decide that when we get there and
then of course I'm gonna have to prepare
to go into hiding after that video
releases
no no no I it's it's actually a physical
notebook for those of you who think that
I'm using a Windows
yeah it is yeah it is right over here I
think I have it here you guys should
probably see it
yeah I definitely still write on paper
there's no way I'm taking that down on a
uh on a Windows and Netbook let's just
call it a netbook
because most Windows laptops are
netbooks apart from the gaming laptops
which are pretty good
uh
although The Thermals are questionable
I I can actually share something on the
screen that's gonna get a lot of you I
in fact I don't think I'll be able to
show my face after this if I did it but
if there's one operating system people
hate more than Windows
I think you guys know the answer to that
if I was to do that
uh
I will be in real trouble let's just put
it that way
oh boy I hope I don't get uh I did this
stream was not a good idea man just I'm
not being flagged as a Windows fanboy
that's fine that's fine I mean I'll just
go and read my uh
um this internals
before I uh you know actually notice
internals rather Windows internals
version 2 is out guys version two is out
just gonna read this and fall asleep
tonight
all right hold on hold on I think there
should be version two there we are part
two is out
oh yes
uh okay I'll probably I'm I I'm probably
not gonna make it uh through if I keep
on showing uh Windows internals
uh looks like so what do you think of
sliver
uh sliver is really good really really
good uh but I like Havoc more I think
Havoc is uh much cleaner much more
functional
no way man no way Nate there's no way
that's possible
wait so are you telling me Usman are you
telling me that without Windows you
could not install Linux is that what
you're telling me
because this if that's true
yes of course I offer mentorships like I
mean I uh the typical model is like I'll
answer all your questions I'll give you
guidance and stuff like that I mean if
if I have time I usually try and jump on
a like a video call uh whenever I have
time or more is you know willing to help
anyone
uh because the Dinos
you should know that I don't use grub
man there's no way I'm using that stuff
as my bootload of choice
uh and uh more importantly I'm not one
of those Psychopaths Who themes my
bootloaders like have you seen those
guys I mean that is just Insanity man
oh but
yeah uh well I'm actually skeptical
about saving this uh this live stream
because this I don't know whether people
will be playing this uh whilst they're
they're chasing after me
uh I don't want to take a chance man
but
um as Martin Luther did
uh you know
during the
medieval times I'm just going to speak
my truth
and I'll deal with the consequences
whatever they may be
I called it out I was a that was another
hot take that almost got me jailed uh
honestly speaking when I made when I
made that video like that stopped
trivializing cyber security video like
man a lot of people got mad at me man
especially the people who thought that I
was talking about them
oh boy
no I'm not gonna cut it I'll probably
just uh I'll just probably do some post
processing if required I'll then I'll
publish it I'll just joke of course I'm
not scared of publishing what I've said
uh but you guys man damn
oh boy no no I'm not getting into any
drama man no one hit me up no one hit me
up
uh
uh I uh I would like to rescind my
statement
uh it was made under the influence of uh
of uh of Linux fanboys
of course I use Windows to post process
hahaha
uh I'll I'll tell you another one
I'll tell you another one I'll tell you
uh let me tell you how insane I am eh
I actually access all of my Linux
servers via Windows using putty
now what are you gonna do about that
what are you guys gonna do about this
I'm not using any open SSH client no way
man no way
I'm not even using the subsystem for
Linux I use just uh nice clean vanilla
version of putty you know
oh boy
oh man
oh boy
things are getting real dark now
anyway
um
oh man these jets are getting wild
you're getting real wild
oh boy oh my God it's almost using vs
code here oh God
oh God there's ultimate chat man this
type of junkie there's uh that guy's on
the he actually understand what actually
vs code is not that bad I mean
let's just be real
let's just be real man
yeah imagine getting stolen Richard
stallman in here this that'll just be
awesome
foreign
oh boy
yeah yeah
on another note
um I I don't know because I haven't like
tried it on my current setup on my
current Hardware what's the Nvidia
driver situation like for Linux because
the last time I tried a man I had to
switch to the open source driver which I
know is the recommended thing to do but
Nvidia seems to be taking this like a
joke I mean like come on man well we at
least need or deserve one good driver
what's the situation there like
uh
uh oh that's a good question so uh
download any version of Windows Server I
would say
uh wind server 2016 onwards you can
download the isos from the evaluation
setter
Microsoft evaluation center
um
Windows Server Ubuntu because we'll set
up some Linux systems as well uh
um probably some windows workstation VMS
or isos
anyway you guys can watch the video and
it'll be I'll I'll put it in parts so
that it's a single video with like
chapters uh
nice nice
now we need proof rights now
we need proof we need proof you can you
can just say stuff like you're playing
Red Dead Redemption 2 on another monitor
ultra settings man well I I'm not
doubting the fact that you could I mean
I don't know what GPU you have but uh
man you guys are some serious uh
you guys are serious man playing Red
Dead Redemption 2 on Ultra I mean I wish
I could do that man that's uh
that's crazy man
yeah I mean look with regards to Linux
gaming I was just bantering around
I mean I know that uh proton is really
like bridged that Gap and I I as I said
I the last time I played was just like a
year and a few months ago on Linux uh
the only reason why I don't play on my
laptop is because The Thermals are
horrendous uh and there's no way I'm
like you know
I'm listening to that fan uh
um let's actually check it together
because I haven't checked this in a
while in a while
let's check it out let's check it out
okay
uh look at the website's still the same
all right so
uh aha battle anyway I'm not gonna I'm
not gonna
I'm not gonna Target
Linux gaming because you know what over
the last two years it's actually come a
long way so
wow that's uh yeah Grand Theft Auto has
always been able to run I think the last
game I ran was
so that's insane man cyberpunk has a
gold rating
that is nuts
wow
yeah this I think this is the the final
hurdle is the online games with uh you
know the anti-cheat
laughs
oh man I I would get a console except
have you seen the scalpers
the scalpers and the P the prices of a
freaking PS5 or I can't I don't even
know the name of the new Xbox I mean
that this is just unacceptable man
these guys are saying the worst the
worst thing there's a reason why I
haven't upgraded my GPU yet is the GPU
prices wow
I remember back in the day like for 400
bucks you were getting like top of the
line GPU man
I mean now now that's I think that's the
price I don't even know
I don't even know what the GPU prices
are anymore
yeah Christ 1K man at this point if
you're building like a proper rig again
uh you probably need like 5K
I would say
um yeah but anyway
I think if I am going to play a game uh
just to get back into it I think which
is a good place to start uh
no man's Sky that's crazy that's called
gold man
um let's see
Elden ring that's another one on the
list
uh
but it should be working
um I don't think it's
yep yeah that's another one
hmm
let me see what the state is here
I I always had a problem with Sandstorm
because I played a lot of sandstorm
uh but it looks like it's working
all right yeah you know what I'm
definitely going ahead with the
experiment
um
really the steam deck wasn't the steam
deck like released this year
oh boy it's actually written here that
wait was I wrong
wasn't there the
uh the the earlier version of proton DB
wasn't that tailored towards uh you know
just standard Linux I I think this is
obviously after the release of the steam
deck which again is another uh freaking
system that's so difficult to get
uh at least where I live
um I can't speak for everyone
I think at this point
um
at this point anyone buying like a 4090
uh
I really want to know what you do for a
living because
you know
firstly you need uh
I think the highest rated BSU power
supply for that and secondly The
Thermals I've heard are
pretty crazy pretty crazy thermals there
no no no kidney is not enough anymore at
this point
you would pretty much like have to sell
your current rig
and then you would be able to buy the
GPU
and then you'd figure out how to buy the
uh you know other PC parts and then sort
of restart the process again
yeah man yeah so
although that 40 90 should be helpful
you know
should be helpful when you're feeling a
bit chilly uh
maybe you want to heat up some food uh
you don't need to turn to your oven just
uh
just put it just just get the food in
there man
one thing's for certain given the amount
of time that's lapsed
there is no way GPU prices will go back
to what they were there is no way like
this has been so long like if it was
just a temporary blip and again let's
just disregard the scalpers and the
crypto Miners and all of those uh insane
people
um
I don't think the prices will ever
reduce so at this point it's just a
matter of buying the best uh the best
you know the card that'll give you your
best bang the best bang for your buck
and then upgrading maybe like three or
five every three or five years
no you see like like the new graphics
cards like the 40 90 are like uh they're
not even sold as graphics card and you
know as gpus anymore I mean they're
they're pretty much
um you know
they can pretty much replace your
