![\"\"](\"https://internal-wp.smokescreen.io/wp-content/uploads/2021/05/Screenshot-2021-05-18-at-8.30.58-PM-813x1024.png\")
UK’s Department for Digital, Culture, Media and Sports has published the 6th edition of its annual cybersecurity breaches survey on GOV.UK.
\n\n\n\nWe sifted through this year’s report to compile the top 6 takeaways. Let’s go.
\n\n\n\nFewer businesses are now deploying security monitoring tools (35% vs. 40% last year) or undertaking any form of user monitoring (32% vs. 38%).
\n\n\n\nCompared to 46% of businesses in 2017, only 39% said that they detected any breach or attack. This can be attributed to fewer organizations deploying security controls and their limited ability to monitor remote employees.
\n\n\n\n83% of attacks on businesses and 79% on charities were in the form of phishing. These are consistent with the attack vectors reported in 2019 and 2020.
\n\n\n\n4 in 10 businesses and 1 in 4 charities were hit by a security breach/attack in the last 12 months.
\n\n\n\nOf the businesses and charities that reported a security breach/attack, a quarter of them were hit at least once a week,
\n\n\n\nThe data from this survey reinforces what we’re seeing globally:
\n\n\n\nYou can read the full report here.
\n\n\n\nThere’s no silver bullet. We can recommend four easy-to-implement active defense strategies that address security challenges around phishing and remote work access. These deception-based active defense recommendations are easy to implement, do not require complex tooling, and detect threats early.
\n\n\n\nEmail decoys are fake email accounts that intercept attackers attempting to mount social-engineering/spear-phishing attacks on high-value personnel.
\n\n\n\nSeed these decoys on social media and other Internet-facing assets where attackers scour for spear-phishing targets. These email decoys are enumerated by hackers and added to their target lists for sending spear-phishing emails. There is no reason for anyone to send any emails to the decoy email addresses. Therefore, any email sent to these addresses is a high-fidelity indication of an attack.
\n\n\n\nYou can integrate these with your SIEM to find other targets. Additionally, you can integrate with proxies to block access to spear-phishing domains.
\n\n\n\nEnabling employees to work from anywhere requires security teams to use VPNs, Citrix servers, and expose applications to the Internet.
\n\n\n\nAttackers target vulnerabilities in these remote access services to get into your network. Use that against them.
\n\n\n\nDeploy Internet-facing decoys that resemble vulnerable applications, databases, and servers. E.g., you can easily set up decoys that have the recent Citrix and ManageEngine vulnerabilities, making them attractive targets for the attackers.
\n\n\n\nAttackers looking for these assets during recon will discover and engage with the decoys as well. Any attempt to seek out these assets will alert you of incoming threats with low alert volume.
\n\n\n\nAttackers use credential stuffing and stolen credentials to break into organizations. These are hard to detect because the activity seems legitimate. You have two simple active defense plays here:
\n\n\n\nAs you’ve seen in the survey finding, fewer organizations have visibility into endpoints because now they are outside the perimeter. Consider using endpoint deception to build this visibility, detect attacks early, and stop lateral movement.
\n\n\n\nPlant endpoint decoys like fake files, processes, passwords, and cookies on the work machines of all your remote employees.
\n\n\n\nAn attacker on your employees’ machines will encounter these decoys and will be caught.
\n\n\n\nEndpoint deception follows the end-user, so even when they’re working from home, your ability to detect threats is not diminished. You gain visibility into home networks that are compromised without having to deploy appliances or network traffic monitoring choke-points.
\n\n\n\nActive defense is emerging as a viable approach to dealing with advanced attacks. MITRE has a new knowledge base dedicated to active defense. If you want to understand why this approach is gaining prominence in infosec circles, read this.
\n\n\n\nFor more on using active defense and deception for remote work security, check out the white paper.
By now, you’ve probably been bulldozed with solution briefings, white papers, vendor pitches, and webinar invitations to discuss how this ransomware could have been stopped.
\n\n\n\nWe’ll do things a little differently. We’ll of course include our resources at the end of this post, because obviously we don’t want to be left behind. But we’ll first take you through what we’ve been saying about ransomware these last couple of months. I think it’ll help you understand where we’re coming from and why we recommend dealing with ransomware with a different mindset.
\n\n\n\nAs a company, we have been vocal about the threat of ransomware for a long time. We’ve seen it singularly wreak more havoc on organizations compared to any other single threat. So we decided to use our social platform to educate the infosec community about ransomware and how to defend against it.
\n\n\n\nHere’s us predicting the weaponisation of the Exchange vulnerabilities for ransomware ⏱
\n\n\n\n\n\n\n\nWe even launched a course focussed exclusively on ransomware 🎓
\n\n\n\n\n\n\n\nAnd then we said some more stuff about the impact of ransomware 🎯
\n\n\n\n\n\n\n\nWe even had a slide just about the consequences of ransomware 💣
\n\n\n\n![\"\"](\"https://internal-wp.smokescreen.io/wp-content/uploads/2021/05/Smokescreen-Consequences-of-ransomware.png\")
And then we wrote a paper on how to defend against it 📝
\n\n\n\n\n\n\n\nAnd made it publically accessible 📖
\n\n\n\n\n\n\n\nAnd then we said this about DARKSIDE 👇🏼
\n\n\n\n\n\n\n\nLet me clarify something here – This is not a ‘I told you so’ post. We are not oracles predicting the future. We have been on this trajectory of ransomware making front page news for years now, starting with Wannacry.
\n\n\n\nBut it’s not all doom and gloom.
\n\n\n\nThe DARKSIDE ransomware did not do anything radically different that can catch the security community off-guard.
\n\n\n\nWe know how most ransomware operates. Download the paper here.
\n\n\n\nWe know what we must do to defend against it.
\n\n\n\nWe simply need to start doing it.
\n\n\n\nHere are three things:
\n\n\n\nWhen analyzing attacker tactics and techniques, ask “Why?”. When you ask “Why?”, it opens up new avenues for guerilla-warfare-style defenses to combat ransomware.
\n\n\n\nI’ve enumerated over 40 approaches in the paper on messing with ransomware. Use deception to disrupt what the ransomware is trying to achieve, rather than trying to stop the usage of a specific tool. It’s easy to setup, doesn’t generate too much data, and has a much faster time to value. This statement may look like a vendor marketing plug but it’s not. If you check out MITRE Shield, you will see that the adoption of deception is vital to active defense against a use case like Ransomware.
\n\n\n\nReduce reliance on detection in only one part of the network, for example, stacking all the controls on the endpoint. Notice how many EDRs are now talking about XDR? It’s likely because it’s impossible to stop threats meaningfully only in one part of your environment. You need defenses across your environment. Active Defense-based deception does this already.
\n\n\n\nIrrespective of how you choose to tackle ransomware, here’s the one advise I’ll leave you with 🙏🏼
\n\n\n\n\n","excerpt":"By now, you’ve probably been bulldozed with solution briefings, white papers, vendor pitches, and webinar invitations to discuss how this ransomware could have been stopped. We’ll do things a little differently. We’ll of course include our resources at the end of this post, because obviously we don’t want to be left behind. But we’ll first […]\n","slug":"the-bright-side-of-the-darkside-ransomware","date":"2021-05-18T16:01:29.000Z","status":"publish","modified":"2021-05-18T16:19:33.000Z","wordpress_id":18782,"featured_media":{"id":"6a62504d-2791-5a4b-ad8a-4d13b155ef9f","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2021/05/Smokescreen-Darkside-Ransomware.png","alt_text":"Smokescreen-Darkside-Ransomware","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAYAAAB/Ca1DAAAACXBIWXMAAAsTAAALEwEAmpwYAAACqklEQVQoz3WTvU9TURiHz72UQhTKrdzbW4EoUSwBtbQUKC2lYL+gUBFKKSDgB35C1Bi/aowmJhrjYGLUxcTBwcHBODg4uLkYYxyN0cF/wMXEhKgBuY+nxYFBh1/eM/1yznmeV1jW6jIg82v5/YsLy9dnKlev5gWFcdW6OCasQs7GsaFqIl6NBpeG7tRwav+PsCxKfS8fTjIVFCS9gkxAtQZ9ChMhheEOuyxzkug0CLTobK0z2GwauIx/R8g268ub+1Y+KKzjyXLr8pjNOrxHJdupWhGPYvU32wlscxBorqXPb+Bv1ql367h0HWN9ZFlxCmtliQ9PwtycVTg1VMaVMRuLKZWTMvt7VA5E7cwnmwi1NhAL6KTDDWzfYlLnNjFdLjbL6TbN0u2KU/z+/pnbBzdwqF+Q71EY71YYaFOJ7VYY8iuMyCcfTTcS3V1HZ7NGPt3O6HCCZCLOeDZLtLeXvZkM/X19dAQCiB9f33F+tIzFtMKl8XJm+1Rmogr5kHx2l8J0pIJMsIauFoPIrk0cmUowncswmZ9gIpcjI8visRhzc3Mk4nHEz2+feLCwkYdnqnhacHAipbAwaONaVqWQUbk8Uclgl5PQLjf7ovWcPZJiLhejNxKhJxwmHArh9/lKZe1+fxHKEs9ueMl3C+4cc3B3vpzH58q5NVvGtKSc8kkoHo3gTkOSNhnprafdU42zxoHD4aBGpqhLdVXVmjZFaT6+vsdMSHD3RCUXxso4mhRMyv8MNglJ2I53u0bbDr1EuUOq42mUMEwXLgmlCKYIxPx7/uvhCq8eTZVKU22CbLfK8QFF/qdgoN0ub6TR4zXweQwa6w0a3EVF1vmnr2lU8lBuCqVOfvH2+XkKuQoW0oLTGQkpK1gctjETrybYquGu1TBlauW2aP/ZlD8604JDURmM0wAAAABJRU5ErkJggg==","aspectRatio":1.9047619047619047,"src":"/static/a72a3afeb6a8b47ebe9708c9950bb690/ee604/Smokescreen-Darkside-Ransomware.png","srcSet":"/static/a72a3afeb6a8b47ebe9708c9950bb690/69585/Smokescreen-Darkside-Ransomware.png 200w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/497c6/Smokescreen-Darkside-Ransomware.png 400w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/ee604/Smokescreen-Darkside-Ransomware.png 800w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/f3583/Smokescreen-Darkside-Ransomware.png 1200w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/5707d/Smokescreen-Darkside-Ransomware.png 1600w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/0ef64/Smokescreen-Darkside-Ransomware.png 2400w","srcWebp":"/static/a72a3afeb6a8b47ebe9708c9950bb690/58556/Smokescreen-Darkside-Ransomware.webp","srcSetWebp":"/static/a72a3afeb6a8b47ebe9708c9950bb690/61e93/Smokescreen-Darkside-Ransomware.webp 200w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/1f5c5/Smokescreen-Darkside-Ransomware.webp 400w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/58556/Smokescreen-Darkside-Ransomware.webp 800w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/99238/Smokescreen-Darkside-Ransomware.webp 1200w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/7c22d/Smokescreen-Darkside-Ransomware.webp 1600w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/f1e40/Smokescreen-Darkside-Ransomware.webp 2400w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAKCAYAAAC0VX7mAAAACXBIWXMAAAsTAAALEwEAmpwYAAACXUlEQVQoz32S3UtTcRjHzzlagtNtZ+ecmRoYvpG6mnM7brbNuaa5F9+ma+YLlWkqpYFgodVN1h8QUVR0IV32D3QXSHSfBP4D3UYXQoQSO59+Mywi6eLL7+G5+PD8ns8jWVZhz4I9RLbfru9vTCmFh9MyaznZupeXuT9RxmjUTn2tA83pQHU4cNjt/0b0K2w2JEvQoMC719eYjkiMdMpkg4qV65KZjsn0B8rpMzUiXp1TtTo1bh1DPzpOAZUEzdrZemzlApK10FdqLV4osXIhheRZ2Yo2K4Sby/E2qES9BiFPEWpQZRi4j4jqdArgj10+bpqsjkjcyZayNlzCckphLqGQC8rMxFUGgg2YpzUGI9V4Gg2qxZS69vd0v4H7X7d5NHWc2YTEaEhmVEDibTJpv0zSK3G1V2Osux5/k0oqXM/48HnisW4GBwaI9/SQTqXoEW/A70dzuZB2P2+xnJFZGVJYzR5jMiozFS1OpzAmcilqI+JxEWpRGU/5mJkYJDs8xNTkJJl0mmQyST6fpycWw15ZifT9yyeeLJTxasXOy6UKFvsVbouvP8gprI+UMJ+pxGwx6DWrmL3YyfWJGJEuk1AwhBkI0OHzEQ6H8Xd0HEr5xubdVsa7JJ7ddPB0vpTnS6XcEntMehXOtdjwNetCik4mXEPMp1FtFE/FgUtVD/ZWBB3WRcvsvH/BXExiY7qEy3FZRCIjdhhslGlvsOFp0IRhg2CbTlOdQW21W0hw/7Ht/lUfAAsHdwgf3ixzRUDTHUWgwo2UMJyQSbSXEz6jYbbq1NXonDwhjP7nDn8CrvNYN+AFX20AAAAASUVORK5CYII=","aspectRatio":1.9152542372881356,"src":"/static/a72a3afeb6a8b47ebe9708c9950bb690/62b1f/Smokescreen-Darkside-Ransomware.png","srcSet":"/static/a72a3afeb6a8b47ebe9708c9950bb690/e7519/Smokescreen-Darkside-Ransomware.png 113w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/7e7e9/Smokescreen-Darkside-Ransomware.png 225w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/62b1f/Smokescreen-Darkside-Ransomware.png 450w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/e2e7f/Smokescreen-Darkside-Ransomware.png 675w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/db955/Smokescreen-Darkside-Ransomware.png 900w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/0ef64/Smokescreen-Darkside-Ransomware.png 2400w","srcWebp":"/static/a72a3afeb6a8b47ebe9708c9950bb690/b8a88/Smokescreen-Darkside-Ransomware.webp","srcSetWebp":"/static/a72a3afeb6a8b47ebe9708c9950bb690/3a3bf/Smokescreen-Darkside-Ransomware.webp 113w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/975bf/Smokescreen-Darkside-Ransomware.webp 225w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/b8a88/Smokescreen-Darkside-Ransomware.webp 450w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/761da/Smokescreen-Darkside-Ransomware.webp 675w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/210c1/Smokescreen-Darkside-Ransomware.webp 900w,\n/static/a72a3afeb6a8b47ebe9708c9950bb690/f1e40/Smokescreen-Darkside-Ransomware.webp 2400w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"}}},{"node":{"id":"26a6fa99-a7a6-5ae1-835e-ae5c2183236e","title":"Ransomware, the limits of prevention, and active defense","content":"\nWe’re almost halfway through 2021, and there seems to be a ransomware resurgence.
\n\n\n\nOr that’s what the headlines will have you believe.
\n\n\n\nOn the contrary, the opposite might be true.
\n\n\n\nAccording to a Sophos survey, ransomware attacks seem to have gone down in 2021. Only 37% of the organizations surveyed have said they experienced a ransomware attack in 2021 compared to 51% in 2020.
\n\n\n\nSo why does it feel like ransomware attacks have gone through the roof? The answer emerges when you look at the victims – high-profile targets.
\n\n\n\nHere are some headlines from the last couple of months:
\n\n\n\nIreland’s Health Services hit with $20 million ransomware demand
\n\n\n\nThe Conti ransomware gang attacked Ireland’s publicly funded healthcare system. The Irish Health Service had to shut down all of its IT systems. The attack disrupted COVID-19 testing, crippled diagnostic services, and forced hospitals to cancel appointments.
\n\n\n\nRansomware attack leads to shutdown of major U.S. pipeline system
\n\n\n\nColonial Pipeline, one of the biggest fuel pipeline operators in the US, had to shut down its entire network following an attack by the DarkSide ransomware group. The attack resulted in gas price increases, panic buying, and supply shortages. The company paid a 75 bitcoin ransom which was worth $5 million when we wrote this.
\n\n\n\nAxa division in Asia hit by ransomware cyber attack
\n\n\n\nOne of Axa’s businesses in Asia got hit by Avaddon ransomware. 3TB of sensitive data was stolen, including customer medical reports (exposing their sexual health diagnosis), copies of ID cards, bank account statements, claim forms, payment records, contracts, and more. The attack impacted IT operations in Thailand, Malaysia, Hong Kong, and the Philippines.
\n\n\n\nToshiba subsidiary confirms ransomware attack
\n\n\n\nA European subsidiary of Toshiba was the victim of a ransomware attack. Sources inside the company believe DarkSide is behind it, but there was no confirmation when this post was published. 740 GB of data, including passports and other PII, was stolen. The company had to sever network connections between Japan and Europe to stop the spread of ransomware.
\n\n\n\nUS cyber insurance major CNA Financial hit with ransomware
\n\n\n\nOne of the biggest players in the cyber insurance space (yeah, we see the irony) suffered a ransomware attack that affected operations for three days. The company was forced to shut down parts of the network to limit the spread and contain the damage. Although the company did not disclose if data was stolen, it’s a pretty big deal. A compromise could potentially help adversaries determine which companies had applied for or acquired cyber insurance, the scope of coverage, and the limits of deductibles.
\n\n\n\nAcer hit with $50 million ransomware demand
\n\n\n\nRansomware operation REvil breached computer giant Acer resulting in the largest known ransomware demand. Images leaked by the ransomware operators revealed that they had access to some of the company’s financial spreadsheets, bank balances, and bank communication.
\n\n\n\nRansomware gangs are now going after meaty targets. After all, why rob a person when you can rob a bank where everyone keeps their money?
\n\n\n\nIt’s no surprise then that the financial impact of ransomware has more than doubled from US$761,106 in 2020 to US$1.85 million in 2021.
\n\n\n\nAccording to Coveware, ransomware demands are up 43% so far in 2021.
\n\n\n\nSo aside from being meaty targets, what else is common between ransomware victims these days? They all make significant investments in cybersecurity.
\n\n\n\nLook at the scale of these companies. They have large security teams, a bevy of infosec consultants at their disposal, and all the cool tools to defend – endpoint detection and response, DLPs, SIEMs, cloud SIEMs, SIEMs that are also UEBA. You get the drift.
\n\n\n\nDifferent folks will give different answers to these questions. Media outlets will not move beyond the sensational headlines, consultants will say there aren’t enough skilled folks in the company, EDRs will say there’s not enough endpoint coverage, SIEMs will say data ingestion from critical segments might be missing, the OT folks will say it’s hard to defend non-IT assets, deception vendors will say there are no decoys/honeypots!
\n\n\n\nEssentially, anyone who has a horse in the race is going to give one-dimensional answers.
\n\n\n\nHere’s the thing though; the companies that suffer these breaches are pretty good at cybersecurity. More often than not, they operate at the cutting edge.
\n\n\n\nThe answer to why they get hit by ransomware is more nuanced. It’s because there are limits to prevention.
\n\n\n\nIf you happen to be one of the most frequently targeted companies, it’s only a matter of time before you’ll get breached despite having the best preventive controls in place.
\n\n\n\nWhy? Because anything preventive assumes the threat to be static. With ransomware, the threat is evolving. The boring bits of ransomware have been automated, there are dedicated ransomware services (REvil allegedly made $100 million in 2020), and there are human adversaries behind the ransomware that are constantly cooking up new and novel ways of compromising their targets.
\n\n\n\nFurther, most solutions to security problems take a siloed approach. Want to defend endpoints? Cover them with an EDR. More visibility? NTA. Malicious behavior? UEBA. Ransomware doesn’t discriminate. It doesn’t just go after your endpoint or server zone. Once it gets in, it just goes after everything.
\n\n\n\nPrevention doesn’t always work because ransomware is a moving target.
\n\n\n\nBusinesses need a different approach for dealing with it – Active defense.
\n\n\n\nRansomware is capable of interacting with all parts of your IT environment. Focussing your efforts on just one part of it will have diminishing returns. Dealing with something like ransomware demands a holistic approach. Your strategy needs to cover critical areas of the environment to be effective.
\n\n\n\n‘Active Defense‘ helps you do that. The approach is use case-driven and balanced in its outcome. You can pick the use case (in this instance, ransomware) and focus on where you want to be most effective (e.g. DMZ, Active Directory, critical server segments, privileged user accounts, privileges workstations, etc.)
\n\n\n\nWhat we’re recommending isn’t something experimental. Forward-thinking security teams are building dedicated deception-based active defense programs, in some cases around specific risks like ransomware.
\n\n\n\nWe have an insurance customer that has done this. They already had a firewall, network segmentation, anti-virus, EDR, and SIEM when they deployed Smokescreen. They were concerned about ransomware (rightly so).
\n\n\n\nThe idea of planting decoy file shares in key segments was adopted as the primary strategy to detect ransomware in the lateral movement phase. In the event of a detection, the organization’s internal incident response process would kick in.
\n\n\n\nThe goal was to detect ransomware spreading on the network, quickly understand the nature of ransomware, and allow established incident response processes to contain the threat.
\n\n\n\nThe security team planted network decoys in the DMZ and DC. The hypothesis behind this decision was that assets in the DMZ were at a high risk of infection and lateral movement activity would likely be recorded in those segments.
\n\n\n\nThe decoys themselves were projecting a diverse set of network services ranging from decoy SMB file shares to FTP servers to SSH servers and decoy applications.
\n\n\n\nSure enough, the company was hit by a ransomware attack. The incident started a little after midnight and a minute later, Smokescreen had raised a detection. Smokescreen was the first security control to raise an alarm.
