MImike_d·Dec 9, 2020
As a red teamer I want to clear up why we build "hacking tools" and why FireEye did nothing wrong here.
For example take the tool mimikatz [1], which is publicly available and well known. It can dump stored passwords out of Windows memory. But if you download mimikatz and try to run it every single antivirus/endpoint protection solution will light up like a christmas tree. However, the underlying technique isn't being blocked - just the specific implementation. This is why we build our own tools: to demonstrate to defenders that while they are blocking a specific implementation they have not addressed the underlying vulnerability.
I do want to call out FireEye for doing an amazing job recovering from this situation. They did the responsible thing and released fingerprints [2] that could be used to detect every single one of their tools. T
Read the rest
hey effectively burned their entire catalog and put them in to the class of "public" tools that are easily identified. I've browsed over the list of signatures and didn't see anything that popped out as giving a malicious attacker any advantage other than saving them work of building it themselves (of course I don't have access to look at the actual tools so YMMV).
Also, everyone gets hacked. No matter how good you are or how many cyber security engineers you have on staff... there is still Matthew in accounting that will open that invoice attachment so he can pay it.
1. https://github.com/gentilkiwi/mimikatz
2. https://github.com/fireeye/red_team_tool_countermeasures/tre...
Edit: To be clear I do work on an internal red team - we hack ourselves. I don't work for FireEye or a competitor.
Edit 2: Don't pick on Matthew. :)