Security Validation

Produkt:Firebase / Google Cloud IAM / Service Account / Create New Private KeyBeschreibung des Problems:Ich versuche, für mein Firebase-Admin-SDK-Servicekonto (firebase-xxxx@xxxxxgserviceaccount.com) einen neuen privaten Schlüssel zu erstellen. Obwohl ich sichergestellt habe, dass die entsprechende Organisation-Policy iam.disableServiceAccountKeyCreation nicht aktiviert ist, erhalte ich weiterhin eine Fehlermeldung, dass die Schlüsselerstellung für dieses Servicekonto nicht erlaubt ist. Ich habe alle mir bekannten Einstellungen, IAM-Rollen und Richtlinien überprüft und kann keinen aktiven Constraint finden, der die Schlüsselgenerierung unterbindet.Beobachtete Fehlermeldung:"Key creation is not allowed on this service account. Please check if service account key creation is restricted by organization policies."Gewünschtes Ergebnis:Ich möchte einen neuen Schlüssel für dieses Servicekonto erstellen können. Gibt es eine weitere, mir nicht ers

Empowering Detection Engineering with Chronicle and Mandiant Security Validation       Introduction   Detection engineers face the relentless task of creating, refining, and validating SIEM rules to keep pace with evolving threats.  Ad hoc testing and reliance on simulated attacks often lead to blind spots and false positives. Mandiant Security Validation (MSV) offers a systematic, attack-centric approach to streamline rule development and proactively uncover weaknesses in your detection logic.   MSV for the Detection Engineer Beyond Vulnerability Scans: MSV tests your entire detection pipeline, not just isolated attack components. This uncovers gaps where SI

Hi all,I know the API to get all the completed jobs in json format: https://<director>/jobs.json.Is there an API to get only the scheduled jobs (https://<director>/jobs?filter=scheduled) in json format?And after getting the list of jobs, is there an API to see the details of each scheduled job? Such as when it was scheduled and which actors are used?Thank you,Paolo

Hello everyone.Has anyone managed to configure the pipelines on MSV and the corresponding part on PowerBI to receive job data and would like to share the basic steps to follow?Especially regarding the configuration of PowerBI which I am not familiar with at all.Our deployment involves only one on-prem Director.Thanks.Paolo

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20241120 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal. For full details on this release, see the 

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20241106 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download the security content pack from the Mandiant Documentation Portal. For full details on this release, see the 

The Mandiant Security Validation (MSV) team is pleased to announce version 4.14.1.1 of the MSV platform. Bug fixes Fixed an issue related to proxy information in integration logs on the Director. Known issues Local Event Filtering works as expected but is limited to Match Action, Match Integration, and Match Events (when the latter involves Raw Events). If a rule has a Match Event condition for any field other than Raw Event, the rule does not apply to Local Events. It only applies to events from standard local integrations in MSV. Network configuration may reset unexpectedly. To resolve the issue, run vsetnet after the upgrade with static IP addresses for one or more interfaces. Appliance OS Security Update The latest platform security update can always be found on the

In this guide, I'll show you how to generate an API key in MSV so that you can use it for programmatic access to your validation platform.  This will be useful for following some of the other guides and resources provided in the forum by others. In MSV, click User, then click User Preferences.  In the subsequent screen, click the + button next to API key to generate a new key. Note that the API key is only displayed at the time of generation, while the modal window that is displaying it is visible.  Once the modal window is closed, the key can't be displayed again, so ensure that you have saved it to a secure location.

The Mandiant Intelligence Validation Research Team (VRT) has published VHR20241023 - Content Expansion. This content pack requires Director version 4.12.1.0-0 or higher. If you’ve enabled the Content Service, this content pack will automatically download and be applied to your Director. Otherwise, you can download and apply the content pack manually using the below link. For a full summary of changes included in this content release, please refer to the release notes in the Mandiant Documentation Portal.

