Backdoors & Breaches Live! 05/19/2021

Summary

Podcast Summary: Talkin' Bout [Infosec] News – Backdoors & Breaches Live! 05/19/2021

---

Episode Overview

This live “Backdoors & Breaches” session, led by guest Incident Master Ian Meyer and featuring the Black Hills Information Security (BHIS) team and friends, transforms a real-world infosec supply chain breach into a collaborative tabletop incident response game. The episode walks listeners through group decision-making, troubleshooting, random failures, and the complications of incomplete visibility—all while emphasizing the chaos, camaraderie, and gallows humor of incident response in cybersecurity.

---

Key Discussion Points & Insights

1. Kicking Things Off and Inside Jokes

• Pronunciation Woes: The team jokes about infosec terms (“SIEM,” “sysop,” “sudo”), riffing on the confusion common with jargon read but rarely heard.
  • Ian: “If you’ve only ever read something, how do you know how to say it?” [01:30]
• Tabletop Game Premise:
  • Ian introduces Backdoors & Breaches—a scenario-driven card game that simulates incident response, useful for both learning and tabletop exercises.
  • Key stages: Initial Compromise, Pivot & Escalate, Persistence, C2/Exfiltration. [04:00–08:00]
• Game Mechanics Explained:
  • Randomness via D20 dice rolls and “inject” cards adds realism and unpredictability (think real-life curveballs).
  • Five “core” procedures with +3 modifiers: SIEM, Call Consultant, Endpoint Analysis, UEBA, and Isolation. [08:00–10:00]

---

2. Scenario Revealed: Cloud Service Breach

• The Scenario (Werewolves not included):
  • The SOC spots anomalous service account authentications from external sources, matching internal conventions but at irregular endpoints (e.g., OWA/external cloud). Some logins succeed—a clear sign accounts are compromised. [11:19–13:10]
• Initial Responses:
  • Team debates first moves, weighing SIEM over EUBA (“not enough past context”), then tries SIEM log analysis first.
  • Quote:
    • Blake: “My vote is for the SIEM.” [13:53]
  • Successful: They identify external cloud access as the initial compromise but are told there may be more undetected paths (“South Dakota law!” joke). [14:34–16:00]

---

3. Mid-Game: Troubleshooting, Failures, and IT Snafus

• Rounds of Investigation:
  1. Server Analysis fails (no IOC found).
  2. Endpoint Analysis fails (EDR rollout unfinished—“James didn’t upgrade Carbon Black,” becomes running gag). [24:42]
  3. RITA (Network Analysis) fails (logs missing—blamed on “Steve” disabling them over lost cafeteria candy). [28:14]
• Inject Cards & Real-Life Parallels:
  • Legal abruptly pulls a key responder for a meeting (“You must remain silent until the incident is over”)—Ralph is “sent to legal.” [30:13–31:13]
  • Jokes abound about calling cyber insurance, resume updates, and exasperated IR fatigue.
    • V: “This feels like 2020.” [62:11]

---

4. Late-Game: Desperation, Recovery, and More Adversity

• Key Strategies:
  • Multiple failed attempts with limited dice luck; SIEM, consultant calls (“George, Chloe”), firewall logs, injects, etc., often stymied by missing data or randomness.
  • Chloe’s consultant card grants three extra turns (a rare break), but SIEM soon crashes because someone fatally queries all historical logs (“Four terabytes! Go home, Steve.”). [51:58]
• Breakthroughs:
  • UEBA analysis finally reveals “Pivot & Escalate”—attackers leveraged stolen service account credentials for credential stuffing (matching real CodeCov breach mechanics). [46:03–47:05]
  • Despite new consultant help, time runs out before the group can fully solve both the “Persistence” and “C2/Exfil” components.
  • Quote:
    • Ian, on team burnout: “The exact mood of an incident response toward the end—you’re like, whatever.” [63:08]
• Ending:
  • The final move, a “call consultant” (George), finally reveals C2/Exfil is HTTPs exfiltration.
  • The group is unable to discover Persistence before the scenario ends.

---

5. Debrief & Learning Points

Scenario Solution:

• Attackers exploited a supply chain weakness, poisoning a CI/CD tool (CodeCov), leaking cloud service credentials. These were used externally for credential stuffing, internal escalation, and ultimately, exfiltration over HTTPS—in other words, a practical breakdown of the real CodeCov breach as applied to incident response education.
  • Moral: Never hardcode credentials; use secrets management!

Notable Quotes / Memorable Moments

• “This was the most brutal game I’ve ever seen… never seen it go to 13 rounds and not be resolved.” – Jason [70:39]
• Running gags blaming “interns,” “James” and “Steve” for IT mishaps, and legal interruptions reflecting real workplace chaos.
• “Is there a sleep option in this game?” – Blake, on IR fatigue [44:24]
• “You walk into the developer room and it reeks of kombucha and hoodies.” – Ian [57:49]

Humor & Realism

• The stress, escalation, and humor mimic real-world security incident response: legal interference, tool misconfigurations, IT scapegoating, and the emotional rollercoaster of dire situations.

---

Timestamps of Important Segments

• Game & Rules Overview: [03:57–10:07]
• Incident Scenario Revealed: [11:19–16:00]
• Critical Decision-Making (Early Rounds): [16:46–25:14]
• First Inject (Legal Intervenes): [30:13]
• Consultants Enter (Chloe’s Extra Turns): [48:32–51:29]
• Persistence & C2/Exfil Discovery: [53:05–63:40]
• Scenario Debrief (CodeCov supply chain): [65:02–69:08]
• Final Wrap-up: [69:58–71:16]

---

Takeaways for the Infosec Community

• Incident Response is Chaotic: Even in simulations, unexpected setbacks and incomplete data can derail the best responders.
• Communication/Human Factors Matter: Legal, “interns,” and misconfigured tooling play as big a role as technology.
• Modern Threats Leverage Supply Chain: Real breaches (like CodeCov) highlight risks in pipelines and cloud integrations.
• Tabletop Exercises Reveal Gaps: These exercises surface process and technical shortfalls, just like in real life.

---

In the spirit of the original episode, the tone remains witty, self-deprecating, and pragmatic—showcasing both the technical and human sides of incident response.

---

If you missed the episode, this play-by-play, complete with quotes and context, will help you understand both the educational value and entertainment that Backdoors & Breaches brings to the table!

Transcript

[Caitlin]

Hello.

[Jason Blanchard]

People are starting to show up here in the twitch chat and YouTube. It's great to see you. Thanks for being here today. This is going to be a regular occurrence here on the Twitch stream and on YouTube. We're gonna do this at least once a month, hopefully every two weeks.

[Ralph]

We'll see.

[Ian Meyer]

And.

[Jason Blanchard]

But if you're here for the news, this is not the news. We're about to breach this live stream. Ralph's like, it's not the news.

[Ralph]

I've been prepping for like the whole day. Thank you. Now it's ruined.

[Ian Meyer]

You've got your news ready to go?

[Ralph]

Yeah, I had all my link.

[Ian Meyer]

Nothing's happened in cybersecurity in the last 24 hours.

[Ralph]

Nothing.

[V]

Let's just hope nothing comes out of this. That becomes.

[Blake]

Unless it's an article from the Hill written as an opinion that set a lot of people off.

[Ralph]

I do have questions about half those articles.

No words.

[Jason Blanchard]

Well, and we ran out of banter. Good job, everybody.

[Ian Meyer]

I killed it.

[Blake]

I'm sorry?

[Ian Meyer]

I killed it.

[Ralph]

Gosh, just talking about, you know, hyped up news articles.

[Jason Blanchard]

Blake, I know last time, we may talk about it again, but you said sign. You called it a sign. You called the seam or sim, a sign. I was playing backdoors and breaches with someone earlier today that called it a cm.

[Blake]

Okay, so it is open interpretation or no.

[Jason Blanchard]

What are your thoughts? A cm.

[Blake]

So I'm a reformed infosec person now and I say sim.

I don't know where the sign came from. It just happened. And you gotta roll with it. At that point, the cat's out of the bag.

[Ian Meyer]

Because you gotta admit, if you've only ever read something, how do you know how to say it? I was learning about computers and my uncle was an administrator for a large power company. He did programming in some ancient language. And I said, yeah, I'm on this BBS and they've made me the sysop. And he stares at me.

Do you mean sysop? And I go, sure, yeah.

I'm one of those. He's like. And he just started bawling, laughing. And I'm like, well, that's really not very encouraging, Uncle Terry.

But yeah, you only ever read it. How do you know how to say it?

