Candidate Scream Instructions<\/p>\n
1. Blueprint:<\/strong> Please kind a design that depicts the following enlighten the put Springfield Energy Plant’s network has been breached by an attacker. Visio, PowerPoint, LucidChart (free), GraphViz (free) or other design would possibly possibly presumably also very neatly be weak to kind the design.<\/p>\n Scenario<\/u><\/p>\n o\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 An attacker sends a spear phishing message with the subject “Free Flaming Moe\u2019s in the Cafeteria at after work: Details in Attachment” containing a malicious Microsoft Be conscious attachment to Homer Simpson who opens the attachment and enables Macros when brought on to be conscious the sweet, sweet Flaming Moe\u2019s tiny print. (mmmmmmmm….Flaming Moe\u2019s Have to be known as the Flaming Homer.) <\/p>\n o\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Once opened, a macro is done which runs a PowerShell recount that establishes a recount and management (C2) channel to a enviornment (https:\/\/d35fkdjh4gt99.cloudfront.derive, 52.85.89.218) which in the extinguish resolves to a machine controlled by the attacker (Frankenstein Grimes) in Amazon’s EC2 cloud. o Frankenstein Grimes escalates his privileges on Homer Simpson’s laptop ( HSCRBN BLB, 172.16.22.4) to produce administrative win admission to and extracts password hashes the exhaust of Mimikatz.<\/p>\n Frank Grimes then makes exhaust of the shared local administrator password obtained from Homer Simpsons laptop to high-tail laterally on the network to Wayland Smithers’ laptop (WS-ULLMAN, 172.16.10.42). o Wayland Smithers’ laptop accommodates an unprotected SSH private key file for an SSH leap field that grants win admission to to the SCADA systems network all the arrangement in which thru the energy plant.\u00a0 o Utilizing these passwords, Frankenstein Grimes authenticates the exhaust of PuTTY to the leap field (SCRATCHY, 10.253.65.85) and then makes exhaust of Nmap to scan for birth ports on the SCADA network (1.1.0.0\/23) for birth port TCP\/666 which controls the reactor.<\/p>\n o\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Frank identifies birth port TCP\/666 and connects to the reactor (SIDESHOW90, 1.1.1.230) over Telnet with out a password required. o Frank then areas malware on the system designed to alter the core temperature of the reactor in the subsequent 30 days.<\/p>\n o\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Frankenstein Grimes then steps abet thru his attack chain leaving ransomware alongside the arrangement in which.<\/p>\n 2. Defensive Controls Mapping:<\/strong> Gift for each and each step which defensive toolset or process would possibly possibly presumably be weak to aid mitigate and detect what Frank Grimes has been ready to successfully develop as an attacker. We request detailed explanations in paragraph assemble. If it is now not already evident, the exercise is Simpsons-themed, so please enjoy enjoyable with it!<\/p><\/p>\n","protected":false},"excerpt":{"rendered":" Candidate Scream Instructions 1. Blueprint: Please kind a design that depicts the following enlighten the put Springfield Energy Plant’s network has been breached by an attacker. Visio, PowerPoint, LucidChart (free), GraphViz (free) or other design would possibly possibly presumably also very neatly be weak to kind the design. Scenario o\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 An attacker sends a spear […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-30784","post","type-post","status-publish","format-standard","hentry","category-solutions"],"_links":{"self":[{"href":"https:\/\/academicwritersbay.com\/solutions\/wp-json\/wp\/v2\/posts\/30784","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/academicwritersbay.com\/solutions\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/academicwritersbay.com\/solutions\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/academicwritersbay.com\/solutions\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/academicwritersbay.com\/solutions\/wp-json\/wp\/v2\/comments?post=30784"}],"version-history":[{"count":0,"href":"https:\/\/academicwritersbay.com\/solutions\/wp-json\/wp\/v2\/posts\/30784\/revisions"}],"wp:attachment":[{"href":"https:\/\/academicwritersbay.com\/solutions\/wp-json\/wp\/v2\/media?parent=30784"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/academicwritersbay.com\/solutions\/wp-json\/wp\/v2\/categories?post=30784"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/academicwritersbay.com\/solutions\/wp-json\/wp\/v2\/tags?post=30784"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}