SCYTHE Goes Atomic

By Anonymous -


SCYTHE Goes Atomic
The SCYTHE team is excited to announce that our latest release gives you the power of Atomic Red Team with all the automation and ease of use of the SCYTHE platform. Plus, you can now create and share your own SCYTHE threats allowing the ecosystem of adversary simulation to expand via the community!
What’s new in version 2.4?
  • Signature avoidance: imphash, program database, and timestamp randomization
  • Import and export User-defined threats
  • Improved support for multiple clients on the same device simultaneously
  • Integration of Red Canary’s Atomic Red Team Exercises for automation
  • Updated MITRE ATT&CK Summary
Signature Avoidance
The “synthetic malware” binaries SCYTHE creates now have even more defense evasion. With the option to set or randomize your Program database (PDB) paths and timestamps you control the artifacts for your Blue Team to find (or not). Additionally, our team has added in an amazing technique for randomizing Import Hashes. (Stay tuned for more on how this was done!)
Threat Import and Export
We’ve made it even easier for SCYTHE users to create, share, and import threats from the community, as well as create threats using automation! Whether building your own internal threat library or looking to add to the public threat ecosystem your Threat Catalog can be expanded quickly and easily.
More ATT&CK™ More Quickly
Thanks to the amazing work being done by Red Canary and all the people who contribute to the Atomic Red Team project, SCYTHE now gives you access to over one-third of the MITRE ATT&CK Matrix in a few clicks. We’ve added the entire Atomic Red Team framework to SCYTHE’s Automation framework so adding techniques is trivial with no custom scripting required! We’ve also completely overhauled our MITRE ATT&CK Report for even easier feedback on which techniques were executed in a campaign.
Now is the Time to Test Drive SCYTHE!
Whether you are trying to validate your defenses, test a new endpoint protection product, or streamline your Red Team’s workflow now is the perfect time to give SCYTHE a try! Request a free trial today!

Popular posts from this blog

New Old Bugs in the Linux Kernel

By Anonymous -
Image
  Introduction Dusting off a few new (old) vulns Have you ever been casually perusing the source code of the Linux kernel and thought to yourself "Wait a minute, that can’t be right"? That’s the position we found ourselves in when we found three bugs in a forgotten corner of the mainline Linux kernel that turned out to be about 15 years old. Unlike most things that we find gathering dust, these bugs turned out to still be good, and one turned out to be useable as a Local Privilege Escalation (LPE) in multiple Linux environments. Who you calling SCSI? The particular subsystem in question is the SCSI (Small Computer System Interface) data transport, which is a standard for transferring data made for connecting computers with peripheral devices, originally via a physical cable, like hard drives. SCSI is a venerable standard originally published in 1986 and was the go-to for server setups, and iSCSI is basically SCSI over TCP. SCSI is still in use today, especially...
Read more

Automated Struct Identification with Ghidra

By Anonymous -
Image
At GRIMM, we do a lot of vulnerability and binary analysis research. As such, we often seek to automate some of the analysis steps and ease the burden on the individual researcher. One task which can be very mundane and time consuming for certain types of programs (C++, firmware, etc), is identifying structures' fields and applying the structure types to the corresponding functions within the decompiler. Thus, this summer we gave one of our interns,  Alex Lin , the task of developing a Ghidra plugin to automatically identify a binary's structs and mark up the decompilation accordingly. Alex's writeup below describes the results of the project, GEARSHIFT, which automates struct identification of function parameters by symbolically interpreting Ghidra's P-Code to determine how each parameter is accessed. The Ghidra plugin described in this blog can be found in our GEARSHIFT repository . Background Ghidra is a binary reverse engineering tool developed by the National Sec...
Read more

SOHO Device Exploitation

By Anonymous -
Image
Netgear R7000 SOHO Device Exploitation After a long day of hard research, it’s fun to relax, kick back, and do something easy. While modern software development processes have vastly improved the quality of commercial software as compared to 10-15 years ago, consumer network devices have largely been left behind. Thus, when it’s time for some quick fun and a nice confidence boost, I like to analyze Small Office/Home Office (SOHO) devices. This blog describes one such session of auditing the Netgear R7000 router , analyzing the resulting vulnerability, and the exploit development process that followed. The write-up and code for the vulnerability described in this blog post can be found in our NotQuite0DayFriday repository. Initial Analysis The first step when analyzing a SOHO device is to obtain the firmware. Thankfully, Netgear’s support website hosts all of the firmwares for the R7000. The Netgear R7000 version 1.0.9.88 firmware used in this blog post can be downloaded from this web...
Read more