Security Validation

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20241106 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal. For full details on this release, see the 

The Mandiant Security Validation (MSV) team is pleased to announce version 4.14.1.1 of the MSV platform. Bug fixes Fixed an issue related to proxy information in integration logs on the Director. Known issues Local Event Filtering works as expected but is limited to Match Action, Match Integration, and Match Events (when the latter involves Raw Events). If a rule has a Match Event condition for any field other than Raw Event, the rule does not apply to Local Events. It only applies to events from standard local integrations in MSV. Network configuration may reset unexpectedly. To resolve the issue, run vsetnet after the upgrade with static IP addresses for one or more interfaces. Appliance OS Security Update The latest platform security update can always be found on the

In this guide, I'll show you how to generate an API key in MSV so that you can use it for programmatic access to your validation platform.  This will be useful for following some of the other guides and resources provided in the forum by others. In MSV, click User, then click User Preferences.  In the subsequent screen, click the + button next to API key to generate a new key. Note that the API key is only displayed at the time of generation, while the modal window that is displaying it is visible.  Once the modal window is closed, the key can't be displayed again, so ensure that you have saved it to a secure location.

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20241023 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download and apply the content pack manually using the below link. For a full summary of changes included in this content release, please refer to the release notes in the Mandiant Documentation Portal.

In this post, I will show you how to use Mandiant Security Validation (MSV) and threat intelligence from Virustotal to validate whether your endpoint security controls can detect data exfiltration using curl on windows. Your task is to validate whether your endpoint security controls can detect and/or prevent a data exfiltration using curl . The steps will be as follows: Find the malicious curl use case on virustotal. Create and run the curl Windows Host CLI action. Validate the efficacy of the internet security controls and address any gaps. 1-Find the malicious curl use case using virustotal: I will use sigma rules to find the needed sample,  browse https://www.virustotal.com/ui/sigma_rules and search for curl.exe , you will the get the following entry:

Many customers have used various API scripts to extract job results from MSV to facilitate results reporting. One method that is much quicker than using the jobs API is the search API.  The search API is what is used by Report Builder and it pulls back a subset of the job results.  It's fairly simple to use and can make reports much simpler because there's not the mound of data that is returned by the jobs API.   The input to the search api is a JSON blob with the details of the search and what fields you would like to bring back.  From any report in report builder, you can just click "View Request Data" to see a working example of the JSON such as the one below: {"conditions": [{"conditions": [{"match_field": "id","match_object": "job","operator": "in","value": [2498,2499,2500,2501]}],"operator": "and"}

One common use case that I have seen at several customers is that they want their SecOps or Operations folks have the ability to monitor that MSV Actors are up and available. To prevent false alarms, a script was created to "ping" the actors.  The script can be put on a scheduled CRON or be ran manually as a part of the playbook.  Feel free to take a look at the Python below and use as needed. For simplicity, I did not include the code to create the HTTPs session to the Director. # Get the list of non-protected actors def setup_data_fields():     global nodeData, evalData     response = session.get(f'https://{director_ip}/topology/nodes.json')     if response.status_code != 200:          print('Unable to get node information from director.')          sys.exit(-1)     nodeData = json.loads(response.text)

New content is constantly being added to MSV as new malware, attack methods, etc. are discovered by Google.  As such, customers would like to be able to quickly get information on the new content without having to go to the library and filter down to the new actions.  This code will pull all of the actions added to MSV since a specific date.  The code looks at a JSON file to get the start date information.  This could easily be replaced with a variable passed into the method.   Enjoy! def getNewActions():#Read the config file - config file must be prebuilt#Read the list of content imports#Update the config file with the latest runtime#Search the content imports list to see if there is new content#Make a list of new content if it is available#Return the list or an empty list if no new content is available     newStuff = False     newActions = {} 

One of the most common questions I hear about MSV is why an event isn’t being attributed to an action being executed.  I normally go through the following steps to see if we can determine why the event wasn’t attributed: Does the event exist at all? (Seriously.)  Is there an event in the security technology that we are integrated with that matches the action that we ran. Is the time good for the event?  Every action executed in MSV has a start time and end time.  The event in question needs to occur between those two times. For example, _time is used in Splunk to denote the time of an event. If _time isn’t between the start time and end time, we will generally not match it to an action. Does the event have correct information?  Is the source IP, destination IP, a

MA-SV Users, The Mandiant Security Validation Team will be deploying 5.14.1.0 on Tuesday, October 1, 2024 at 0800 EDT (12:00PM UTC). During this time, users might experience brief disruptions accessing the service. Full service will be restored no later than 9:00AM EDT (1:00PM UTC).Fixes include: Fixed an issue where testing queries returned "null" in results without indication of error. Fixed an issue where the AEDA landing page didn't indicate that monitors were broken. Fixed an issue where the Operation Status incorrectly stated that Remote Integration tests were failing. Fixed an issue where Jobs indefinitely stalled in between groups. Fixed an issue where the AEDA landing page was taking too long to update. Fixed an issue where the LoginUI.exe process took too long to restart when a Network Action was run with an interactive session using a Windows system a

Validation Customers, The Mandiant Intelligence Validation Research Team (VRT) has published VHR20240918 - Content Expansion, a Security Content Pack focusing on Campaign 24-032, Campaign 24-034, and Campaign 24-036. The content pack includes 12 new Actions and 9 new Files. For full details on this release, see the Release Notes on the Mandiant Documentation Portal.