\n\n\n\nInvestigation revealed that all decoys masquerading as file shares had been encrypted within the DMZ segment. The decoy files hosted on these file shares had been encrypted and renamed, which allowed for easy identification of the ransomware strain.
\n\n\n\nRoot cause analysis further revealed that the lateral movement phase of the ransomware attack was detected by Smokescreen less than a minute after it began encrypting assets.
\n\n\n\nWhy do you think the security team at this insurance company was able to avert a ransomware breach? Sure they had our active defense solution, but more importantly, they had the foresight to think what an attacker would possibly do and then build defenses that would intercept those attacks.
\n\n\n\nThat’s Active Defense in action.
\n\n\n\nBuilding a dedicated defense strategy around ransomware is a worthy goal to have in 2021.
\n\n\n\nRansomware is industry-agnostic and affects all parts of your network. Today, it is the one singular threat that can completely disrupt operations and bring business to a grinding halt.
\n\n\n\nHaving the ability to detect ransomware early in the attack lifecycle can be instrumental in limiting its spread and impact.
\n\n\n\nActive defense gives you the ability to do this without investing in expensive tooling, adding headcount, or making changes to your network.
\n\n\n\nWe’re going to leave you with a playbook of active defense strategies that can help you detect over 40 ransomware techniques.
\n\n\n\nPlaybook – The Top 40 Ransomware Techniques and How to Mess With Them
\n\n\n\nRemember, you don’t have to implement everything. But implementing even some of it can help you control and reduce the attack surface available to ransomware.
\n\n\n\n\n","excerpt":"We’re almost halfway through 2021, and there seems to be a ransomware resurgence. Or that’s what the headlines will have you believe. On the contrary, the opposite might be true. According to a Sophos survey, ransomware attacks seem to have gone down in 2021. Only 37% of the organizations surveyed have said they experienced a […]\n","slug":"ransomware-the-limits-of-prevention-and-active-defense","date":"2021-05-17T12:15:38.000Z","status":"publish","modified":"2021-05-18T16:18:54.000Z","wordpress_id":18779,"featured_media":{"id":"8fcb1a39-fe2c-5560-b945-364105ce2807","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2021/05/Smokescreen-Ransomware-Defense.png","alt_text":"Smokescreen Ransomware Defense","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAYAAAB/Ca1DAAAACXBIWXMAAAsTAAALEwEAmpwYAAADL0lEQVQozx2SfUzUdRzHv56HbVrTBGGWcnLe/e5O7g4fjgfdBbgT4ZCmqeMo5gNuJpXxkCeZwo2HKCFDzafTlWaWOZSgjhPHcSBwZxRu6mCtWmtraU8qsYGICXv1rb8/+7w+n/eDUFlslLi3c7v1Xe4FvdRUlqI2WZlisBJhtKJWzExT4pmmN6HWGlDHKYjYhWiXWgmcrWYoeJwHoYs0HisnUqtBnNyTy1DnIR4Phnl4o4fhq0fxHS5k9hIbaoOFqfp4xHwJeVaHKk7PVAmcpVPwV+Ux1H2Cf/o7Gelt5n7wIP2nixFtpav55kQZPza+za9fVTF6/VMme+vQ25dLiEKE/HTrpiwKNjuJ0C1CRGuYazTwZXEmfUfe4MapIu74q5gYuMhE735EUW46weotBMqcjLR54Psmmo6WMMOcQFq2nH1SycTXn8O3fjo+riJ9VQqq+VrynSm0ludzdW8Okz11/BU+g3t7DkJYElmR5aB+22paG3bg2uZCGBKYLn1s92zgbuAII31+7nacYTTs5U7LPiKNJkRMLJp4E+6Ndmp2riPWIq15cjZCZV6GWGDB7EglKSsVMVePUKzMtCRwrnAVofoddNfl85uvAn5o4e9ALVEmIyLyGcSceeRkLyc1bQlihoQ9HY2ISl5B+d5Cfva9x5+XT3GgtoyYZfKI3ozNnoS3NJdg2RoeBqrpb25gzVqH9DaOlPQkfN63GA+f5fF1P5817MZkleFdqHAx0tXA5EAP49cuMx7y0ne6hGhbImKhlKE1krkykbyNDqZodFKqhkhFoaPGxXD3ccZudTMcbmI0dIyfGt9E+IoyCB0q5uZHu/ilpUJW5wKToXp0/6U8TyFqaTLu117A/eoGohbbJHABMQaFS69nEnp/J9cObuV3fyV818RYVy3ipbVptHo20e528uCKh0c3z3O4+mWeWJTAi3lZDDbvh1t+uRBi4It68nMdqOSnGek2zu920bknh0dd7zDo/wDX+pUy5XgbWvtzeLZkcK62gOTns6VUC0+ZF9O+bx23fQe433uJPwInGev7kKG2SuaYzf9LnykL/sp6OyUFTqbHSTtmxfAvXln2Qtw0IX8AAAAASUVORK5CYII=","aspectRatio":1.7699115044247788,"src":"/static/6a39ebe40d3a52b97b478c8ce0551c02/ee604/Smokescreen-Ransomware-Defense.png","srcSet":"/static/6a39ebe40d3a52b97b478c8ce0551c02/69585/Smokescreen-Ransomware-Defense.png 200w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/497c6/Smokescreen-Ransomware-Defense.png 400w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/ee604/Smokescreen-Ransomware-Defense.png 800w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/f3583/Smokescreen-Ransomware-Defense.png 1200w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/5707d/Smokescreen-Ransomware-Defense.png 1600w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/2685c/Smokescreen-Ransomware-Defense.png 2560w","srcWebp":"/static/6a39ebe40d3a52b97b478c8ce0551c02/58556/Smokescreen-Ransomware-Defense.webp","srcSetWebp":"/static/6a39ebe40d3a52b97b478c8ce0551c02/61e93/Smokescreen-Ransomware-Defense.webp 200w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/1f5c5/Smokescreen-Ransomware-Defense.webp 400w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/58556/Smokescreen-Ransomware-Defense.webp 800w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/99238/Smokescreen-Ransomware-Defense.webp 1200w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/7c22d/Smokescreen-Ransomware-Defense.webp 1600w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/ab8d3/Smokescreen-Ransomware-Defense.webp 2560w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAYAAAB/Ca1DAAAACXBIWXMAAAsTAAALEwEAmpwYAAADL0lEQVQozx2SfUzUdRzHv56HbVrTBGGWcnLe/e5O7g4fjgfdBbgT4ZCmqeMo5gNuJpXxkCeZwo2HKCFDzafTlWaWOZSgjhPHcSBwZxRu6mCtWmtraU8qsYGICXv1rb8/+7w+n/eDUFlslLi3c7v1Xe4FvdRUlqI2WZlisBJhtKJWzExT4pmmN6HWGlDHKYjYhWiXWgmcrWYoeJwHoYs0HisnUqtBnNyTy1DnIR4Phnl4o4fhq0fxHS5k9hIbaoOFqfp4xHwJeVaHKk7PVAmcpVPwV+Ux1H2Cf/o7Gelt5n7wIP2nixFtpav55kQZPza+za9fVTF6/VMme+vQ25dLiEKE/HTrpiwKNjuJ0C1CRGuYazTwZXEmfUfe4MapIu74q5gYuMhE735EUW46weotBMqcjLR54Psmmo6WMMOcQFq2nH1SycTXn8O3fjo+riJ9VQqq+VrynSm0ludzdW8Okz11/BU+g3t7DkJYElmR5aB+22paG3bg2uZCGBKYLn1s92zgbuAII31+7nacYTTs5U7LPiKNJkRMLJp4E+6Ndmp2riPWIq15cjZCZV6GWGDB7EglKSsVMVePUKzMtCRwrnAVofoddNfl85uvAn5o4e9ALVEmIyLyGcSceeRkLyc1bQlihoQ9HY2ISl5B+d5Cfva9x5+XT3GgtoyYZfKI3ozNnoS3NJdg2RoeBqrpb25gzVqH9DaOlPQkfN63GA+f5fF1P5817MZkleFdqHAx0tXA5EAP49cuMx7y0ne6hGhbImKhlKE1krkykbyNDqZodFKqhkhFoaPGxXD3ccZudTMcbmI0dIyfGt9E+IoyCB0q5uZHu/ilpUJW5wKToXp0/6U8TyFqaTLu117A/eoGohbbJHABMQaFS69nEnp/J9cObuV3fyV818RYVy3ipbVptHo20e528uCKh0c3z3O4+mWeWJTAi3lZDDbvh1t+uRBi4It68nMdqOSnGek2zu920bknh0dd7zDo/wDX+pUy5XgbWvtzeLZkcK62gOTns6VUC0+ZF9O+bx23fQe433uJPwInGev7kKG2SuaYzf9LnykL/sp6OyUFTqbHSTtmxfAvXln2Qtw0IX8AAAAASUVORK5CYII=","aspectRatio":1.765625,"src":"/static/6a39ebe40d3a52b97b478c8ce0551c02/62b1f/Smokescreen-Ransomware-Defense.png","srcSet":"/static/6a39ebe40d3a52b97b478c8ce0551c02/e7519/Smokescreen-Ransomware-Defense.png 113w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/7e7e9/Smokescreen-Ransomware-Defense.png 225w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/62b1f/Smokescreen-Ransomware-Defense.png 450w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/e2e7f/Smokescreen-Ransomware-Defense.png 675w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/db955/Smokescreen-Ransomware-Defense.png 900w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/2685c/Smokescreen-Ransomware-Defense.png 2560w","srcWebp":"/static/6a39ebe40d3a52b97b478c8ce0551c02/b8a88/Smokescreen-Ransomware-Defense.webp","srcSetWebp":"/static/6a39ebe40d3a52b97b478c8ce0551c02/3a3bf/Smokescreen-Ransomware-Defense.webp 113w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/975bf/Smokescreen-Ransomware-Defense.webp 225w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/b8a88/Smokescreen-Ransomware-Defense.webp 450w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/761da/Smokescreen-Ransomware-Defense.webp 675w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/210c1/Smokescreen-Ransomware-Defense.webp 900w,\n/static/6a39ebe40d3a52b97b478c8ce0551c02/ab8d3/Smokescreen-Ransomware-Defense.webp 2560w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"34627d50-53e7-5dda-bb36-6ab2c0cf489d","name":"Amir Moin"}}},{"node":{"id":"e3cd17da-d028-5fad-bd26-31d9b3a4604d","title":"Using deception to shield the insurance sector","content":"\nLet’s cut to the chase, insurance companies are under siege from cyberattacks. An Accenture report from 2020 shows that attacks on insurers have more than doubled from 240 to 519, on average. Insurers also sit on top of sensitive customer data and are at risk of losing it – 44% exposed more than 500,000 customer records in 2019 compared to 15% for cross-industry peers.
\n\n\n\nAs more people around the world come under the ambit of insurance policies, the risk to insurers continues to grow. In this post, we take a look at some of the key pieces of an insurer’s infrastructure that adversaries target, why they go after it, and how you can use deception to build active defenses that mitigate the risk of these attacks and put you in a better position to detect and contain these threats,
\n\n\n\nFor a moment, step into the shoes of a malicious entity targeting an insurance company. Your goal is to get $$$. What are your best opportunities?
\n\n\n\nThe database of all policyholders and their policy details, complete with confidential and protected information is perhaps the most valuable asset of an insurer. This would be the holy grail of compromises. Given that a lot of this information is distributed across many systems (some of them legacy), protecting them is a challenge for the sector.
\n\n\n\nNot only would this data sell for a neat sum on the underground market, but it can also be weaponized in numerous ways, including and not limited to:
\n\n\n\nTo achieve this target, adversaries will have to invest time and money into:
\n\n\n\nCost-benefit analysis reveals Low to medium risk with an extremely high payout.
\n\n\n\nAdvanced and organized criminal syndicates.
\n\n\n\nInsurance companies deal with lots of files. Lots and lots of files. If an adversary succeeds in encrypting as many files as possible, the payout from this activity can be significant.
\n\n\n\nRansomware operators of any sophistication.
\n\n\n\nInsurance companies worldwide are expected to digitize their interactions with consumers. Everything from pre-sales to claims management is expected to be made available to consumers directly in a bid to simplify the consumer experience. This involves the adoption of cloud services, moving previously internal systems to Internet-facing infrastructure, and spinning up even more infrastructure to support business objectives. Adversaries now have a wider attack surface available to them to exploit.
\n\n\n\nMapping external infrastructure is a trivial task and therefore there are minimal considerations for groups adopting this approach.
\n\n\n\nLow effort with payout equivalent to the criticality of the infrastructure they compromise.
\n\n\n\nCybercriminals of any sophistication.
\n\n\n\nDeception is about tilting the odds of winning in your favor. It’s about making reasonable judgments about what the adversary might go after and presenting that information to them on a platter. Deception is about abstracting defenses to individual attacker techniques with lesser effort and increased cost to the attacker.
\n\n\n\nThe core principle of deception is the idea that any interaction with a decoy can be viewed as suspicious and warrants immediate action.
\n\n\n\nBroadly, the plan is to plant decoys across the network, from perimeter to end-point, to deceive the adversary. At a high-level, the following locations will be configured with decoys:
\n\n\n\nBy spreading decoys across the infrastructure, we maximize our chances of detecting adversaries. Remember, we only need to be able to detect the adversary once.
\n\n\n\nThe following is a break-down of what this might look like in practice.
\n\n\n\nLet’s say you don’t want to use deception. The alternative is to understand and defend yourself against every attacker technique. As per MITRE ATT&CK, these are over 100 and this does not account for variations in how these attacks might be executed.
\n\n\n\nDeception is grounded in addressing the motivations of the adversary and presenting fake information on a platter that adversaries find attractive. It is technique-agnostic and abstracts away the complexity that arises from blocking individual tools, techniques, and behaviors.
\n\n\n\nDeception is a form of Active Defense, where security teams take proactive steps to channel the adversary and make their life difficult. It varies from regular defense where you wait for an existing system to generate an alarm and then react.
\n\n\n\nMITRE new active defense framework, Shield, is being adopted by CISOs around the world and we see this approach being embraced by more and more security teams at insurance companies.
Pentest reports tell a story. The story of how the team managed to break into your environment. In my experience, a critical component usually missing from these reports is the rationale behind the choices made by the pentesters who ran the assessment.
\n\n\n\nAsking why allows you to deconstruct choices that real threat actors might make in your environment. Having a sense of those choices will give you some active defense opportunities.
