Beyond just pinging the domains used by Cyber Crucible to make sure that your endpoint can reach all of the correct network address, the Cyber Crucible Agent installer includes a test argument that ensures a valid TLS/SSL connection can be made in both directions to all required servers.

Simply add --test-connection to the installer execution, making sure to still include group id(s) and OAuth tokens that are necessary to perform authentication. Seen above is a screenshot showing the only modification needed to the provided .bat script, and a successful output.

While all of the Cyber Crucible agent’s behavioral detection and protection happens at the endpoint, without need to submit samples to the cloud for analysis, the endpoint agent still requires a connection to a server to receive licensing information, configuration, software updates, etc.

If your network is locked down to the point of not allowing connections to IP ranges where the Cyber Crucible servers are hosted, then you may need a proxy configured to allow the agent (only) to reach its server for installation. See How to Manage Proxy Configurations for information on configuring the agent.

What type of proxy can I use?

As of version 4.4.6.3 for the Cyber Crucible agent, the proxy configurations support Socks5. There is no restriction on where the server is hosted (on prem, or off), as long as the network restrictions allow the agents to reach it. An example diagram is given below of a simple proxy configuration where the Socks5 server is hosted within the locked down network, and is allowed only to connect to an external machine that tunnels traffic.

This setup allows the agents to connect to their server(s), while maintaining the network policy. Requiring only 1 rule that allows the Socks5 host to reach its external proxy server on one port (ssh). This ensures that not only is all traffic on 443, but also doubly wrapped in SSH before leaving the network, and requires no inbound port-forwarding.

Uninstalling multiple agents at once is simple.

Travel to the Agents page.

We recommend using filters, such as machine name, group, IP address, or version filters to bring the most agents to the screen as possible. This is most useful for users with hundreds or thousands of agents in a group.

Here, we used the shift key, while clicking on 3 rows, to select three agents.

The Uninstall All Selected Agents is on the top left above the grid.

After permissions are checked on the server, that you have permission in the agents' groups, uninstall commands will be issued.

The agents receive a digitally-signed uninstall command. The signature is used by the agents to validate the command really came from Cyber Crucible, and not a criminal trying to remove your protective software.

Once the agents validate, they will prepare the system for uninstallation upon reboot.

The Attention column will have the entry “Uninstall in Progress” and show a Cancel Uninstall button in the cell.

Once the machine is rebooted, the agent validates the uninstall is being conducted, and removes all files.

Of important note - the agent will confirm “one last hello” before completely uninstalling, so sometimes agents will be present for a short period of time after reboot. This is due to some network environments not working properly for up to 30 seconds after the desktop is visible. Note that once uninstalls are finished, licenses are automatically removed from agents.

Introduction

Cyber Crucible is designed to run without interrupting end users or employees, while quietly notifying chosen Dashboard users (typically chosen IT and Security team members) of automated responses.

A lot of the simulators for ransomware or malware do not accurately capture a hacker’s behavior. Even though that causes issues for tools like Cyber Crucible that (correctly) identify the simulation as a false positive, that isn’t necessarily a bad thing.

Some vendors will actually build their detection engines around these simulators for some of their detection functionality, to ensure that any customer tests pass with flying colors.

Real malware actions like ransomware encryption run the risk of unrecoverably encrypting or corrupting data. At Cyber Crucible, we’ve even seen ransomware secretly activates other malware on the network, or do other actions that could harm the company trying to test Cyber Crucible.

So, you don’t want to use malware, and you don’t want to use a simulator so accurate that you might accidentally corrupt your data.

Testing Cyber Crucible

There is an easy way to test Cyber Crucible without using malware or a simulation so realistic you put your or your company’s data at risk.

Cyber Crucible assesses digital identity accesses at every millisecond of the day. A lot of those digital identities are stored in the browsers - that is why attackers put web browsers to the top of the list for their automated targeting.

Cyber Crucible identity access behavioral analysis will result in one of three responses:

1. Do Nothing

2. Hide the data

   1. known legitimate application that passes all memory and kernel checks, but does not need access to that particular identity data - example: unexploited Windows Explorer

3. Suspend the process

   1. known legitimate application that should have access to the identity data but is hacked, or

   2. a strange application

Here are two locations that are common for Windows users:

In this case, the Windows username is “denni”, and these are the location where session data is stored. You may find the variable %LOCALAPPDATA% works for you if you don’t want to figure out the username.

• C:\Users\denni\AppData\Local\Google\Chrome\User Data\Default\Sessions

  • %LOCALAPPDATA%\Google\Chrome\User Data\Default\Sessions

• C:\Users\denni\AppData\Local\Microsoft\Edge\User Data\Default\Sessions

  • %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Sessions

The View Without Cyber Crucible Installed

Let’s first see what one of these folders looks like with Explorer.exe, without Cyber Crucible Installed.

