Organizations spend a lot of time thinking about advanced stuff. Right now it’s AI — everybody talks about what AI can do, what it can detect, what it can automate, what are the AI threats. Fine, that’s where the market is right now. But if you actually look at incident, most of them don’t come… Read More »Advanced Systems, Forgotten Basics
As I wrote many times, I work in integrator company. Part of the job is that new technology land on my desk on regular basis. As example, few years ago it was SD-WAN, now common things Then it was cloud-delivered firewall. Then ZTNA. Now it’s managed browser turn. Another new technology Managed browser, sometimes called… Read More »Managed Browser — New Technology, Old Doubts
I work for a systems integrator, and from time to time we have to prove the value of our solutions or proposals. Last time, I ran a quite “interesting” PoC. The customer planned to refresh their LAN/WAN infrastructure completely, introduce advanced network security capabilities, and manage everything through cloud-native management. At the beginning, my thoughts… Read More »Market Ready, Tech Broken: The Early Adoption Trap
Modern firewalls can be split into multiple virtual instances that share the same physical hardware. The most common reason for doing this is administrative separation. For example, different teams manage different parts of the infrastructure while using the same physical firewall. Another reason is to separate infrastructure areas or environments. As an instructor and engineer… Read More »Do you really need multiple virtual context (VDOMs/ VSYS)?
Let’s step into the practical stage of building a covert C2 channel on top of a public LLM. I first tried to build C2 using the approach from the previous post: a custom C2 website with the LLM acting as a proxy to fetch and pass commands. This did not work. All tested LLMs (ChatGPT,… Read More »Living off the Land (AI) part 2
In my previous blog post, I explained and tested how C2 over trusted DNS protocol works. Advanced C2 can be implemented in many ways. One interesting technique is the use of trusted services as a covert C2 tunnel, classified by MITRE as T1102. https://attack.mitre.org/techniques/T1102 LLMs such as ChatGPT, Gemini, and Claude are widely used and… Read More »Living off the Land (AI) part 1
Some time ago, I wrote an article about my first deployment in the public cloud, specifically in Azure. In general, many Azure networking rules and design patterns work very differently from what we know from traditional on-premises environments. In on-prem networking, asymmetric routing is usually not desirable. In the public cloud, it depends. For outbound… Read More »Azure Inbound traffic
Panorama is a well-known tool for managing Palo Alto Networks firewalls and providing central log storage. It has been available for as long as the NGFW firewalls themselves. I work with it frequently. Like any product, it is not perfect. I have encountered several specific drawbacks. Panorama management logic is based on Device Groups for… Read More »Strata Cloud Manager
Some time ago, I wrote an article about the differences between AV and E/XDR products. I have another good example that shows why AV products are obsolete. In my previous blog post, I described a DNS tunneling technique used for C2 communication. This article shows how the same activity looks from the host detection perspective.… Read More »AV <-> E(X)DR again…
Some time ago, I did some tests related to DNS tunneling identification. What was wrong with that scenario was that the test was not based on a real-life setup. DNS tunneling happened only inside the infrastructure (LAN environment), without any connection to the Internet or external DNS servers. Such a scenario can influence how vendors… Read More »DNS Tunneling again…