Michael Haag – Medium

Jul 22

Top 5 reasons Atomic Red Team is for the 99% + 1%

I recently listened to a Red Canary sponsored Risky Business podcast. The topic was around Atomic Red Team. A term kept being tossed around that attacker emulation is for the security 1%. Now, maybe I am reading into it too much, but since July 6th I can’t stop thinking about…

Atomic Red Team

6 min read

Jan 20

Finding .Net Assemblies

With all the buzz around #WhisperGate, something stood out to me not covered in a few articles. Elastic called out the move and process hollowing into InstallUtil.exe. For us, we have content written around InstallUtil.exe and there are many Atomics we’ve tested and modified, but the moving and process hollowing…

Whispergate

3 min read

Jul 20, 2021

Suricata…. for Windows

I spent a short while googling around to find a way to install Suricata on Windows and it would actually work. Turns out, it’s not that simple to install and there was no easy button. Eventually, I got something to work, albeit not pretty, but it is reproducible! In my…

Suricata

2 min read

Jan 4, 2021

Malleable C2 Profiles and You

Like most defenders out there today we keep hearing and seeing CobaltStrike used by actors. I wanted to share some notes on some back of the napkin research I’ve been doing related to it in hopes that it sparks interest in others to begin investigating more. It wasn’t until about…

Cobalt Strike

5 min read

Mar 14, 2020

Splunk BOTS — Setup

A while back, I tweeted how to setup BOTS on DigitalOcean, but I never blogged it for easier access. Let’s get started. For $10 (or $5) on DigitalOcean, you can setup a simple Ubuntu instance with Splunk and BOTS (Boss of the SOC) v2 dataset OR BOTSv3 dataset. Head over…

Splunk

3 min read

Oct 9, 2018

Hunting Methodology — Splunk BOTS (Boss of the SOC) — Part 1

I’ve been having a lot of conversation with @subtee about hunting and blue team that I decided it would be beneficial to showcase how I hunt through all sorts of data in a scenario where I was just “dropped in”. …

Sysmon

5 min read

Hunting Methodology — Splunk BOTS (Boss of the SOC) — Part 1

Apr 10, 2017

Sysmon Splunk App

We have come a short ways since the initial revolution of Sysmon posts related to hunting and App creation in different log management platforms. In that short span, many ELK and Graylog apps have cropped up. Today, to help those in need on the Splunk side, @jarrettp and I have…

Sysmon

2 min read

Feb 9, 2017

Hunting with Sysmon

Previously I mentioned I would release my simple generic Splunk App to help anyone almost instantly operationalize Sysmon data. So, here it is! It is nothing completely fancy or of superior wizardry caliber, but it will get you everything you ever wanted to begin monitoring for evil in your environment…

Sysmon

4 min read

Feb 6, 2017

Splunking the Endpoint: Threat Hunting with Sysmon

As usual, there has been a lot of chatter about threat hunting, but never enough tactical guides or threat hunting methods from individuals. I recently gave a talk at BSidesSD titled “Detecting and Preventing the Adversary”. A majority of the talk was focused on hunting and the methodology I implement…

Microsoft

5 min read

Splunking the Endpoint: Threat Hunting with Sysmon