Roberto Rodriguez

Oct 5, 2020

Azure Sentinel To-Go 🛒 — Part 2: Integrating a Basic Windows Lab 🧪 via ARM Templates 🚀

Most of the time when we think about the basics of a detection research lab, it is an environment with Windows endpoints, audit policies configured, a log shipper, a server to centralize security event logs and an interface to query, filter and visualize the data collected. Recently, I started working…

Azure

15 min read

Azure

15 min read

Published in

Open Threat Research

·Sep 9, 2020

It is Biceps 💪 Day! Flexing an ARM Template to deploy Azure Sentinel 🏹

Ever since I joined the Microsoft Threat Intelligence Center (MSTIC) R&D team, I have been learning about Azure Resource Manager (ARM) templates to deploy several detection research environments as code. It has been a great journey learning about the syntax and format, and even when some might not like writing…

Azure

9 min read

Azure

9 min read

Published in

Open Threat Research

·Jul 27, 2020

Mordor PCAPs 📡 — Part 1: Capturing Network Packets from Windows Endpoints with Network Shell (Netsh) ⚔️ and Azure Network Watcher 🌩

On April 21st, 2020, the ATT&CK evals team released the results of their APT29 evaluation , the emulation plan, all payloads used for Day 1 and Day 2 , and a Do-It-Yourself Caldera plugin. …

Azure

10 min read

Mordor PCAPs 📡 — Part 1: Capturing Network Packets from Windows Endpoints with Network Shell…

Azure

10 min read

Published in

Open Threat Research

·Jul 21, 2020

Extending the Exploration and Analysis of Windows RPC Methods Calling other Functions with Ghidra 🐉, Jupyter Notebooks 📓 and Graphframes 🔗!

A few weeks ago, I was going over some of the research topics in my to-do list, and the one that sounded interesting to work on during 4th of July weekend 😆 was the documentation and exploration of relationships between RPC procedures/methods and other external functions such as Win32 APIs…

Ghidra

17 min read

Ghidra

17 min read

Published in

Open Threat Research

·Jun 12, 2020

Community Evaluating Free Telemetry 💸 🌎 Following the ATT&CK Evals Methodology ⚔️

In late 2019, the ATT&CK Evaluations team evaluated 21 endpoint security vendors to provide insight and transparency over their true capabilities to detect adversary behavior mapped to ATT&CK. …

Cybersecurity

14 min read

Community Evaluating Free Telemetry 💸 🌎 Following the ATT&CK Evals Methodology ⚔️

Cybersecurity

14 min read

Published in

Open Threat Research

·May 3, 2020

Mordor Labs 😈 — Part 3: Executing ATT&CK APT29 Evaluations Emulation Plan 📕 -Day2

Building the environment for scenario two is very easy and takes around 30–45 mins. Once the environment is set up, you will still have to set up your computer to authenticate via certificates with point-to-site VPN. This post is part of a three-part series where I share my experience deploying…

Cybersecurity

9 min read

Mordor Labs 😈 — Part 3: Executing ATT&CK APT29 Evaluations Emulation Plan 📕 -Day2

Cybersecurity

9 min read

Published in

Open Threat Research

·May 3, 2020

Mordor Labs 😈 — Part 2: Executing ATT&CK APT29 Evaluations Emulation Plan 📕 -Day1

Building the environment for scenario one is very easy and takes around 30–45 mins. Once the environment is set up, you will still have to set up your computer to authenticate via certificates with point-to-site VPN. This post is part of a three-part series where I share my experience deploying…

Cybersecurity

7 min read

Mordor Labs 😈 — Part 2: Executing ATT&CK APT29 Evals Emulation Plan 📕 -Day1

Cybersecurity

7 min read

Published in

Open Threat Research

·May 2, 2020

Mordor Labs 😈 — Part 1: Deploying ATT&CK APT29 Evals Environments via ARM Templates 🚀 to Create Detection Research Opportunities 🌎!

In late 2019, the ATT&CK Evaluations team evaluated 21 endpoint security vendors using an evaluation methodology based on APT29. On April 21st, 2020, they released the results of that evaluation, the emulation plan, all payloads used for Day 1 and Day 2 , and a Do-It-Yourself Caldera plugin. One of…

Cybersecurity

15 min read

Mordor Labs 😈 — Part 1: Deploying ATT&CK APT29 Evals Environments via ARM Templates 🚀 to Create…

Cybersecurity

15 min read

Published in

Open Threat Research

·Mar 27, 2020

Azure Sentinel To-Go! 🛒 — Part 1: A Lab with Prerecorded Data 😈 and a Custom Logs Pipeline via Azure Resource Manager Templates 🚀

Recently, I started working with Azure Sentinel, and as any other technology that I want to learn more about, I decided to explore a few ways to deploy it. I got a grasp of the basic architecture and got more familiarized with it. As a researcher, I also like to…

Azure

18 min read

Azure

18 min read

Published in

Open Threat Research

·Jan 11, 2020

Jupyter Notebooks 📓 from SIGMA Rules 🛡⚔️ to Query Elasticsearch 🏹

Happy new year everyone 🎊! I’m taking a few days off before getting back to work and you know what that means 😆 Besides working out a little bit more and playing with the dogs, I have some free time to take care of a few things in my to-do…

Python

12 min read

Jupyter Notebooks 📓 from SIGMA Rules 🛡⚔️ to Query Elasticsearch 🏹

Python

12 min read