2.7 KiB
| title | date | draft | description | weight |
|---|---|---|---|---|
| Network Breach | 2020-08-12T13:04:55+03:00 | false | Simulate an internal network breach and assess the potential impact. | 1 |
Overview
Whether it was the Hex-men campaign that hit your Internet-facing DB server, a cryptomining operation that attacked your WordPress site or any other malicious campaign – the attackers are now trying to go deeper into your network.
Infection Monkey will help you assess the impact of internal network breach, by trying to propagate within it using service vulnerabilities, brute-forcing and other safe attack methods.
Configuration
- Exploits -> Exploits You can review the exploits Infection Monkey will be using. By default all safe exploiters are selected.
- Exploits -> Credentials This configuration value will be used for brute-forcing. We use most popular passwords and usernames, but feel free to adjust it according to your native language and other factors. Keep in mind that long lists means longer scanning times.
- Network -> Scope Make sure to properly configure the scope of the scan. You can select Local network scan and allow Monkey to propagate until maximum Scan depth(hop count) is reached or you can fine tune it by providing specific network ranges in Scan target list. Scanning local network is more realistic, but providing specific targets will make scanning process substantially faster.
- (Optional) Internal -> Network -> TCP scanner You can add custom ports your organization is using.
- (Optional) Monkey -> Post Breach Actions If you only want to test propagation in the network, you can turn off all post breach actions. These actions simulate attacker's behaviour after getting access to a new system, but in no way helps to exploit new machines.
Suggested run mode
To simulate a foreign device you could introduce the Island server to the network and run monkey from it. Alternatively, for a malicious agent simulation, you should run monkey manually on a machine that’s already running in the network. Combining both, as always, will give you the best coverage.
Assessing results
Check infection map and security report to see how far monkey managed to propagate in the network and which vulnerabilities it used in doing so. If you left post breach actions selected, you should also check ATT&CK and Zero Trust reports.
