Cybersecurity Lessons from Huntress’ hack_it 2020 Event
Summary
Huntress recaps hack_it 2020, covering incident-response tabletop exercises, Cobalt Strike’s malleable command-and-control capabilities, and an introduction to security analysis and vulnerability research.
Key points
- Tabletop scenarios explored phishing, network infection, lateral movement, data targeting, and ransomware deployment through endpoint management software.
- Participants emphasized activating a formal incident-response plan, assigning response roles, communicating with clients, documenting lessons, and supporting the team after an incident.
- The Cobalt Strike session discussed how malicious actors repurpose the commercial tool and use malleable command-and-control profiles to make traffic resemble other actors or applications.
- The recap notes that dynamically changing network indicators can make signature-based identification and network detection more difficult.
- A security-analysis session introduced recognizing unusual software behavior and reverse engineering to identify potential vulnerabilities.
Article Details
- Topic
- Cybersecurity education event recap covering incident-response tabletop exercises, Cobalt Strike tradecraft, and security analysis.
People
Annie BallewJoined a session examining Cobalt Strike from the adversary’s perspective.Jason SlagleCo-led a session on security analysis and malicious behavior.Kelvin TegelaarCo-led a tabletop exercise at hack_it 2020 and emphasized checking in with the team after an incident.Mendy GreenJoined a defensive-focused follow-up session about Cobalt Strike.Tom LawrenceJoined a session examining Cobalt Strike from the adversary’s perspective.