radiator uh if if if the one that you
have is is busted up
um
yeah just um you know the first graphics
cards that can do more than just compute
you know uh
pretty awesome if you ask me I mean I
the only time I saw the I like these
thermals are really bad you know like
honestly like the worst I ever got was
maybe
when I had the 980
uh but that's because I really really
use that card and I did not change the
thermal paste and thermal pads uh for a
very long time
well I I don't think it can run crisis
yet uh that's something that
I don't think humans will ever you know
will ever be able to do on Ultra 4K uh
it's just not within our reach
oh my
yeah that is
uh that's uh
that's I don't think that's that's going
to work no no
yeah I mean like like Doom is the exact
opposite like uh
you're gonna even run doom on your
fridge at this point you know talk about
compatibility that's like the
that is just the next level man
the fact that I'm still able to play the
original dos version of of Doom is is
insanity
like uh
oh boy oh boy
oh man by the way like uh I haven't
played any of the the the modern Doom
games like uh I think the latest were or
the most recent version was Doom eternal
what's that like
um because I you know I really like Doom
I think I played it once with a friend
oh yes all right
I think uh that's one of the games that
will be featured in the test so do keep
an eye out for that
all right man
uh I don't know how long this stream has
been going on for uh
but at some point I think I would need
to get on to making those videos for you
guys and also begin work on the
um on the Linux video uh
so you know just gonna prep for that
anyway any other questions guys I really
appreciate you guys sticking uh with me
on the stream I'll probably I'll publish
it like probably like 10 20 minutes
after it's done
just so that the quality process the
video is processed
yeah man I really appreciate it guys uh
if you want me to do more of these uh
live streams you know I'm happy to do so
today's session was more focused on
rents apologies for that uh
but you know I needed to address some of
these pressing issues uh but uh you know
we're able to touch on the mighty attack
framework hopefully the next streams
will be much more cohesive and on topic
uh but yeah
um I really appreciate you guys man I'll
be you know looking to to to to start
uploading now I just wanted to start off
with this live stream to set the pace
for the stuff that we'll be doing
uh but I really appreciate you guys
sticking with me uh you know over the
course of the downtime the lack of
uploads but uh all I can say is you know
we have like really really good stuff
planned out
and it's all thanks to you
um
and yeah not really focused on
subscribers anymore and on views just
want to make good content and hopefully
you know also I also want to build uh
you know good relationship with you guys
because uh you know I think the audience
participation is really really important
so
much appreciated ladies and gentlemen
and uh I think I'll be ending anytime
now so
there's any more
questions
I am oh someone's asking for opinion on
the Intel GPU
thank you smun thank you Fabio
deck fan constantinos much appreciated
uh my thoughts on the Intel GPU I saw
that uh I can't really give any of my
any of my opinions I saw some reviews of
it I think it's a good thing because it
sort of caters towards the low to mid
end
uh you know for I would say a good price
so I think they just it's something that
Intel can drop if it's you know if they
want it to work competition is always a
good thing especially with guys like
Nvidia uh you know walking around
because you know
and Nvidia is just over the last four or
five years have just been you know
making really really bad decisions
whether it would be you know
uh messing up their partnership with
EVGA uh
you know creating cards
um that uh operate at 150 degrees
Celsius on idle
you know just just absolutely your
horrific decisions
yeah I appreciate that cyber Clement
thank you memes I believe yeah so
um I'm pretty active on Twitter and and
Discord you can find all the links in
the Stream description
um
I'm not really a meme guy I don't post a
lot of memes uh because
as I said at this point I'm pretty much
a wanted man
um
and uh you know
I don't want any people after me at this
point you know so
well now I'm just gonna lie low
until all this Linux heat dies off which
I don't think it will but uh
I'm looking for my day in court and I
think my day in court will be Saturday
or Sunday next week or this week rather
so
yeah I'll be covering cyber ranges this
week because I want to do a dedicated
video right now
like on this stream I've been
particularly particularly going on
various tangents which is regrettable
because that was not the the goal trust
me like when I was planning or putting
those slides together the last thing on
my mind was start about start a rant
about Linux start
it's just oh man I love technology I
love Linux uh yeah you know just
