Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Rob Harrand
Python & MITRE ATT&CK: Part 15/15
(🔗 <- Link to back to Part 14 🔗) In this blog series we’ve seen examples from an imaginary attack on a healthcare company. We began with the attackers discussing their target in a dark web discussion, followed by the creation of resources, a phishing attack, through the discovery of the network, the finding of data, and leading to its eventual exfiltration and destruction.
Python & MITRE ATT&CK: Part 14/15
Impact (🔗 <- Link to back to Part 13 🔗) We’ve reached the final stage of the attack, that of Impact from the MITRE ATT&CK framework. At this point, an attacker may try to stay under the radar, quietly exfiltrating data for many years. Alternatively, they may wish to cause disruption via encryption, deletion, or something more subtle, like data changes within files. For our scenario, we’ll assume the attacker wishes to delete the original files.
Python & MITRE ATT&CK: Part 11/15
Collection (🔗 <- Link to back to Part 10 🔗) Our attackers are now on the ‘R&D’ system, remoting in from their newly established admin account thanks to various factors, including a plaintext password. On this new system, they find numerous shared drives and thousands of files. The majority look to be of little interest, including large files of raw data from scientific instrumentation. What’s of more interest, however, is a folder called ‘Clinical’, where sensitive IP appears to reside.
Python & MITRE ATT&CK: Part 10/15
og Name: Security Source: Microsoft-Windows-Security-Auditing Event ID: 4625 Level: Audit Failure Keywords: Audit Failure User: N/A Computer: BOBS-PC Logon Type: 10 (Remote Desktop) Account For Which Logon Failed: Security ID: NULL SID Account Name: new_bd Account Domain: BOBS-PC Failure Information: Failure Reason: Unknown user name or bad password Status: 0xC000006D Sub Status: 0xC000006A Process Information: Caller Process Name: C:\Windows\System32\winlogon.exe Network Information: Source...
Python & MITRE ATT&CK: Part 9/15
Discovery (🔗 <- Link to back to Part 8🔗) So far, our attacker will have explored the available systems to a small extent, working methodically and patiently, limiting activity until defense evasion techniques had been employed. At this point, they’re likely to expand their efforts, and ask questions such as, What accounts are present? (Windows, email, cloud, etc.) What is the network architecture? What applications are running? What sites have been visited using the browser?
Python & MITRE ATT&CK: Part 7/15
Python & MITRE ATT&CK: Part 7/15 Photo by Hannes Wolf on Unsplash (🔗 <- Link to back to Part 6 🔗) Introduction A key step in a cyberattack is the next part of the MITRE ATT&CK framework: Defence Evasion. Earlier (in part 4), we used the analogy of a security guard patrolling a physical premises when discussing the monitoring of logs on a device. Now, we can imagine a thief who had gained access to such a property and is now employing techniques to avoid the security guard and other such controls.
Python & MITRE ATT&CK: Part 6/15
Python & MITRE ATT&CK: Part 6/15 Photo by Clay Banks on Unsplash (🔗 <- Link to back to Part 5🔗) Introduction What’s next for our attackers? They now have a ‘backdoor’ account that’s persistent, and will proceed towards their ultimate goal of stealing sensitive IP from the company. It’s important to note that not all cyberattacks are linear, nor do they all involve every step of the MITRE ATT&CK framework.
Python & MITRE ATT&CK: Part 3/15
Initial Access (🔗 <- Link to back to Part 2 🔗) The stage is set for the launch of the criminal’s attack. They launch their phishing email using the infrastructure that’s in place, and target the members of the HR team. The members of this team were discovered, let’s assume, during the Reconnaissance phase by using a platform such as LinkedIn. Recall that in the dark web discussion, one of the perpetrators stated that “I’ll target their HR team first.
Python & MITRE ATT&CK: Part 1/15
Reconnaissance Rob Harrand · Follow 9 min read · -- Photo by Chris Yang on Unsplash (🔗 <- Link to back to Part 0 🔗) We’ll begin at the point where most attacks are initiated, which is when information on a potential target is being sought. In our imagined scenario, the cybercriminal organisation begins its overall attack by discussing certain details on a dark web chat-forum. This is the Reconnaissance stage of the MITRE ATT&CK framework.
Python & MITRE ATT&CK: Part 0/15
Series Introduction Rob Harrand · Follow 5 min read · -- Photo by David Clode on Unsplash This 16-part blog series will outline an imagined cyber-attack from start to finish, following an example path through the MITRE ATT&CK framework. At each stage, we’ll see examples of where Python could be used. The data used in these scenarios is fabricated, but should provide useful and connected examples that can demonstrate some of the potential analysis approaches in Python.
SharePoint Lists
OK, maybe 'ultimate weapon' is a bit strong. But hear me out... If you browse the Internet for 'cyber security projects' you're likely to come across things like the installation of technical tools, such as , , or . These tools are fantastic and such projects can be a lot of fun, but what will they be protecting? As the old adage goes, " A band is only as good as its drummer" [ 1]. I've come to believe that a cyber security setup is only as good as its lists.
Malicious Domain Detection using Machine Learning
Spam detection, a classic example of machine learning (ML) applied to cyber security, has been around for many years. The way it works can be understood intuitively based upon how we as humans distinguish spam from non-spam (‘ham’) emails. Namely, if an email is littered with spelling mistakes, excessive exclamation points, is out-of-character for the alleged sender, is making an offer that’s too good to be true, or is asking for personal information, it raises red flags.
Marathon Training: A Data Perspective
In late 2018, at the age of 38, I realised that the moderate levels of physical exercise that I’d done in my 20s and early 30s had become a distant memory. Life had completely taken over my spare time, and as I ruminated about the not-that-long-away transition into my 40s, I knew it was now or never to get moving again. I’d never been interested in any form of sport, and pretty much hated PE at school.
Affimer Proteins: Next Generation Sequencing Data Analysis (Part 1)
Affimer Proteins In this blog series, I’ll describe a specific data analysis problem using the R programming language. Namely, the analysis of biological data from a Next Generation Sequencing machine, relating to a specific type of molecule called an Affimer protein. A reasonable working knowledge of R is beneficial to understanding the code, but the overall process can be understood without this.
Drawing Flowers Using Mathematics
“The scientist does not study nature because it is useful; he studies it because he delights in it, and he delights in it because it is beautiful.” — Henri Poincaré There are many examples of natural facts that can be described in mathematical terms. Nice examples are the shape of snowflakes, the fractal geometry of romanesco broccoli or how self-similarity rules the growth of plants. R is a tool for doing serious analysis, but not everything in life is serious.
Applying Data Science
Where, when, why and what You’ve read the blog posts about changing the world using bleeding-edge AI on massive datasets. You’ve seen the articles revealing the intricate and technical details of TensorFlow, Spark and advanced model ensembles. But one question that usually isn’t focused upon is how to apply these fancy tools to everyday life? Or simply how to apply the more run-of-the-mill data science tools and concepts? This blog post is an attempt to show some possible ideas.
Is Data Science For You?
Think of a country. Which one did you think of? France? Brazil? Australia? Now ponder this; where did that answer come from? Did you sense it pop into your head? The author Sam Harris uses this question to highlight the fact that we do not ‘choose’ many, and arguably any of our seemingly conscious decisions. I want to suggest that this very same subconscious decision-making process is already at work in answering the question posed in the title of this blog post.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Rob
Contact Rob, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack