Prelude
Prelude
  • 75
  • 69 757
Intro to Verified Security Tests: Authoring Tests That Scale
In order for continuous testing to scale to tens or hundreds of thousands of endpoints, we had to tear down the concept of traditional TTPs and start fresh with the Verified Security Test (VST) format - the lifeblood of Prelude Detect.
In this session, the battle-tested TTP/VST author and Prelude's Co-Founder and CTO, David Hunt, provides an introduction to VSTs. David will breakdown the requirements of VSTs and provide a tutorial on how to author your own VSTs for continuously testing endpoint deployments of any size.
Create your free Prelude account: platform.preludesecurity.com/detect
🔗 Related Links 🔗
Prelude Detect Docs: docs.preludesecurity.com/docs/the-basics
Prelude CLI Docs: docs.preludesecurity.com/docs/prelude-cli
Prelude Visual Studio Integration Docs: docs.preludesecurity.com/docs/visual-studio-integration
Prelude Tests GitHub: github.com/preludeorg/test
Prelude Libraries GitHub: github.com/preludeorg/libraries
Переглядів: 436

Відео

Global Affairs? In my Threat Model?
Переглядів 195Рік тому
Alex Rudolph shares how to analyze an APT's force structures and doctrine to understand cyber conflict and incorporate into threat models. Link to join the Prelude Discord: discord.gg/fZbfdUQM4A
Designing and Building a Mechanical Keyboard
Переглядів 281Рік тому
Cyboard's Erik Trinkle presents lessons learned on designing and manufacturing custom mechanical keyboards. Link to join the Prelude Discord: discord.gg/fZbfdUQM4A
Protocol Reverse Engineering
Переглядів 3,9 тис.Рік тому
In this session, netspooky presents an introduction to protocol reverse engineering, with lots of history, resources, tips and tricks, and more. 00:00 Intro 02:00 Protocol RE Fundamentals 10:35 Preparing to Reverse Engineer 15:37 Packet Analysis 41:05 Software RE 56:08 Hardware RE 01:02:54 Specifications 01:16:52 Documenting Your Findings 01:20:50 Healthy Research Mindset
Avoiding Insidious Points of Compromise in Infrastructure Access Systems
Переглядів 260Рік тому
BastionZero's CEO, Dr. Sharon Goldberg, explores case studies of devastating pitfalls of infrastructure access systems and how to avoid them.
Offensive Wasm
Переглядів 2 тис.Рік тому
Joe DeMesy presents research on applications of Web Assembly (WASM) in Sliver, an open-source cross-platform adversary emulation framework.
Intro to Syscalls for Windows Malware
Переглядів 17 тис.Рік тому
This session features eversinc33 giving an intro to syscalls implementations for Windows malware. This is a recording from the Prelude Discord Live Stream Series. Click here to join the Prelude Discord: discord.gg/fZbfdUQM4A
My Open Source Journey with osquery and Fleet
Переглядів 690Рік тому
This session features Zach Wasserman, CTO of Fleet and Co-creator of osquery, talking about his experience building a career in open-source software. This is a recording from the Prelude Discord Live Stream Series. Click here to join the Prelude Discord: discord.gg/fZbfdUQM4A
Malware Dev with Nim: A Case Study in NimPlant
Переглядів 2,7 тис.Рік тому
This session features Cas van Cooten discussing his open-source Nim C2, NimPlant. The slides from this presentation can be found on the presenter's GitHub: github.com/chvancooten/conferences/blob/main/2023-03 - Malware Development with Nim @ Prelude livestream/Malware Development with Nim A Case Study in NimPlant.pdf Click here to join the Prelude Discord: discord.gg/fZbfdUQM4A
An Introduction to Open Source Continuous Security Testing at Scale
Переглядів 755Рік тому
This presentation by Prelude CTO & Co-Founder, David Hunt, introduces continuous security testing at scale via a guided walkthrough. Attendees will get an orientation around our open source probes and Verified Security Tests, which are then used to continuously validate the efficacy of our defenses. This talk originally took place on Mr.Un1k0d3r's Discord Server. Follow him on Twitter at @MrUn1...
AV/EDR Evasion: Packer Style
Переглядів 6 тис.Рік тому