[Blake]

Right. Similar jobs. Pseudo or pseudo?

[Ian Meyer]

Sudo.

[Ralph]

Sedon't.

[Ian Meyer]

I keep yelling like pseudo at those puzzles with the math and they never solve themselves. I don't understand how that command works. Sudoku, that's what's up. Sudoku puzzles.

[Ralph]

Oh, fun story. You don't need sudo. If you just always run as root. Oh, yeah.

[Jason Blanchard]

All right, Everybody, it is 4:30. It is time for another edition of Backdoors and Breaches Live where we invite guests on from the Infomec. Did I call it Infomec?

[Ralph]

Here we go.

[Ian Meyer]

I was supposed to bring my Gundam.

[V]

How do we restart the live stream?

[Ralph]

Fly this ship, buddy.

[Jason Blanchard]

It already started. All right, so welcome to Backdoors and Breaches Live. I'm just Jason Blanchard. I'm not doing much today except controlling the tabletop simulator that Ian Meyer will be using. I'm here to introduce Ian Meyer. He's going to be our Incident Master today. Our hope is to bring on future Incident Masters. So if you've been playing Backdoors and Breaches and you're like, hey, I'd like to do this on a live stream, sure, sounds great. You can always reach out to me or on the Discord Channel or through email, but Ian Myers, our host. So if you could bring up Ian and I could just say that Ian is probably one of my favorite people in the infrastructure community. He is the president, president of BSides Orlando. Just feel like he's an instructor, a great guy, and he's taken Cubicles and Compromises, which is what Backdoors of Breaches is built on, and he just like, went in another direction with Cubicles and Compromises and turned it into, like, a viable thing. We couldn't do that. And so we created Backdoors and Breaches, but Ian was able to. And so maybe we should just copy what Ian's doing. So instead we just brought him on to play Backdoors and Breaches. And with that, Ian, it's all yours.

[Ian Meyer]

Well, first off, I mean, you're one of my favorite people, big guy like this. So no. Yeah. Thank you for those kind words. Like I said, my name is Ian Meyer. I do run the advanced cue balls and compromises at Wild West Hack and Fest, which is coming up in Reno, Nevada. Was it June 16th and 17th there, Jason? So you should definitely sign up for that. If you're listening. As my plug, I'll take the $10 later. With that said, we are going to play Backdoors and Breaches today, and I've put together a wonderful scenario for the team of folks that are going to help us solve this. So if it is your first time hearing about Backdoors and Breaches, if you turn into the live stream to see what this is all about, let's talk about it for just a moment. Backdoors and Breaches is a card game. That you can play with your business, with your peers, with people that might need to learn a little bit more about incident response and understand the ways in which attackers get into an environment and how you might respond to it. So there's a few rules that you need to understand. We'll go through them real quick and then we'll introduce the team that'll be playing with us today. And if it's like I said, your first time seeing it, don't worry, it'll all start to make sense pretty quickly. So what we have as we go through this environment, you should be seeing now the game board. We have four things that we need to solve to beat the incident, to stop the attacker. And those are our. We have our initial compromise, how the attacker got into the environment. We then have our pivot and escalate. Once they got in, where did they move to? What did they do? How did they escalate Privilege? Well, just like any good apt, once they've done that, they need to maintain persistence. They don't want to leave, they're comfortable, they got a couch, they're getting creds, they're stealing stuff, so they want to stay, they don't want to be kicked out. So they've got persistence. And then the last thing they'll go through and do is the command and control and exfil. How can they send more commands in to get more things? How can they control that persistence that they have? And then how do they get that sweet, sweet, juicy data out of the environment so they can compromise it further? There's some other rules that you should be aware of as well. So we have a series of procedures that you get to use. We have a set of procedures that the team can use. They're laid out on here that give them a 3 modifier. Now, what does that mean? These procedures are procedures that the team knows incredibly well. So we saw a SIEM there, we saw calling a consultant, endpoint analysis there, User entity behavior analytics, and then the last one, isolation. So these are procedures that the team knows incredibly well. And when they go to use them to try and figure out any of these four areas that the attackers are using to get the environment, they get a three modifier. And you're saying, but Ian, what are you talking about, a 3 modifier? Well, this game injects entropy, randomness, and that is done in the form of D20 dice. Now, what you're seeing on the screen is a virtual representation of this in person. I've got one of these cool black hills dice but in person, you would roll the dice. And what ends up happening is if you get a one through a ten. Well, unfortunately, even though the procedure that you chose to try and figure something out should have worked, it didn't. You know, maybe if your solar winds, I probably shouldn't say that. Solar winds. You blame the intern. Oh, the intern didn't do it, all right. Or, you know, the backups weren't there or whatever it is, it just didn't work. Now, when it doesn't work, you can't use that procedure again for another three turns. However, if it was one of those written procedures, the ones you just kill it at, you had the big four come in and they said, man, you're so incredibly mature in this area. It's amazing. And you get that three modifier. If you rolled a 10, you get plus three, which brings you up to 10, 11, 12, 13. And now you pass. And if your procedure, if your procedure happens to be one that is effective at discovering one of those four areas, your card flips over and you find out one of the ways, whether it be C2, exfil, pivot, escalate, whatever it is. One of the ways that the attackers got into the environment and what they're doing.

So if it didn't work, it spins. You don't get to use it again. Now, those written procedures, those five that you got, that you're the three, those aren't the only ones you can use any of the procedures in the Black Hills backdoors and breaches card set you can use, they just don't give you that modifier. When you do use them, though, you can only use them for another three turns as it goes through. So they have that cooldown period for those of you who are gamers. So last couple rules we want to cover real quick before we introduce the team here is also those roles. If you happen to roll a one.

You just flat failed. It fell completely on your face. You went to get the backup, and literally you dropped it and it shattered into a million pieces. I don't know how that would happen. It was just that bad. If you roll a one, you have to pull an inject card. So an inject card, and that's a procedure card. Inject card. Here I do. You have to pull an inject card. What's an inject? Well, this is a new thing that comes up. This is a. It could be good, it could be bad. Who knows? It's just another problem or benefit that you have to deal with. So if you run a roll of one or 20, you do that. Also, if for whatever reason, you pull procedure cards and three times in a row you fail the procedure, procedure doesn't work. You got to roll an inject card. So just to, you know, add insult to injury, if you're still not making your way, you pull an inject card. But remember, those injects aren't always bad. Sometimes you get lucky. It's like, oh, somebody found the backup. Ooh, something good happened. So we're going to stop there because I think we covered everything. Jason, did I miss anything before we roll into introductions?

[Ralph]

Nope.

[Jason Blanchard]

Just a reminder that there's a three turn cool off period for successful and unsuccessful.

[Ian Meyer]

Yes, thank you. Thank you for the clarity. Perfect. So I believe we are ready to start. And look, we have this lovely group of folks ready to go here. And I'll just do the quick name introductions for everyone. So, Caitlin, hello. Thank you for joining us today and playing. We've also got V. Q. We've got Blake myself on camera there, and then we've got Ralph as well. So thank you for joining. Say hi, everybody.

[Blake]

Hello.

[Ian Meyer]

Hello. Hi. Hello. Are you ready to play?

Are you ready for the scenario?

[V]

Yeah, I think it's a little too late to back out.

[Ian Meyer]

It's too late to back up. Jason will hunt you down.

[Ralph]

Is it too late to back up? I don't know.

[V]

It is if you're asking that question. It is too late to back up.

[Ian Meyer]

Okay, so we're ready for the scenario. Excellent.

[Q]

Ian scares me a little bit. I don't know why he looks all like sleeping innocence and is going to come up with a crazy scenario. I just know it.

[Ian Meyer]

Oh, well. I mean, are you prepared for werewolves that have HAK5 devices?

Yes.

[Blake]

Werewolves love pineapples.

[Ian Meyer]

Let's do it.

Werewolves love pineapples. So excellent. So we're ready. It's after hours and you find yourself on call for the incident response team. You finally come home after a long week of dealing with triage and alerts and phishing emails, and you get a pager duty notification. The security operations center noticed some odd authentications. It hasn't seen them before. You call the SOC to find out what they're seeing and what's going on. They respond back that it looks like they're service accounts of some sort and they seem to be ours. They're using our naming convention, but they're not coming in in the way that they usually would. And some are successful. They're getting logged in and we don't ever see these accounts being used on these services. There's a lot of attempts and we think this might be. And you do your best, Penn and tell. I think we've got a hacker. What's your first move? Feel free to ask questions.

[Ralph]

Someone said resign. I mean, I don't know.

[Blake]

It's feeling like an option.

[V]

To call Cyber Risk Insurance.

[Blake]

So do we know where these accounts are logging into? And when I say where, do we mean into an Azure login endpoint or is this authenticating against our active directory domain?

[Ian Meyer]

Okay, excellent question. Hold on, let me ask. Let me get the A junior stock guy.

Okay. They said external. They said it's external. Owa. That kind of stuff. They're just hitting anything that's on the edge.

[Ralph]

So did you say that they were getting successful logins for some of them?

[Ian Meyer]

Successful, yeah. Okay.

[Ralph]

All right. So we have compromised accounts.

[Blake]

It's a fact, potentially. Or accounts that can log in from external that might have got sprayed.

So the screen's a little blurry for me because it's out of zoom. Is there ability to zoom in and see our.

[Ian Meyer]

Yeah. Let's go through our procedures again. So what do we have?

[Ralph]

We have.

[Ian Meyer]

We can check our sim. We can call a consultant. We can.

Look at endpoint security protection analysis. We can do user entity behavior analytics, or we can start isolating systems. Those ones that people are attaching to.

[Blake]

I would rule out euba because if these accounts haven't authenticated before, there's probably not enough context in EUBA to get anything meaningful.

My vote is for the siem.

[Ralph]

All right. Voting for the seam.

[Ian Meyer]

Yeah. All right. We.

[Ralph]

Sorry, I had to bring it back.

[Ian Meyer]

There it is. We have our. We have our first move of 10, remember? 10. You have 10 turns to figure this out. You want purple or you want orange? Orange. Who's choosing?

[Q]

Not me.

[Caitlin]

Purple.

[Ian Meyer]

I heard purple, Jason. I heard purple.

[Ralph]

I'm blaming all of you guys if it doesn't work. Oh my gosh.

[Blake]

Purple.

[Ian Meyer]

14. 14.

Excellent. So with 14, we had. That was sim log analysis, right? Jason? The one up there team.

[Jason Blanchard]

That is correct.

[Blake]

It's okay.

[Ian Meyer]

We're going to give them external cloud access for the initial compromise.

[Ralph]

It seems to work.

[Ian Meyer]

Yeah, it seems to work. Okay, so. And not that I'm telling you this for any particular reason, but just a reminder that just because you got one once with something doesn't mean that necessarily there aren't others that seem wouldn't have discovered. So just keep that in mind as you're playing through, especially those who are new to watching. I am only required by, you know, South Dakota law. To give you one things there are there. I don't know why South Dakota did that or why they. But either way it's a law. Yeah, it's a law. It's just the way it is. So external cloud access. So the soc starts digging through and they say, hey, wait a minute, I'm noticing here that these credentials, the only time that they ever get used on the network are when they're used to connect services internally up to some of these cloud environments that we have. So I think someone actually may have gotten access to some of these services that we actually have hosted outside and potentially got a hold of these credentials. So we're going to dig into that a little bit further but that certainly seems to be the credentials that are being used to get into the environment. So you got a little more detail. You know that somehow an external cloud service potentially has some sort of impact that allowed for attackers to potentially use credentials to get into your environment. Time to turn off the Internet.

[Ralph]

It was SolarWinds again.

[Ian Meyer]

That's right, we've got SolarWinds all over again. No, so yeah, so we know that. So now that's turn one. We've now rotated our SIM card and we are moving on to turn to. What does the illustrious team here suggest we do with the new information? Feel free to ask questions about the first response.

[Blake]

So to cover this again, you said that the accounts that are authenticating are have been provisioned in good faith to connect from on prem to cloud.

[Ian Meyer]

Correct.

[Blake]

So these accounts would be then enabled to access the cloud. It wasn't a change in configuration. We're saying that is a correct credentials have been compromised.

[Ian Meyer]

Yeah, that is a correct understanding. The credentials that were being used at that point were used specifically and created and configured to work with a cloud, a hybrid environment in which there's some on prem and there's some cloud services and some of the credentials that are being used are ones that have only ever been associated with those services.

[Blake]

My vote would be to do is the endpoint security analysis. I'm thinking that a box was compromised, the creds were hard coded somewhere to run. That's just a thought.

[V]

Isn't there a separate one that does same on servers? I remember there being another card for that.

[Caitlin]

Server analysis.

[Ian Meyer]

I'm going to make weird deceptive DM noises when you say things. I'm going to be like.

And that means nothing by the way.

[V]

That sounds like something out of North Dakota.

[Ian Meyer]

We don't do what North Dakotans do around here.

[Blake]

That's just my thought. Just from saying that it was. Those credentials were provisioned for a reason. That's where we would find them.

[Ian Meyer]

That's a thought.

[V]

Now, those being service accounts, possibility that they may find more info and server analysis than input analysis.

Maybe.

[Ralph]

I mean, those service accounts could have been from a workstation, right? I mean, there's tons of different services that run on workstations. Login too, especially like provisioning workstations. That's a common thing I've seen inside of environments. And they'll actually log into the system over and over again to provision and continue. Those credentials get in memory. Right. They stay in w. Digest a bunch of different places inside. And you know, if you could extract that, you could possibly win immediately. Right.

[Blake]

Okay, what do we think?

[Q]

V. Oh, wow, putting me on this spot. Do endpoint analysis. But the question is, do we know which boxes potentially look at?

[V]

No, but wouldn't if you pick that, wouldn't that just. In spirit of the game, Check all the endpoints.

[Ian Meyer]

Check all the endpoints. So jump into something and like a carbon black or an EDR or something like that and say, have I seen this anywhere? Please help.

[Blake]

Yeah, We've worried on CrowdStrike.

[Ian Meyer]

Okay. Yeah, yeah. So for those listening at home while they're thinking, the group here is thinking about taking your endpoint detection and response tools and hunting around to see, hey, do we see anything that looks potentially like these credentials executing on the systems and seeing what processes may be running as well. So is that, is that your vote?

[Ralph]

I'm good with an endpoint. I'm good with the point.

[Ian Meyer]

Yeah.

[Ralph]

Or server. Those are both fine. I think there's, there's some win there, but let's do input.

[Blake]

Yeah, So I think. Not the, not the card with the modifier, we're looking at the standard cards, right? Those two options.

[Ian Meyer]

Which card are you going to use? That server.

[Blake]

Now let's go with server analysis. That was Q's. I like Q's original line of thought.

[V]

Hey, don't blame me for that now.

[Ian Meyer]

Yeah.

[Q]

Look, I know everyone would go isolate and I see some comments, but one of the things I learned is that in the spirit of the game, you don't want anything by isolating the machine. However, in practice you would want to isolate. We would want to minimize the impact.

[Blake]

Yeah, we'd have to find those hosts first though.

[Ian Meyer]

All right, so which one are you going with?

[Q]

Orange.

[V]

Orange.

[Ian Meyer]

Oh, I'm sorry, but which card did we go with? I thought I heard some isolation changes there or what no. Okay, so a server analysis.

[Ralph]

Yeah, do server analysis. Let's go. Come on.

[Ian Meyer]

Okay, let's do it. 7. Okay, so. And server analysis wasn't one of our three. Even if it was, it wouldn't have given us a modifier to get there.

I should have gotten the prices right. Like.

That one. That one I feel like is a little too much, but like.

Anyway, so server analysis, unfortunately, you went through and checked the servers and hunted through the environment again, using tools that are on the servers to detect either anything that might be out of place, any sort of indicator of compromise based on what you know, and there was nothing there, nothing that led you to believe that there was any sort of challenge, any sort of link to the IOCs, just nothing. So unfortunately, that didn't do anything. So we're give that one a turn that will be available to you again in three turns. I think seam is now available to you in two turns. Coming back in two turns, and we are moving on to turn three. I need fail horns. Okay, so we're moving on to turn three. So server analysis didn't do anything for us. We still know that there's our cloud services, they're associated somehow. The accounts that are logging in to successfully to some places and not to others, those services are still going and right now we don't know much else.

[V]

So what the option brought up in addition to the server was the endpoint.

[Ian Meyer]

Yeah, that was one of the options brought up. So endpoint hunting around and actually seeing if there's something on the individual endpoints that might give us a clue as to how these accounts potentially leaked out into the one.

[Ralph]

Yeah, we could do endpoint. I mean, does anyone have any.

[Ian Meyer]

I mean, hey, the crowd.

[Blake]

My other thought would be Rita.

[Ralph]

Oh, going for the Rita.

