Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

title:blackhat:us-21 Rope: Bypassing Behavioral Detection of Malware with Distributed ROP-Driven Execution
Distributed malware concepts challenge the behavioral detection of AV and EDR solutions by diluting the temporal and spatial features of a malicious execution across multiple processes. Several notable families already adopt a modular design with distinct features delegated to cooperating individual components. Recent research pushed this idea further by splitting the code of a single component into chunks to be run by emulators injected in multiple processes. The shortcoming of these approaches, however, are the conspicuous features and primitives they rely on, which make them easy prey for state-of-the-art AV or EDR systems and may also conflict with OS mitigations for hardening processes.In this talk, we will present Rope, a new covert distributed execution technique. Rope builds on transactional NTFS as non-inspectable covert channel for payload distribution and execution coordination, and on return-oriented programming to encode the desired actions. Our technique seeks to minimize IoCs on the machine: for instance, it does not need any RWX region. Return-oriented programming is central for achieving the desired properties of our design and brings advantages against code-based detections. For its implementation, we designed a stealth, usable injection primitive that temporarily hijacks threads from possibly hardened processes and ignites the distributed execution.Every technique we use in Rope complies with presently available Windows 10 mitigations or bypasses them in original ways that the talk will detail. Our Rope malware samples successfully eluded popular AV and EDR solutions.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0608
ATT&CK Technique Name:Conficker
Conficker resets system restore points and deletes backup files.[23]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0140
ATT&CK Technique Name:LazyScripter
LazyScripter has established GitHub accounts to host its toolsets.[13]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

titleblackhat:us-18 Practical Web Cache Poisoning: Redefining 'Unexploitable'
Modern web applications are composed from a crude patchwork of caches and content delivery networks. In this session I'll show you how to compromise websites by using esoteric web features to turn their caches into exploit delivery systems, targeting everyone that makes the mistake of visiting their homepage.
I'll illustrate and develop this technique with vulnerabilities that handed me control over numerous well known websites and frameworks, progressing from simple single-request attacks to intricate exploit chains that hijack JavaScript, pivot across cache layers, subvert social media and misdirect cloud services in pursuit of the perfect exploit.
Unlike previous cache poisoning techniques, this approach doesn't rely on other vulnerabilities like response splitting, or cache-server quirks that are easily patched away. Instead, it exploits core principles of caching, and as such affects caching solutions indiscriminately. The repercussions also extend beyond websites - I'll show how using this approach, I was able to compromise Mozilla infrastructure and partially hijack a notorious Firefox feature, letting me conduct tens of millions of Firefox browsers as my personal low-fat botnet.
In addition to sharing a thorough detection methodology, I'll also release and open source the Burp Suite Community extension that fueled this research. You'll leave with an altered perspective on web exploitation, and an appreciation that the simple act of placing a cache in front of a website can take it from completely secure to critically vulnerable.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0599
ATT&CK Technique Name:Kinsing
Kinsing has created and run a Bitcoin cryptocurrency miner.[12][13]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1011
ATT&CK Technique Name:User Guidance
Inform users that device rooting or granting unnecessary access to the accessibility service presents security risks that could be taken advantage of without their knowledge.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0112
ATT&CK Technique Name:Windshift
Windshift has used fake personas on social media to engage and target victims.[14]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0378
ATT&CK Technique Name:PoshC2
PoshC2 contains a module for recursively parsing through files and directories to gather valid credit card numbers.[34]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0670
ATT&CK Technique Name:WarzoneRAT
WarzoneRAT has the ability of performing remote desktop access via a VNC console.[21]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:C0024
ATT&CK Technique Name:SolarWinds Compromise
During the SolarWinds Compromise, APT29 removed evidence of email export requests using Remove-MailboxExportRequest.[1]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0063
ATT&CK Technique Name:SHOTPUT
SHOTPUT has a command to obtain a process listing.[227]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0154
ATT&CK Technique Name:Cobalt Strike
Cobalt Strike can use Window admin shares (C$ and ADMIN$) for lateral movement.[18][19]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:C0021
ATT&CK Technique Name:C0021
During C0021, the threat actors lured users into clicking a malicious link which led to the download of a  ZIP archive containing a malicious .LNK file.[22]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:C0014
ATT&CK Technique Name:Operation Wocao
During Operation Wocao, threat actors used a custom proxy tool called "Agent" which has support for multiple hops.[34]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0622
ATT&CK Technique Name:AppleSeed
AppleSeed has exfiltrated files using web services.[1]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:C0002
ATT&CK Technique Name:Night Dragon
During Night Dragon, threat actors used domain accounts to gain further access to victim systems.[12]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M0942
ATT&CK Technique Name:Disable or Remove Feature or Program
Ensure that unnecessary ports and services are closed to prevent risk of discovery and potential exploitation.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:T1550
ATT&CK Technique Name:Use Alternate Authentication Material
Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1018
ATT&CK Technique Name:User Account Management
Periodically review user accounts and remove those that are inactive or unnecessary. Limit the ability for user accounts to create additional accounts.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0260
ATT&CK Technique Name:InvisiMole
InvisiMole samples were timestomped by the authors by setting the PE timestamps to all zero values. InvisiMole also has a built-in command to modify file times.[28]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1030
ATT&CK Technique Name:Network Segmentation
Operate intrusion detection, analysis, and response systems on a separate network from the production environment to lessen the chances that an adversary can see and interfere with critical response functions.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0661
ATT&CK Technique Name:FoggyWeb
FoggyWeb's loader can call the load() function to load the FoggyWeb dll into an Application Domain on a compromised AD FS server.[9]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

titleblackhat:asia-19 iOS Dual Booting Demystified
In this talk, we will investigate and present on the ways in which to boot a custom firmware image on an iOS device. In order to show this, we will detail how the secure iOS boot process functions, including many of the details of how the low level component verification works as well as the loading and running of processes at boot time. It's known that iOS devices tightly integrate their software and hardware components in order to secure the system, but how is this done in practice?
We will answer this question and others by focusing on one of these integrations, specifically the boot process for modern iOS devices. The iOS boot process is a critical part of a device's system security as it helps to ensure that each component of the device can be trusted before it is used by the system. Each step of the iOS boot process contains components that are cryptographically signed by Apple to ensure their integrity and verify the chain of trust before allowing the device to continue booting. The chain of trust for iOS includes the system bootloader, XNU kernel, kernel extensions, SEP, Wi-Fi, and the baseband firmware.
From our detailed understanding and explanation of how the boot process functions for iOS we will then discuss ways in which researchers can take these learnings to create and load a custom iOS firmware image on a device, including a custom XNU kernel and system disk image side by side with the device's original iOS firmware image.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0053
ATT&CK Technique Name:SeaDuke
SeaDuke can securely delete files, including deleting itself from the victim.[211]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0666
ATT&CK Technique Name:Gelsemium
Gelsemium can modify the Registry to store its components.[62]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0641
ATT&CK Technique Name:Kobalos
Kobalos can record the IP address of the target machine.[124]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

titleblackhat:us-19 Lessons From Two Years of Crypto Audits
Over the last two years, we've completed many successful crypto audits. These audits consisted of mostly paid engagements but also unsolicited ones, as well with a mixture of blockchain projects as well as good old cryptography. We've worked for major blockchain organizations and have seen the most complex crypto protocols ever deployed at scale, which is really exciting but at the same time terrifying—what if there's a critical bug that could compromise the entire network? What if we as security auditors miss something? Questions like these loom over anyone performing an audit. There is no shortage of places things can go wrong, bugs in source code, protocol defects, incorrect implementations, and the list goes on.In this talk we'll first describe some of the most interesting security issues we've found (at least the ones we're authorized to talk about), then we'll focus on the risks associated with one of the most popular memory-safe languages, namely Rust. We'll describe a list of sanity checks and security best practices that we use internally when auditing Rust code, along with examples from real Rust audits. Finally, we'll draw some lessons from our experience, providing advice to fellow security auditors and developers, to get the most out of a security audit.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0114
ATT&CK Technique Name:Chimera
Chimera has used compromised domain accounts to gain access to the target environment.[4]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0528
ATT&CK Technique Name:Javali
Javali can use DLL side-loading to load malicious DLLs into legitimate executables.[30]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1017
ATT&CK Technique Name:User Training
Close out all browser sessions when finished using them to prevent any potentially malicious extensions from continuing to run.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0049
ATT&CK Technique Name:OilRig
OilRig has used macros to verify if a mouse is connected to a compromised machine.[34]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

