Cybrary ForgeCYBRARY / FORGE
Back to Cybrary Forge

Build the attacker

Say who is coming at the estate and what they brought. Forge resolves that into an ATT&CK chain, raises those detections on your own SIEM instance and opens the graded cases that answer them.

Walk the SIEM demo
Their role
What is in their kit
What they are after

How they read on the estate

Ransomware crew: a ransomware crew carrying Credential dumper, after harvest credentials. That is 4 step(s) of ATT&CK, loud on the wire.

The breach walk this builds

  1. T1078.001Default Accountsinitial-access
    Ransomware crew
  2. T1003OS Credential Dumpingcredential-access
    Credential dumper
  3. T1110Brute Forcecredential-access
    Harvest credentials
  4. T1021.001Remote Desktop Protocollateral-movement
    Ransomware crew

The detections it will raise

  • high
    Default Accounts on WKSTN-11estate-default-credential · helpdesk-admin · 203 min into the shift
  • critical
    OS Credential Dumping on FS-EDGE-01estate-credential-access · svc-backup · 162 min into the shift
  • medium
    Brute Force on LNX-BUILD-03estate-auth-failure-burst · j.okafor · 122 min into the shift
  • high
    Remote Desktop Protocol on WKSTN-04estate-lateral-movement · t.beck · 81 min into the shift

This seeds your own instance only. Nobody else's console changes.