[Ian Meyer]

Going for cyber deception. All right, is there anyone we haven't heard from? I think we've heard, I don't know everyone's voice when they're away yet. So is there anyone who hasn't chimed in yet? Come on, let's hear the feedback. Let's, let's. You're in the war room. Think about it. It's the old. It's in before times. Your incident response. Now there's cold pizza. Someone brought like half a flat of leftover Red Bull from the last time this happened. You start talking, get a little punchy. No.

All the dad jokes start coming out. Some of you aren't even fathers, just like, I don't even know what happened.

[Blake]

Laughing at. Laughing at your failure?

[Ralph]

Yes, exactly.

[Blake]

Maybe that's just A personal thing. I don't know.

[Ralph]

Okay. Shining your crying in a corner.

[Ian Meyer]

Yeah, that's right.

[Ralph]

You can fight. It's the one.

[Ian Meyer]

All right, so. So the. The word on the street here is endpoint. How does everyone feel about that? Let's get a thumbs up with everybody on screen.

[Ralph]

Yeah, let's do it.

[Ian Meyer]

Thumbs up. Thumbs up. Thumbs up. Be. So he's not okay just doing the whole gladiator thing in the middle there.

You know. Anyway, okay, so we're going end point analysis. All right, let's go ahead and roll.

[Ralph]

Which.

[Ian Meyer]

Which color we rolling? Did we already roll? I was looking down. Which one we can orange.

[Caitlin]

Another shot.

[Ian Meyer]

Orange. Oh, we're going back to orange.

[Ralph]

Shoot, here we go. Come on, come on, come on, come on.

[V]

You know what?

[Ian Meyer]

We should.

[V]

We should ban orange.

[Caitlin]

It's time to retire orange.

[Ian Meyer]

Yeah, we always get in this game where it's like orange. Susan. Anyway, okay, so we tried our analysis, looked around and. Wait a minute. Hold on. Just realized something.

[Ralph]

Hey, did.

[Ian Meyer]

Hey, hold on. Hey. Employment. Yeah. Yeah. Behind the. Put the pizza down. Yeah, the upgrade of carbon Black. Done. There's 400 systems that. There's 400 systems. Not done yet, of course. Okay, so we didn't find anything because James didn't get this done and the project's behind. So. Yeah, there's no audit to this. So we didn't find anything. And unfortunately.

James.

[V]

Fire James.

[Ralph]

That's the last time we hire interns.

[Blake]

That's the last time we give the intern domain admin privileges.

[Ian Meyer]

Okay.

[V]

Is it.

[Ralph]

Is it that normal? Sop. I don't understand what's wrong with this statement.

[Ian Meyer]

That's right.

[Ralph]

That's right.

[Ian Meyer]

Give them everything. Okay, so we didn't. We didn't learn anything new. We have now failed two roles. We're moving on to four. So if we fail again, we are going to get one of our inject cards. So this one I really want to. We want to get at.

[Jason Blanchard]

So.

[Ian Meyer]

And I need to start keeping track here. So we're on turn four. Keeping track in another window. But. Okay, so we're on turn four. Remember what seem is about to come back online. So we'll have that back next turn.

[Q]

So maybe do Rita.

[Ian Meyer]

Rita. Okay, Rita. I see Rita. How are we thinking Rita for. For those listening in the audience. What. What. What would we get out of Rita?

[Q]

You asking me?

[Ian Meyer]

So.

We.

[Ralph]

We hopefully find out where they're. Where they're at. Right?

[Q]

Yeah, exactly.

[Blake]

Exactly.

[Q]

It's just narrowing it down.

[Blake]

Detect beaconing, detect east west traffic. Find some Anomalies determine possible source destination inside our network.

[Ralph]

Where, how?

[Blake]

They landed on those.

[Ralph]

Most likely, Janice from accounting system got popped. And so we'll find Janice, right? That's the. That's the hope, right?

[Ian Meyer]

Who was it?

[Jason Blanchard]

That.

[V]

Is that.

[Ian Meyer]

Is that where we're going to go? Rita?

[Blake]

We're going. Rita.

[V]

Let's go, Rita.

[Ralph]

Purple dice. Purple dice. The orange is.

[V]

You can throw the orange one away.

[Ian Meyer]

Who? I don't know, V or Caitlyn.

[Caitlin]

Who.

[Ian Meyer]

Who originally suggested. Who originally suggested Zeke? I heard one of you.

[Ralph]

I thought it was V. Yeah.

You.

[Ian Meyer]

Get to choose purple or orange.

[Q]

I'm not sure as I'm not going to do orange, so. I mean, purple it is. And just for the record, I'm terrible at dice roll, so I'm not expecting.

[Ian Meyer]

Well, don't worry. If it fails, It's Jason's fault.

[Blake]

Eleven.

[Ralph]

It was 11. It fell back.

You touched it.

[Ian Meyer]

It was three.

[Ralph]

All right.

[Ian Meyer]

Okay. So we did. The game is rigged, Rita. Okay, okay.

[Blake]

Now we resign.

[Ian Meyer]

Now we resign.

[V]

Somebody posted a job yet?

[Ian Meyer]

Yeah.

I'm trying to come up with a quick scenario here. For sure. So there's a couple things that are going to happen here now. So we went into Rito. We started to pull those logs out, looking for beaconing, looking at any sort of behavior there, and. Yeah, hold on. Steve.

[V]

Steve.

[Ian Meyer]

Oh, Steve.

Quit. Why? Oh, okay. Steve turned off all the logging. It turns out that we stopped doing candy in the cafeteria. And we're like, steve, it's Covid. We don't do that right now. And he was like.

And so all the logging's been off to bring that data through the network and whatnot. So. James, I know I yelled at you before. No. Okay, it's. Okay, fine. Just fix it. Fix it. Okay, so what else happens as we move on to turn five? Does everyone remember day drinking? Day drinking.

We call our mental health professional and we talk to them over a long cry. That is a better coping mechanism than drinking.

[Ralph]

Everyone, it's crowding.

[Ian Meyer]

Okay, we have to pull an inject card because we've had three failures in a row. So the Ed McMahon to my Johnny Carson. Could you get us an inject card from the decky deck? What do we get?

Legal takes your most skilled handler into a meeting to explain the incident. That is not a great card, but it's very realistic. It is realistic. It is absolutely realistic. So who brought the lawyer to the party? So what does this card represent? You are dealing with an incident, and suddenly an executive bursts into the room and says, we've got a contract to sign with IKEA for all kinds of different nuts and bolts that we're going to ship with this blinky box. And we say, why are we even doing this? Shut up. We need that person. Bring them with me. No, we need that we. Oh, okay. Have fun storming the castle. So they've taken them away for very important reasons. So they may never come back. All is quiet now. It's time to step up and shine. Now, I don't actually see a negative on this card other than it. It's kind of a storyline. Jason, can you give some clarity on that? I can't remember if there was actually a downturn to that.

[Jason Blanchard]

So the thing is that, Ian, you get to choose who's been leading the most in this incident, and they will remain silent until the incident is over. Your choice.

[Ian Meyer]

Oh, who needs to remain silent? You know what? You know what I think I'm going to do here? I think we're going to take. Hold on. I'm gonna. I'm just gonna leave it to chance because you've all actually been participating really well. So let's see.

I should have gotten the one through 10. There we go. Ralph. Sorry, buddy.

[Ralph]

How did I know it was gonna be me?

[Ian Meyer]

I actually got. I rolled until I got a number that matched. You know, going this way and. Sorry, man, I could feel it. Ralph, you've got to go with legal and help them figure out the legal requirements around testing the manufacturing systems for the IKEA nuts and bolts that sold for the government penetration test to make sure that we can actually meet all the Fedramp requirements and FIPS requirements. So you have fun with that.

[Ralph]

I feel depressed.

[Q]

But could we still contact him via email?

[Ian Meyer]

Could you still contact him by email? You could, but the lawyers are going to tell him we can't bring phones into the room right now. Very highly. You know, as we work out this manufacturing deal for the nuts and bolts that we don't need, but our customers want to come with our blinky box.

[V]

Do we have an intern who can just walk in with a piece of paper?

[Ian Meyer]

Do we have a blinker?

[Caitlin]

Just slide him a note on the table.

[Ralph]

I'll be over in the corner coloring.

[Ian Meyer]

Guys, let's move on to five. Time to sing the doom song. So let's move on to five. All right, Ralph, have fun with the legal team. Okay, so I believe we've got SIM back on the table. Yay, SIM back on the table. Remember, you still have your other. You can call a consultant. You can. You got any of the other procedures, at this point, we don't know anything new yet. We've moved. We moved on to. This is. This is turn five, right? Yeah, this is turn five. So we've got five turns left. We're halfway through the game. You've got one of the four cards needed to stop the incident. What say you?