Today, the Mandiant Intelligence Validation Research Team (VRT) published VHR20240904 - Content Expansion, a Security Content Pack focusing on CVE-2024-0778, CVE-2024-3272, and Campaign 24-023.  This content pack includes 12 new Actions and 9 new Files. For full details on this release, see the Release Notes on the Mandiant Documentation Portal.

How to get security alert from browsers?

Hi everyone,I’m running an (PII Removed by Staff) and want to ensure the highest level of security for our user data on Google Cloud. What are the best practices for securing sensitive information and protecting against breaches?Thanks for your advice!

Hi All,I'm receiving the following error when attempting to access an advisory notification."you have insufficient permissions to access the resource, or because a Principal Access Boundary policy is blocking your access to the resource. "Clicking the link using any account including super admin gives the same error.Thanks,-BPIT

The MSV Report Builder is a powerful analytics tool. It is easy to get carried away with all the widgets available after running a campaign of attack simulations and emulations when crafting an Executive Debrief Report . A Debrief should be "brief" but also stick to a set of simple principles. In this case less is more for those who are charged with making risk decisions.  The report template should include a text section to record the analysis and just enough data widgets (graphs, charts, tables) to back up and color the analysis. The analysis itself should be recorded in "your" words using concise sections like : Objective, Scope,  Performance Analysis, Key Issues (good & bad), Potential Solutions and/or Next Steps. Using a debrief process that simply presents fair and concise information to  those in charge of risk will help empower them to make decisions in the best interest of your data assets. Example Debrief Report

Probably the most asked question in all of Mandiant Security Validation.  In over 4 years, this question has been asked by customers I work with hundreds of times.  While there's a hundred possible reasons the log wasn't matched to the action, there's only a few questions needed to figure it out. First and foremost, was there actually a log generated? MSV cannot find something that does not exist. Windows group policies and many other types of security protections may not generate a log. Never fear, the next question can help answer this one.  What kind of action is it? Seems kind of simple, but knowing what kind of action it is will narrow the search drastically.  Malicious file transfer actions are not written to disk, so don't expect any EDR logs. Host CLI actions seldom hit the network, so don't expect any firewall, proxy, network appliance logs. DNS actions are simply name resolution requests. If DNS resolutions a

  Shells, shells and more shells!Do’s and don’t for creating Host CLI Actions The Mandiant Security Validation(MSV) platform is distinctly different from attack simulation technologies. Security validation includes vast integrations with defensive technologies and attack execution across the entire enterprise security environment. It is not limited to endpoint security controls. It uses real, active attack binaries to test the effectiveness of security controls.The platform is open and allows users to create custom actions needed in their environment.A little reviewMSV offers four shells for writing command line scripts. This article will speak to three of those

Your Red Team engagement found a vulnerability. Here’s how you can use Mandiant Security Validation to ensure it gets fixed.     The Mandiant Security Validation(MSV) platform is distinctly different from attack simulation technologies. Security validation includes vast integrations with defensive technologies and attack execution across the entire enterprise security environment. It is not limited to endpoint security controls. It uses real, active attack binaries to test the effectiveness of security controls. MSV has the ability to create scheduled jobs and monitors. This provides a way to repeatedly test a vulnerability unti

Directors Follow these steps to upgrade to a 4.14.0.0 Director on Rocky Linux 8 while preserving your data and settings. For an existing Director virtual appliance, on version 4.13 or earlier:  Optional: If using a static IP, go to Settings > Director Settings, click Network and note the following network information for the Director (required for Step 5): Director IP address Director gateway Director DNS server (if applicable) Upgrade your existing Director to version 4.14.0.0. After this step, you will have a 4.14.0.0 Director that is still running on CentOS 7. See

We just acquired Mandiant Security Validation. We are starting to deploy actors, but we want to be optimal when deploying them to get as much information out of MSV as quickly as possible to show leadership that the investment was a good one. Does anyone have any tips on how to do this?

Hello, I'm trying to deploy/make use of the AEDA (advanced environmental drift analysis) module. How do i use it effectively in my environment?

Mandiant Security Validation (MSV) is an automated and continuous approach to testing the efficacy of an organization's security controls against cyber threats. Security Validation is informed by timely threat intelligence and executes automated and continuous testing of security controls with the use of real attacks. Effective security requires more than just implementing controls. Understanding their real-world effectiveness is crucial for protecting your organization from cyber threats. Mandiant Security Validation tackles this challenge by providing a comprehensive solution to test and evaluate your security posture. Baseline Testing provides a starting point for measuring the effectiveness of your security controls. Baselines are essential for creating a repeatable process to generate large scale metrics used to measure trends and get a deeper understanding of your security pos

Many of the MSV Integrations especially in the SIEM category utilize field mappings to associate data to variables used by MSV to attribute log or alert events to Actions. Typical mappings include: source IP, destination IP, host name, user, source Port, destination port, file hash, detection time, and event description. The field mappings process is a cycle of acquiring a log sample, setting up initial mappings, running an action, and then verifying if an alert has been attributed to the action. If not, review suspicious events for the partial match and identify which fields need correcting. The process can be complicated; however, it can be streamlined utilizing these few steps: Assumption:  The integration is already configured, suspicious events enabled, the integration query is syntactically correct and the integration passes the Check Health test. Additionally the user knows how to trouble shoot event attrib

Many times a user may want to be able to find what job the details in a report are provided from. As you can see in my first screen shot here you just see the results. In order to have the job information listed you just need to edit your report.  So scroll up to the top and click edit report. Once the report is in edit mode you will select the data table and edit widget. This will allow you to modify the columns in your report. You will be adding a column which contains the JobID. So select the jobs then JobID.