title:blackhat:eu-22 Deep into Android Bluetooth Bug Hunting: New Attack Surfaces and Weak Code Patterns
In the past few years, researchers have found hundreds of security vulnerabilities in the AOSP Bluetooth module such as Blueborne and BlueFrag. Almost all of these vulnerabilities are caused by the process not properly validating the remote user-supplied data, when parsing the Bluetooth request packet.In this context, in order to improve the security of Bluetooth, Google has adopted a variety of hardening methods:1. Validate the length of incoming Bluetooth packets.2. Implement a new and more secure AVRCP profile.3. Rewrite Bluetooth stack code-named "Gabeldorsche" in Rust.However, through some new approaches (focusing on the lifecycle of Bluetooth packet data and specific weak Bluetooth architectural logic), we still found a large number of security vulnerabilities hidden deep in the code.In this presentation, we will first introduce the Bluetooth protocol architecture in AOSP, and summarize the existing research results and known attack surfaces. Then, we will share new attack surfaces and several potentially vulnerable code patterns, which have never been discussed before. Next, we will show how to efficiently find the vulnerabilities by fuzzing and code auditing (based on CodeQL). With these ideas, we found 23 vulnerabilities in different Bluetooth profiles (l2cap, bnep, avrcp, gatt, sdp...) and obtained 8 CVEs for some critical or high risk vulnerabilities. The vulnerabilities can lead to serious consequences such as information disclosure, privilege escalation and remote code execution. Finally, we will explain the root causes of vulnerabilities through several real cases, and share our work in exploiting these vulnerabilities.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S1012
ATT&CK Technique Name:PowerLess
PowerLess can encrypt browser database files prior to exfiltration.[43]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0376
ATT&CK Technique Name:HOPLIGHT
HOPLIGHT can enumerate device drivers located in the registry at HKLM\Software\WBEM\WDM.[7]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0269
ATT&CK Technique Name:QUADAGENT
QUADAGENT creates a scheduled task to maintain persistence on the victim’s machine.[120]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0521
ATT&CK Technique Name:BloodHound
BloodHound has the ability to collect local admin information via GPO.[5]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0143
ATT&CK Technique Name:Flame
Flame can take regular screenshots when certain applications are open that are sent to the command and control server.[63]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0251
ATT&CK Technique Name:Zebrocy
Zebrocy performs persistence with a logon script via adding to the Registry key HKCU\Environment\UserInitMprLogonScript.[9]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0650
ATT&CK Technique Name:QakBot
QakBot can use cmd.exe to launch itself and to execute multiple C2 commands.[269][270][271][84]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0690
ATT&CK Technique Name:Green Lambert
Green Lambert can add init.d and rc.d files in the /etc folder to establish persistence.[9][10]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0203
ATT&CK Technique Name:Hydraq
Hydraq uses basic obfuscation in the form of spaghetti code.[112][164]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0570
ATT&CK Technique Name:BitPaymer
BitPaymer can use icacls /reset and takeown /F to reset a targeted executable's permissions and then take ownership.[5]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0032
ATT&CK Technique Name:Lazarus Group
Lazarus Group lnk files used for persistence have abused the Windows Update Client (wuauclt.exe) to execute a malicious DLL.[4][5]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

titleblackhat:us-18 KeenLab iOS Jailbreak Internals: Userland Read-Only Memory can be Dangerous
Modern operating systems nowadays implement read-only memory mappings at their CPU architecture level, preventing common security attacks. By mapping memories as read-only, the memory owner process can usually trust the memory content, eleminating unnecessary security considerations such as boundary check, TOCTTOU(Time of check to time of use) issues etc., with the assumption of other processes not being able to mutate read-only shared mappings in their own virtual spaces.However, the assumption is not always correct. In the past few years, several logical issues were addressed by security community, most of which were caused by operating systems incorrectly allowing to remap the read-only memories as writble without marking them COW(copy-on-write). As a result, the memory content of the owner process is not trustable anymore, yet causing memory corruption problem or even leading to userland privilege escalation. With operating system evolves, such issues are rare though. On the other hand, with stronger and more abundant features provided by peripheral components attached to the mobile device, DMA(direct-memory-access) technology enables the ability for fast data transfer between the host and peripheral devices. DMA leverages IOMMU(Input/Output Memory Management Unit) for memory operations, thus memory protection mechanism provided by CPU MMU is not available during the DMA transfer. In the middle of 2017, Gal Beniamini of Goole Project Zero team utilized DMA to successfully achieve device-to-host attack on both Nexus 6p and iPhone 7. Nevertheless, this new attack model usually only applies for device-to-host attack senario, where a firmware bug is needed to fully control the device. Unfortunately, DMA related interfaces are not exposed to userland applications directly. With months of research, we found an exception case on iOS device: the Apple Graphics. At MOSEC confe...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0240
ATT&CK Technique Name:ROKRAT
ROKRAT relies on a specific victim hostname to execute and decrypt important strings.[12]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

title:blackhat:us-21 Qualcomm WiFi: Infinity War
Qualcomm is the chip manufacturer with the highest market share in smart phones. With hundreds of millions of devices using Qualcomm WiFi chips, any security issue can cause a big impact on users, among which, 0-click remote/adjacent attack surface is always the most concerning attack surface by security researchers as they require no user interaction, thus attacks can be performed in a silent manner. Furthermore, as one of the most important short-distance communication protocols, WiFi must be a major target of attackers.This topic will explain to the audience the security risks faced by Qualcomm WiFi as well as its mitigations, illustrated by eight of the latest 0-click remote vulnerabilities we discovered. On the other hand, although the flagship Snapdragon 865 of Qualcomm in 2020 has made a lot of changes and security enhancements in WiFi, we still managed to find more security issues by conducting in-depth security research on the WiFi module of sdm865. In this talk, we also share our methodology in regards to reverse engineering and exploitation of WiFi in sdm865.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G1005
ATT&CK Technique Name:POLONIUM
POLONIUM has obtained and used tools such as AirVPN and plink in their operations.[39]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0543
ATT&CK Technique Name:Spark
Spark has encoded communications with the C2 server with base64.[85]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0516
ATT&CK Technique Name:SoreFang
SoreFang can download additional payloads from C2.[421][422]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M0813
ATT&CK Technique Name:Software Process and Device Authentication
Devices should authenticate all messages between master and outstation assets.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:C0013
ATT&CK Technique Name:Operation Sharpshooter
During Operation Sharpshooter, a first-stage downloader installed Rising Sun to %Startup%\mssync.exe on a compromised host.[189]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0411
ATT&CK Technique Name:Rotexy
Rotexy retrieves a list of installed applications and sends it to the command and control server.[25]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0409
ATT&CK Technique Name:Machete
Machete sends stolen data to the C2 server every 10 minutes.[12]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:C0006
ATT&CK Technique Name:Operation Honeybee
During Operation Honeybee, the threat actors used a malicious DLL to search for files with specific keywords.[217]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0061
ATT&CK Technique Name:FIN8
FIN8 harvests credentials using Invoke-Mimikatz or Windows Credentials Editor (WCE).[31]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0351
ATT&CK Technique Name:Cannon
Cannon adds the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon to establish persistence.[3]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M0953
ATT&CK Technique Name:Data Backup
Take and store data backups from end user systems and critical servers. Ensure backup and storage systems are hardened and kept separate from the corporate network to prevent compromise.  Maintain and exercise incident response plans  [8], including the management of gold-copy back-up images and configurations for key systems to enable quick recovery and response from adversarial activities that impact control, view, or availability.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0122
ATT&CK Technique Name:Silent Librarian
Silent Librarian has acquired domains to establish credential harvesting pages, often spoofing the target organization and using free top level domains .TK, .ML, .GA, .CF, and .GQ.[57][58][59][60][61][62]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

