Prelude
Prelude
  • 75
  • 61 441
Intro to Verified Security Tests: Authoring Tests That Scale
In order for continuous testing to scale to tens or hundreds of thousands of endpoints, we had to tear down the concept of traditional TTPs and start fresh with the Verified Security Test (VST) format - the lifeblood of Prelude Detect.
In this session, the battle-tested TTP/VST author and Prelude's Co-Founder and CTO, David Hunt, provides an introduction to VSTs. David will breakdown the requirements of VSTs and provide a tutorial on how to author your own VSTs for continuously testing endpoint deployments of any size.
Create your free Prelude account: platform.preludesecurity.com/detect
🔗 Related Links 🔗
Prelude Detect Docs: docs.preludesecurity.com/docs/the-basics
Prelude CLI Docs: docs.preludesecurity.com/docs/prelude-cli
Prelude Visual Studio Integration Docs: docs.preludesecurity.com/docs/visual-studio-integration
Prelude Tests GitHub: github.com/preludeorg/test
Prelude Libraries GitHub: github.com/preludeorg/libraries
zhlédnutí: 391

Video

Global Affairs? In my Threat Model?
zhlédnutí 178Před rokem
Alex Rudolph shares how to analyze an APT's force structures and doctrine to understand cyber conflict and incorporate into threat models. Link to join the Prelude Discord: discord.gg/fZbfdUQM4A
Designing and Building a Mechanical Keyboard
zhlédnutí 249Před rokem
Cyboard's Erik Trinkle presents lessons learned on designing and manufacturing custom mechanical keyboards. Link to join the Prelude Discord: discord.gg/fZbfdUQM4A
Protocol Reverse Engineering
zhlédnutí 3,3KPřed rokem
In this session, netspooky presents an introduction to protocol reverse engineering, with lots of history, resources, tips and tricks, and more. 00:00 Intro 02:00 Protocol RE Fundamentals 10:35 Preparing to Reverse Engineer 15:37 Packet Analysis 41:05 Software RE 56:08 Hardware RE 01:02:54 Specifications 01:16:52 Documenting Your Findings 01:20:50 Healthy Research Mindset
Avoiding Insidious Points of Compromise in Infrastructure Access Systems
zhlédnutí 225Před rokem
BastionZero's CEO, Dr. Sharon Goldberg, explores case studies of devastating pitfalls of infrastructure access systems and how to avoid them.
Offensive Wasm
zhlédnutí 1,8KPřed rokem
Joe DeMesy presents research on applications of Web Assembly (WASM) in Sliver, an open-source cross-platform adversary emulation framework.
Intro to Syscalls for Windows Malware
zhlédnutí 14KPřed rokem
This session features eversinc33 giving an intro to syscalls implementations for Windows malware. This is a recording from the Prelude Discord Live Stream Series. Click here to join the Prelude Discord: discord.gg/fZbfdUQM4A
My Open Source Journey with osquery and Fleet
zhlédnutí 648Před rokem
This session features Zach Wasserman, CTO of Fleet and Co-creator of osquery, talking about his experience building a career in open-source software. This is a recording from the Prelude Discord Live Stream Series. Click here to join the Prelude Discord: discord.gg/fZbfdUQM4A
Malware Dev with Nim: A Case Study in NimPlant
zhlédnutí 2,4KPřed rokem
This session features Cas van Cooten discussing his open-source Nim C2, NimPlant. The slides from this presentation can be found on the presenter's GitHub: github.com/chvancooten/conferences/blob/main/2023-03 - Malware Development with Nim @ Prelude livestream/Malware Development with Nim A Case Study in NimPlant.pdf Click here to join the Prelude Discord: discord.gg/fZbfdUQM4A
An Introduction to Open Source Continuous Security Testing at Scale
zhlédnutí 725Před rokem
This presentation by Prelude CTO & Co-Founder, David Hunt, introduces continuous security testing at scale via a guided walkthrough. Attendees will get an orientation around our open source probes and Verified Security Tests, which are then used to continuously validate the efficacy of our defenses. This talk originally took place on Mr.Un1k0d3r's Discord Server. Follow him on Twitter at @MrUn1...
AV/EDR Evasion: Packer Style
zhlédnutí 6KPřed rokem
This session features Twitter's @S3cur3Th1sSh1t providing a tutorial on AV and EDR evasion techniques. This is a recording from the Prelude Discord Live Stream Series. The slides from this presentation can be found on the presenter's GitHub: github.com/S3cur3Th1sSh1t/Creds/blob/master/Presentations/AV_EDR Evasion_Packer Style.pdf Click here to join the Prelude Discord: discord.gg/fZbfdUQM4A
Windows Internals for Red Teams
zhlédnutí 12KPřed rokem
This session features Charles "Mr.Un1k0d3r" Hamilton providing a lesson on Windows internals through the lens of a red teamer. This is a recording from the Prelude Discord Live Stream Series. Click here to join the Prelude Discord: discord.gg/fZbfdUQM4A
Intro to Reverse Engineering
zhlédnutí 1,9KPřed rokem
Software reverse engineering is the process of understanding how software works by inspecting compiled binary and its runtime behavior. This session features cmex providing an introduction to reverse engineering concepts and some practical tips for malware analysis. Click here to join the Prelude Discord: discord.com/invite/NWURE99JzE
Creating a Windows Packer
zhlédnutí 1,9KPřed rokem
Packers are programs that decompress and load new programs within their address space. This session features frank2 providing an introduction on how to write a packer. A version of this tutorial is also available on GitHub: github.com/frank2/packer-tutorial This is a recording from the Prelude Discord Live Stream Series. Click here to join the Prelude Discord: discord.com/invite/NWURE99JzE
CVE-2014-6271: ShellShock
zhlédnutí 844Před 2 lety
ShellShock is a vulnerability that allows arbitrary code to execute on a Linux computer. It does this by taking advantage of how Bash (a program found on most Linux machines) evaluates environment variables. This week marks a theme change from adversary emulation to CVE exploitation. Over the next 6 weeks we’ll release exploits that test whether a machine is exploitable to specific Linux CVEs. ...
APT38 Pharmaceuticals Attacks
zhlédnutí 295Před 2 lety
APT38 Pharmaceuticals Attacks
GTsST Iron Viking
zhlédnutí 91Před 2 lety
GTsST Iron Viking
APT38 CryptoSpy
zhlédnutí 148Před 2 lety
APT38 CryptoSpy
GTsST Sandworm
zhlédnutí 126Před 2 lety
GTsST Sandworm
APT38 WannaCry
zhlédnutí 155Před 2 lety
APT38 WannaCry
APT38 The Sony Hack
zhlédnutí 262Před 2 lety
APT38 The Sony Hack
APT38 DarkSeoul
zhlédnutí 158Před 2 lety
APT38 DarkSeoul
APT40 Find and Exfiltrate Chain
zhlédnutí 119Před 2 lety
APT40 Find and Exfiltrate Chain
APT40 Shellcode Injection & Defense Evasion
zhlédnutí 240Před 2 lety
APT40 Shellcode Injection & Defense Evasion
0verture: The Prelude Podcast CVE-EP12
zhlédnutí 50Před 2 lety
0verture: The Prelude Podcast CVE-EP12
APT40 Government Organizations
zhlédnutí 261Před 2 lety
APT40 Government Organizations
APT40 Maritime Industry
zhlédnutí 113Před 2 lety
APT40 Maritime Industry
0verture: The Prelude Podcast CVE-EP11
zhlédnutí 18Před 2 lety
0verture: The Prelude Podcast CVE-EP11
Prelude Live: Operator 1.5 Tips and Features (Recorded 4/14/22)
zhlédnutí 101Před 2 lety
Prelude Live: Operator 1.5 Tips and Features (Recorded 4/14/22)
APT40 targets defense industry with multi-stage macro-enabled documents
zhlédnutí 105Před 2 lety
APT40 targets defense industry with multi-stage macro-enabled documents

Komentáře

  • @georgeyork8975
    @georgeyork8975 Před 11 dny

    I have a question for you regarding RS232 equipment. I obtained a S100 spectrophotometer with an rs232 connecter. The company was contacted but now the unit is obsolete with no software available to use the unit. I want to send data and receive and also try and figure out the commands to make the unit work etc. I downloaded a program on my computer which allows RealTerm (serial capture program) to try and get the unit to work and communicate. I want to be able to eventually create a gui interface on the computer to allow access of the data on the unit. With your expert knowledge on this matter was wondering what software and procedures would you use to reverse engineer such a task to be able to do this? Any information would be appreciated thanks!!!

  • @DotNetRussell
    @DotNetRussell Před 20 dny

    TIL > Hipster technologies > Schemaless databases 😂

  • @CarterOW
    @CarterOW Před 22 dny

    Unfortunately incredibly hard to digest.

  • @user-yi4ef2gk1o
    @user-yi4ef2gk1o Před měsícem

    this is a great framework/tool i will make great things with this knowledge

  • @froska12
    @froska12 Před měsícem

    i dont know nothing abt hacking tell me wth is this

  • @luiszuniga5815
    @luiszuniga5815 Před měsícem

    dear lord its the vocal fry guy again

    • @Preludeorg
      @Preludeorg Před měsícem

      Zach Wasserman slander will not be tolerated.

  • @nceevij
    @nceevij Před 2 měsíci

    I am happy I cam across to your channel. I am hooked

  • @nceevij
    @nceevij Před 2 měsíci

    or May be something on Blockchain Protocol Engineering a lowest level

  • @nceevij
    @nceevij Před 2 měsíci

    Can you make a video on reverse Blockchain Protocol Engineering something in the space of Blockchain ?

  • @alexandrest-fort2520
    @alexandrest-fort2520 Před 2 měsíci

    Mon tabarnak

  • @diperru
    @diperru Před 3 měsíci

    @Preludeorg What HEX editor used at 51:20 ?

  • @bitferret-rx5rn
    @bitferret-rx5rn Před 4 měsíci

    first to comment... yay!!!

    • @joech1065
      @joech1065 Před 2 měsíci

      First reply to the first comment🎉

    • @danielmohring4610
      @danielmohring4610 Před 2 měsíci

      @@joech1065 first reply to the first reply to the first comment 🥳

    • @user-yi4ef2gk1o
      @user-yi4ef2gk1o Před měsícem

      @@danielmohring4610 first to reply to the first comment reply 🤭😆😁

  • @alienJIZ1990
    @alienJIZ1990 Před 4 měsíci

    Wow, excellent presentation! This topic/attack vector is not nearly covered enough. The space needs more people who understand this and you explained it extremely well

  • @Red4mber
    @Red4mber Před 4 měsíci

    Damn, that's by far the best explanation i've seen on the subject

  • @MsDuketown
    @MsDuketown Před 5 měsíci

    if the numbers add up, the time is right😂

  • @lovedoraemon2390
    @lovedoraemon2390 Před 7 měsíci

    thanks, this is very clear to understand.

  • @camaradamanuel5025
    @camaradamanuel5025 Před 9 měsíci

    Pretty smart, I like it! Thanks for the demonstration.

  • @user-ru7qk6ui4u
    @user-ru7qk6ui4u Před 9 měsíci

    I've seen some malware written in D. Languages ​​such as Carbon, Zig, Haxe can be used. Could an AI help in these cases of detecting unconventional codes?

    • @MsDuketown
      @MsDuketown Před 5 měsíci

      lot's of ICT skills on display. Are you an IT'er?

  • @halfbelf5923
    @halfbelf5923 Před 10 měsíci

    Thank you for explaination. It was useful for me :) I'm coding on c# maybe 2-3 years and I decide to learn something new about malware etc. but only in this guide I found useful techniques.

  • @imranthoufeeque165
    @imranthoufeeque165 Před 11 měsíci

    Little suggestion to include the video quality... I am watching this video in 1080 but still i feel blurish...

    • @nicksonkosi
      @nicksonkosi Před 4 dny

      Same here. I thought there was a problem with my phone

  • @rnrbeast
    @rnrbeast Před 11 měsíci

    Very good explanations, thanks for sharing this

  • @epicujjwal
    @epicujjwal Před rokem

    cool stuf

  • @cyboard3674
    @cyboard3674 Před rokem

    Thanks for sharing and thanks again for having me!

  • @detective5253
    @detective5253 Před rokem

    thanks guys, you rock as always! speaking of keyboards, is it possible to write a C++ code that could cripple the keyboard's functionalities to write while it's still plugged into the USB port?

  • @elviramegne5632
    @elviramegne5632 Před rokem

    Thank you!

  • @eversinc33
    @eversinc33 Před rokem

    I just wanna provide some additional info that I missed to give in the talk, but I feel that should be addressed: 1) The Nt* and Zw* functions, which I call syscalls here, are technically just stdcall wrappers around the actual syscall instruction. The terminology is confusing and many people refer to them as syscalls, but technically they are just wrappers that enable the syscalls to easily be called from C/C++. 2) When I refer to the usage of GetModuleHandle and GetProcAddress with Nt*/Zw* functions as being suspicious, that is also only partly true. Many legitimate programs, including standard windows binaries, use these calls with Nt*/Zw* functions. What might be suspicious here is the type of APIs you are importing, e.g. if those are known to be used for code injection, not the usage of GetProcAddress/GetModuleHandle itself.

  • @juliogallo7694
    @juliogallo7694 Před rokem

    i cant believe theres a course on this! This is incredible

  • @yurim9917
    @yurim9917 Před rokem

    👏👏👏

  • @TheGoncas2
    @TheGoncas2 Před rokem

    It's not everyday that you see software that consistently only REMOVES features every new update. 1.7 is even more empty than this.

  • @innominateeclipse2231

    amazing stuff guyzz very helpful kudos

  • @CyberCelt.
    @CyberCelt. Před rokem

    This is a fantastic intro, thanks a lot

    • @Preludeorg
      @Preludeorg Před rokem

      Glad you enjoyed - all the credit to eversinc33!

  • @detective5253
    @detective5253 Před rokem

    great slide explaination out there. could you please focus more on the practical side? it's gonna be interesting if you dive deep into red team simulation tactics and malware development using C++ and C# for dealing with system calls if possible.

    • @Preludeorg
      @Preludeorg Před rokem

      Thanks for the encouraging words. We'll keep this in mind!

  • @fakeacount1479
    @fakeacount1479 Před rokem

    hey prelude, can you make video about making your own malware in c++ and testing it in virus total to get 0 detections😮😊

  • @SUJALSURENDRACHAUHAN

    Great content! Keep it up

  • @yurim9917
    @yurim9917 Před rokem

    👏👏👏

  • @Pascal-0x90
    @Pascal-0x90 Před rokem

    This is definitely an underrated video. I absolutely loved hearing about your journey as well as learning about the evolution of osquery and Fleet. These are some amazing contributions to the open source community and thank you for taking the time to talk about your experiences. :)

    • @Preludeorg
      @Preludeorg Před rokem

      We agree! Zach was a great guest. We appreciate his commitment to community.

  • @cvport8155
    @cvport8155 Před rokem

    Please make more vd for advanced techniques red team and pivoting and dev malware bypass EDR

    • @Preludeorg
      @Preludeorg Před rokem

      We'll keep this in mind for future content! Thanks for watching.

  • @joyemoticon
    @joyemoticon Před rokem

    Wow! I could not have asked for a better topic. Exactly what I was wanting to learn!

    • @Preludeorg
      @Preludeorg Před rokem

      Glad to hear this. Huge thanks to eversinc33

  • @fordprefect8235
    @fordprefect8235 Před rokem

    Awesome. Interesting demo too.

    • @Preludeorg
      @Preludeorg Před rokem

      Thanks! Check out the new GUI for Detect: platform.preludesecurity.com/detect

  • @detective5253
    @detective5253 Před rokem

    it's unbelievable seeing this channel's capabilities and got no high views, subs, nor even people to interact in the comments while crap like youtubers keep posting shit while they make millions!

    • @Preludeorg
      @Preludeorg Před rokem

      Gee, thank you!

    • @the_god_killah
      @the_god_killah Před rokem

      U expect millions of people to sit thru a PowerPoint presentation talking about a random programming language?? 😂

  • @Hade-hw6vl
    @Hade-hw6vl Před rokem

    I wanted to get started with reverse engineering but not sure how/where to start and I found you guys :) Please keep it coming! Thank you so much for all the effort you guys put in creating useful contents.

    • @Preludeorg
      @Preludeorg Před rokem

      Thanks for watching. All the credit to the guests that sharing their knowledge and experience with us!

  • @whatwhere1089
    @whatwhere1089 Před rokem

    can you hide the member list in future streams

  • @LexAsLex
    @LexAsLex Před 2 lety

    does this mean that python should be installed on windows machine?

    • @Preludeorg
      @Preludeorg Před 2 lety

      Python needs to be installed on the machine running the Operator instance. Any windows box (even one without Python) can visit the watering-hole website.

    • @LexAsLex
      @LexAsLex Před 2 lety

      @@Preludeorg yes, it's clear to me that http server will be running on the Operator machine. I have been rushy writing my question, sorry. It is not clear to me if the windows target machine must have python installed to allow the execution of the TTP "check rdp credentials", for example. I see it's using python, like the other TTP install PySMB and Install Impacket; so I guess python is needed on windows machine, am I wrong? Thank you!

    • @Preludeorg
      @Preludeorg Před 2 lety

      ​@@LexAsLex Thank you for your questions. Let us know if this clarifies things-- You can think of this chain as having two distinct parts: The first part is setting up the environment for everything that is going to take place. This is done by standing up the website and installing libraries needed to check communication with SMB and RDP. The box running Operator will need python3 installed so all of this can happen. This will allow any OS to be able to communicate with the target box. The second part is the target box. In the case of this chain, it is targeting a Windows box. Windows typically has SMB and RDP services and if these services are exposed on the network, the Operator box (referenced in the first part above) will attempt to reach out and authenticate with these services. Python isn’t needed on the target windows box. If the environment running the Operator session (referenced in the first part above) is a Windows box, then it will need python3 to set up the environment. The target (referenced in the second part), however, will still not need python3 installed.

    • @LexAsLex
      @LexAsLex Před 2 lety

      ​@@Preludeorg ooh I see! now it's very clear! Actually once the credentials have been collected the rdp check can be done from the attacker machine! thank you for clarification!

    • @Preludeorg
      @Preludeorg Před 2 lety

      @@LexAsLex Great. If you have additional questions about this chain or something else you're working on in Operator, you can join our Discord server for additional support-- discord.gg/gzUv4XNquu

  • @joshuasmith1252
    @joshuasmith1252 Před 2 lety

    The first half of this video is a static screen with a VO - take advantage of the medium you are using to present the information, maybe an animated timeline overview that moves through the steps as you describe them, or some slides that change showing relevant news stories / clips / wayback machine from those events - enjoying the content - this seemed more of a podcast than a YT video - also the screen detail is difficult to make out - if the intention is to show us the config / Prelude chain - it is difficult to actually read / view the output in the Prelude window - just my 0.02

    • @Preludeorg
      @Preludeorg Před 2 lety

      Joshua, Thank you for the thoughtful reply, we really appreciate the feedback. Our plan is to formalize the first half of the video into a threat intelligence presentation (similar to what you're describing). The second half would be the technical side. We will take your feedback and use it moving forwards! Thanks, Prelude team

  • @senyang5764
    @senyang5764 Před 2 lety

    good job:)

  • @legato891
    @legato891 Před 2 lety

    Hackers hate him

  • @blackwasp9285
    @blackwasp9285 Před 2 lety

    👍

  • @MarsTheProgrammer
    @MarsTheProgrammer Před 2 lety

    The problem with this is that i need to learn the prelude software, whereas i current can just spin up a vm from vulnhub and play around with vulnerable machines from there.

    • @Preludeorg
      @Preludeorg Před 2 lety

      Operator is primarily an adversary emulation and automation framework. The purpose is to help simplify detection engineering processes by making it easier to build and run predictable attacks. You could use it to poke around vulnhub boxes though and we actually have a built-in provisioning system to deploy virtual machines with preconfigured challenges.

  • @raeannbrown8927
    @raeannbrown8927 Před 2 lety

    Excellent information

  • @raeannbrown8927
    @raeannbrown8927 Před 2 lety

    Thumbs 👍 up