In this post, I will show you how to use Mandiant Security Validation (MSV) and threat intelligence from Virustotal to validate whether your endpoint security controls can detect data exfiltration using curl on windows. Your task is to validate whether your endpoint security controls can detect and/or prevent a data exfiltration using curl . The steps will be as follows: Find the malicious curl use case on virustotal. Create and run the curl Windows Host CLI action. Validate the efficacy of the internet security controls and address any gaps. 1-Find the malicious curl use case using virustotal: I will use sigma rules to find the needed sample,  browse https://www.virustotal.com/ui/sigma_rules and search for curl.exe , you will the get the following entry:

Hello everyone,I'd like to share with the community a thing we did internally to use the MSV Library with the MITRE ATT&CK Navigator (https://mitre-attack.github.io/attack-navigator/).This job was made in collaboration with my colleagues from the CSIRT team.We had two objectives:"plot" the MSV Library on the MITRE ATT&CK matrix using layers (https://github.com/mitre-attack/attack-navigator/tree/master/layers).overlaying the MSV library with custom layers or layers from MITRE to extract the list of actions corresponding to the techniques that are common to the two layers.The approach we developed is very simple and it's the following:analyse MSV Library and collect a list of VIDs for every technique.

Many customers have used various API scripts to extract job results from MSV to facilitate results reporting. One method that is much quicker than using the jobs API is the search API.  The search API is what is used by Report Builder and it pulls back a subset of the job results.  It's fairly simple to use and can make reports much simpler because there's not the mound of data that is returned by the jobs API.   The input to the search api is a JSON blob with the details of the search and what fields you would like to bring back.  From any report in report builder, you can just click "View Request Data" to see a working example of the JSON such as the one below: {"conditions": [{"conditions": [{"match_field": "id","match_object": "job","operator": "in","value": [2498,2499,2500,2501]}],"operator": "and"}

One common use case that I have seen at several customers is that they want their SecOps or Operations folks have the ability to monitor that MSV Actors are up and available. To prevent false alarms, a script was created to "ping" the actors.  The script can be put on a scheduled CRON or be ran manually as a part of the playbook.  Feel free to take a look at the Python below and use as needed. For simplicity, I did not include the code to create the HTTPs session to the Director. # Get the list of non-protected actors def setup_data_fields():     global nodeData, evalData     response = session.get(f'https://{director_ip}/topology/nodes.json')     if response.status_code != 200:          print('Unable to get node information from director.')          sys.exit(-1)     nodeData = json.loads(response.text)

New content is constantly being added to MSV as new malware, attack methods, etc. are discovered by Google.  As such, customers would like to be able to quickly get information on the new content without having to go to the library and filter down to the new actions.  This code will pull all of the actions added to MSV since a specific date.  The code looks at a JSON file to get the start date information.  This could easily be replaced with a variable passed into the method.   Enjoy! def getNewActions():#Read the config file - config file must be prebuilt#Read the list of content imports#Update the config file with the latest runtime#Search the content imports list to see if there is new content#Make a list of new content if it is available#Return the list or an empty list if no new content is available     newStuff = False     newActions = {} 

One of the most common questions I hear about MSV is why an event isn’t being attributed to an action being executed.  I normally go through the following steps to see if we can determine why the event wasn’t attributed: Does the event exist at all? (Seriously.)  Is there an event in the security technology that we are integrated with that matches the action that we ran. Is the time good for the event?  Every action executed in MSV has a start time and end time.  The event in question needs to occur between those two times. For example, _time is used in Splunk to denote the time of an event. If _time isn’t between the start time and end time, we will generally not match it to an action. Does the event have correct information?  Is the source IP, destination IP, a

MA-SV Users, The Mandiant Security Validation Team will be deploying 5.14.1.0 on Tuesday, October 1, 2024 at 0800 EDT (12:00PM UTC). During this time, users might experience brief disruptions accessing the service. Full service will be restored no later than 9:00AM EDT (1:00PM UTC).Fixes include: Fixed an issue where testing queries returned "null" in results without indication of error. Fixed an issue where the AEDA landing page didn't indicate that monitors were broken. Fixed an issue where the Operation Status incorrectly stated that Remote Integration tests were failing. Fixed an issue where Jobs indefinitely stalled in between groups. Fixed an issue where the AEDA landing page was taking too long to update. Fixed an issue where the LoginUI.exe process took too long to restart when a Network Action was run with an interactive session using a Windows system a

Validation Customers, The Mandiant Intelligence Validation Research Team (VRT) has published VHR20240918 - Content Expansion, a Security Content Pack focusing on Campaign 24-032, Campaign 24-034, and Campaign 24-036. The content pack includes 12 new Actions and 9 new Files. For full details on this release, see the Release Notes on the Mandiant Documentation Portal.