titleblackhat:eu-18 RustZone: Writing Trusted Applications in Rust
Trusted Execution Environments (TEEs) are present in many devices today, and are used to perform security critical computation in an isolated environment. ARM's TrustZone is one of the most widely used TEEs in the world today, present in nearly every modern Android device.TrustZone allows developers to write applications that run in a "Secure World" with hardware isolation of resources. Most implementations use a Trusted Operating System to run multiple Trusted Applications.However, Trusted Applications are still written in C, and many common classes of vulnerabilities have been found in these applications. While TrustZone provides isolation of resources, it cannot prevent against vulnerable code.In this talk, we will explore using the Rust language to write a Trusted Application. Rust allows developers to write system level code, but provides security features including memory safety, type safety, and error handling. These are desirable features for development of Trusted Applications.We will begin with an overview of TrustZone and Rust language, then show how Rust can be used to develop a Trusted Application. To conclude, we will demo a Trusted Application on real TrustZone hardware.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1022
ATT&CK Technique Name:Restrict File and Directory Permissions
Restrict read/write access to system-level process files to only select privileged users who have a legitimate need to manage system services.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:T1556.001
ATT&CK Technique Name:Domain Controller Authentication
Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:T1574.001
ATT&CK Technique Name:DLL Search Order Hijacking
Adversaries may execute their own malicious payloads by hijacking the search order used to load DLLs. Windows systems use a common method to look for required DLLs to load into a program.  Hijacking DLL loads may be for the purpose of establishing persistence as well as elevating privileges and/or evading restrictions on file execution.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0096
ATT&CK Technique Name:APT41
APT41 modified legitimate Windows services to install malware backdoors.[15][16] APT41 created the StorSyncSvc service to provide persistence for Cobalt Strike.[17]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0267
ATT&CK Technique Name:FELIXROOT
FELIXROOT collects a list of running processes.[100]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0078
ATT&CK Technique Name:Gorgon Group
Gorgon Group attempted to get users to launch malicious Microsoft Office attachments delivered via spearphishing emails.[103]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0477
ATT&CK Technique Name:Goopy
Goopy has the ability to communicate with its C2 over DNS.[23]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:T1614
ATT&CK Technique Name:System Location Discovery
Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from System Location Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0047
ATT&CK Technique Name:Gamaredon Group
Gamaredon Group has injected malicious macros into all Word and Excel documents on mapped network drives.[6]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S1012
ATT&CK Technique Name:PowerLess
PowerLess can use an encrypted channel for C2 communications.[11]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0337
ATT&CK Technique Name:BadPatch
BadPatch can download and execute or update malware.[55]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:T1030
ATT&CK Technique Name:Data Transfer Size Limits
An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds. This approach may be used to avoid triggering network data transfer threshold alerts.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0050
ATT&CK Technique Name:APT32
APT32 modified Windows Services to ensure PowerShell scripts were loaded on the system. APT32 also creates a Windows service to establish persistence.[11][12][13]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M0945
ATT&CK Technique Name:Code Signing
Utilize code signatures to verify the integrity of the installed program on safety or control assets has not been changed.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0081
ATT&CK Technique Name:Tropic Trooper
Tropic Trooper sent spearphishing emails that contained malicious Microsoft Office and fake installer file attachments.[234][235][236][237][238]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0240
ATT&CK Technique Name:ROKRAT
ROKRAT can extract clipboard data from a compromised host.[40]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0176
ATT&CK Technique Name:Wingbird
Wingbird uses services.exe to register a new autostart service named "Audit Service" using a copy of the local lsass.exe file.[137][138]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0094
ATT&CK Technique Name:Kimsuky
Kimsuky has created email accounts for phishing operations.[6]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

title:botconf2013 Legal limits of proactive actions: Coreflood botnet example
Passive defense mechanisms are necessary component of well-designed cyber defense programs but they are no longer sufficient to address increasingly sophisticated threats. Thus, addressing the threats more comprehensively may require additional mechanisms. So, active cyber defense is consist of proactive actions to prevent, detect and respond to attacks and provide real-time capability to discover, detect, analyze and mitigate threats and vulnerabilities. However, this mechanism raise some legal problems. Coreflood Botnet Takedown Operation is a good example of it. Some argue that it breaches personal privacy but others assert that it eliminates a known threat to that victim’s privacy and financial security. Thus trying to set the legal limits of actions or propose a legal model for actions (stop C&C, eliminate botnets or to step forward and eliminate malware) becomes significant. In this regard consent based theories has to be evaluated.
pdf下载:https://www.botconf.eu/wp-content/uploads/formidable/2/05-Coreflood-OguzKaanPehlivan-1.pdf


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1020
ATT&CK Technique Name:SSL/TLS Inspection
If it is possible to inspect HTTPS traffic, the captures can be analyzed for connections that appear to be domain fronting.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

title:blackhat:us-20 Breaking Samsung's Root of Trust: Exploiting Samsung S10 Secure Boot
Being the highest market share smartphone manufacturer, Samsung conducts a series of protection on Android called Knox Platform to ensure the security of its smartphones. During the booting process, Samsung uses S-boot (Secure Boot) to make sure it can only boot a stocked image. If the device tries to boot a custom image, it will trip a one-time programmable bit e-fuse (a.k.a Knox bit). Once a trustzone app (trustlet) detects the Knox bit tripped, it will delete the encryption key for the sensitive data to prevent unauthorized data access to the locked phone.In this presentation, we'll present several vulnerabilities we found in S-Boot that are related to USB request handling. By exploiting these vulnerabilities, we're allowed to bypass the mitigation of S-boot through the USB device and obtain code execution in early boot stage. In other words, as long as we have the phone (whether locked or not) and an USB-C connector, we'll be able to boot a custom image without tripping the Knox bit, allowing us to retrieve sensitive data from a locked device.We will also describe how we discover and exploit the vulnerabilities in detail, demonstrate the exploit on a Samsung Galaxy S10 smartphone, and discuss the possible impact of these vulnerabilities.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0040
ATT&CK Technique Name:Patchwork
A Patchwork file stealer can run a TaskScheduler DLL to add persistence.[128]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0449
ATT&CK Technique Name:Maze
Maze has injected the malware DLL into a target process.[44][45]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1034
ATT&CK Technique Name:Limit Hardware Installation
Limit the use of USB devices and removable media within a network.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1021
ATT&CK Technique Name:Restrict Web-Based Content
If a link is being visited by a user, block unknown or unused files in transit by default that should not be downloaded or by policy from suspicious sites as a best practice to prevent some vectors, such as .scr, .exe, .pif, .cpl, etc. Some download scanning devices can open and analyze compressed and encrypted formats, such as zip and rar that may be used to conceal malicious files.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0661
ATT&CK Technique Name:FoggyWeb
FoggyWeb can remotely exfiltrate sensitive information from a compromised AD FS server.[46]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0638
ATT&CK Technique Name:Babuk
Babuk has the ability to check running processes on a targeted system.[21][22][23]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0649
ATT&CK Technique Name:SMOKEDHAM
SMOKEDHAM has added user accounts to local Admin groups.[14]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1032
ATT&CK Technique Name:Multi-factor Authentication
Require multi-factor authentication for SSH connections wherever possible, such as password protected SSH keys.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

title:blackhat:us-21 Deepfake Social Engineering: Creating a Framework for Synthetic Media Social Engineering
How do you know that you are actually talking to the person you think you are talking to? Deepfake and related synthetic media technologies represent the greatest revolution in social engineering capabilities over the past century. In recent years, scammers have used synthetic audio in vishing attacks to impersonate executives to convince employees to wire funds to unauthorized accounts. In March 2021, the FBI warned the security community to expect a significant increase in synthetic media enabled scams over the next 18 months. The security community is at a highly dynamic moment in history in which the world is transitioning away from being able to trust what we experience with our own eyes and ears. This presentation proposes the Synthetic Media Social Engineering framework to describe these attacks and offers some easy to implement, human-centric countermeasures. The Synthetic Media Social Engineering framework encompasses five dimensions: Medium (text, audio, video, or a combination), Interactivity (pre-recorded, asynchronously, or Real-Time), Control (human puppeteer, software, or a hybrid), Familiarity (unfamiliar, familiar, close), and Intended Target (human or automation, an individual target, or a broader audience). While several technology-based methods to detect synthetic media currently exist, this work focuses discussion on human centered countermeasures to Synthetic Media Social Engineering attacks because most technology-based solutions are not readily available to the average user and are difficult to apply in real-time. Behavior-focused methods can teach users to spot inconsistencies between behaviors of the legitimate person and a Synthetic Media Social Engineering puppet. Proof-of-life statements will effectively counter most virtual kidnappings. Financial transfers should require either multi-factor authentication (MFA) or multi-person a...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0440
ATT&CK Technique Name:Agent Smith
Agent Smith’s core malware is disguised as a JPG file, and encrypted with an XOR cipher.[1]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0194
ATT&CK Technique Name:PowerSploit
PowerSploit contains a collection of CodeExecution modules that inject code (DLL, shellcode) into a process.[52][53]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0467
ATT&CK Technique Name:TajMahal
TajMahal has the ability to capture VoiceIP application audio on an infected host.[37]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0013
ATT&CK Technique Name:PlugX
PlugX has a module to download and execute files on the compromised machine.[347][348]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0022
ATT&CK Technique Name:APT3
APT3 has been known to remove indicators of compromise from tools.[1]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0274
ATT&CK Technique Name:Calisto
Calisto uses a hidden directory named .calisto to store data from the victim’s machine before exfiltration.[17][18]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0692
ATT&CK Technique Name:SILENTTRINITY
SILENTTRINITY can enumerate and collect the properties of domain computers.[81]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0604
ATT&CK Technique Name:Industroyer
The Industroyer IEC 61850 payload component has the ability to discover relevant devices in the infected host's network subnet by attempting to connect on port 102.[6]Industroyer contains an OPC DA module that enumerates all OPC servers using the ICatInformation::EnumClassesOfCategories method with CATID_OPCDAServer20 category identifier and IOPCServer::GetStatus to identify the ones running.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0260
ATT&CK Technique Name:InvisiMole
InvisiMole can be launched by using DLL search order hijacking in which the wrapper DLL is placed in the same folder as explorer.exe and loaded during startup into the Windows Explorer process instead of the legitimate library.[25]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1024
ATT&CK Technique Name:Restrict Registry Permissions
Consider using Group Policy to configure and block modifications to service and other critical server parameters in the Registry.[3]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0239
ATT&CK Technique Name:Bankshot
Bankshot searches for certain Registry keys to be configured before executing the payload.[10]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