\n\n\n\nLet me demonstrate this with a little thought experiment. Let’s consider a pentest where the objective was to demonstrate access to the customer database. Here’s what the pentesters broadly did:
\n\n\n\nIn each of these steps, the pentesters made some choices. As you’ll now see, deconstructing these choices can help build better defenses.
\n\n\n\nThe Active Defense matrix was released by MITRE to provide a framework for identifying opportunities where adversary behavior can be influenced to enable defenders to easily spot threats.
\n\n\n\nThe foundation of the Active Defense approach rests on three principles:
\n\n\n\nSo let’s begin by deconstructing each of the 7 steps in the report to identify Active Defense opportunities
\n\n\n\nBlock PowerShell to force the adversary to use non-PowerShell options.
\n\n\n\nSince PowerShell usage for C2 is fairly common, it reduces the risk of being hit with commodity malware that uses PowerShell even today.
\n\n\n\nMITRE Shield Technique: Security Controls
\n\n\n\nSetup attractive decoy accounts, assign attractive privileges, and setup attribute level auditing on description, SPN, etc. to monitor enumeration attempts. This has the added advantage of detecting password spraying regardless of intensity and staggering strategies.
\n\n\n\nGain insight into enumeration activities being conducted against the domain from a user perspective.
\n\n\n\n(Note: Don’t ever use these accounts for any operations. There are ways to make this opsec safe)
\n\n\n\nMITRE Shield Technique: Decoy Account
\n\n\n\nSetup decoy computers, assign attractive hostnames to databases, and setup attribute level auditing on description, SPN, etc. to monitor enumeration attempts.
\n\n\n\nGain insight into enumeration activities being conducted against the domain from a computer perspective.
\n\n\n\nMITRE Shield Technique: Decoy System
\n\n\n\nLet’s assume that Kerberoasting was the privilege escalation technique that worked. In this case, let’s also assume that the service account was a domain admin.
\n\n\n\nMakes the adversary believe they have obtained hashes to the customer database SQL service account while at the same time removing the risk of kerberoasting a real domain admin account.
\n\n\n\nA similar approach can be used for other popular privilege escalation techniques.
\n\n\n\nThere are many techniques available for privilege escalation, and some of them lend themselves well to an Active Defense approach. However, in cases where that doesn’t work, focus on what the adversary intends to accomplish with those privileged credentials.
\n\n\n\nMITRE Shield Technique: Decoy Account, Decoy System, Security Controls
\n\n\n\nEven a single port query against the decoy SQL server system is worth investigating while complicating access to the real customer database.
\n\n\n\nMITRE Shield Technique: Network Diversity, Decoy Diversity, Network Manipulation
\n\n\n\nEven a single port query against the decoy SQL server system is worth investigating while complicating access to the real customer database
\n\n\n\nMITRE Shield Technique: Standard Operating Procedure, Decoy Credentials
\n\n\n\nUnfortunately, if the adversary has reached this point, detection difficulty increases. This is because, from an analytics perspective, you are looking for a legitimate account, logging into a legitimate database, and running possibly legitimate queries. However, there are still things we can do.
\n\n\n\nMITRE Shield Technique: Hunting, System Activity Monitoring
\n\n\n\nI present an abstracted approach to applying Active Defense use cases. It has 4 pieces:
\n\n\n\nYou can use the above as a combination to assess a use case beyond just analyzing pentest reports. The pentest report was just a means for me to present my idea.
\n\n\n\nI would like you to note a few things.
\n\n\n\nFor free, of course.
\n\n\n\nAt this point, I’m positive that you’ve heard of MITRE Shield. It’s a new active defense knowledge base released by MITRE – stuff they’ve been implementing for over a decade to engage adversaries and derail attacks. They’ve opened it up to everyone, and for the first time perhaps, the infosec community has a shared vocabulary and framework for actively defending against attacks instead of reacting to them.
\n\n\n\nI’ve been having conversations about MITRE Shield and Active Defense with CISOs and customers. While some of the conversations are basic and around what is active defense and why does it matter, what I consistently hear from across the board is – “how do we even begin to implement this stuff?” That’s a fair question, but it’s only one part. What more folks aren’t asking is, where do we implement active defenses for the most impact.
\n\n\n\nI’ve zeroed down on four active defense techniques from the MITRE Shield matrix that address both the questions – how do I get started with this and where should I be building active defenses first. Think of this as a soft launch guide for your Active Defense journey.
\n\n\n\nI’ve selected techniques based on two factors:
\n\n\n\nAs a result, all four defenses are Active Directory exclusive. Active Directory has become an adversary favorite attack vector. By deploying active defenses in Active Directory, you’ll be able to make great strides in disrupting adversary actions.
\n\n\n\nOnly two:
\n\n\n\nLet’s dive right in.
\n\n\n\nMITRE Shield Procedure – DPR002
\n\n\n\nPlant decoy accounts in your Active Directory. Any interaction with these accounts is a high-confidence indicator of compromise. These accounts will also help you study the adversary’s actions, mislead attackers by putting these accounts in their path during enumeration, and use them to influence the attacker’s actions and next steps.
\n\n\n\nSet up a decoy account and give it “Domain Admin” privileges. This will make the account interesting to the adversary.
\n\n\n\nIn this video, we focus on detecting the operation. We show how to setup Windows Auditing so that we can capture the appropriate log. We also demonstrate an attack to test if the logs are captured appropriately.
\n\n\n\nPsuedo-code for detection rule:
\n\n\n\nIf login_activity observed for decoy_account then raise a high priority alert.\n\n\n\n
MITRE Shield Procedures – DPR0022 and DPR0033
\n\n\n\nDecoy systems are an excellent active defense tool because they act as a target to lure away attackers from legitimate assets. Decoy content could be anything ranging from fake files to browser shortcuts that act as breadcrumbs to point adversaries to decoy systems.
\n\n\n\nIn this video, we set up a webserver on our test machine to channel an adversary towards interacting with it. We create a browser shortcut and place it in a publically accessible location on the Active Directory Server to make it easier for the adversary to discover.
\n\n\n\nWe ensure that our web server is logging connections. If an adversary attempts to conduct reconnaissance against this webserver, we should see a logline in the webserver log.
\n\n\n\nPsuedo-code for detection rule:
\n\n\n\nIf REQUEST observed for /admin then raise a high priority alert.\n\n\n\n
MITRE Shield Procedure – DPR0024
\n\n\n\nDecoy credentials are fake usernames and passwords that can be planted in a variety of places including in the Active Directory. They act as silent alarms when interacted with and also as a means to delay the attacker.
\n\n\n\nIn this video, we create a batch file planted with fake credentials and store it in a publically accessible location on the Active Directory Server to make it easier for the adversary to discover.
\n\n\n\nIn this video, we show how to set up auditing on your test machine to capture attempts to use the credentials against your test machine.
\n\n\n\nPsuedo-code for detection rule:
\n\n\n\nIf login_event is 4625 AND username is admin\n\n\n\n
Then raise a high priority alert.
MITRE Shield Procedure – DPR0052
\n\n\n\nPocket litter is an active defense technique used to mislead attackers into thinking that the system and user they’re exploiting are legit. You plant fake documents, browser history, browser sessions, etc. to give adversaries the confidence that they are on the right track.
\n\n\n\nIn this video, we will set up a file share on the test machine. We will plant a shortcut to this file share in a publically accessible location on the Active Directory Server to make it easier for the adversary to discover.
