- 75
- 69 757
Prelude
United States
Приєднався 6 жов 2020
Prelude is a technology company that hardens cybersecurity defenses. Organizations of all sizes can use our tools to run continuous security tests against their systems to discover areas of weakness to fix. We do that in a way that's safe, transparent, and integrated with existing defensive tools to allow organizations to get ahead of real incidents before they happen.
Our mission is to increase the reach, frequency and usage of advanced security for all organizations.
Learn more at www.preludesecurity.com
Our mission is to increase the reach, frequency and usage of advanced security for all organizations.
Learn more at www.preludesecurity.com
Intro to Verified Security Tests: Authoring Tests That Scale
In order for continuous testing to scale to tens or hundreds of thousands of endpoints, we had to tear down the concept of traditional TTPs and start fresh with the Verified Security Test (VST) format - the lifeblood of Prelude Detect.
In this session, the battle-tested TTP/VST author and Prelude's Co-Founder and CTO, David Hunt, provides an introduction to VSTs. David will breakdown the requirements of VSTs and provide a tutorial on how to author your own VSTs for continuously testing endpoint deployments of any size.
Create your free Prelude account: platform.preludesecurity.com/detect
🔗 Related Links 🔗
Prelude Detect Docs: docs.preludesecurity.com/docs/the-basics
Prelude CLI Docs: docs.preludesecurity.com/docs/prelude-cli
Prelude Visual Studio Integration Docs: docs.preludesecurity.com/docs/visual-studio-integration
Prelude Tests GitHub: github.com/preludeorg/test
Prelude Libraries GitHub: github.com/preludeorg/libraries
In this session, the battle-tested TTP/VST author and Prelude's Co-Founder and CTO, David Hunt, provides an introduction to VSTs. David will breakdown the requirements of VSTs and provide a tutorial on how to author your own VSTs for continuously testing endpoint deployments of any size.
Create your free Prelude account: platform.preludesecurity.com/detect
🔗 Related Links 🔗
Prelude Detect Docs: docs.preludesecurity.com/docs/the-basics
Prelude CLI Docs: docs.preludesecurity.com/docs/prelude-cli
Prelude Visual Studio Integration Docs: docs.preludesecurity.com/docs/visual-studio-integration
Prelude Tests GitHub: github.com/preludeorg/test
Prelude Libraries GitHub: github.com/preludeorg/libraries
Переглядів: 436
Відео
Global Affairs? In my Threat Model?
Переглядів 195Рік тому
Alex Rudolph shares how to analyze an APT's force structures and doctrine to understand cyber conflict and incorporate into threat models. Link to join the Prelude Discord: discord.gg/fZbfdUQM4A
Designing and Building a Mechanical Keyboard
Переглядів 281Рік тому
Cyboard's Erik Trinkle presents lessons learned on designing and manufacturing custom mechanical keyboards. Link to join the Prelude Discord: discord.gg/fZbfdUQM4A
Protocol Reverse Engineering
Переглядів 3,9 тис.Рік тому
In this session, netspooky presents an introduction to protocol reverse engineering, with lots of history, resources, tips and tricks, and more. 00:00 Intro 02:00 Protocol RE Fundamentals 10:35 Preparing to Reverse Engineer 15:37 Packet Analysis 41:05 Software RE 56:08 Hardware RE 01:02:54 Specifications 01:16:52 Documenting Your Findings 01:20:50 Healthy Research Mindset
Avoiding Insidious Points of Compromise in Infrastructure Access Systems
Переглядів 260Рік тому
BastionZero's CEO, Dr. Sharon Goldberg, explores case studies of devastating pitfalls of infrastructure access systems and how to avoid them.
Offensive Wasm
Переглядів 2 тис.Рік тому
Joe DeMesy presents research on applications of Web Assembly (WASM) in Sliver, an open-source cross-platform adversary emulation framework.