title:blackhat:asia-23 The Various Shades of Supply Chain: SBOM, N-Days and Zero Trust
Over the past two years, attacks on multiple targets in the semiconductor industry have consistently led to leaks of firmware source code. A compromised developer device could potentially give an attacker access to the source code repository, adding a major gap in the security of the software supply chain. There are multiple policies in place to improve transparency in the firmware supply chain in general, but implementing and adopting them will take years. The technology industry is in the midst of active discussions about the use of "software bill of materials" (SBOMs) to address supply chain security risks.In order to implement supply chain security practices, there must be better transparency on software dependencies. Previously, any piece of software shipped as black-box without providing any information related to software dependencies and third-party components. Firmware has largely been looked at in the same way. We already discussed in our previous talks the multiple levels of complexity in the UEFI firmware ecosystem and supply chain taxonomy and we already discussed the firmware supply chain complexity topics regarding the firmware update delivery and how the timing plays a negative role to give an attackers advantage to adopt already known vulnerabilities (N-days) to their attacks in last year's research "The Firmware Supply-Chain Security Is Broken: Can We Fix It?".The silicon vendor reference code vulnerabilities are always the worst since impacting the whole industry and all the device vendors have used the same chips on their devices. When it comes to applying mitigations, how does the industry take advantage of them, and who controls their adoption in the firmware? Those are all good questions, but unfortunately, no positive news can be shared. The system firmware attack vectors will be discussed in this talk from the perspective of attacking the operating system ...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0378
ATT&CK Technique Name:PoshC2
PoshC2 has modules for keystroke logging and capturing credentials from spoofed Outlook authentication messages.[137]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:C0001
ATT&CK Technique Name:Frankenstein
During Frankenstein, the threat actors used Empire to automatically gather the username, domain name, machine name, and other system information.[12]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M0921
ATT&CK Technique Name:Restrict Web-Based Content
If a link is being visited by a user, block unknown or unused files in transit by default that should not be downloaded or by policy from suspicious sites as a best practice to prevent some vectors, such as .scr, .exe, .pif, .cpl, etc. Some download scanning devices can open and analyze compressed and encrypted formats, such as zip and rar that may be used to conceal malicious files.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G1001
ATT&CK Technique Name:HEXANE
HEXANE has identified executives, HR, and IT staff at victim organizations for further targeting.[2][3]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0375
ATT&CK Technique Name:Remexi
Remexi gathers and exfiltrates keystrokes from the machine.[152]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:T1606.001
ATT&CK Technique Name:Web Cookies
Adversaries may forge web cookies that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies to authenticate and authorize user access.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0526
ATT&CK Technique Name:KGH_SPY
KGH_SPY can send a file containing victim system information to C2.[95]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0262
ATT&CK Technique Name:QuasarRAT
QuasarRAT can obtain passwords from common FTP clients.[35][36]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S1034
ATT&CK Technique Name:StrifeWater
StrifeWater has the ability to take screen captures.[163]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1031
ATT&CK Technique Name:Network Intrusion Prevention
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

titleblackhat:us-20 Beyond Root: Custom Firmware for Embedded Mobile Chipsets
Rooting a smartphone is often considered the ultimate method to allow a user to take complete control of their device. Despite this, many smartphones contain hardware which is closed off to any modification. This talk aims to show how this hardware can be reverse engineered in order to bypass its protections and further expand its functionality.
Using proprietary NFC Controllers as an example, we will cover analysis of the protocols used by the chips, how the firmware protections could be broken, and how custom firmware could be developed and deployed to the phone with no hardware modifications. This will include methodologies for analysing weaknesses in firmware update protocols, leveraging the Unicorn CPU Emulator to bypass debugging restrictions, and techniques for reverse engineering the hardware capabilities of an unknown chip in order to implement custom features. This will end with demonstration of a smartphone with passive NFC sniffing capabilities and expanded tag emulation functionality.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0482
ATT&CK Technique Name:Bundlore
Bundlore has obfuscated data with base64, AES, RC4, and bz2.[66]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0172
ATT&CK Technique Name:Reaver
Reaver encrypts collected data with an incremental XOR key prior to exfiltration.[35]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0363
ATT&CK Technique Name:Empire
Empire contains modules that can discover and exploit search order hijacking vulnerabilities.[5]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

title:blackhat:us-18 Breaking Parser Logic: Take Your Path Normalization off and Pop 0days Out!
We propose a new exploit technique that brings a whole-new attack surface to defeat path normalization, which is complicated in implementation due to many implicit properties and edge cases. This complication, being under-estimated or ignored by developers for a long time, has made our proposed attack vector possible, lethal, and general. Therefore, many 0days have been discovered via this approach in popular web frameworks written in trending programming languages, including Python, Ruby, Java, and JavaScript.
Being a very fundamental problem that exists in path normalization logic, sophisticated web frameworks can also suffer. For example, we've found various 0days on Java Spring Framework, Ruby on Rails, Next.js, and Python aiohttp, just to name a few. This general technique can also adapt to multi-layered web architecture, such as using Nginx or Apache as a proxy for Tomcat. In that case, reverse proxy protections can be bypassed. To make things worse, we're able to chain path normalization bugs to bypass authentication and achieve RCE in real world Bug Bounty Programs. Several scenarios will be demonstrated to illustrate how path normalization can be exploited to achieve sensitive information disclosure, SMB-Relay and RCE.
Understanding the basics of this technique, the audience won't be surprised to know that more than 10 vulnerabilities have been found in sophisticated frameworks and multi-layered web architectures aforementioned via this technique.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0089
ATT&CK Technique Name:The White Company
The White Company has used phishing lure documents that trick users into opening them and infecting their computers.[237]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0096
ATT&CK Technique Name:APT41
APT41 has transferred implant files using Windows Admin Shares.[10]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S1067
ATT&CK Technique Name:FluBot
FluBot can retrieve the contacts list from an infected device.[17]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

title:blackhat:us-20 IoT Skimmer: Energy Market Manipulation through High-Wattage IoT Botnets
Despite the many conveniences afforded by Internet of Things (IoT) devices, their rapid and global deployment has increased the attack vector and raised serious security and privacy concerns for enterprise users and customers. Vulnerable IoT devices can be hacked and harnessed into giant botnets that threaten even properly secured networks. In this talk, we will present IoT Skimmer, a hierarchical structure which leverages the potential of high-wattage IoT botnets to slightly manipulate the total demand of the power grid and attack deregulated electricity markets. Our proposed approach is the first energy market manipulation cyberattack and presents two attacker models based on the adversary's motivation and end goal: i) the attacker can cause maximum financial profit/damage to a particular market player (e.g., power plant owner or power utility), and ii) the attacker can cause financial damage to the entire market players.Attacker one aims to alter the electricity price in the energy market by slightly changing the total power demand of the system and gain monetary profits for particular market players while causing financial loss to the rest. Attacker two, the nation state actor, leverages a nonlinear attack model to cause financial damage to the entire energy market and all its players, which may be weaponized as part of a trade/cold war.We have defined and analyzed several stealth strategies such that the attacks remain stealthy from both the market operator and end users' perspectives. The performance of the proposed attacks is evaluated with real-world datasets acquired from two of the largest energy markets in the US, New York, and California. The obtained results illustrate the huge economic impact of IoT Skimmer attack on the studied markets. Finally, a set of technical recommendations are proposed to reduce the vulnerability and attack vector, thereby decreasing t...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

title:blackhat:eu-19 Booting the iOS Kernel to an Interactive Bash Shell on QEMU
Booting the iOS kernel on QEMU with an interactive bash shell and a live debugger attached to the kernel. A major step forward in the direction of having a full iOS open source system emulator on QEMU. The research details and demo will be presented in this talk.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0659
ATT&CK Technique Name:Diavol
Diavol can collect the username from a compromised host.[49]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0045
ATT&CK Technique Name:menuPass
menuPass has used the Csvde tool to collect Active Directory files and data.[23]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0555
ATT&CK Technique Name:CHEMISTGAMES
CHEMISTGAMES can download new modules while running.[9]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0521
ATT&CK Technique Name:BloodHound
BloodHound can collect information about local groups and members.[2]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0625
ATT&CK Technique Name:Cuba
Cuba can discover shared resources using the NetShareEnum API call.[26]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0182
ATT&CK Technique Name:FinFisher
FinFisher has used the KernelCallbackTable to hijack the execution flow of a process by replacing the __fnDWORD function with the address of a created Asynchronous Procedure Call stub routine.[2]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0060
ATT&CK Technique Name:BRONZE BUTLER
BRONZE BUTLER has used a tool to capture screenshots.[27][28]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0490
ATT&CK Technique Name:XLoader for iOS
XLoader for iOS can obtain the device’s UDID, version number, and product number.[42]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0427
ATT&CK Technique Name:TrickMo
TrickMo can inject input to set itself as the default SMS handler, and to automatically click through pop-ups without giving the user any time to react.[13]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0098
ATT&CK Technique Name:T9000
T9000 can take screenshots of the desktop and target application windows, saving them to user directories as one byte XOR encrypted .dat files.[166]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0094
ATT&CK Technique Name:Kimsuky
Kimsuky can gather a list of all processes running on a victim's machine.[146]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0268
ATT&CK Technique Name:Bisonal
Bisonal has used the MPRESS packer and similar tools for obfuscation.[19]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0353
ATT&CK Technique Name:NOKKI
NOKKI uses a unique, custom de-obfuscation technique.[158]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0412
ATT&CK Technique Name:ZxShell
ZxShell can disable the firewall by modifying the registry key HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile.[37]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0463
ATT&CK Technique Name:INSOMNIA
INSOMNIA can collect the device’s phone number, ICCID, IMEI, and the currently active network interface (Wi-Fi or cellular).[18]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0260
ATT&CK Technique Name:InvisiMole
InvisiMole can use Data Protection API to encrypt its components on the victim’s computer, to evade detection, and to make sure the payload can only be decrypted and loaded on one specific compromised computer.[10]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0534
ATT&CK Technique Name:Bazar
Bazar can establish persistence by writing shortcuts to the Windows Startup folder.[6][7]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:T1560.001
ATT&CK Technique Name:Archive via Utility
Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

title:blackhat:us-22 Go With the Flow: Enforcing Program Behavior Through Syscall Sequences and Origins
Over the years, applications increased in size and complexity, and with that also the number of vulnerabilities. Both industry and academia have proposed countermeasures to harden applications against potential attacks. For instance, control-flow integrity (CFI) tries to limit control-flow transfers within an application to transfers that are possible based on the program source code. Unfortunately, such countermeasures only work within one security domain, e.g., only on the userspace level. Once they are circumvented, an attacker can arbitrarily interact with other domains, such as the kernel.This talk presents our concept of syscall-flow-integrity protection (SFIP), limiting the control flow across security domains, i.e., user-to-kernel transfers. By design, it is fully compatible with CFI and enhances the system's security in case that CFI is circumvented. SFIP relies on three pillars: syscall sequences that model the control flow of the application, syscall origins that map syscalls to the locations at which they can be invoked, and efficient enforcement of the information by the operating system. We identify 3 challenges in the extraction of the syscall sequences and origins, e.g., a non-bijective mapping between syscalls and syscall locations. We demonstrate a proof-of-concept implementation, called SysFlow, that solves these challenges and allows for automated syscall-flow-integrity protection of large-scale real-world applications with a runtime overhead of only 1.8%. To demonstrate that SFIP is a viable approach to reduce the attack surface of applications, we discuss how it increases the complexity of control-flow-hijacking and mimicry attacks and demonstrate how it can mitigate a real-world attack. Finally, we analyze syscall sequences and origins of several real-world applications, effectively demonstrating an attack surface reduction of 90.9% compared...


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0018
ATT&CK Technique Name:admin@338
admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about the OS: ver >> %temp%\download systeminfo >> %temp%\download[9]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0040
ATT&CK Technique Name:Patchwork
Patchwork has obfuscated a script with Crypto Obfuscator.[66]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0147
ATT&CK Technique Name:Pteranodon
Pteranodon can use a dynamic Windows hashing algorithm to map API components.[10]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M0946
ATT&CK Technique Name:Boot Integrity
Check the integrity of the existing BIOS or EFI to determine if it is vulnerable to modification. Use Trusted Platform Module technology. [2] Move system's root of trust to hardware to prevent tampering with the SPI flash memory. [3] Technologies such as Intel Boot Guard can assist with this. [4]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0610
ATT&CK Technique Name:SideTwist
SideTwist has primarily used port 443 for C2 but can use port 80 as a fallback.[43]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S1061
ATT&CK Technique Name:AbstractEmu
AbstractEmu can send large amounts of device data over its C2 channel, including the device’s manufacturer, model, version and serial number, telephone number, and IP address.[1]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

title:botconf2015 Automatically classifying unknown bots by the register messages
The ever-increasing number of malware/botnet samples demands efficient and scalable classification solution for better detection and prevention. C&C protocol based classification has proved to be effective and accurate. However, it’s not trivial to acquire new samples’ detailed C&C protocol, which decreases the scalability of C&C based classification. In this talk we present a simplified classification solution, which is based on the C&C register message. Similarities in semantics/structure of register messages are studied and used. Because of the easier acquisition of register messages, we think our solution is easy to automate and has better scalability. The implementation details and evaluation result would be talked.
pdf下载:https://www.botconf.eu/wp-content/uploads/formidable/2/OK-P13-Liu-Ya-Automatically-Classify-Unknown-Bots-by-The-Register-Messages-2.pdf


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0053
ATT&CK Technique Name:SeaDuke
SeaDuke is capable of uploading and downloading files.[398]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0438
ATT&CK Technique Name:Attor
Attor's Blowfish key is encrypted with a public RSA key.[3]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0395
ATT&CK Technique Name:LightNeuron
LightNeuron can be configured to automatically collect files under a specified directory.[22]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0403
ATT&CK Technique Name:Riltok
Riltok communicates with the command and control server using HTTP requests.[23]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0134
ATT&CK Technique Name:Downdelph
After downloading its main config file, Downdelph downloads multiple payloads from C2 servers.[150]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0688
ATT&CK Technique Name:Meteor
Meteor can use WinAPI to remove a victim machine from an Active Directory domain.[123]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0439
ATT&CK Technique Name:Okrum
Okrum has used DriveLetterView to enumerate drive information.[214]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0182
ATT&CK Technique Name:FinFisher
FinFisher tracks the latitude and longitude coordinates of the infected device.[20]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0239
ATT&CK Technique Name:Bankshot
Bankshot generates a false TLS handshake using a public certificate to disguise C2 network communications.[2]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0629
ATT&CK Technique Name:RainyDay
RainyDay can create and register a service for execution.[43]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1026
ATT&CK Technique Name:Privileged Account Management
Review privileged cloud account permission levels routinely to look for those that could allow an adversary to gain wide access, such as Global Administrator and Privileged Role Administrator in Azure AD.[14][15][16] These reviews should also check if new privileged cloud accounts have been created that were not authorized. For example, in Azure AD environments configure alerts to notify when accounts have gone many days without using privileged roles, as these roles may be able to be removed.[17] Consider using temporary, just-in-time (JIT) privileged access to Azure AD resources rather than permanently assigning privileged roles.[16]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0398
ATT&CK Technique Name:HyperBro
HyperBro has used a legitimate application to sideload a DLL to decrypt, decompress, and run a payload.[28][29]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:T1484.001
ATT&CK Technique Name:Group Policy Modification
Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain. Group policy allows for centralized management of user and computer settings in Active Directory (AD). GPOs are containers for group policy settings made up of files stored within a predictable network path \<DOMAIN>\SYSVOL\<DOMAIN>\Policies\.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0094
ATT&CK Technique Name:Kimsuky
Kimsuky has used QuickZip to archive stolen files before exfiltration.[40]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0492
ATT&CK Technique Name:CookieMiner
CookieMiner has checked for the presence of "Little Snitch", macOS network monitoring and application firewall software, stopping and exiting if it is found.[23]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:C0012
ATT&CK Technique Name:Operation CuckooBees
During Operation CuckooBees, attackers used a signed kernel rootkit to establish additional persistence.[15]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0093
ATT&CK Technique Name:GALLIUM
GALLIUM has used a variety of widely-available tools, which in some cases they modified to add functionality and/or subvert antimalware solutions.[53]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0112
ATT&CK Technique Name:Windshift
Windshift has exfiltrated local account data and calendar information as part of Operation ROCK.[34]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1040
ATT&CK Technique Name:Behavior Prevention on Endpoint
On Windows 10, update Windows Defender Application Control policies to include rules that block the older, vulnerable versions of PubPrn.[4]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0334
ATT&CK Technique Name:DarkComet
DarkComet can execute various types of scripts on the victim’s machine.[13]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0082
ATT&CK Technique Name:APT38
APT38 have created firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443.[2]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M0930
ATT&CK Technique Name:Network Segmentation
Segment operational network and systems to restrict access to critical system functions to predetermined management systems. [2]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0010
ATT&CK Technique Name:Turla
Turla and its RPC backdoors have used APIs calls for various tasks related to subverting AMSI and accessing then executing commands through RPC and/or named pipes.[177]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0660
ATT&CK Technique Name:Clambling
Clambling has the ability to use TCP and UDP for communication.[16]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0065
ATT&CK Technique Name:Leviathan
Leviathan has used BITSAdmin to download additional tools.[18]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0279
ATT&CK Technique Name:Proton
Proton modifies the tty_tickets line in the sudoers file.[6]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:C0024
ATT&CK Technique Name:SolarWinds Compromise
During the SolarWinds Compromise, APT29 obtained information about the configured Exchange virtual directory using Get-WebServicesVirtualDirectory.[281]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0082
ATT&CK Technique Name:APT38
APT38 uses a tool called CLEANTOAD that has the capability to modify Registry keys.[12]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0198
ATT&CK Technique Name:NETWIRE
NETWIRE can inject code into system processes including notepad.exe, svchost.exe, and vbc.exe.[40]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0060
ATT&CK Technique Name:BRONZE BUTLER
BRONZE BUTLER has used legitimate applications to side-load malicious DLLs.[13]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