\n\n\n\nIn this video, we show how to set up file share auditing on your test machine to capture attempts to access the file share on your machine.
\n\n\n\nPsuedo-code for detection rule:
\n\n\n\nIf login_event is 5140 AND share_name contains shared_folder_name\nThen raise a high priority alert.\n\n\n\n
These folders are accessible to all users within your environment. Over time, these folders accrue a lot of files and scripts that are interesting to adversaries. We wish to use these folders to misdirect the attacker, should the attacker go browsing through these folders. It is also uncommon for regular users to require to browse through this folder.
\n\n\n\nThe focus of this guide was to get your mind thinking about active defense. If there’s one thing I’d like you to walk away with, it’s that if any of these defenses trigger an alarm you will have discovered malicious activity for a couple of hours of effort. And it cost you nothing.
\n\n\n\nAt Smokescreen, we’ve been implementing active defense programs since before it was a thing. No wonder then that Smokescreen covered 95% of MITRE Shield when it launched in Sep 2020. If you’d like to see how we can help, hit us up. Here’s a mapping of Smokescreen to MITRE Shield if it’s helpful.
\n\n\n\nWe’re also running active defense workshops where we deconstruct MITRE Shield and talk about how you can implement it. Feel free to sign up.
\n","excerpt":"For free, of course. At this point, I’m positive that you’ve heard of MITRE Shield. It’s a new active defense knowledge base released by MITRE – stuff they’ve been implementing for over a decade to engage adversaries and derail attacks. They’ve opened it up to everyone, and for the first time perhaps, the infosec community […]\n","slug":"four-mitre-shield-techniques-you-can-implement-in-2021","date":"2020-12-30T16:48:39.000Z","status":"publish","modified":"2021-02-03T07:14:04.000Z","wordpress_id":18652,"featured_media":{"id":"3b48d9b0-598d-52ec-92d7-1eef58be5ea8","source_url":"https://ss-website-content-prod.s3.ap-south-1.amazonaws.com/wp-content/uploads/2020/12/Smokescreen-MITRE-Shield-Techniques.png","alt_text":"Smokescreen-MITRE-Shield-Techniques","large":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAALCAYAAAB/Ca1DAAAACXBIWXMAAAsTAAALEwEAmpwYAAACQklEQVQoz0WSSW8TQRCF84s5IXFBHJEQ4g9wQggOkbhEBEEIS4xDMkZeEhzH8SITJ+N4tu4Zz+6xncerceIcamq6W/11Vb23ZU8mULYN33UxUx5mWsHXGjPfRxgECGezh+Ba9gOea8+Dchy4lgXn5gbCsUwTW/IZXHTR6w/RG11jMrV5mRcJiKIIcRw/BNdRGJZggfpKbaAboDkew6hWcWg0YHRGuDQtFFmKPMuQpSmSJEHKSEooH4jC8sHAlypdeLZF4HRT5ZbFn9HlGOOrK5gTEybXJl+8NDkK7SPP8xKWpMzZkrlgXjBWPFshZQ7DpISWwBuWuf3lKz7sf8f23jd8rBxit/obe8c1NLoXmOcZUsLiyIY3rUG755z5KbRlINZt5MEJVrkFz9UEmmvgzo8D7Faq2Cdk5+AXPlWPcNg6RWc4YtsJsjmQWAfQJ0/gd1/Bbz+D138L3XkO1XyE1PoJpWICr9ctN9pnaHXOcdYfoHXRw1/m7ugfivmcs0yR5bdInD8I2k+he68RCHT4Dqr3Brr1GJl7TGC0BopCmkoFVEwsEVNFmVnKEKWlwpSzy/0zJP0XSNw6YqeBePIZyfg90sFLFH4DygvvKmTL1UoFNcPA8dERDOZms4l6vY4Jh1wqTfi8KLBY3qIo5igWQLFkyN5ixVhQbXstijOlOgyXG4rmLk19Z+gsE0HW1pFqg4CmZhc+za/EMuzMEQ+KZe5tI/4Rujg/uIOJee/NLLCNFxmyJ+ez0tyKqrvlfeFIt/8BWgssJrC5KxYAAAAASUVORK5CYII=","aspectRatio":1.9047619047619047,"src":"/static/edada2176ce537fff9fc98c912eee812/ee604/Smokescreen-MITRE-Shield-Techniques.png","srcSet":"/static/edada2176ce537fff9fc98c912eee812/69585/Smokescreen-MITRE-Shield-Techniques.png 200w,\n/static/edada2176ce537fff9fc98c912eee812/497c6/Smokescreen-MITRE-Shield-Techniques.png 400w,\n/static/edada2176ce537fff9fc98c912eee812/ee604/Smokescreen-MITRE-Shield-Techniques.png 800w,\n/static/edada2176ce537fff9fc98c912eee812/f3583/Smokescreen-MITRE-Shield-Techniques.png 1200w,\n/static/edada2176ce537fff9fc98c912eee812/5707d/Smokescreen-MITRE-Shield-Techniques.png 1600w,\n/static/edada2176ce537fff9fc98c912eee812/0ef64/Smokescreen-MITRE-Shield-Techniques.png 2400w","srcWebp":"/static/edada2176ce537fff9fc98c912eee812/58556/Smokescreen-MITRE-Shield-Techniques.webp","srcSetWebp":"/static/edada2176ce537fff9fc98c912eee812/61e93/Smokescreen-MITRE-Shield-Techniques.webp 200w,\n/static/edada2176ce537fff9fc98c912eee812/1f5c5/Smokescreen-MITRE-Shield-Techniques.webp 400w,\n/static/edada2176ce537fff9fc98c912eee812/58556/Smokescreen-MITRE-Shield-Techniques.webp 800w,\n/static/edada2176ce537fff9fc98c912eee812/99238/Smokescreen-MITRE-Shield-Techniques.webp 1200w,\n/static/edada2176ce537fff9fc98c912eee812/7c22d/Smokescreen-MITRE-Shield-Techniques.webp 1600w,\n/static/edada2176ce537fff9fc98c912eee812/f1e40/Smokescreen-MITRE-Shield-Techniques.webp 2400w","sizes":"(max-width: 800px) 100vw, 800px"}}},"medium":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAKCAYAAAC0VX7mAAAACXBIWXMAAAsTAAALEwEAmpwYAAACFUlEQVQoz02SS0/bQBSF83f7A7rprpt22S5bqbtu6KpqEaiKUAuEgAgJIQhC0jyI4zi249f4NbZj0OkZJ0pZXM3Ynvl87rmnZhsGTF2HNp1iPtehGyZc10UoBKIwRBzHSLal9lEUVd+E7yPgOW+1gmNZUBxrsUBttVxWsItGA832LVr9R9iOhyKTyLMMaZruSqYx0oTwKEQkAgSeQ6BFoAnFUdBapZA1nkwxnc0w518WpgndtFgmshfQKF0jTApWDhGvkcgSMnumarlTWXN5aULY96Pf+PHnBAeNJg7OznHcucb+aRO261FpjlSmEF4fwh2w3TGE00UiBpDiDqVcwuM522DLLskTtvztVx37x6c4JHCvfoTD5gXOuj2sFDAv2K5AeP8Wwd17iNs38AafETx8QNB5BWn8hO/HBOobDy3W/fAvxjMNY22O4eMMQ+59mv/8VFJdhkxyIA/v4PUJGX5CMPiIYPQVfvc1pH0C34s2CiszWYamwaR/yk/XtuFzgg4nGIaCPuasFIWxh8w6QhbNkdgt7uvItS8oRYfAcAukhwvCri4vcd1u46rVQu/mBr1eD6PRqIqKlLIaSlECWfGELC+54v+areFQxG7KDqEqU2EQIGbO0iRhi5vYKJgkLOG7iGqVYhGoyDCDzqqKjL3tsgKqMKoHNXYV0sDzqgtVqAlXoJdZVM/qfbQNt7JGWVTNgqx/v9rh65njvVwAAAAASUVORK5CYII=","aspectRatio":1.9152542372881356,"src":"/static/edada2176ce537fff9fc98c912eee812/62b1f/Smokescreen-MITRE-Shield-Techniques.png","srcSet":"/static/edada2176ce537fff9fc98c912eee812/e7519/Smokescreen-MITRE-Shield-Techniques.png 113w,\n/static/edada2176ce537fff9fc98c912eee812/7e7e9/Smokescreen-MITRE-Shield-Techniques.png 225w,\n/static/edada2176ce537fff9fc98c912eee812/62b1f/Smokescreen-MITRE-Shield-Techniques.png 450w,\n/static/edada2176ce537fff9fc98c912eee812/e2e7f/Smokescreen-MITRE-Shield-Techniques.png 675w,\n/static/edada2176ce537fff9fc98c912eee812/db955/Smokescreen-MITRE-Shield-Techniques.png 900w,\n/static/edada2176ce537fff9fc98c912eee812/0ef64/Smokescreen-MITRE-Shield-Techniques.png 2400w","srcWebp":"/static/edada2176ce537fff9fc98c912eee812/b8a88/Smokescreen-MITRE-Shield-Techniques.webp","srcSetWebp":"/static/edada2176ce537fff9fc98c912eee812/3a3bf/Smokescreen-MITRE-Shield-Techniques.webp 113w,\n/static/edada2176ce537fff9fc98c912eee812/975bf/Smokescreen-MITRE-Shield-Techniques.webp 225w,\n/static/edada2176ce537fff9fc98c912eee812/b8a88/Smokescreen-MITRE-Shield-Techniques.webp 450w,\n/static/edada2176ce537fff9fc98c912eee812/761da/Smokescreen-MITRE-Shield-Techniques.webp 675w,\n/static/edada2176ce537fff9fc98c912eee812/210c1/Smokescreen-MITRE-Shield-Techniques.webp 900w,\n/static/edada2176ce537fff9fc98c912eee812/f1e40/Smokescreen-MITRE-Shield-Techniques.webp 2400w","sizes":"(max-width: 450px) 100vw, 450px"}}}},"author":{"id":"765e8417-7ed6-55b7-95a7-1d561141e760","name":"Sudarshan Pisupati"}}}]},"costSectionImage":{"childImageSharp":{"fluid":{"base64":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAANCAYAAACpUE5eAAAACXBIWXMAAAsTAAALEwEAmpwYAAADUklEQVQ4yzWSW2gcZRzFzzcze02y273OfWdnZ3dmr9mmSUsiaaJtV+0lNppaGmukTcEHgygWtS8iKAUFRSEvggj6JoJPPha1j74IfREUBC+ICIKgD2K7mfn7n10dOAzfzHy/Od/5H4xGDVzb6aPSaeeyhl2ZdepW2qx5Sd3qirK2JKnWCaHb56HZO9DMZ4Rm3YBm3YRq7kuq8aFQjU8yVv3LGct5F4AEuVyBVCofl8rqT6xfpKr+h6Sa/0iaSUK3SJgOgSVbdUrbLgmjRtBtYiihqk9VqvLa/A7HH/aAQinWCyiWCWV+UeYPVIM3WRFsNxQ1L4TjhTPNzkGx1T3g9QFDxwwdJwx7LFT9LooVgt34Gucv98ELBpbfQ4kfVrS7SaMWJq16lPH8SHJakahPJTfaLD8SthvBqEXsOso5XsTRhBOH9dbneHzXgmyYMfRWDEzxH3Nei3LNNhUGC5T1+wTXJ+EGJPFdbgTEQJIdj7IshaEczRTY7H6KK88VIfKVOT7u95wd5erNcC4IorQXUL6/QIeGiyS1eiS8DkN9Uvgu1RoTKXG2GsdS1SOUVULn8Pt45Z00RKHiMnCc4CHkXT+aZRfJoEf5zgLlh0skMxDsMHYn11sTh1LskqGp+Oj/AwdHb+LWN0qc3ygeiKyaYY6zyrd7UX7+MBXmj9CMP5g44wxJZqjitlj+ZOoZBiZjYEXj7PV7WFi+LhFxcw4Vn50ORL2Xc1vhXKcb5oJeWOwNo1SzG8FpRiJWrRGBh8XZRXIM0u2I2zB1pxp/4djaVcSXUlE/Ev9VRqgWZdwmzbTapLADxL2zG7HiqYYwWLodcnYhqgZLG087aP2G1dEmllaBREV9OuF4d9Kdwbey3/0x3Rv+qjSD36WG/2cq6P2d6Q7HuaMrlPK7pDiNScEli4tu2qRw7txhLrv9Mx58dA3nLgGnYpubO6s4e2kDDz22JU5uXBHrp/dw36mXxfIDr8srJ96SV+7fTyyvf5BcXPlYHix+JnXmv1Da/a+yQf9Ooub+kPL7t3Hm4hE8chkozWUFntwD1jeQeXVf4MbbCl58IyleejOD51+bxe71Ap7Y07B1zcGFXR9bV+ex+dQx3ryGje0Rzm2fwekL2+yuibMX8S+BMBcPGVLWLQAAAABJRU5ErkJggg==","aspectRatio":1.528735632183908,"src":"/static/739e365bb81f8bf83185927701d2793f/651c0/cost-image-2x.png","srcSet":"/static/739e365bb81f8bf83185927701d2793f/e223a/cost-image-2x.png 133w,\n/static/739e365bb81f8bf83185927701d2793f/66882/cost-image-2x.png 265w,\n/static/739e365bb81f8bf83185927701d2793f/651c0/cost-image-2x.png 530w,\n/static/739e365bb81f8bf83185927701d2793f/a384c/cost-image-2x.png 795w,\n/static/739e365bb81f8bf83185927701d2793f/c884a/cost-image-2x.png 1056w","srcWebp":"/static/739e365bb81f8bf83185927701d2793f/46494/cost-image-2x.webp","srcSetWebp":"/static/739e365bb81f8bf83185927701d2793f/a5ef1/cost-image-2x.webp 133w,\n/static/739e365bb81f8bf83185927701d2793f/4dc00/cost-image-2x.webp 265w,\n/static/739e365bb81f8bf83185927701d2793f/46494/cost-image-2x.webp 530w,\n/static/739e365bb81f8bf83185927701d2793f/5b747/cost-image-2x.webp 795w,\n/static/739e365bb81f8bf83185927701d2793f/950f5/cost-image-2x.webp 1056w","sizes":"(max-width: 530px) 100vw, 530px"}}}},"pageContext":{"id":"ea0aa0bf-7d16-5925-b1f2-594f99da9771","relatedPostsIDs":[18716,18782,18779,18707,18652]}},"staticQueryHashes":["1478079672"]}