bantering around and you know at the end
of the day
if Linux wins I think Computing will
will win in general
I use Windows as a last resort
uh to get the job done it's not a
particularly
you know decent operating system the
memory leaks are horrific but anyway
most of you have said that I am a
secretly uh a supporter
and a shill
of the larger Microsoft conspiracy and
uh you know that that may be true I
don't know
although I think you know being part of
a conspiracy sort of entitles you to
some sort of compensation which I
haven't received you know quite the
contrary
because I've bought Windows licenses so
uh thank you
hack
I can't pronounce that name
oh yeah
no I don't accept checks so I was
expecting more of a direct transfer you
know like a wire because it's uh oh boy
did I share too much they promised me
something but they haven't delivered
promised me exclusive access to uh
Windows 12 beta builds for my pleasure
you know I'm really excited about that
Windows 12 and 13 beta bills really
really excited for that I mean that's
just in you know next level stuff there
they're also looking to revamp Windows
Vista a Windows Vista version 2
um coming coming soon
oh that's crazy man uh
I'm going to have editorial decisions
over windows 12.
just
almost
that's gonna be awesome we're looking to
do like crazy stuff we're looking to
bring widgets back we're going to bring
the performance widget back uh we're
looking to bring the the calendar as
well as the uh the assistant uh we're
looking to bring that paper clip
assistant back uh we're all going to put
it on on your desktop for ease of access
uh we're also going to put a magnifier
there in case you need it because you
know who knows when you can't read text
on the screen God forbid you forgive you
forget that you have a scroll wheel
um
yeah so there's a lot of design stuff
that we're doing uh we're also thinking
of making a few changes to the taskbar
you know we will share updates on that
uh once we're there
uh yeah we also yeah there's lots of
stuff lots of stuff
we're also looking to bring back Windows
7 games uh the standard games that came
pre-packaged on Windows 7 Windows XP
like pinball uh whatever that's the
space pinball game uh the Plants vs
Zombies all of that you know all of that
good stuff essentially gonna give you a
ready-made operating system with
everything that you need probably five
you know four to five browsers of uh you
know you can choose to uh you can pick
whatever you want to use uh although
you'll not be on uh you'll not be able
to uninstall software
uh because you'll be working or
operating in a very uh a very new type
of uh user space that we've come up with
with very limited permissions obviously
uh they don't allow you to pretty much
do anything outside of your home
directory
um
and of course there's no way you'll be
able to see uh your system drive so yeah
really really exciting things uh coming
up
um very very excited hopefully you guys
are excited
ah thanks for on really appreciate that
well obviously constantinos obviously I
mean that's what we do at Microsoft we
pretty much look at what Mac does and uh
you know we're not complete idiots we
also have some taste you know so we pick
what we like and generally speaking our
objective at here at the Microsoft
Windows 12 and 13 are beta division
uh has primarily to to make sure that um
we control the user's experience as much
as possible uh we're also coming up with
an idea of like having pop-up ads uh
show up in Explorer
um you know
while we don't want to go down the road
of having non-skippable video ads I
think a few pop-up ads every hour would
be a really good thing you know to
expose our custom our customer base to
new products
um and uh you know we are committed to
ensuring that they're able to get like
uh you know
some of the best products out there I
mean you know we pretty much let anyone
advertise but uh yeah it's uh good stuff
good stuff coming up
hopefully you guys are excited as we are
I mean you can tell from my face that uh
this is just the next level Next Level
stuff here
how can you start in cyber security let
me answer that question for you so on my
channel
and I'm not Shilling myself here if I
was I'll be showing you my uh my hidden
uh Microsoft uh let me just show you
uh this is really lame here uh but but
but but if you go to my channel
uh and you head over to
I believe I made it uh the cyber
security career guide uh roadmap Etc
whatever I call the video uh where is it
oh my God I can't even find my own video
here
this is the one cyber security career
roadmap I answer your question in detail
in that video there
so
it pretty much gives you the roadmap
depending on what avenue you want to
take with a red team blue team stuff
like that
uh yeah not that I'm Shilling myself I
mean I wouldn't do that
although I'm trying to I'm really trying
my best uh to like get my my profile
picture set as the default uh
account profile picture for Windows 13.