[Caitlin]

So maybe this would be a good time to call a consultant. Since we're halfway through, we're not doing so great.

[Ian Meyer]

Yeah, no, that's not.

[V]

What do.

[Ian Meyer]

Yeah, that's a really solid point. Yeah, absolutely. You just lost someone. You say. You go to the legal team and you say, hey, if you're gonna take our person, you got to come up with budget for us to go get somebody, because we're deep in it right now. So that happens in the real world. Who said that? Who was that? Was that Caitlin? Was that B. Yep.

Okay.

[Ralph]

Is that.

[Ian Meyer]

Is that what everyone agrees to call a consultant?

[Q]

Yeah.

[Ian Meyer]

Excellent. Caitlin, please choose a dice.

[Caitlin]

All purple, all the way. Let's go.

[Ian Meyer]

Seven. All right, but that only brings us to ten.

[Blake]

Modifier.

[Ian Meyer]

So close.

[V]

Do we have a third color?

[Ian Meyer]

Can we swirl it, like. Can we do something? All right, so call a consultant. Unfortunately, didn't work. So I'm gonna. I'm gonna. Let's see. Who was it? Who, Jason? Which one of the consultant. Because I'm not real familiar with consultant cards. Which consultant would have told us, I don't know, pivot and escalate or C2 and X fill? Any of those.

[Jason Blanchard]

Either George or Chiles or Timidine.

[Ian Meyer]

Okay, so we call. We call. Okay, we're gonna. All right, perfect. So you pick up the phone, you say, we got to get George. We got to get George on the phone. And get him on the phone, he answers like, hello. Yeah, we need you in here. We really need you in here. Help us figure this out. And he's like, I'm running a sans course right now, and I got Bryson in my ear talking about what we need to do for Scythe, and I just wished I could help you, but I just don't have the time. Can I get back to you in a couple hours? But, you know, a couple hours might be too late, so you say, thanks for your time. Maybe I can call you back later. Let me know. We'll do that. So, unfortunately, he wanted to help, but he's deep in it too, and he can't get you yet. So maybe when he comes back around, you can give him a call again. He'll be like, yes, I finished my sans Course, I'm ready to help you, but for right now, nothing. All right, so we're moving on to six. James made the call. That's what. He's over there. I swear he's just playing Warcraft. I don't know. And I'm like, who even does that anymore? And he's like, I play Warcraft. Classic.

[Ralph]

It's cool.

[Ian Meyer]

And I'm like, whatever, that's fine. I mean, maybe do your job. Okay, so we're on. We're on a move. Six. We don't know much else. We have three more to go.

[Blake]

So what does the group think about firewall log?

[V]

That's what I was looking at this point too, because we're getting so close to the doom time, right?

[Blake]

We got.

Three cards and five chance.

[Ian Meyer]

Hopefully there's no modifier on this one.

[Blake]

So we don't get the plus three. That if we get that eight doesn't bring us to 11. So we're. It's a hard. It's a hard roll on that one.

[Caitlin]

We do have our SIM again.

[Ian Meyer]

Yeah, we do.

[V]

Would the fatwa logs be in sim?

[Blake]

They could be. They should.

[Caitlin]

We say they are.

[Q]

It depends.

[V]

Were those also turned off?

[Blake]

Oh, we fixed that.

[Ian Meyer]

We have to check, but arguably they should be there.

[V]

Well, in that case, personally, I think SIM would kill two birds with one stone.

[Blake]

Yeah, it could, but if we're trying to pick up the C2, firewall logs would help us as well.

[Ian Meyer]

Yeah, you gotta check that. Ben's like. If James configured him, forget it. He's like, yeah, I routed. I routed everything to null. That's good, right?

[V]

I think there's. There's a lot of emphasis on firewall logs.

[Ian Meyer]

A lot of emphasis on firewall logs. Can we get everyone up on the screen? We'll do a. We'll do a thumbs up vote here. Let's see. Let's bring everybody up. Wonderful. Firewall logs. Thumbs up. Is that one, two. Ralphie, Ralph, get Eric in the legal room.

[Ralph]

Yeah.

[Ian Meyer]

Gee, what are you doing? All right, so thumbs up again. Who do we have? Because Ralph can't vote. So we got four. Four of you. One, two, three. Okay. Caitlin's the abstainer. Caitlin, just out of curiosity, where were you? Where were you thinking?

[Caitlin]

I just think that we should look at the sim. I think that hopefully we've got all of those logs in there and we get the Plus 3 modifier on it. So if, you know, purple fails us again, then we should be good. Hopefully. Fingers crossed.

[Blake]

Caitlin, convince me I'm on the SIM board.

[Ralph]

So.

[Ian Meyer]

Oh, man.

I need somebody to cave here, or. You know what we'll do? We'll do a dice roll to decide.

[Ralph]

We?

[V]

What are you thinking?

[Q]

I don't know. I'm thinking rock, white, paper, scissors. I don't know. I'm kind of in between.

[Ian Meyer]

You want to let fate decide?

[Q]

Yeah.

[Ian Meyer]

Let's do some house rules. Let's do it. Jason, can you give us a role for whether they want to try their firewall rules or if they want to try sim? And since I'm choosing, we're going orange. All right.

[V]

By the way, Magneto, you spelled your wrong.

[Ralph]

Oh.

[Ian Meyer]

If you roll the dice, does it count as a turn in the tabletop or.

[V]

No.

[Jason Blanchard]

So 1 through 10 will be SIM, and 11 through 20 will be firewall.

[Ian Meyer]

Okay. See her go.

[Blake]

Come on.

[Ian Meyer]

All right, so firewall it is. The fates have decided. Now you have to roll if it's going to be successful. So let's go. Who wants. Does anyone want everything? Everyone wanted to go purple, right? Because now they hate orange.

[Blake]

We just needed that 20 on our last.

[Caitlin]

We wasted our good roll.

[Ian Meyer]

And that would have gotten you an inject.

So a little bit of column A, a little bit of column B. Okay, you guys want to do purple again?

[V]

Purple hasn't been very friendly either, but we'll do it.

[Blake]

Okay, nice.

[Ian Meyer]

So you did your firewall analysis. You start looking through the firewall logs, and everything looks normal. You start looking through, and it's like, wait a minute. This. All. This all seems fine, but then when you start digging a bit deeper. Wait a minute. Hold on. Let me look at this. Wait, Stephanie. Hey. Did you configure that next gen firewall that we got? No, not next quarter. This quarter. So the next. No, the next gen. No, the layer seven. Oh, yeah. It turns out all those cloud services actually go through a layer 7 firewall that hasn't been set up for logging yet. So maybe there was something there, but it's not set up the log yet, unfortunately. That didn't really give you any other information either. What are we on to? This is move seven, right? Let's take a look here. I'm taking some notes to fill you in on the.

[V]

I'm not going to need to update my resume.

[Ian Meyer]

When I worked in a NOC that we were going to make it so that certain events automatically uploaded a resume to Monster.

But it was our resume, not like somebody else's. It was a joke. All right, so we're on to move seven. We are running low here. Can we bring up the plus Three cards. Just a little closer. Perfect. All right, so your seam is still there. Your consultant's not back yet. You could do endpoint. You could do user entity behavior and also isolation. So I mean, you've only got seven, eight, nine. Oh, we're on. This is move seven. So you've got a couple moves left. I would highly suggest that maybe you start leveraging some of those other ones to see where it leads you.

[Q]

What about ueiba? Because it's going to deal with concurrent logins.

[Ralph]

Yeah.

[Blake]

UEBA or isolation, just shut down that part of the network.

[V]

Do we know what part that is?

[Q]

But is isolation going to give us anything closer to finding out what's happened? Or is it simply just going to isolate the machine? Which in practice works.

[Ian Meyer]

So having to do a little metagaming right now in the really real world.

[Blake]

Right. So we have three chances left with three cards left. So in the spirit of the game, to stop the damage, plus using the modifier, which we obviously desperately need. Unless Ian decides to Rick, roll us by saying that the layer 7 firewall is not set up.

[Q]

Yeah, I think they need to really hire some new stuff.

[Ian Meyer]

Yeah, no, I mean, we get what we can get. I mean, if you came in and you saw the environment the way it is, I mean, you know, we hire the best interns.

[V]

Ian, you gotta send your employees to Black Hills training.

[Ian Meyer]

That's true. Absolutely right.

[V]

Take a class with bo.

[Ian Meyer]

That's right. They do need to take a class with bo. Get some cloud perimeter training, reach that thing.