This session features Twitter's @S3cur3Th1sSh1t providing a tutorial on AV and EDR evasion techniques. This is a recording from the Prelude Discord Live Stream Series. The slides from this presentation can be found on the presenter's GitHub: github.com/S3cur3Th1sSh1t/Creds/blob/master/Presentations/AV_EDR Evasion_Packer Style.pdf Click here to join the Prelude Discord: discord.gg/fZbfdUQM4A
Windows Internals for Red Teams
Переглядів 14 тис.Рік тому
This session features Charles "Mr.Un1k0d3r" Hamilton providing a lesson on Windows internals through the lens of a red teamer. This is a recording from the Prelude Discord Live Stream Series. Click here to join the Prelude Discord: discord.gg/fZbfdUQM4A
Intro to Reverse Engineering
Переглядів 2,1 тис.Рік тому
Software reverse engineering is the process of understanding how software works by inspecting compiled binary and its runtime behavior. This session features cmex providing an introduction to reverse engineering concepts and some practical tips for malware analysis. Click here to join the Prelude Discord: discord.com/invite/NWURE99JzE
Creating a Windows Packer
Переглядів 2,3 тис.Рік тому
Packers are programs that decompress and load new programs within their address space. This session features frank2 providing an introduction on how to write a packer. A version of this tutorial is also available on GitHub: github.com/frank2/packer-tutorial This is a recording from the Prelude Discord Live Stream Series. Click here to join the Prelude Discord: discord.com/invite/NWURE99JzE
CVE-2014-6271: ShellShock
Переглядів 9592 роки тому
ShellShock is a vulnerability that allows arbitrary code to execute on a Linux computer. It does this by taking advantage of how Bash (a program found on most Linux machines) evaluates environment variables. This week marks a theme change from adversary emulation to CVE exploitation. Over the next 6 weeks we’ll release exploits that test whether a machine is exploitable to specific Linux CVEs. ...
APT38 Pharmaceuticals Attacks
Переглядів 3132 роки тому
APT38 Pharmaceuticals Attacks
GTsST Iron Viking
Переглядів 992 роки тому
GTsST Iron Viking
APT38 CryptoSpy
Переглядів 1552 роки тому
APT38 CryptoSpy
GTsST Sandworm
Переглядів 1292 роки тому
GTsST Sandworm
APT38 WannaCry
Переглядів 1602 роки тому
APT38 WannaCry
APT38 The Sony Hack
Переглядів 2752 роки тому
APT38 The Sony Hack
APT38 DarkSeoul
Переглядів 1672 роки тому
APT38 DarkSeoul
APT40 Find and Exfiltrate Chain
Переглядів 1302 роки тому
APT40 Find and Exfiltrate Chain
APT40 Shellcode Injection & Defense Evasion
Переглядів 2702 роки тому
APT40 Shellcode Injection & Defense Evasion
0verture: The Prelude Podcast CVE-EP12
Переглядів 512 роки тому
0verture: The Prelude Podcast CVE-EP12
APT40 Government Organizations
Переглядів 3102 роки тому
APT40 Government Organizations
APT40 Maritime Industry
Переглядів 1242 роки тому
APT40 Maritime Industry
0verture: The Prelude Podcast CVE-EP11
Переглядів 202 роки тому
0verture: The Prelude Podcast CVE-EP11
Prelude Live: Operator 1.5 Tips and Features (Recorded 4/14/22)
Переглядів 1062 роки тому
Prelude Live: Operator 1.5 Tips and Features (Recorded 4/14/22)
APT40 targets defense industry with multi-stage macro-enabled documents
Переглядів 1192 роки тому
APT40 targets defense industry with multi-stage macro-enabled documents

КОМЕНТАРІ

  • @user-ye7nd3oh4p
    @user-ye7nd3oh4p 2 місяці тому

    niceee

  • @danyalahmad9288
    @danyalahmad9288 3 місяці тому

    I was litterally lloking for syscall viedo on yt, but never found something i clearly understood, yt random recomended this viedo, and this is exactly what i need, excelent explanation really loved it, This chanel is worth subscribing

  • @martinstu8400
    @martinstu8400 3 місяці тому

    the fact that any of this is possible says volumes about how bad design of modern OSes is. Both linux and windows are historical mistakes, evolving responsively to environment, without any intellectual guidance. There has to be a complete overhaul, a completely new OS: well documented, hackless, maintained by actually smart people.

    • @fordprefect8235
      @fordprefect8235 2 місяці тому

      very bad take. if the os can do it, a user can do it. thats not changeable if you want a usable os. the only difference between "malware" and "goodware" is the intent.

  • @georgeyork8975
    @georgeyork8975 4 місяці тому

    I have a question for you regarding RS232 equipment. I obtained a S100 spectrophotometer with an rs232 connecter. The company was contacted but now the unit is obsolete with no software available to use the unit. I want to send data and receive and also try and figure out the commands to make the unit work etc. I downloaded a program on my computer which allows RealTerm (serial capture program) to try and get the unit to work and communicate. I want to be able to eventually create a gui interface on the computer to allow access of the data on the unit. With your expert knowledge on this matter was wondering what software and procedures would you use to reverse engineer such a task to be able to do this? Any information would be appreciated thanks!!!

  • @DotNetRussell
    @DotNetRussell 4 місяці тому

    TIL > Hipster technologies > Schemaless databases 😂

  • @CarterOW
    @CarterOW 4 місяці тому

    Unfortunately incredibly hard to digest.

  • @AustinHypes
    @AustinHypes 5 місяців тому

    this is a great framework/tool i will make great things with this knowledge

  • @froska12
    @froska12 5 місяців тому

    i dont know nothing abt hacking tell me wth is this

  • @luiszuniga5815
    @luiszuniga5815 5 місяців тому

    dear lord its the vocal fry guy again

    • @Preludeorg
      @Preludeorg 5 місяців тому

      Zach Wasserman slander will not be tolerated.

  • @nceevij
    @nceevij 6 місяців тому

    I am happy I cam across to your channel. I am hooked

  • @nceevij
    @nceevij 6 місяців тому

    or May be something on Blockchain Protocol Engineering a lowest level

  • @nceevij
    @nceevij 6 місяців тому

    Can you make a video on reverse Blockchain Protocol Engineering something in the space of Blockchain ?

  • @alexandrest-fort2520
    @alexandrest-fort2520 7 місяців тому

    Mon tabarnak

  • @diperru
    @diperru 8 місяців тому

    @Preludeorg What HEX editor used at 51:20 ?

  • @bitferret-rx5rn
    @bitferret-rx5rn 8 місяців тому

    first to comment... yay!!!

    • @joech1065
      @joech1065 6 місяців тому

      First reply to the first comment🎉

    • @danielmohring4610
      @danielmohring4610 6 місяців тому

      @@joech1065 first reply to the first reply to the first comment 🥳

    • @AustinHypes
      @AustinHypes 5 місяців тому

      @@danielmohring4610 first to reply to the first comment reply 🤭😆😁

  • @alienJIZ1990
    @alienJIZ1990 8 місяців тому

    Wow, excellent presentation! This topic/attack vector is not nearly covered enough. The space needs more people who understand this and you explained it extremely well

  • @Red4mber
    @Red4mber 8 місяців тому

    Damn, that's by far the best explanation i've seen on the subject

  • @MsDuketown
    @MsDuketown 9 місяців тому

    if the numbers add up, the time is right😂

  • @lovedoraemon2390
    @lovedoraemon2390 11 місяців тому

    thanks, this is very clear to understand.

  • @camaradamanuel5025
    @camaradamanuel5025 Рік тому

    Pretty smart, I like it! Thanks for the demonstration.

  • @halfbelf5923
    @halfbelf5923 Рік тому

    Thank you for explaination. It was useful for me :) I'm coding on c# maybe 2-3 years and I decide to learn something new about malware etc. but only in this guide I found useful techniques.

  • @imranthoufeeque
    @imranthoufeeque Рік тому

    Little suggestion to include the video quality... I am watching this video in 1080 but still i feel blurish...

    • @nicksonkosi
      @nicksonkosi 4 місяці тому

      Same here. I thought there was a problem with my phone

  • @rnrbeast
    @rnrbeast Рік тому

    Very good explanations, thanks for sharing this

  • @epicujjwal
    @epicujjwal Рік тому

    cool stuf

  • @cyboard3674
    @cyboard3674 Рік тому

    Thanks for sharing and thanks again for having me!

  • @detective5253
    @detective5253 Рік тому

    thanks guys, you rock as always! speaking of keyboards, is it possible to write a C++ code that could cripple the keyboard's functionalities to write while it's still plugged into the USB port?

  • @elviramegne5632
    @elviramegne5632 Рік тому

    Thank you!

  • @eversinc33
    @eversinc33 Рік тому

    I just wanna provide some additional info that I missed to give in the talk, but I feel that should be addressed: 1) The Nt* and Zw* functions, which I call syscalls here, are technically just stdcall wrappers around the actual syscall instruction. The terminology is confusing and many people refer to them as syscalls, but technically they are just wrappers that enable the syscalls to easily be called from C/C++. 2) When I refer to the usage of GetModuleHandle and GetProcAddress with Nt*/Zw* functions as being suspicious, that is also only partly true. Many legitimate programs, including standard windows binaries, use these calls with Nt*/Zw* functions. What might be suspicious here is the type of APIs you are importing, e.g. if those are known to be used for code injection, not the usage of GetProcAddress/GetModuleHandle itself.

  • @juliogallo7694
    @juliogallo7694 Рік тому

    i cant believe theres a course on this! This is incredible

  • @yurim9917
    @yurim9917 Рік тому

    👏👏👏

  • @TheGoncas2
    @TheGoncas2 Рік тому

    It's not everyday that you see software that consistently only REMOVES features every new update. 1.7 is even more empty than this.

  • @innominateeclipse2231
    @innominateeclipse2231 Рік тому

    amazing stuff guyzz very helpful kudos

  • @CyberCelt.
    @CyberCelt. Рік тому

    This is a fantastic intro, thanks a lot

    • @Preludeorg
      @Preludeorg Рік тому

      Glad you enjoyed - all the credit to eversinc33!

  • @detective5253
    @detective5253 Рік тому

    great slide explaination out there. could you please focus more on the practical side? it's gonna be interesting if you dive deep into red team simulation tactics and malware development using C++ and C# for dealing with system calls if possible.

    • @Preludeorg
      @Preludeorg Рік тому

      Thanks for the encouraging words. We'll keep this in mind!

  • @fakeacount1479
    @fakeacount1479 Рік тому

    hey prelude, can you make video about making your own malware in c++ and testing it in virus total to get 0 detections😮😊

  • @SUJALSURENDRACHAUHAN
    @SUJALSURENDRACHAUHAN Рік тому

    Great content! Keep it up

  • @yurim9917
    @yurim9917 Рік тому

    👏👏👏

  • @Pascal-0x90
    @Pascal-0x90 Рік тому

    This is definitely an underrated video. I absolutely loved hearing about your journey as well as learning about the evolution of osquery and Fleet. These are some amazing contributions to the open source community and thank you for taking the time to talk about your experiences. :)

    • @Preludeorg
      @Preludeorg Рік тому

      We agree! Zach was a great guest. We appreciate his commitment to community.

  • @cvport8155
    @cvport8155 Рік тому

    Please make more vd for advanced techniques red team and pivoting and dev malware bypass EDR

    • @Preludeorg
      @Preludeorg Рік тому

      We'll keep this in mind for future content! Thanks for watching.

  • @joyemoticon
    @joyemoticon Рік тому

    Wow! I could not have asked for a better topic. Exactly what I was wanting to learn!

    • @Preludeorg
      @Preludeorg Рік тому

      Glad to hear this. Huge thanks to eversinc33

  • @fordprefect8235
    @fordprefect8235 Рік тому

    Awesome. Interesting demo too.

    • @Preludeorg
      @Preludeorg Рік тому

      Thanks! Check out the new GUI for Detect: platform.preludesecurity.com/detect

  • @detective5253
    @detective5253 Рік тому

    it's unbelievable seeing this channel's capabilities and got no high views, subs, nor even people to interact in the comments while crap like youtubers keep posting shit while they make millions!

    • @Preludeorg
      @Preludeorg Рік тому

      Gee, thank you!

    • @会供価
      @会供価 Рік тому

      U expect millions of people to sit thru a PowerPoint presentation talking about a random programming language?? 😂

  • @Hade-hw6vl
    @Hade-hw6vl Рік тому

    I wanted to get started with reverse engineering but not sure how/where to start and I found you guys :) Please keep it coming! Thank you so much for all the effort you guys put in creating useful contents.

    • @Preludeorg
      @Preludeorg Рік тому

      Thanks for watching. All the credit to the guests that sharing their knowledge and experience with us!

  • @whatwhere1089
    @whatwhere1089 Рік тому

    can you hide the member list in future streams

  • @LexAsLex
    @LexAsLex 2 роки тому

    does this mean that python should be installed on windows machine?

    • @Preludeorg
      @Preludeorg 2 роки тому

      Python needs to be installed on the machine running the Operator instance. Any windows box (even one without Python) can visit the watering-hole website.

    • @LexAsLex
      @LexAsLex 2 роки тому

      @@Preludeorg yes, it's clear to me that http server will be running on the Operator machine. I have been rushy writing my question, sorry. It is not clear to me if the windows target machine must have python installed to allow the execution of the TTP "check rdp credentials", for example. I see it's using python, like the other TTP install PySMB and Install Impacket; so I guess python is needed on windows machine, am I wrong? Thank you!

    • @Preludeorg
      @Preludeorg 2 роки тому

      ​@@LexAsLex Thank you for your questions. Let us know if this clarifies things-- You can think of this chain as having two distinct parts: The first part is setting up the environment for everything that is going to take place. This is done by standing up the website and installing libraries needed to check communication with SMB and RDP. The box running Operator will need python3 installed so all of this can happen. This will allow any OS to be able to communicate with the target box. The second part is the target box. In the case of this chain, it is targeting a Windows box. Windows typically has SMB and RDP services and if these services are exposed on the network, the Operator box (referenced in the first part above) will attempt to reach out and authenticate with these services. Python isn’t needed on the target windows box. If the environment running the Operator session (referenced in the first part above) is a Windows box, then it will need python3 to set up the environment. The target (referenced in the second part), however, will still not need python3 installed.

    • @LexAsLex
      @LexAsLex 2 роки тому

      ​@@Preludeorg ooh I see! now it's very clear! Actually once the credentials have been collected the rdp check can be done from the attacker machine! thank you for clarification!

    • @Preludeorg
      @Preludeorg 2 роки тому

      @@LexAsLex Great. If you have additional questions about this chain or something else you're working on in Operator, you can join our Discord server for additional support-- discord.gg/gzUv4XNquu

  • @joshuasmith1252
    @joshuasmith1252 2 роки тому

    The first half of this video is a static screen with a VO - take advantage of the medium you are using to present the information, maybe an animated timeline overview that moves through the steps as you describe them, or some slides that change showing relevant news stories / clips / wayback machine from those events - enjoying the content - this seemed more of a podcast than a YT video - also the screen detail is difficult to make out - if the intention is to show us the config / Prelude chain - it is difficult to actually read / view the output in the Prelude window - just my 0.02

    • @Preludeorg
      @Preludeorg 2 роки тому

      Joshua, Thank you for the thoughtful reply, we really appreciate the feedback. Our plan is to formalize the first half of the video into a threat intelligence presentation (similar to what you're describing). The second half would be the technical side. We will take your feedback and use it moving forwards! Thanks, Prelude team

  • @GoldenbestNo.1
    @GoldenbestNo.1 2 роки тому

    good job:)

  • @legato891
    @legato891 2 роки тому

    Hackers hate him

  • @blackwasp9285
    @blackwasp9285 2 роки тому

    👍

  • @MarsTheProgrammer
    @MarsTheProgrammer 2 роки тому

    The problem with this is that i need to learn the prelude software, whereas i current can just spin up a vm from vulnhub and play around with vulnerable machines from there.

    • @Preludeorg
      @Preludeorg 2 роки тому

      Operator is primarily an adversary emulation and automation framework. The purpose is to help simplify detection engineering processes by making it easier to build and run predictable attacks. You could use it to poke around vulnhub boxes though and we actually have a built-in provisioning system to deploy virtual machines with preconfigured challenges.