title:blackhat:us-22 RCE-as-a-Service: Lessons Learned from 5 Years of Real-World CI/CD Pipeline Compromise
In the past 5 years, we've demonstrated countless supply chain attacks in production CI/CD pipelines for virtually every company we've tested, with several dozen successful compromises of targets ranging from small businesses to Fortune 500 companies across almost every market and industry. In this presentation, we'll explain why CI/CD pipelines are the most dangerous potential attack surface of your software supply chain. To do this, we'll discuss the sorts of technologies we frequently encounter, how they're used, and why they are the most highly privileged and valuable targets in your company's entire infrastructure. We'll then discuss specific examples (with demos!) of novel abuses of intended functionality in automated pipelines which allow us to turn the build pipelines from a simple developer utility into Remote Code Execution-as-a-Service. Is code-signing leading your team into a false sense of security while you programmatically build someone else's malware? Is it true that "any sufficiently advanced attacker is indistinguishable from one of your developers"? Have we critically compromised nearly every CI/CD pipeline we've ever touched? The answer to all of these questions is yes. Fortunately, this presentation will not only teach you exactly how we did it and the common weaknesses we see in these environments, but also share key defensive takeaways that you can immediately apply to your own development environments.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0368
ATT&CK Technique Name:NotPetya
NotPetya creates a task to reboot the system one hour after infection.[118]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

titleblackhat:us-19 ClickOnce and You're in - When Appref-ms Abuse is Operating as Intended
As tried-and-true methods of code execution via phishing are getting phased out, new research was required to maintain that avenue of gaining initial access. Sifting through different file types and how they operate led to further examination of the ".Appref-ms" extension, utilized by Microsoft's ClickOnce. This research led down a long and winding road, not only resulting in some new updates to be applied to our phishing methodology but an innovative method for C2 management as well - all while staying within the means of how appref-ms is intended to be used.Follow us down the rabbit hole as we delve into what an .appref-ms file is, how it operates, and some of the methods discovered that can be leveraged to deploy our own nefarious purposes. We will also provide insight on what this execution looks like from the user's perspective, and additional steps that can be taken throughout deployment to further mask and enhance these malicious capabilities.To play our own devil's advocate, we will also cover potential indicators of compromise that result from appref-ms abuse in addition to some preemptive measures that can be deployed to protect against it. Appref-ms abuse has the potential to be a great addition to any security tester's toolkit. It runs natively on Windows 10 and 7, blends in with normal operations, and is an easily adaptable method of code delivery and execution. It's up to you to determine how to use it.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0125
ATT&CK Technique Name:HAFNIUM
HAFNIUM has used open-source C2 frameworks, including Covenant.[151]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0024
ATT&CK Technique Name:Dyre
Dyre can detect sandbox analysis environments by inspecting the process list and Registry.[16][17]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0555
ATT&CK Technique Name:CHEMISTGAMES
CHEMISTGAMES can collect files from the filesystem and account information from Google Chrome.[5]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0199
ATT&CK Technique Name:TURNEDUP
TURNEDUP is capable of injecting code into the APC queue of a created Rundll32 process as part of an "Early Bird injection."[2]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0601
ATT&CK Technique Name:Hildegard
Hildegard has searched for SSH keys, Docker credentials, and Kubernetes service tokens.[3]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0049
ATT&CK Technique Name:OilRig
OilRig has encrypted and encoded data in its malware, including by using base64.[232][233][234][235][236]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0316
ATT&CK Technique Name:Pegasus for Android
Pegasus for Android accesses call logs.[15]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0182
ATT&CK Technique Name:FinFisher
FinFisher clears the system event logs using  OpenEventLog/ClearEventLog APIs .[13][14]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0650
ATT&CK Technique Name:QakBot
QakBot can modify the Registry to store its configuration information in a randomly named subkey under HKCU\Software\Microsoft.[125][126]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

title:blackhat:us-22 Smishmash - Text Based 2fa Spoofing Using OSINT, Phishing Techniques and a Burner Phone
In recent years the data leaks have escalated, and leaked passwords and usernames have become a common attack vector in phishing attacks. Until recently phone numbers were commonly overlooked by attackers as well as red teams. This year has seen an increase in attacks circumventing text based 2fa.In this talk, the researchers will show how it's possible to gather data from publicly available sources and connect the phone numbers most likely used by two factor authentication systems to other leaked email and login credentials. We will simulate an attack armed with your cracked password, email address and phone number.We will show techniques and methods used by real threat actors to bypass text based 2fa using only publicly leaked data using real time attack by indexing OSINT data combined with publicly available attack tools and frameworks.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:T1055.005
ATT&CK Technique Name:Thread Local Storage
Adversaries may inject malicious code into processes via thread local storage (TLS) callbacks in order to evade process-based defenses as well as possibly elevate privileges. TLS callback injection is a method of executing arbitrary code in the address space of a separate live process.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0007
ATT&CK Technique Name:APT28
APT28 has used a variety of public exploits, including CVE 2020-0688 and CVE 2020-17144, to gain execution on vulnerable Microsoft Exchange; they have also conducted SQL injection attacks against external websites.[10][11]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:C0006
ATT&CK Technique Name:Operation Honeybee
During Operation Honeybee, threat actors installed DLLs and backdoors as Windows services.[85]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M0813
ATT&CK Technique Name:Software Process and Device Authentication
To protect against AiTM, authentication mechanisms should not send credentials across the network in plaintext and should also implement mechanisms to prevent replay attacks (such as nonces or timestamps). Challenge-response based authentication techniques that do not directly send credentials over the network provide better protection from AiTM.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

titleblackhat:us-21 Your Software IS/NOT Vulnerable: CSAF, VEX, and the Future of Advisories
As more attention is paid to security and the underlying components used in developing software, more organizations will be sending out security advisories. As SBOMs become more widespread, many of these advisories will actually be "false positives," when the underlying component vulnerability isn't actually exploitable. Organizations developing and using software will thus face an increasing amount of information to process and prioritize if they want to address the constantly evolving risk.The German and US governments have ended up partnering to coordinate industry-led initiatives to help automate the production, consumption, and scale of advisories, with particular attention to non-traditional software areas like ICS and healthcare. The Common Security Advisory Framework (CSAF) is an OASIS project that seeks to help automate the creation, management, and use of machine-readable vulnerability-related advisories. This talk will further introduce a key idea at the intersection of advisories and SBOM: the "Vulnerability Exploitability eXchange" (VEX) that allows software providers to explicitly communicate that they are *not* affected by a vulnerability. We close with an overview of the policy context to help practitioners understand where the world of SBOM and advisories is heading.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0038
ATT&CK Technique Name:Stealth Falcon
Stealth Falcon malware creates a scheduled task entitled "IE Web Cache" to execute a malicious file hourly.[166]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0340
ATT&CK Technique Name:Octopus
Octopus can capture screenshots of the victims’ machine.[116][117][118]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0622
ATT&CK Technique Name:AppleSeed
AppleSeed has been distributed to victims through malicious e-mail attachments.[6]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M0807
ATT&CK Technique Name:Network Allowlists
Use host-based allowlists to prevent devices from accepting connections from unauthorized systems. For example, allowlists can be used to ensure devices can only connect with master stations or known management/engineering workstations. [2]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0436
ATT&CK Technique Name:TSCookie
TSCookie has the ability to inject code into the svchost.exe, iexplorer.exe, explorer.exe, and default browser processes.[64]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0077
ATT&CK Technique Name:Leafminer
Leafminer used several tools for retrieving login and password information, including LaZagne.[45]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0115
ATT&CK Technique Name:Crimson
Crimson can spread across systems by infecting removable media.[11]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0223
ATT&CK Technique Name:POWERSTATS
POWERSTATS has used useless code blocks to counter analysis.[31]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0657
ATT&CK Technique Name:BLUELIGHT
BLUELIGHT can use different cloud providers for its C2.[11]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0062
ATT&CK Technique Name:DustySky
DustySky collects information about running processes from victims.[85][86]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

title:blackhat:us-20 NoJITsu: Locking Down JavaScript Engines
Data-only attacks against dynamic scripting environments have become common. Web browsers and other modern applications embed scripting engines to support interactive content. The scripting engines optimize performance via just-in-time compilation. Since applications are increasingly hardened against code-reuse attacks, adversaries are looking to achieve code execution or elevate privileges by corrupting sensitive data like the intermediate representation of optimizing JIT compilers. This has inspired numerous defenses for just-in-time compilers.Our work demonstrates that securing JIT compilation is not sufficient. First, we present a proof-of-concept data-only attack against a recent version of Mozilla's SpiderMonkey JIT in which the attacker only corrupts heap objects to successfully issue a system call from within bytecode execution at run time. Previous work assumed that bytecode execution is safe by construction since interpreters only allow a narrow set of benign instructions and bytecode is always checked for validity before execution. We show that this does not prevent malicious code execution in practice. Second, we design a novel defense, dubbed NOJITSU to protect complex, real-world scripting engines from data-only attacks against interpreted code.The key idea behind our defense is to enable fine-grained memory access control for individual memory regions based on their roles throughout the JavaScript lifecycle. For this we combine automated analysis, instrumentation, compartmentalization, and Intel's Memory-Protection Keys to secure SpiderMonkey against existing and newly synthesized attacks. We implement and thoroughly test our implementation using a number of real-world scenarios as well as standard benchmarks. We show that NOJITSU successfully thwarts code-reuse as well as data-only attacks against any part of the scripting engine while offering a modest run-time overhead of only 5%.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0102
ATT&CK Technique Name:Wizard Spider
Wizard Spider has used RDP for lateral movement.[55][56][57]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

title:blackhat:us-21 How I Used a JSON Deserialization 0day to Steal Your Money on the Blockchain
Fastjson is a widely used open source JSON parser with 23'100 stars on GitHub. As a basic module of countless java web services, it serves hundreds of millions of users. We managed to find a way to bypass many security checks and mitigations by using the inheritance process of some basic classes, and achieve remote code execution successfully. We will disclose these high-risk and universal gadgets for the first time in this talk.Now, we can control many important websites and affect millions of users. Let's make things more interesting. We found that this fastjson vulnerability affects a multi-billion-dollar blockchain. We designed multiple complex gadgets based on the features of the blockchain, and exquisitely achieved information leakage and pointer hijacking. Putting all these gadgets together, we achieved remote code execution on the blockchain nodes.However, generally after remote code execution, we seem to have no better exploit method other than the 51% attack, which will lead to serious accounting confusion. After a detailed analysis of the architecture design of the public blockchain, we found a way from RCE to steal the public blockchain users' assets almost without any notification.To the best of our knowledge, this is the first published attack case on the realization of covertly stealing user assets after RCE on the public blockchain nodes. We will propose a more covert post penetration exploit method for public blockchain nodes in this talk.Blockchain is not bulletproof to security vulnerability and we hope our work can notify blockchain developers and users to be more careful about security.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:C0001
ATT&CK Technique Name:Frankenstein
During Frankenstein, the threat actors used trojanized documents that retrieved remote templates from an adversary-controlled website.[15]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0456
ATT&CK Technique Name:Aria-body
Aria-body has used an encrypted configuration file for its loader.[38]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

title:blackhat:asia-19 Locknote: Conclusions and Key Takeaways from Black Hat Asia 2019
At the close of this year's conference, join Black Hat Founder Jeff Moss and members of the esteemed Black Hat Review Board for an insightful conversation on the most pressing issues facing the InfoSec community. This Locknote will feature a candid discussion on the key takeaways coming out of Black Hat Asia and how these trends will impact future InfoSec strategies.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0264
ATT&CK Technique Name:OopsIE
OopsIE can upload files from the victim's machine to its C2 server.[93]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0551
ATT&CK Technique Name:GoldenEagle
GoldenEagle has used HTTP POST requests for C2.[17]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0581
ATT&CK Technique Name:IronNetInjector
IronNetInjector can use an IronPython scripts to load a .NET injector to inject a payload into its own or a remote process.[31]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1024
ATT&CK Technique Name:Restrict Registry Permissions
Ensure proper Registry permissions are in place to prevent adversaries from disabling or interfering with security services.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0269
ATT&CK Technique Name:QUADAGENT
QUADAGENT has a command to delete its Registry key and scheduled task.[192]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0537
ATT&CK Technique Name:HyperStack
HyperStack can use default credentials to connect to IPC$ shares on remote machines.[5]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0526
ATT&CK Technique Name:KGH_SPY
KGH_SPY can enumerate files and directories on a compromised host.[164]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S1009
ATT&CK Technique Name:Triton
Triton uses a Python script that is capable of detecting Triconex controllers on the network by sending a specific UDP broadcast packet over port 1502. [8]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0534
ATT&CK Technique Name:Bazar
Bazar can use a timer to delay execution of core functionality.[9]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0680
ATT&CK Technique Name:LitePower
LitePower can use HTTP and HTTPS for C2 communications.[188]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0660
ATT&CK Technique Name:Clambling
Clambling has the ability to set its file attributes to hidden.[14]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0496
ATT&CK Technique Name:REvil
REvil can use the Windows command line to delete volume shadow copies and disable recovery.[282][283][284][285]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S1030
ATT&CK Technique Name:Squirrelwaffle
Squirrelwaffle has contained a hardcoded list of IP addresses to block that belong to sandboxes and analysis platforms.[21][22]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:C0021
ATT&CK Technique Name:C0021
During C0021, the threat actors used TCP for some C2 communications.[14]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

titleblackhat:us-21 Zero - The Funniest Number in Cryptography
What is the funniest number in cryptography? 0. The reason is that for all x, x*0 = 0, i.e., the equation is always satisfied no matter what x is.  This talk will explore crypto bugs in four BLS signatures' libraries (ethereum/py ecc, supranational/blst, herumi/bls, sigp/milagro bls) that revolve around 0. Furthermore, we developed "splitting zero" attacks to show a weakness in the proof-of-possession aggregate signature scheme standardized in BLS RFC draft v4. Eth2 bug bounties program generously awarded $35,000 in total for the reported bugs.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

title:botconf2016 Detecting the Behavioral Relationships of Malware Connections
A normal computer infected with malware is difficult to detect. There have been several approaches in the last years which analyze the behavior of malware and obtain good results. The malware traffic may be detected, but it is very common to miss-detect normal traffic as malicious and generate false positives. This is specially the case when the methods are tested in real and large networks. The detection errors are generated due to the malware changing and rapidly adapting its domains and patterns to mimic normal connections. To better detect malware infections and separate them from normal traffic we propose to detect the behavior of the group of connections generated by the malware. It is known that malware usually generates various related connections simultaneously and therefore it shows a group pattern. Based on previous experiments, this paper suggests that the behavior of a group of connections can be modelled as a directed cyclic graph with special properties, such as its internal patterns, relationships, frequencies and sequences of connections. By training the group models on known traffic it may be possible to better distinguish between a malware connection and a normal connection.
pdf下载:https://www.botconf.eu/wp-content/uploads/formidable/2/PR16-Detecting-the-Behavioral-Relationships-of-Malware-Connections-GARCIA.pdf


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M0919
ATT&CK Technique Name:Threat Intelligence Program
Develop a robust cyber threat intelligence capability to determine what types and levels of threat may use software exploits and 0-days against a particular organization.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0395
ATT&CK Technique Name:LightNeuron
LightNeuron is capable of starting a process using CreateProcess.[109]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S1011
ATT&CK Technique Name:Tarrask
Tarrask may abuse the Windows schtasks command-line tool to create "hidden" scheduled tasks.[325]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

title:botconf2016 A Tete-a-Tete with RSA Bots
The expansion and specifically the sophistication of botnets has brought with it an increased use of cryptography for safe-guarding communication channels between bots and their command-and-control instances. Asymmetric encryption (or public-key cryptography) currently poses a major challenge for malware analysts. In this regard, understanding the communication protocol is a critical requirement in the analysis of botnets.The goal of this short-talk is to present a generic, fully automated method for tracking botnet communication protocols and a prototype implementation for recovering obfuscated network traffic. Our method arises from the need of constantly analyzing highly active botnet families while sparing significant reverse engineering effort. The results show that our approach successfully obtains changes in message structures by circumventing encryption and interacting directly with the bots.
pdf下载:https://www.botconf.eu/wp-content/uploads/formidable/2/PR14-Tete-aTete_with_RSA_Bots_presentation-FRIESS-2.pdf