[Q]

So what about we do the seam again? Because we get the modifier for it.

[Ian Meyer]

Gonna bring the seam back into action. That's right, Thomas. That's what we hired you guys for.

[Ralph]

The.

[Ian Meyer]

The.

[V]

The.

[Ian Meyer]

The top notch crack incident response team we've got here on the phone.

[Q]

Wait, we get paid?

[Ian Meyer]

What's that?

[Q]

I'm saying, as far as I know, we don't get paid.

[Ian Meyer]

No. Oh, well, now you get like interns.

Hey, you're getting paid. An exposure. All right, so I think we heard steam again. Everyone agree with seam.

[Blake]

I'll go with it.

[Ian Meyer]

Wonderful. Purple dice again.

[V]

I'll go with the team.

[Ian Meyer]

Let's give it two.

[Blake]

Yeah.

[Caitlin]

It's rigged.

[V]

The game is rigged.

[Blake]

We need to do a code review on these dice.

[Ralph]

This is actually past that point where we put in a resume. Like, I'm just gonna look for a.

[Ian Meyer]

New job, Like a new career.

[Q]

Yeah, career change.

[Ian Meyer]

I'm gonna move. I'm gonna move out to South Dakota and become a farrier. I'm Gonna shoe horses. Look.

Okay, so let's get into the scenario here. So anyway, so you rolled, you started digging back through the seam again and you're looking through it and you're not seeing anything new. Now what you start to realize as you're looking through here and you're running your searches. Oh, wait a minute, hold on. This query is not done running. What's going on? So the query is just chugging, chugging, chugging, chugging, chugging. And the data you're getting back isn't complete. So you're trying to find something. Maybe there's still something in there, maybe there isn't. But the data you're getting back currently is not showing you anything. So you say, well, you know, maybe we come back to this. Maybe we get a sharper search query, maybe we start looking for something else inside of that search. But right now we've got nothing new. So we're moving on to turn eight. Now let's see, we passed turn six, right? Are we to another inject? Did we fail three times? I think we failed three times, right?

[Q]

No.

[Caitlin]

Did you get an 18 on the firewall?

[Blake]

We did get an 18, yeah.

[Ian Meyer]

You did pass. Okay, cool. So you got one more until you.

Remember the injects can be good though. They're good injects. So you know, somebody could show up with, like I said, pizza and cold Red Bull, you know.

[Blake]

Yeah. Is there a sleep option in this game? I mean, how long have we been up working this incident, just getting rolled.

[Ian Meyer]

As Jason talked about advanced cue ball compromises, we do take fatigue into, into account in advanced cubicles and compromises, but not here, is not, that's not part of the play. So. All right, so you've still got a couple cards that you could play there that are not in cooldown. Your consultant comes back in turn nine, but they're not there yet. And you know, you can play some of these other ones, but yeah, I would definitely keep hanging on to those plus threes because it really does seem like you need them. So what do you all think? CEO doesn't care. Oh, they care.

End of quarter. It's the end of the quarter. They want to know what's going on.

[Ralph]

I think it's Russia.

[Ian Meyer]

This is too advanced.

But it's not fancy bear. It's like a, you know, it's a casual bear. He's got, he's good. It's lazy bear. He threw a corporate logo polo on khaki bear.

[Ralph]

Perfect. That'll be the next apt, right?

[Ian Meyer]

Okay, so let's all right, Moving through the game here.

[V]

So isolation and UEBA were suggested previously.

[Ian Meyer]

Okay, UEBA or isolation? What? Says the team?

[Caitlin]

I think ueba.

[Q]

Yeah, I'm gonna go for that one as well.

[Ian Meyer]

Okay, ueba. All right. Purple. We heard. I think we heard purple.

[Ralph]

Purple.

[Blake]

Dice, your days are numbered.

You're back on the end circle.

[Ian Meyer]

And guess what, Mr. Jason, if you would please reveal for us. Pivot and escalate. We now know that, and you probably could have guessed it was credential stuffing. So what do we now know about the incident? Well, you heard me say service accounts. And what has happened is somehow the attackers have gotten a hold of service accounts that exist in that cloud service, that hybrid cloud environment. And they've started taking them and putting them everywhere they can find them. They're going through, and they're trying to use them because they found them. They found them in that outside service. And they say, wait a minute, hold on. We know that this service is tied back to this company, and so we're going to find anything on their edge that'll take a credential, and we're going to throw it at it, and we're going to see if we can get in. And they were successful in doing so, which allowed them to pivot and escalate into the environment. So now we know that they somehow have gotten cloud credentials.

Out of some cloud service we're using, and they were able to use those to pivot into our internal environment. What we still don't know is what those credentials necessarily were. And we also don't know how they're getting data out or what data they're getting out. So those are. We still need to discover C2 and Xfil, and we still need to discover persistence and coming back into gameplay. I believe we do have the consultants now. Correct. With two turns left. So we are on turn nine. You have. You have two turns left and two things to discover. You can do it, I believe, in all of you.

[Caitlin]

So can we do perfectly on these last two turns? Or we maybe get a consultant that gives us some more terms?

[Blake]

Gets us one.

[Ian Meyer]

Gets you both. Yeah.

[Caitlin]

Or gets a. Is there a consultant that gives us both of these?

[Ian Meyer]

Oh, that's a good question, Jason. I don't know. I don't know. Do we have a consultant that can tell you the. Well, you could. Well, no, you can't, because you only got two turns left. I was gonna say you could choose one of the consultants that gives you, like, a plus five modifier or one of those, but that would only give you one card.

[Caitlin]

So I think we have a consultant that does extra turns.

[Jason Blanchard]

Yeah, there's a consultant for extra turns.

[Ian Meyer]

Oh, who's that? Who's got that wonderful consulting card?

[Jason Blanchard]

Chloe.

[Ian Meyer]

A wonderful, wonderful person who would absolutely give you extra turns if she could.

Like. No, we'll get it. We'll do this. We got it. Okay, so what do y' all think? Are you calling. Are you gonna call the consultant? And if you get it. Are you. Are you ringing? Chloe?

[Blake]

Here, use my phone.

[Ralph]

Yeah.

[Ian Meyer]

All right. Call the consultant.

Purple treated you well last time. You sticking with purple, everybody?

[Ralph]

Yes.

[Ian Meyer]

Not hearing a no. Oh, okay. So why is that role not coming out, Jason? They get the consultant and they get an inject. Or they just get the inject.

[Jason Blanchard]

They get the consultant and an inject.

[Ian Meyer]

Oh, man. This might pull you out. So you get. Can we see the Chloe card first? Yeah, absolutely. So we give Chloe a phone call, and they're like, oh, wow, I'm so sorry that you're. You know, you're having these problems. I've got a team that might be able to help you out that we can have work on this in parallel. Let's see if we can get some defenders on there with you and into your environment, and they can work at the same time during that incident. So now you got a little more head count, a little more horsepower, so you can turn that last turn into. What is this? Three extra turns. So we are now going into extra innings thanks to Chloe, but we also get an inject card. So let's. Let's get our inject card.

And steam goes.

We talked about that. That is rough talk.

[Blake]

Were there any questions that you had?

[Ralph]

The only thing that's worked.

[Ian Meyer]

Yeah, what is it?

[V]

What was SIM running on an old laptop?

[Ian Meyer]

What's the budget?

[Ralph]

Jesus Christ.

[V]

It must be running on aws.

[Ian Meyer]

No, they just. It does go down. They just be Like A $37,000. Thanks for your.

[Blake]

Was this the one where they sell you a very small license and then they tell you to send everything to the sim?

[Ian Meyer]

You can run this sensor on a Raspberry PI. No, the more data trash came up. Because I was saying that. Okay, so let me take a note here for the end.

[V]

It is now.

[Ian Meyer]

Okay, so your seam's down. Let's get that off the board. And so no more. Yeah.

[Ralph]

Are there any good inject cards?

[Ian Meyer]

There are, yeah.

[Ralph]

I feel like we don't know where they are.

[Ian Meyer]

Trying to see here. Where is. Oh, yeah, here's a good one. One of the injects is Seam Analyst returns From Splunk training +2 modifier to all logging. Oh, yeah, there are good ones in there.

[Caitlin]

I think we got a good inject. Last time we played, actually, it, like, revealed two of the cards.

[Ralph]

Oh, yeah, yeah, yeah, it did.

[Ian Meyer]

Okay, so we got three more turns. Chloe's helped us out. We're doing. They're getting there. The seam went down, though, so that's going to be a problem because a lot of our logs are going in there. But that's okay.

[Ralph]

Steve.