Today, the Mandiant Intelligence Validation Research Team (VRT) published VHR20240904 - Content Expansion, a Security Content Pack focusing on CVE-2024-0778, CVE-2024-3272, and Campaign 24-023.  This content pack includes 12 new Actions and 9 new Files. For full details on this release, see the Release Notes on the Mandiant Documentation Portal.

How to get security alert from browsers?

Hi everyone,I’m running an (PII Removed by Staff) and want to ensure the highest level of security for our user data on Google Cloud. What are the best practices for securing sensitive information and protecting against breaches?Thanks for your advice!

Hi All,I'm receiving the following error when attempting to access an advisory notification."you have insufficient permissions to access the resource, or because a Principal Access Boundary policy is blocking your access to the resource. "Clicking the link using any account including super admin gives the same error.Thanks,-BPIT

Many MSV deployments include multiple on-premise actors and one or two Mandiant cloud hosted actors. Many use cases like data extraction or malicious file transfers (MFT) will require that the on-premise actors can communicate with the cloud hosted actor. Mandiant requires clients to submit a list of public IP addresses that the on-premise actors will use to communicate with the cloud hosted actor. The MSV operator often does not know this information and may resort to an internal ticket or inquiry to a network administrator to find this information out and that can take more time than wanted. A simple and faster alternative is to create Host-CLI actions utilizing the cURL utility to identify the egress IP address of each on-premise actor. Yes, this works on network actors as they are linux based and can run Host-CLI actions using a bash shell. An action for multiple shell types can be similarly created as cURL is supported on many OS platforms including windows (cmd.exe or po

The MSV Report Builder is a powerful analytics tool. It is easy to get carried away with all the widgets available after running a campaign of attack simulations and emulations when crafting an Executive Debrief Report . A Debrief should be "brief" but also stick to a set of simple principles. In this case less is more for those who are charged with making risk decisions.  The report template should include a text section to record the analysis and just enough data widgets (graphs, charts, tables) to back up and color the analysis. The analysis itself should be recorded in "your" words using concise sections like : Objective, Scope,  Performance Analysis, Key Issues (good & bad), Potential Solutions and/or Next Steps. Using a debrief process that simply presents fair and concise information to  those in charge of risk will help empower them to make decisions in the best interest of your data assets. Example Debrief Report

Probably the most asked question in all of Mandiant Security Validation.  In over 4 years, this question has been asked by customers I work with hundreds of times.  While there's a hundred possible reasons the log wasn't matched to the action, there's only a few questions needed to figure it out. First and foremost, was there actually a log generated? MSV cannot find something that does not exist. Windows group policies and many other types of security protections may not generate a log. Never fear, the next question can help answer this one.  What kind of action is it? Seems kind of simple, but knowing what kind of action it is will narrow the search drastically.  Malicious file transfer actions are not written to disk, so don't expect any EDR logs. Host CLI actions seldom hit the network, so don't expect any firewall, proxy, network appliance logs. DNS actions are simply name resolution requests. If DNS resolutions a

  Shells, shells and more shells!Do’s and don’t for creating Host CLI Actions The Mandiant Security Validation(MSV) platform is distinctly different from attack simulation technologies. Security validation includes vast integrations with defensive technologies and attack execution across the entire enterprise security environment. It is not limited to endpoint security controls. It uses real, active attack binaries to test the effectiveness of security controls.The platform is open and allows users to create custom actions needed in their environment.A little reviewMSV offers four shells for writing command line scripts. This article will speak to three of those