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1051
ATT&CK Technique Name:Update Software
Update software regularly by employing patch management for internal enterprise endpoints and servers.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0575
ATT&CK Technique Name:Conti
Conti can enumerate through all open processes to search for any that have the string "sql" in their process name.[65]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

title:blackhat:us-19 GDPArrrrr: Using Privacy Laws to Steal Identities
On May 25, 2018 the European Union's General Data Protection Regulation (GDPR) came into effect, bringing with it the most expansive governmental effort to regulate data security and privacy to date. Among the GDPR's many provisions is the "Right of Access," which states that individuals have the right to access their personal data. This provision can be easily abused by social engineers to steal sensitive information that does not belong to them.My research centers on a practical case study wherein I attempted to steal as much information as possible about my fiancé (with her consent) using GDPR Subject Access Requests. In a survey of more than 150 companies, I demonstrate that organizations willingly provide highly sensitive information in response to GDPR right of access requests with little or no verification of the individual making the request. This ranges from typical sensitive identity data like addresses and credit card information to esoteric data such as a history of train journeys or a list of domains owned. While far too often no proof of identity is required at all, even in the best cases the GDPR permits someone capable of stealing or forging a driving license nearly complete access to your digital life. Moreover, the highly standardized nature of GDPR requests makes it possible to automate this process at immense scale and provides one of the most reliable general phishing attack typologies to date.This is a solvable problem, and one which could have been incorporated into the initial GDPR if regulatory legislation were subjected to security assessments like those used for modern software. The presentation suggests possible remediations and offers a cautionary tale for future policymakers designing GDPR-inspired privacy legislation. It also suggests short-term ways in which individuals and businesses seeking to protect themselves against these attacks.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1026
ATT&CK Technique Name:Privileged Account Management
Do not allow remote access to services as a privileged account unless necessary.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0352
ATT&CK Technique Name:OSX_OCEANLOTUS.D
OSX_OCEANLOTUS.D uses a shell script as the main executable inside an app bundle and drops an embedded base64-encoded payload to the /tmp folder.[34][35]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S1018
ATT&CK Technique Name:Saint Bot
Saint Bot has created a scheduled task named "Maintenance" to establish persistence.[154]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0184
ATT&CK Technique Name:POWRUNER
POWRUNER may collect domain group information by running net group /domain or a series of other commands on a victim.[24]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0624
ATT&CK Technique Name:Ecipekac
Ecipekac can download additional payloads to a compromised host.[159]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

title:botconf2019 The Cereals Botnet
A new under-the-radar botnet targeting Network Access Storage (NAS) and Network Video Recorder (NVR) devices, has been discovered. The botnet originates back to 2013, uses a known vulnerability for infection, and is still active as of today. Our research shows that it is infecting a range of devices from a well-known vendor in the consumer software space, however these devices are so popular that compromised examples can be found in both small businesses and governments alike. What makes this botnet unique is the way that it was built from stock components with only very few custom-built binaries; the separation of its subnets; and the way host nodes communicate with the C2. Years later the vendor fixed the targeted vulnerability, however, a large chunk of infected nodes’ firmware has either never been updated or the devices have not been restarted in years.
pdf下载:https://www.botconf.eu/wp-content/uploads/formidable/2/B2019-Neumann-Eberhardt-the_cereals_botnet_botconf_2019_final-2.pdf


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

title:blackhat:us-18 For the Love of Money: Finding and Exploiting Vulnerabilities in Mobile Point of Sales Systems
These days it's hard to find a business that doesn't accept faster payments. Mobile Point of Sales (mPOS) terminals have propelled this growth lowering the barriers for small and micro-sized businesses to accept non-cash payments. Older payment technologies like mag-stripe still account for the largest majority of all in-person transactions. This is complicated further by the introduction of new payment standards such as NFC. As with each new iteration in payment technology, inevitably weaknesses are introduced into this increasingly complex payment eco-system.In this talk, we ask what are the security and fraud implications of removing the economic barriers to accepting card payments; and what are the risks associated with continued reliance on old card standards like mag-stripe? In the past, testing for payment attack vectors has been limited to the scope of individual projects and to those that have permanent access to POS and payment infrastructure. Not anymore!In what we believe to be the most comprehensive research conducted in this area, we consider four of the major mPOS providers spread across the US and Europe; Square, SumUp, iZettle, and Paypal. We provide live demonstrations of new vulnerabilities that allow you to MitM transactions, send arbitrary code via Bluetooth and mobile application, modify payment values for mag-stripe transactions, and a vulnerability in firmware; DoS to RCE. Using this sampled geographic approach, we are able to show the current attack surface of mPOS and, to predict how this will evolve over the coming years.For audience members that are interested in integrating testing practices into their organization or research practices, we will show you how to use mPOS to identify weaknesses in payment technologies, and how to remain undetected in spite of anti-fraud and security mechanisms.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0034
ATT&CK Technique Name:NETEAGLE
If NETEAGLE does not detect a proxy configured on the infected machine, it will send beacons via UDP/6000. Also, after retrieving a C2 IP address and Port Number, NETEAGLE will initiate a TCP connection to this socket. The ensuing connection is a plaintext C2 channel in which commands are specified by DWORDs.[42]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0379
ATT&CK Technique Name:Revenge RAT
Revenge RAT creates a Registry key at HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell to survive a system reboot.[223]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0554
ATT&CK Technique Name:Egregor
Egregor has used DLL side-loading to execute its payload.[21]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S1013
ATT&CK Technique Name:ZxxZ
ZxxZ has been encoded to avoid detection from static analysis tools.[366]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0502
ATT&CK Technique Name:Drovorub
Drovorub can exfiltrate files over C2 infrastructure.[36]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:T1048.003
ATT&CK Technique Name:Exfiltration Over Unencrypted Non-C2 Protocol
Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1054
ATT&CK Technique Name:Software Configuration
Configure browsers or tasks to regularly delete persistent cookies.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1040
ATT&CK Technique Name:Behavior Prevention on Endpoint
Some endpoint security solutions can be configured to block some types of behaviors related to process injection/memory tampering based on common sequences of indicators (ex: execution of specific API functions).


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0439
ATT&CK Technique Name:Okrum
Okrum's loader can detect presence of an emulator by using two calls to GetTickCount API, and checking whether the time has been accelerated.[31]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0605
ATT&CK Technique Name:EKANS
EKANS uses encoded strings in its process kill list.[111]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0046
ATT&CK Technique Name:FIN7
FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems.[5]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0289
ATT&CK Technique Name:Pegasus for iOS
Pegasus for iOS update and sends the location of the phone.[28]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0012
ATT&CK Technique Name:PoisonIvy
PoisonIvy creates a Registry subkey that registers a new service. PoisonIvy also creates a Registry entry modifying the Logical Disk Manager service to point to a malicious DLL dropped to disk.[94]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0669
ATT&CK Technique Name:KOCTOPUS
KOCTOPUS will perform UAC bypass either through fodhelper.exe or eventvwr.exe.[39]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:C0025
ATT&CK Technique Name:2016 Ukraine Electric Power Attack
During the 2016 Ukraine Electric Power Attack, Sandworm Team used MS-SQL access to a pivot machine, allowing code execution throughout the ICS network.[5]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1025
ATT&CK Technique Name:Privileged Process Integrity
On Windows 8.1 and Windows Server 2012 R2, enable Protected Process Light for LSA.[93]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1056
ATT&CK Technique Name:Pre-compromise
This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls. Efforts should focus on minimizing the amount and sensitivity of data available to external parties.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

titleblackhat:us-18 Return of Bleichenbacher's Oracle Threat (ROBOT)
With a 19 year old vulnerability, we were able to sign a message with the private key of Facebook. We'll show how we found one of the oldest TLS vulnerabilities in products of 10 different vendors and how we practically exploited it on famous sites. We'll also discuss how the countermeasures introduced back in TLS 1.0 and expanded over the years failed to prevent this and why RSA PKCS #1 v1.5 encryption should be deprecated. Finally, we'll present what related problems are still present and unfixed in many popular TLS libraries.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:T1137.003
ATT&CK Technique Name:Outlook Forms
Adversaries may abuse Microsoft Outlook forms to obtain persistence on a compromised system. Outlook forms are used as templates for presentation and functionality in Outlook messages. Custom Outlook forms can be created that will execute code when a specifically crafted email is sent by an adversary utilizing the same custom Outlook form.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0121
ATT&CK Technique Name:Sidewinder
Sidewinder has sent e-mails with malicious links to credential harvesting websites.[22]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0458
ATT&CK Technique Name:Ramsay
Ramsay can compress and archive collected files using WinRAR.[63][64]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S1060
ATT&CK Technique Name:Mafalda
Mafalda has been obfuscated and contains encrypted functions.[201]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0007
ATT&CK Technique Name:APT28
APT28 has used COM hijacking for persistence by replacing the legitimate MMDeviceEnumerator object with a payload.[4][5]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:G0032
ATT&CK Technique Name:Lazarus Group
Several Lazarus Group malware families use timestomping, including modifying the last write timestamp of a specified Registry key to a random date, as well as copying the timestamp for legitimate .exe files (such as calc.exe or mspaint.exe) to its dropped files.[32][33][34][35]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:M1024
ATT&CK Technique Name:Restrict Registry Permissions
Ensure proper permissions are set for Registry hives to prevent users from modifying keys associated with COR_PROFILER.


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0089
ATT&CK Technique Name:BlackEnergy
The BlackEnergy 3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder.[8]


Instruction: 请分析这段安全相关的文本内容

Output:
安全文本分析：

ATT&CK ID:S0662
ATT&CK Technique Name:RCSession
RCSession can capture screenshots from a compromised host.[135]