[Ian Meyer]

Yeah. No. Get the seam back. No. What do you mean you ran a query to the beginning of time?

We have four terabytes of log. Do you have any.

Just go home for the rest of the. Okay, so Steve ran a query against all four terabytes of log files, and that's what took the thing down. We're going to get it back up, but we might have some data store corruption, so it's going to take a minute to do those restores. Yeah. So there went your siem. We'll get it back up and running hopefully soon. But Chloe's got you covered with some extra folks. So what are we going to do here with our. Our next turn? We are on to turn 10. Keeping in mind you have three extra turns.

[Caitlin]

So this is turn 10, and then we have three additional turns after this one.

[V]

You want to go with the ones with some extra oomph in them. The endpoint and isolation are the ones that have the. What's that number? The addition.

[Ian Meyer]

Endpoint plus three.

[Ralph]

Okay.

[Caitlin]

I think I vote for Endpoint, so maybe we can figure out the persistence.

[Ian Meyer]

Okay. I think Q. I think you called that originally purple or orange.

[V]

That's a hard decision.

[Ian Meyer]

Oh, man. That's the thing. You take a leadership role. You gotta, you know, run with it.

[V]

This is not leadership. This is just jumping on the grenade.

[Ian Meyer]

Everyone else stepped backwards.

[V]

I'm gonna follow what everybody's been doing and just go with purple.

[Ian Meyer]

Purple. Purple's good. All right, let's see it. Was that a roll? Was a seven.

[V]

I don't think it was at all.

[Ian Meyer]

Was it a roll? Yeah, that was a roll. That was a roll. Okay. And we only saw you pick it up. Yeah.

[Caitlin]

I don't believe it.

[V]

Yeah.

[Q]

I have our three rolls.

[Ian Meyer]

You know what I love about this? No one's blaming me for this. They're like, jeez.

Like, how did that happen? Okay, so we got a seven. Unfortunately, that only takes us to 10 with your plus three. So you were right at the edge there. So here's the thing. You start looking through the analysis from the behavior analytics, and you're seeing something. Something does look odd. There are some behaviors that you don't necessarily expect to see happen from certain systems, but you can't put your finger on it. There's just something that doesn't look normal. But you. You don't know why. So that's really, you know, unfortunately, because the roll failed you. You're not potentially getting that additional detail, but there's definitely something going on. We are now into extra innings. We had our passing roll, so I think. I don't think we actually get. We. I don't think it's possible for us to get an inject again because we had no. We had a failing. No, we could get an inject again. We could get it on roll 13. Okay, so roll 11.

[Q]

I would say endpoint analysis or Rita, kind of where my mind is.

[Ian Meyer]

Okay, so we're going to actually go and look at.

The endpoint on this one. I think I always get the two mixed up. We're actually going in physically looking at the. Grabbing the logs physically off of it. Not remote, correct, Jason?

[Jason Blanchard]

That is correct. You could remote into it, but you're looking at the. Whatever task you're running and things like that.

[Ian Meyer]

Wonderful, Perfect.

[V]

I'm looking at persistence now, right? Persistence. And.

[Ian Meyer]

Yeah, yeah, you need persistence, and you need C2 and exfil at this point.

[Caitlin]

So endpoint could get us persistence or reta could get us exfil. So I think either one is a good option.

[Blake]

Incident master. Can you check with James or Steve and see if they got the logs turned back on for Rita?

[Ian Meyer]

Oh, yeah, hold on. Yeah, hold on, James. Yeah, no, put. Put the switch down. I don't care if it's Mario Party. Okay, fine. Did you get. Did you get Rita setback?

[Ralph]

You get.

[Ian Meyer]

Yes. No. What? Okay. Yeah. That's wonderful. You got a star in Mario Party. I'm thrilled for you. Now, the readologues.

Yeah, no, they think they did it. They think it's back up. But, I mean, we're gonna have to check that work because James always tells us he's got stuff done but doesn't. So anyway. So, yeah.

[Q]

If only Jones is good at his job as he is at playing on his switch.

[Ian Meyer]

I know.

[V]

I don't think he's very good at that either.

[Ian Meyer]

So I think. So we doing. You trust James?

[Ralph]

I do not.

[Ian Meyer]

Okay. First off, James is the. The owner's kid. It's okay. But, you know, just, you know. So anyway, preferential.

A little Bit of nepotism going on. So anyway, so we got to get those two. You said endpoint analysis. And he's a people person, I'm a people person.

So we need either endpoint analysis. And I also heard Rita, what saith the group?

[V]

I'll do endpoint.

[Ian Meyer]

Does everyone agree with that?

[Blake]

Let's do it, let's go.

[V]

But I'm not picking the dice.

[Ian Meyer]

All right. I heard Caitlyn say let's do it immediately after queue. So Caitlyn, you pick the dice. Purple 4.

[Ralph]

This is the gift of the game.

[Ian Meyer]

Okay, so we go over and we start looking around to see what we can find out about the systems. And you go over and you think that based on some of the traffic you're seeing, maybe it's the developer. So you go back into the developer pit and you start looking around and seeing, is there anything here that we can look at? So you examine a couple developer laptops, you sit down and they're.

Trying to make a developer joke and I can't come up with it quick enough.

You walk into the developer room and it reeks of kombucha and hoodies.

That's your room.

Anyway, you go in there, you examine the developer laptops, and again, you know, you see something in the user behavior logs and you know that you're getting close, but you're still not quite able to find it. Like everything looks just normal. RGB keyboards everywhere. That's right, they've got those. And if Comrade Ev was on here, they've got productivity hexagons like these.

So okay, yeah, you didn't find anything, unfortunately. So we're going to move on into 12. And I think on this one, I think if we get a failure, we are going to get an inject. Is our consultant already back?

[V]

Yeah, the consultant is back.

[Ian Meyer]

Oh, the consultant's back again. Wow, that was fast.

[Ralph]

Wow, wasn't it?

[Ian Meyer]

No, I think 9, 10. So they were consultant was 9, 10, 11, 12. Wouldn't that be next turn? Yeah.

[Ralph]

How dare you.

[Ian Meyer]

Okay, you know, we didn't like Jason before, but now.

Okay, so Rita was your other one that you had called out. Is there anyone that isn't currently turned that you might also want to take a, a peek at? Inject. Felix is going. So the listeners here are like inject. Inject.

It's a monster.

[Ralph]

I have an opinion, but I'm gonna keep it to myself.

[Ian Meyer]

No, we don't keep opinions to ourselves. This is an open loving forum.

[V]

I mean, what kind of security person keeps opinion that's true, too. Get them access to Twitter.

[Ian Meyer]

Absolutely. Have you seen my Twitter? All right, so let's. Okay, so what are we doing? Let's get some ideas on the table here.

[Jason Blanchard]

All right, we're also losing Blake because he has to attend a meeting.

[Ian Meyer]

Oh, yeah, yeah. We gotta move this.

[Jason Blanchard]

It's very realistic.

[V]

That is also very realistic.

[Ian Meyer]

It is, yeah.

[V]

Shooting incident. You're gonna have other meetings to go to.

[Ian Meyer]

All right, so we wouldn't. We would have been right on time, but you got Chloe, so we're an extra inning. So let's move this foot through 12. What are we gonna do, Rita?

[Q]

I'm still there.

[Ian Meyer]

Rita.

[Q]

All right, but perhaps we should go orange dice and not have Jason roll it.

[Ian Meyer]

Orange dice.

[V]

I think.

[Ian Meyer]

I think the.

[V]

The preferences do not have.

[Ralph]

We need a celebrity role.

[Ian Meyer]

Please, somebody hold his hand.

[Jason Blanchard]

No one's gonna respond to my emails anymore.

[Ian Meyer]

I think Jason's the only one that can.

[Ralph]

So.

[Ian Meyer]

Here we go.

[Ralph]

Come on, money.

[Ian Meyer]

10. All right, so what did we have, though? Because. Did we have a.

[Caitlin]

Which one was the modifier?

[Ian Meyer]

Yeah, we don't have a modifier. Okay.

James. Yeah, no, he left. He knew what he did. He knows he's done wrong.

[V]

Justin, this is the game you invite me to.

[Ian Meyer]

Yeah, this is. This is the one. This is the one. Yeah. Unfortunately, it seems like James. He left. He knew what was coming. Like, I must ask him, like, hey, did you get those logs? And I was like, oh, yeah, totally. I got the log. I got the logs. I'll be right back. So we got one move left.

[Q]

Did you beat him up? Did you say I did?

[Ian Meyer]

Well, no, no. That's against HR policy.

