Table-Top Exercises

1.1      Introduction Recently, myself and a few friends decided to port my coworker Kevin Haubris‘ COFFLoader project to Metasploit. This new BOFLoader extension allows Beacon Object Files (BOFs) to be used from a Meterpreter session. This addition unlocks many new possibilities for Meterpreter and, in my opinion, elevates Meterpreter back up to the status of a ‘modern C2 payload’.

As security practitioners, we live in a time where there is an abundance of tools and solutions to help us secure our homes, organizations, and critical data. We know the dangers of unpatched applications and devices as well as the virtues of things like password managers and encrypted databases to protect our passwords and other sensitive information. However, we often forget that these tools, while helpful and no doubt beneficial, are subject to the same attacks as other applications.

tl;dr Out-of-band (OOB) communications are alternative systems or technologies that allow responders to collaborate, coordinate, and inform during an incident. OOB should not use any existing, normal infrastructure. OOB should provide email, voice, and real-time communications capabilities; mass one-way communications to employees, clients, and the public; and file storage. Ensure that your OOB solution meets any internal legal requirements. Set up OOB before an incident occurs.