that's something that I'm really
pressing for it's not possible in
Windows 12. um
but uh yeah yeah
anyway
uh
yes yes of course I mean
we're
we love risk we love risk here at
Windows you know
so
so it's something we're very we're very
in no you know we're really focused on
innovation
um so
if there is an issue we can always push
out the Windows update that will most
likely interfere with your day and uh
you know force you to restart at an
inappropriate time hopefully when you're
giving a presentation or uh doing a live
stream like I am so yeah uh you know we
can always push out an update to get rid
of that if required whenever we want of
course it's our operating system we
should essentially control uh when it's
updated regardless of whether you bought
a license so yeah
foreign
updates that was I mean wow
that Service Pack system was uh really
interesting
ah no no we we don't have that high uh
you know we don't have standards that
high there's no way we are going to make
Windows posix compliant there's no way
man
you know we're more interested in
transparency effects
rounded edges
and widgets you know yeah so
good stuff good stuff
in YouTube someone's asking YouTube
there are more strict rules for hacksec
comparing to other channels
uh yes yes I told you you guys remember
this like uh like one year ago they like
they were going hard on cyber security
content creators like wow man
uh but it is now although we have to
abide by a new set of guidelines
um
with regards to you know uh
always making sure that you speak good
about Windows which is one of them so I
have to abide by that so you know again
apologies guys
uh there's no way you can get a strike
here I mean you know I have to abide by
the guidelines but in all seriousness uh
there's a few things that we can't show
like fishing uh we can't show any
fishing attacks
uh we can show the exploitation of
mobile networks
primarily because they assume that you
can set up your own mobile network
regardless of whether it's simulated in
any way so
there's a lot of stuff we can do
um
yeah it's a Windows 13 man
let me tell you that's a game changer
man
that one minimum minimum RAM
requirements 16 gig
16 gig idling actually 18 gig uh if
you're x64 processor
um yeah good stuff man
good stuff
no man if you look at it if you look at
it from the correct perspective
this is Windows from heaven
I mean that you know this is just on
imagine letting us update your operating
system for you
I mean that is just
and wouldn't you want us to to tailor
your ad experience
like we will not interfere with ads we
would give you like a focus mode where
you could like disable ads for like five
minutes and then they would reactivate
but uh
yeah I mean I I I would say that this is
like this is this is very very uh
um you know
this is this is where the direction we
should be moving in
oh
okay you know what I I I think at this
point there's the sarcasm is reaching
its limits with regards to Windows
although I I never thought that was
possible
um
but yeah there's lots of goods uh lots
of good stuff in the work so all I can
tell you is
uh the best thing you can do is keep
your expectations as high as possible as
high as humanly possible and by the way
we're not going to fix any memory leaks
and uh
with regards to you know running tasks
we're gonna pretty much Start every
program every Microsoft program on
Startup and they cannot be terminated at
all
um
so yeah yeah yeah
that is correct that is correct you know
because
um
we believe that we we are in in an era
of shopping and uh ideally you know
Microsoft would like to have the
opportunity to sell you stuff you know
and uh we are of course not financially
motivated
uh you know we love supporting the the
corporate
um industrial Community uh you know
whenever they need to advertise uh
anything really uh whether it may be a
new drug
um you know a new form of treatment
vaccines uh
you know anything really we we just like
to advertise it um you know new Windows
Surface books uh the new versions uh
absolutely awesome fantastic you guys
should pick them up man
really good stuff good stuff
good stuff
oh yeah and another thing if you do buy
a some of our new service books
releasing with Windows 13
um
uh we have made the very difficult
decision
to but we think it's it's going to be
useful in the in the wrong in the long
run to disable or to password protect uh
the BIOS and of course there's no way we
could possibly tell you the the password
to your device so
we think it's in the best interest of
everyone if if you don't know what's in
there anymore uh it's it's just the best
thing ever so
don't worry about that just turn on your
computer and you know head over to
whatever sites you visit don't worry
about the thing
it's all going to be okay once in a
while click on the ads buy something you
know
completely surrender yourself
if you want a good laptop for cyber
security get a ThinkPad
um
though I still have my T4 my d440
and also a t420 I mean I can't like that
the hardware that the keyboard on those
is really awesome but uh the reason why
I'm saying get one is because you can
upgrade the RAM put in an SSD
uh you know if you're doing VMS and
stuff
yeah XPS is good Dell XPS are good as
well
that's true
or you can always get a you know a
surface pad whatever they call them uh
whatever the the devices we sell are
called um
I mean it's just uh you know they have a
touch screen pretty cool man you can
touch uh your folders you can open
folders with two clicks how about that
Surface Book is that what is called
surface pad Surface Book
uh yeah yeah it is Feb the February the
30th that is correct
um
if there any delays will definitely let
you know
um you know the date is subject to
change
um based on our
our knowledge of uh you know
I can't anymore man
oh come on man I'm working on Windows 13
there's so many things we do we do
office uh
uh you know you know we do we do we make
Microsoft Office we develop office uh
we're doing you know we've worked
seriously hard on our on our edge
browser I mean that's in in our opinion
is one of the best I mean sure we took
like a lot of the source code from
chromium but
but come on man I mean haven't we made
it better haven't you haven't you seen
the inbuilt PDF editing Edge
it's just absolutely phenomenal man
oh yeah that's just among one product we
also make the Xbox which you guys seem
to love uh we make flight simulator
another great product
uh you know
we're doing big things man doing big big
big
we also own Skype how about that
foreign
okay guys I need to go now man
I need to head out though
uh apologies
of course it exists of course Skype
exists
we know we all know you use it we all
know it's it's like your guilty pleasure
you know it's uh it's uh
don't forget don't forget
that we made wordpad
you know the predecessor to notepad plus
plus
you know
oh boy
yeah yeah
okay anyway
much appreciated guys uh you know
um I really really appreciate you guys
bringing me on the stream this is this
is insane I didn't think it would be
here for four hours but here we are
uh you know really excited for the new
content I I probably dropped the the
videos you guys have requested starting
tonight so Sunday night that is
and uh yeah cool stuff
if you want to attend some of my live
training uh I'll be doing uh
a boot camp on uh introduction to C2
Frameworks this week uh that's again
entirely up to you uh it'll be through
cyber ranges and the labs so we'll be
taking a look at
most of the C2 Frameworks
um popular ones
yeah so lots of content lots of red team
blue team purple steam stuff
yeah I apologize guys but I didn't
answer your question let me just end the
stream here and then I'll uh I'll turn
it
um I'll just make a few edits in the
beginning and the end
make sure the audio is all good and uh
and then I'll I'll make it public again
which is
it's actually been kind of fun I really
like this I think I'll be doing this
more
cheers guys
good night man
yeah I appreciate that
appreciate that
um
it's time it's time to install Arch
it's uh the links are in the description
section so
yeah if you want to guys if you guys
want to reach me like privately uh
Twitter is probably the best place or
Discord the links to all of them are in
the description section
um
because right now I mean
I'm uh I'm finishing children I was just
finishing writing some
some code for the new performance widget
uh anyway
hopefully you know
really really good
all right guys thanks a lot for tuning
in I'm going to end today's stream here
I had a really great time
and uh yeah
look really looking forward to the next
few weeks the remainder of the Year lots
of videos
coming out
so I'm gonna end the stream in five four
three
two one