Search Results

Group NameTraining Data - Vanilla Ransomware (Hive)ScenarioIn this training scenario, we will execute a ‘vanilla’ ransomware payload, running as admin without any exploits. This simulates the basic example of a user downloading malware via a phishing link, mal...

Group NameTraining Data - Signed Ransomware (Hive)ScenarioIn this training scenario, we will execute a ransomware payload, running as admin, and with a custom signature. This scenario is not too different from the ‘vanilla’ sample, but utilizes a signed execut...

Group NameTraining Data - RAT Exfil (Quasar)ScenarioIn this training scenario, we will execute a RAT on the victim machine, and use it to enumerate the data on disk, with the goal of exfiltrating files.While this is not a ransomware attack, the behaviors used ...

Group NameTraining Data - Process Injection (Hive)ScenarioIn this training scenario, we will execute a ransomware payload via process injection into an already running Svchost.exe. The Svchost in question is a normal system operation, long running, signed, and...

Group NameTraining Data - Process Hollowing SQL (Hive)ScenarioIn this training scenario, we will execute a ransomware payload via process hollowing, an injection / evasion technique where a process is started and has its executable code modified to do some oth...

Group NameTraining Data - Identity Theft (Redline)ScenarioIn this training scenario, we will execute a piece of “stealer” malware in order to perform the first stage of an attack, credential theft. Unlike the RAT scenario, this one does not use the same behavi...

FeaturesUpgraded pattern matching capabilities in the behavioral model.This is especially relevant for additional coverage of identity store locations, such as cryptocurrency wallet locations.Increased software dependency functionality for (Cyber Crucible) lib...

FeaturesUpgraded monitoring and prevention capabilities for automated identity access protection.Optimize network usage through variable communication rates dependent on client behaviors.FixesN/AMD5 Hashesservice.exe = 408d8ae9e35ee65c8e208cfa76c67df6 assist...

FeaturesImplemented a cross-link on the extortion responses child grid to view the related process creations and injections.Implemented user password aging policy for groups.Added training mode and the ability to reset a parent group’s training data to its ori...

FixesOptimized identity information tracking for applications with large number of deeply nested directories.MD5 Hashesservice.exe = 9c6474e44959e8eba54876c46e13fb25 assistant.exe = 03d671ffa567ac8dc783ce905d624351 CCRRSecMon.sys (Windows7) = 5fbd3b4a...

FeaturesImplemented controller for training licenses and added a training license expiration service.Updated each endpoint to account for the web application’s new training mode feature along with tests to each endpoint for training mode.Added an endpoint for ...

FeaturesNoneFixesOptimization of variable handling for one genre of behavior.Cause: One unspecified security product produced a very large number of behaviors on a couple large servers, which cause excessive memory usage of Cyber Crucible.Symptoms: Cyber Cru...

FeaturesNoneFixesFixed Acronis compatibility issuesMD5 Hashesservice.exe = 4747ae6372a0f3a410c145e64314123c assistant.exe = f7c0ac0044a3b186d2f6db2a8a1989f0 CCRRSecMon.sys (Windows10) = f69661a61bb9364d6f25f5f4b410729c CCRRSecMon.sys (Windows8) ...

FeaturesCredential protection support for Microsoft Teams and Signal MessengerFixesSuppressed network related logs when in safe mode without networkingBackup some agent data on uninstall to the Windows temporary storage folderMD5 Hashesservice.exe = 23735f3c...

FeaturesNoneFixesReduced network usage when sending large amounts of reports at onceFix handling of some certificate dataMD5 Hashesservice.exe = a54087913a6ddd451853ffce64112e21 assistant.exe = 14859d6c32192a073c0518b0d3e957ee CCRRSecMon.sys (Windows8) ...

FeaturesNoneFixesReduced memory usage in servers with many unique program certificatesMD5 Hashesservice.exe = c7afcb665f6849d39430df2271703cd6 assistant.exe = d6ed1b6f2d6d914e9bb08396a3d03a57 CCRRSecMon.sys (Windows8) = 1a399a22cecdca9b5ffefe69a211fc6...

FeaturesNoneFixesReduced memory usage during handling of programs that use undefined behavior in querying directoriesMD5 Hashesservice.exe = 7bf08deada69a09e2c0362337554c124 assistant.exe = ced782e4c6793e4b8a2ec2d4580b90f8 CCRRSecMon.sys (Windows10) = ...

FeaturesNoneFixesIncreased logging and telemetry for bad machine statesStability increase for Identity protections at boot timeMD5 Hashesservice.exe = 5f33211e1c36f31439a9d5efb8e7b029 assistant.exe = ced782e4c6793e4b8a2ec2d4580b90f8 CCRRSecMon.sys (Windows10...