Intro to Syscalls for Windows Malware
Переглядів 17 тис.Рік тому
This session features eversinc33 giving an intro to syscalls implementations for Windows malware. This is a recording from the Prelude Discord Live Stream Series. Click here to join the Prelude Discord: discord.gg/fZbfdUQM4A
My Open Source Journey with osquery and Fleet
Переглядів 690Рік тому
This session features Zach Wasserman, CTO of Fleet and Co-creator of osquery, talking about his experience building a career in open-source software. This is a recording from the Prelude Discord Live Stream Series. Click here to join the Prelude Discord: discord.gg/fZbfdUQM4A
Malware Dev with Nim: A Case Study in NimPlant
Переглядів 2,7 тис.Рік тому
This session features Cas van Cooten discussing his open-source Nim C2, NimPlant. The slides from this presentation can be found on the presenter's GitHub: github.com/chvancooten/conferences/blob/main/2023-03 - Malware Development with Nim @ Prelude livestream/Malware Development with Nim A Case Study in NimPlant.pdf Click here to join the Prelude Discord: discord.gg/fZbfdUQM4A
An Introduction to Open Source Continuous Security Testing at Scale
Переглядів 755Рік тому
This presentation by Prelude CTO & Co-Founder, David Hunt, introduces continuous security testing at scale via a guided walkthrough. Attendees will get an orientation around our open source probes and Verified Security Tests, which are then used to continuously validate the efficacy of our defenses. This talk originally took place on Mr.Un1k0d3r's Discord Server. Follow him on Twitter at @MrUn1...
AV/EDR Evasion: Packer Style
Переглядів 6 тис.Рік тому
This session features Twitter's @S3cur3Th1sSh1t providing a tutorial on AV and EDR evasion techniques. This is a recording from the Prelude Discord Live Stream Series. The slides from this presentation can be found on the presenter's GitHub: github.com/S3cur3Th1sSh1t/Creds/blob/master/Presentations/AV_EDR Evasion_Packer Style.pdf Click here to join the Prelude Discord: discord.gg/fZbfdUQM4A
Windows Internals for Red Teams
Переглядів 14 тис.Рік тому
This session features Charles "Mr.Un1k0d3r" Hamilton providing a lesson on Windows internals through the lens of a red teamer. This is a recording from the Prelude Discord Live Stream Series. Click here to join the Prelude Discord: discord.gg/fZbfdUQM4A
Intro to Reverse Engineering
Переглядів 2,1 тис.Рік тому
Software reverse engineering is the process of understanding how software works by inspecting compiled binary and its runtime behavior. This session features cmex providing an introduction to reverse engineering concepts and some practical tips for malware analysis. Click here to join the Prelude Discord: discord.com/invite/NWURE99JzE
Creating a Windows Packer
Переглядів 2,3 тис.Рік тому
Packers are programs that decompress and load new programs within their address space. This session features frank2 providing an introduction on how to write a packer. A version of this tutorial is also available on GitHub: github.com/frank2/packer-tutorial This is a recording from the Prelude Discord Live Stream Series. Click here to join the Prelude Discord: discord.com/invite/NWURE99JzE
CVE-2014-6271: ShellShock
Переглядів 9592 роки тому
ShellShock is a vulnerability that allows arbitrary code to execute on a Linux computer. It does this by taking advantage of how Bash (a program found on most Linux machines) evaluates environment variables. This week marks a theme change from adversary emulation to CVE exploitation. Over the next 6 weeks we’ll release exploits that test whether a machine is exploitable to specific Linux CVEs. ...
APT40 Shellcode Injection & Defense Evasion
Переглядів 2702 роки тому
APT40 Shellcode Injection & Defense Evasion
0verture: The Prelude Podcast CVE-EP12
Переглядів 512 роки тому
0verture: The Prelude Podcast CVE-EP12
0verture: The Prelude Podcast CVE-EP11
Переглядів 202 роки тому
0verture: The Prelude Podcast CVE-EP11
Prelude Live: Operator 1.5 Tips and Features (Recorded 4/14/22)
Переглядів 1062 роки тому
Prelude Live: Operator 1.5 Tips and Features (Recorded 4/14/22)
APT40 targets defense industry with multi-stage macro-enabled documents
Переглядів 1192 роки тому
APT40 targets defense industry with multi-stage macro-enabled documents
niceee
I was litterally lloking for syscall viedo on yt, but never found something i clearly understood, yt random recomended this viedo, and this is exactly what i need, excelent explanation really loved it, This chanel is worth subscribing
the fact that any of this is possible says volumes about how bad design of modern OSes is. Both linux and windows are historical mistakes, evolving responsively to environment, without any intellectual guidance. There has to be a complete overhaul, a completely new OS: well documented, hackless, maintained by actually smart people.
very bad take. if the os can do it, a user can do it. thats not changeable if you want a usable os. the only difference between "malware" and "goodware" is the intent.
I have a question for you regarding RS232 equipment. I obtained a S100 spectrophotometer with an rs232 connecter. The company was contacted but now the unit is obsolete with no software available to use the unit. I want to send data and receive and also try and figure out the commands to make the unit work etc. I downloaded a program on my computer which allows RealTerm (serial capture program) to try and get the unit to work and communicate. I want to be able to eventually create a gui interface on the computer to allow access of the data on the unit. With your expert knowledge on this matter was wondering what software and procedures would you use to reverse engineer such a task to be able to do this? Any information would be appreciated thanks!!!
TIL > Hipster technologies > Schemaless databases 😂
Unfortunately incredibly hard to digest.
this is a great framework/tool i will make great things with this knowledge
i dont know nothing abt hacking tell me wth is this
dear lord its the vocal fry guy again
Zach Wasserman slander will not be tolerated.
I am happy I cam across to your channel. I am hooked
or May be something on Blockchain Protocol Engineering a lowest level
Can you make a video on reverse Blockchain Protocol Engineering something in the space of Blockchain ?
Mon tabarnak
@Preludeorg What HEX editor used at 51:20 ?
first to comment... yay!!!
First reply to the first comment🎉
@@joech1065 first reply to the first reply to the first comment 🥳
@@danielmohring4610 first to reply to the first comment reply 🤭😆😁
Wow, excellent presentation! This topic/attack vector is not nearly covered enough. The space needs more people who understand this and you explained it extremely well
Damn, that's by far the best explanation i've seen on the subject
if the numbers add up, the time is right😂
thanks, this is very clear to understand.
Pretty smart, I like it! Thanks for the demonstration.
Thank you for explaination. It was useful for me :) I'm coding on c# maybe 2-3 years and I decide to learn something new about malware etc. but only in this guide I found useful techniques.
Little suggestion to include the video quality... I am watching this video in 1080 but still i feel blurish...
Same here. I thought there was a problem with my phone
Very good explanations, thanks for sharing this
cool stuf
Thanks for sharing and thanks again for having me!
thanks guys, you rock as always! speaking of keyboards, is it possible to write a C++ code that could cripple the keyboard's functionalities to write while it's still plugged into the USB port?
Thank you!
I just wanna provide some additional info that I missed to give in the talk, but I feel that should be addressed: 1) The Nt* and Zw* functions, which I call syscalls here, are technically just stdcall wrappers around the actual syscall instruction. The terminology is confusing and many people refer to them as syscalls, but technically they are just wrappers that enable the syscalls to easily be called from C/C++. 2) When I refer to the usage of GetModuleHandle and GetProcAddress with Nt*/Zw* functions as being suspicious, that is also only partly true. Many legitimate programs, including standard windows binaries, use these calls with Nt*/Zw* functions. What might be suspicious here is the type of APIs you are importing, e.g. if those are known to be used for code injection, not the usage of GetProcAddress/GetModuleHandle itself.
🖤
i cant believe theres a course on this! This is incredible
👏👏👏
It's not everyday that you see software that consistently only REMOVES features every new update. 1.7 is even more empty than this.
amazing stuff guyzz very helpful kudos
This is a fantastic intro, thanks a lot
Glad you enjoyed - all the credit to eversinc33!
great slide explaination out there. could you please focus more on the practical side? it's gonna be interesting if you dive deep into red team simulation tactics and malware development using C++ and C# for dealing with system calls if possible.
Thanks for the encouraging words. We'll keep this in mind!
hey prelude, can you make video about making your own malware in c++ and testing it in virus total to get 0 detections😮😊
Hey fake acount1 - we'll consider the request 😏
@@Preludeorg ok.
Great content! Keep it up
Thanks!
👏👏👏
This is definitely an underrated video. I absolutely loved hearing about your journey as well as learning about the evolution of osquery and Fleet. These are some amazing contributions to the open source community and thank you for taking the time to talk about your experiences. :)
We agree! Zach was a great guest. We appreciate his commitment to community.
Please make more vd for advanced techniques red team and pivoting and dev malware bypass EDR
We'll keep this in mind for future content! Thanks for watching.
Wow! I could not have asked for a better topic. Exactly what I was wanting to learn!
Glad to hear this. Huge thanks to eversinc33
Awesome. Interesting demo too.
Thanks! Check out the new GUI for Detect: platform.preludesecurity.com/detect
it's unbelievable seeing this channel's capabilities and got no high views, subs, nor even people to interact in the comments while crap like youtubers keep posting shit while they make millions!
Gee, thank you!
U expect millions of people to sit thru a PowerPoint presentation talking about a random programming language?? 😂
I wanted to get started with reverse engineering but not sure how/where to start and I found you guys :) Please keep it coming! Thank you so much for all the effort you guys put in creating useful contents.
Thanks for watching. All the credit to the guests that sharing their knowledge and experience with us!
can you hide the member list in future streams
Good idea 💡 Thanks for the feedback.
Yes please. That would be great!
does this mean that python should be installed on windows machine?
Python needs to be installed on the machine running the Operator instance. Any windows box (even one without Python) can visit the watering-hole website.
@@Preludeorg yes, it's clear to me that http server will be running on the Operator machine. I have been rushy writing my question, sorry. It is not clear to me if the windows target machine must have python installed to allow the execution of the TTP "check rdp credentials", for example. I see it's using python, like the other TTP install PySMB and Install Impacket; so I guess python is needed on windows machine, am I wrong? Thank you!
@@LexAsLex Thank you for your questions. Let us know if this clarifies things-- You can think of this chain as having two distinct parts: The first part is setting up the environment for everything that is going to take place. This is done by standing up the website and installing libraries needed to check communication with SMB and RDP. The box running Operator will need python3 installed so all of this can happen. This will allow any OS to be able to communicate with the target box. The second part is the target box. In the case of this chain, it is targeting a Windows box. Windows typically has SMB and RDP services and if these services are exposed on the network, the Operator box (referenced in the first part above) will attempt to reach out and authenticate with these services. Python isn’t needed on the target windows box. If the environment running the Operator session (referenced in the first part above) is a Windows box, then it will need python3 to set up the environment. The target (referenced in the second part), however, will still not need python3 installed.
@@Preludeorg ooh I see! now it's very clear! Actually once the credentials have been collected the rdp check can be done from the attacker machine! thank you for clarification!
@@LexAsLex Great. If you have additional questions about this chain or something else you're working on in Operator, you can join our Discord server for additional support-- discord.gg/gzUv4XNquu
The first half of this video is a static screen with a VO - take advantage of the medium you are using to present the information, maybe an animated timeline overview that moves through the steps as you describe them, or some slides that change showing relevant news stories / clips / wayback machine from those events - enjoying the content - this seemed more of a podcast than a YT video - also the screen detail is difficult to make out - if the intention is to show us the config / Prelude chain - it is difficult to actually read / view the output in the Prelude window - just my 0.02
Joshua, Thank you for the thoughtful reply, we really appreciate the feedback. Our plan is to formalize the first half of the video into a threat intelligence presentation (similar to what you're describing). The second half would be the technical side. We will take your feedback and use it moving forwards! Thanks, Prelude team
good job:)
Hackers hate him
👍
The problem with this is that i need to learn the prelude software, whereas i current can just spin up a vm from vulnhub and play around with vulnerable machines from there.
Operator is primarily an adversary emulation and automation framework. The purpose is to help simplify detection engineering processes by making it easier to build and run predictable attacks. You could use it to poke around vulnhub boxes though and we actually have a built-in provisioning system to deploy virtual machines with preconfigured challenges.