Right? All right, I think we're. We're at the last turn, right? And we got the inject, didn't we? That was inject.

[Jason Blanchard]

God, you're right.

[Ian Meyer]

Oh, yeah. Inject to inject.

[Ralph]

I mean, I keep seeing it in the chat, so I think it's the same. All right.

[Ian Meyer]

Honey. Pots deploy. Oh, I think that's a good one. Hold on. Bring it up.

[Caitlin]

I think.

[Ian Meyer]

So what do we get?

[Jason Blanchard]

It reveals the escalate card. It reveals the pivot and escalate card, which you've already.

[Ian Meyer]

Which we've already revealed. Perfect.

[Ralph]

A card that does nothing for us.

[Ian Meyer]

Do anything bad.

[Ralph]

It doesn't make me feel better.

[V]

This feels like 2020.

[Ian Meyer]

What's funny is, y' all were, like, really? Like, I can't wait to break this incident down, because this is gonna be interesting. Okay, so one last move. Let's close her down.

[Caitlin]

Call a consultant really our only chance, I think.

[Ian Meyer]

Yeah. And who.

[Caitlin]

We clearly need somebody to help us out.

[Q]

What about who would give us C2 or X4 or both?

[Ian Meyer]

Is there any way to get you both?

[Jason Blanchard]

There is no way to get both.

[Ian Meyer]

There's no way to get both.

[Jason Blanchard]

There's no way.

[Ian Meyer]

Let's just see if we can get one. Then we shall not pass. Jason, can we. Well, let's first off, roll. And then if we're gonna say. Are we saying call a consultant?

[Caitlin]

Yes.

[Q]

What do we have to lose?

[Ian Meyer]

The exact mood of an incident response, or towards the end, you're like, whatever.

[Q]

It is, nearly midnight. Just for the record.

[Ian Meyer]

Okay, so let's give it. Let's give the roll here. Move it along here. Let's. I'm gonna choose. Let's do purple 18. Very good. Who are we choosing, Jason? I guess we just pick one that'll.

[Ralph]

Give us the best.

[Ian Meyer]

All right, George, let's see. We already have C2 and X fill. George will give us.

[Jason Blanchard]

Yep.

[Q]

Yeah, perfect.

[Ian Meyer]

Because that works in with the storyline. Everyone good with that?

[Q]

Yeah.

[Ian Meyer]

All right, so remember earlier you called George, George, help us out? Well, all right. He finished up his sans class. He's on a break. And he called back to and said, hey, I'm on a break. What's going on? Can I help? And you start describing the problem to him. And he goes, oh, man. That really sounds like you've got. And if we go ahead and reveal the C2 and exfil card, it seems like you've got some exfil over HTTPs. So let's see what's happened so far. So right now you've got a cloud environment that somehow it was leaking some credentials. Those credentials were then used against your environment, and somehow they were getting more data out of your environment using HTTPs and just kind of just going right straight out. So what we didn't get was our persistence card. We don't know how that data was getting out. And unfortunately, I believe that was our 13th turn. So even though Chloe brought in the big guns to help you out, unfortunately, the mystery was not solved. Scooby and the gang will go home.

Lawyers. We'll get Ralph back with the lawyers and say, get the. Get the cyber insurance people. We're in trouble here. All right, so who wants to hear what actually happened?

[Ralph]

Yes.

[Ian Meyer]

Everyone's like, do it.

[Ralph]

Just.

[Q]

Yes, just tell us.

[V]

There's so much enthusiasm in here.

[Ian Meyer]

Actually.

[Ralph]

No thunder.

[Ian Meyer]

This particular incident the way I always. Who cares?

Everyone knows attribution's a joke. No. So this was actually Based off the most recent CodeCOV disclosure, where essentially what happened was CodeCOV, which is a code quality company that integrates into your CI CD pipeline. And the reason this popped into my head as I was doing this is Rapid7, a large provider of vulnerability and scanning management. For those who are listening to this and aren't, you know, just getting into the field, they had to disclose a breach because they said, hey, we use this codecov. Codecov, I should say, because it's like code coverage tool. And attackers were able to use it to get a hold of a portion of our source code. So using that as the basis for this scenario, what actually happened was developers in your organization were using a tool like CodeCOV that had hard coded ad credentials in it. Now, these services that were coded into the containers, yeah, they were only ever really running internally to the environment and then connecting outbound to these cloud services that they, that they're actually running in this hybrid environment. You heard me say that this is a hybrid environment, right? So they were phoning home that way. This is also, by the way, a really good reason to not have hard coded credentials in your containers and use a secrets manager. So the attackers got that initial compromise by poisoning. The reason we have external cloud service is just as you can read about in the CodeCOV breach response, they poisoned the containers that you would pull into your CI CD pipeline and used their bash script functions to actually send data out. So that's where we got the HTTPs. If you actually go through and look at the exfil method they were using.

Curl through HTTPs through this bash updater tool that would send the code up to CodeCOV and then analyze it. And so what they do is they'd send it there, but they'd also redirect it somewhere else and the attackers would analyze it. They found these service credentials which they then used all over the environment. Actually, that's glaring there. But the credential stuffing, they said, hey, let's try and use these everywhere. You then said, well, wait a minute, service accounts are working from the outside. Yes, because those service accounts were set up as domain admin because they were only ever supposed to be inside of the environment. So they went through, they got those credentials, and on external services that for whatever reason had domain admin as an allowed login, externally, they were able to log in. So in the end, it was essentially a supply chain compromise of a code quality tool that allowed for additional credentials to be leaked out and then the attackers to come back in. So it's a little topsy turvy. In this case, the exfiltration actually happened when the credentials got out, not when the attackers got in. So that was the scenario if we want to come back to everyone, if you'd like to ask me questions, call me a jerk, whatnot. I think you all did phenomenally, though, because the notes that I had here, that I actually put up at the top, because I tried to sort of. When you went to the server analysis, I was like, no, go to the endpoints. Because the storyline was going to be. They were running a local Docker container that had their code quality thing on it. They were running it, they were checking it. And your UEBA spotted. Hey, wait a minute. This should never be coming from here. When Caitlin suggested we should try the SIEM again, you should try the seam again because that would have given you one of the other ones. And thankfully, though, for those of you who were worried about the inject, your seam not working by the end, there were no cards that were going to discover that. So it actually didn't hurt you.

[V]

What sucks about this is that our code is still terrible.

[Ian Meyer]

Right?

[Ralph]

Right.

[Ian Meyer]

Just so everyone knows, code is still terrible. And Ralph's in there with the lawyers. He'll be like, hey, can we okay out of the IKEA thing, let's talk about how we got to pay out on this breach.

[Ralph]

So.

I'm pick up on Ralph.

[Q]

Is he still okay? Did you survive the lawyers?

[Ralph]

That's a negative.

[V]

Ralph is the only one who gets.

[Ralph]

To keep his job.

Only by proxy.

[Ian Meyer]

Yeah, the lawyers at the end took him all out for steak and scotch and whatnot. He's like, so what I miss, folks.

[Ralph]

Boy, this sounds horrible over there.

[Ian Meyer]

This is great.

[Ralph]

These guys just talk and feed me.

[Ian Meyer]

They did a reverse fear on this steak. It's amazing. Excellent. So thank you all for playing and thank you for having me, Jason. This was a pile of fun. Yeah.

[Jason Blanchard]

Thank you all so much. We're gonna wrap it up for today. If you joined us at the beginning, if you would like to play in the future, always let us know. If you ever want a demo for you and your organization, you can always reach out to us at Black Hills Information Security and we can do that for you. For those of you that hung out the whole time, thanks for doing that. This was the most brutal game I've ever seen. I've never seen a game this brutal. I've never seen a game go to 13 rounds game before, and I've never seen it get to 13 rounds and not be resolved like it's. It's never happened. Like, you had two consultants, you had three inject cards.

[Ian Meyer]

Those are some mean dice.

[Caitlin]

Wow.

[Jason Blanchard]

So well done to our people, our friends who volunteered today and thank you so much for being a part of our community and to everyone who watched, thank you. We'll see you next time. And Ian, great job. I mean, the fact that you had to keep rolling with the reason why things weren't working, I was like, I don't know if he's gonna be able to do it again. You're like, James, Jesus Christ. So I definitely learned a couple things today that I'm gonna incorporate into when I do, when I play instant Master.

[Ian Meyer]

So love you, buddy.

[Jason Blanchard]

All right, everybody. Thank you. Go ahead and kill it, Ryan. Kill it with fire. And we are out.

[V]

Thanks, everyone.

[Ralph]

Bye, guys.