SCYTHE: Starting 2019 with Linux and ATT&CK™

By Anonymous -


SCYTHE: Starting 2019 with Linux and ATT&CK™

The SCYTHE team has been hard at work on our new release and we are proud to present the next major evolution of the SCYTHE Continuous Red Team Automation platform.
What’s New
  • More auto-generated implants
  • Linux support
  • One-Click MITRE ATT&CK Report
  • New Threats in the Threat Catalog
  • New Logging Output Option
Linux Implant Builder
The campaign creation menu now allows you to select an operating system for Linux campaign creation. You will have the SCYTHE automation and ease of use you have come to expect, but the platform will now produce Linux executable to deploy as your own custom malware/agent.
MITRE ATT&CK Report
Continuously monitor how well the organization’s risk posture is fortified across the MITRE ATT&CK matrix. In addition to our existing MITRE ATT&CK functionality, SCYTHE now supports a one-click report, showing you which ATT&CK Techniques were utilized in your campaign and summary of the results. This report can be generated at any time, in any campaign, and is another iteration in our integration with MITRE ATT&CK.
New Update to Threat Catalog and More Robust Logging & 3rd-Party Reporting Integration
Stronger 3rd-party reporting integrations enabled by new additional options for logging output. In this release we also included new options for logging output, to support an even greater number of third party reporting integrations, and as usual, we have included some new Threats in the Threat Catalog for you to add to your growing arsonal of vendor and use case specific custom built modules.
We’ve added in APT3 to the Threat Catalog. APT3 is a China-based threat group that researchers have attributed to China’s Ministry of State Security. [1] [2] This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap.[1] [3] It is blamed for using a Remote Access Trojan named Pirpi in attacks against the US and UK. The Trojan is usually delivered through malicious attachments or links in spear-phishing e-mails and the group has a history of innovating new browser-based zero-day exploits. FireEye claims that it is one of the most sophisticated threat groups tracked by their Threat Intelligence arm.
Your Feedback Matters
Your feedback drives the evolution of SCYTHE to be the solution you need.  We cannot overstate how important your feedback is to us and we would love to hear what features and functionality you would want for your Red Team Automation platform. Please drop us a line and don’t hesitate to request a free trial of the newest version release of SCYTHE!

Popular posts from this blog

New Old Bugs in the Linux Kernel

By Anonymous -
Image
  Introduction Dusting off a few new (old) vulns Have you ever been casually perusing the source code of the Linux kernel and thought to yourself "Wait a minute, that can’t be right"? That’s the position we found ourselves in when we found three bugs in a forgotten corner of the mainline Linux kernel that turned out to be about 15 years old. Unlike most things that we find gathering dust, these bugs turned out to still be good, and one turned out to be useable as a Local Privilege Escalation (LPE) in multiple Linux environments. Who you calling SCSI? The particular subsystem in question is the SCSI (Small Computer System Interface) data transport, which is a standard for transferring data made for connecting computers with peripheral devices, originally via a physical cable, like hard drives. SCSI is a venerable standard originally published in 1986 and was the go-to for server setups, and iSCSI is basically SCSI over TCP. SCSI is still in use today, especially...
Read more

Automated Struct Identification with Ghidra

By Anonymous -
Image
At GRIMM, we do a lot of vulnerability and binary analysis research. As such, we often seek to automate some of the analysis steps and ease the burden on the individual researcher. One task which can be very mundane and time consuming for certain types of programs (C++, firmware, etc), is identifying structures' fields and applying the structure types to the corresponding functions within the decompiler. Thus, this summer we gave one of our interns,  Alex Lin , the task of developing a Ghidra plugin to automatically identify a binary's structs and mark up the decompilation accordingly. Alex's writeup below describes the results of the project, GEARSHIFT, which automates struct identification of function parameters by symbolically interpreting Ghidra's P-Code to determine how each parameter is accessed. The Ghidra plugin described in this blog can be found in our GEARSHIFT repository . Background Ghidra is a binary reverse engineering tool developed by the National Sec...
Read more

SOHO Device Exploitation

By Anonymous -
Image
Netgear R7000 SOHO Device Exploitation After a long day of hard research, it’s fun to relax, kick back, and do something easy. While modern software development processes have vastly improved the quality of commercial software as compared to 10-15 years ago, consumer network devices have largely been left behind. Thus, when it’s time for some quick fun and a nice confidence boost, I like to analyze Small Office/Home Office (SOHO) devices. This blog describes one such session of auditing the Netgear R7000 router , analyzing the resulting vulnerability, and the exploit development process that followed. The write-up and code for the vulnerability described in this blog post can be found in our NotQuite0DayFriday repository. Initial Analysis The first step when analyzing a SOHO device is to obtain the firmware. Thankfully, Netgear’s support website hosts all of the firmwares for the R7000. The Netgear R7000 version 1.0.9.88 firmware used in this blog post can be downloaded from this web...
Read more