Here, we see multiple Chrome Sessions under the “default” Google Chrome profile.

This information typically contains sensitive information that an attacker would want to hijack sessions with important programs like IT administration portal, banking, email, or storage tools like Google Drive or Dropbox.

The View With Cyber Crucible Installed

After installing Cyber Crucible, a quick test may be conducted, without using malware or any type of criminal techniques or misuse of IT equipment.

In this case, the same browser session storage location is used:

• C:\Users\denni\AppData\Local\Google\Chrome\User Data\Default\Sessions

  • %LOCALAPPDATA%\Google\Chrome\User Data\Default\Sessions

• C:\Users\denni\AppData\Local\Microsoft\Edge\User Data\Default\Sessions

  • %LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Sessions

Cyber Crucible immediately after installation is already blocking access to the data in that folder.

Please notice that this is the exact same Explorer process that was already running upon installation, so the program running suddenly has had access revoked at the “hard drive” or kernel layer. Even programs, benign, exploited, or malware that are already running are correctly assessed by Cyber Crucible.

Seeing your test in the Cyber Crucible Dashboard

There are a large number of identity data accesses in a running system, at all times.

Software as a Service and cloud-based programs have resulted in many websites and applications that have limited on the website itself, while the browser (or embedded browser for applications) constantly communicates with data servers to populate spreadsheets, tables, graphs, and social media content.

Identity Access page

Identity accesses that are deemed appropriate for Cyber Crucible to suspend the offending application are listed in the Identity Access page.

These are situations where the program accessing the identity data should be stopped, not just have data hidden.

In this case, Explorer was not stopped after the multitude of checks Cyber Crucible conducted. Instead, data was just hidden.

Therefore, there are no identity access violations listed here.

Identity Access Hide page

Cyber Crucible optionally has the ability to show Dashboard customers situations in which identity data was hidden, but which there the accessing program was not stopped.

Explorer was not exploited or otherwise malicious in this test, it was just accessing very privileged identity data for the Chrome and Edge browsers.

Most users do not have access to this information given the additional load on the customers' machines and networks transmitting that data to Cyber Crucible servers.

Please ask if you would like access, but please know the activity you are seeing is not malicious activity, but identity data privacy behaviors Cyber Crucible conducts on a GRC, or policy enforcement, perspective.

Here, we see in this short video, that Explorer was blocked from viewing the browser session data, even though Explorer itself was not interrupted.

Cyber Crucible has created a Powershell Script that can take in a CSV file path containing Net bios machine names to automatically release licenses from.

Script Arguments

The script takes in a few arguments in order to run:

• CSVPath

  • This is the path of the CSV file that contains the machine names of agents whose licenses should be released

  • The format of this file should be .csv and the delimiter should be a comma

• MachineNameHeader

  • This is the header name of the column that contains the machine names

  • The CSV file must have a header row

• AgentLastActiveDays (Optional)

  • By default, the script will not release the licenses of agents with matching machine names that have called in within the last 30 days. You may pass a different number to this argument if 30 days is not desired

• RefreshToken

  • Your refresh token can be found on the Rest Integration Page. See the “How to find Your Refresh Token” section for more

• CaseSensitive (Optional)

  • A Switch parameter indicating if the script should use case-sensitive matching on the given machine names from the CSV file when finding the corresponding agents.

  • By default, the script will use case-insensitive matching

• TrainingMode (Optional)

  • A Switch parameter indicating if the machine names are training mode data.

  • Only include this argument if the machine names are for training mode data, otherwise do not include

• DemoMode (Optional)

  • A Switch parameter indicating if the machine names are demo mode data.

  • Only include this argument if the machine names are for demo mode data, otherwise do not include

Download the Script

How to Run the Script

After downloading the script and finding your refresh token, open Powershell and navigate to where you have downloaded the script. Then you can run the script with the arguments defined above. An example command to run the script can be seen below:

.\ReleaseLicensesFromMachines.ps1 -CSVPath "C:\Users\user\Documents\csvFile.csv" -MachineNameHeader "MachineName" -RefreshToken "token"

The script will look for your agents that have matching machine names from the CSV file and remove their licenses. The script may take a few minutes to finish running and should be left running until it finishes.

Please note that if you have multiple agents with the same machine name, all of these agents will have their license removed if the machine name is included in the CSV file. Agents with matching machine names that have called in within the specified number of days in the AgentLastActiveDays argument (Default of 30 days, see argument definition above) will not have their license removed.

How to find Your Refresh Token

You will need a refresh token to be able to run the script, which can be found on our website on the Rest Integration page:

The data collected by the Cyber Crucible agent goes through multiple layers of filtering, in order to cut out noise from having too much raw telemetry. The raw data produced by the kernel sensors is trimmed down [Filter #1] to reduce both endpoint memory usage, and network bandwidth per-agent. Following that, the REST API will associate raw process/endpoint telemetry it receives to automated responses, such that the analyst can choose to view only relevant data [Filter #2].

As seen in the figure above, an average customer’s workstation endpoints may produce multiple gigabytes of raw sensor data over a 24hr span, whereas only a few megabytes of which will be relevant to a SOC alert if an attack is attempted.

Travel to the Agents page.

Locate the desired agent, and click the trash icon in the Agent Name column:

Note that only agents on version 4.4.6.3 and higher have this capability

Where to Find a Group’s Current Proxy Configuration Setting

Users can view a group’s current proxy server configuration setting for agents in this group to follow by first navigating to the Groups page found under the Administration tab in the sidebar.

A group’s current proxy server config setting can be found in the “Proxy Server Config“ column on the grid.

If the group does not have a proxy server config enabled, the “Do Not Use Proxy“ text will be shown.

If the group has a proxy server config enabled, the current proxy config’s URL will be shown

How to Update a Group to Enable a Proxy Server

Users can enable agents in a group to use a proxy server by first clicking the manage proxy configurations icon in the “Proxy Server Config” column on the Groups page. Clicking this icon will popup a modal where users can manage the proxy server configurations for the group.

The Manage Proxy Server Configuration modal that appears is used to view and manage the proxy server configurations for the group. Users can save multiple configurations inside a group, and all saved configs are shown on this modal’s grid. Note that all saved proxy server configurations for a group will appear on the Download Agent modal as well.

In order to select a proxy server configuration for the group, the config must first be submitted on the New Proxy Configuration Form. This form is hidden by default, click the toggle to display it.

After submitting the new configuration form, it will be shown below on the modal’s grid.

To select a proxy configuration for agents in this group to use, first select the desired configuration, then click the edit icon above the grid.

After clicking the edit icon for the desired proxy configuration, the group’s current proxy server config is now updated and can be seen on this modal and in the “Proxy Server Config” column. Agents in this group will now use the group’s updated proxy configuration. Note that if an agent receives instructions to switch to an unreachable proxy server it will not switch until that server becomes reachable.

How to Update a Group to Not Use a Proxy

If a group has a proxy server enabled for agents in this group to use and users want to update the group so that agents in this group will not use a proxy, first navigate to the Groups page and locate the desired group on the grid.

Then click the manage proxy configurations icon in the “Proxy Server Config“ column. Clicking this icon will pop up the Manage Proxy Server Configuration modal.

On this modal, click the x icon to update agents in this group to not use a proxy server and call to our servers normally. Note that the current proxy configuration will not be removed from the group’s saved proxy configurations, this is a separate step explained in the section below.

After clicking the x icon, the modal will be updated to reflect this change and the “Proxy Server Config“ column for this group will now show “Do Not Use Proxy“.

How to Remove a Saved Proxy Configuration in a Group

To remove a group’s saved proxy configuration, first navigate to the Groups page and locate the desired group on the grid.

Then click the manage proxy configurations icon in the “Proxy Server Config“ column. Clicking this icon will pop up the Manage Proxy Server Configuration modal.

On this modal, click the desired saved proxy configuration to remove for this group, then click the trash icon. After clicking this icon, the selected proxy configuration will no longer appear in the grid as a saved proxy configuration for the group.

Note that if you remove a saved proxy configuration for a group and this configuration is set as the current proxy server configuration for the group, this will also update the group’s current proxy server configuration to not use a proxy.

How to Install an Agent Using a Proxy

First, navigate to the Agents page found under the Operations tab in the sidebar. Then click the Download Agent button. Clicking this button will popup the Download Agent modal.

On this modal, if you select a group that has saved proxy configurations, the Select Proxy Configuration for Installer option will appear with the group’s current setting selected as the default value. All of the group’s saved proxy configurations will appear as options as well, including a Do Not Use Proxy option.

When opting to use a proxy for the installer, the only possibly installer type is the Command Line Installer.

If you select the Do Not Use Proxy option, our normal installer type options will appear.

Note that if you select a proxy configuration for the installer that is not the group’s current setting, the installer will run with the selected setting and then switch to the group’s current proxy configuration setting after installing.

Where Can I See if an Agent is Able to Bypass the Proxy?

Users can view if agents can connect to our servers without using a proxy by first navigating to the Agents page found under the Operations tab in the sidebar. Then locate the Agent is Able to Bypass Proxy column on the grid.

Note that the Agent is Able to Bypass Proxy column will not be visible unless the user is a member of a group that has enabled agents in the group to use a proxy.

If the agent is in a group that has enabled the use of a proxy and the agent cannot bypass the proxy to connect to our servers, the red x will be shown in the column. See an example of this below:

If the agent is in a group that has enabled the use of a proxy and the agent is able to bypass the proxy and connect to our servers normally, the green check-mark will be shown in the column. See an example of this below: