Compromise Software Supply Chain
Course Content
Supply chain attacks can have a major impact. By putting a backdoor into software that victims are known to use, threat actors can gain initial access and pave the way for their next steps. They also have the potential to target a large number of victims at once if they alter software that is widely used. This was the case with the 2020 SolarWinds attack. In that compromise, the attackers used a trojanized version of an update to the SolarWinds Orion Platform, which is an IT management software used by over 30,000 organizations. As such, the threat actors may have gained access to not only SolarWinds' clients' data, but potentially the data of those organizations' clients.
In this course, you will also learn about the techniques "User Execution: Malicious File" and "Event Triggered Execution: Accessibility Features." The technique User Execution: Malicious Image involves the attacker relying on a user to run a malicious package of software (called an image) in order to deploy malware. The user typically assumes the image is legitimate based on how it is named. The last technique covered in this course, Event Triggered Execution: Accessibility Features, involves an attacker modifying the way certain accessibility features work that users can trigger using a key combination before logging in. In this way, the attacker can get access to a command prompt or backdoor without having to log into the system.
Learn how to detect and mitigate these techniques to protect your organization from this highly sophisticated type of attack.
Apply what you learn and get the hands-on skills you need in Cybrary's MITRE ATT&CK Framework courses aligned to the tactics and techniques used by the threat group APT29. Prevent adversaries from accomplishing the tactic of initial access.
Instructed by
Matt has led multiple Red Team engagements, ranging from a few weeks to a year and covering multiple security domains. Outside of Red Teaming, Matt is also a seasoned penetration tester with interests in: AppSec, OSINT, Hardware, Wifi, Social Engineering, and Physical Security. Matt has a Master's degree in Information Assurance and an exhaustive number of certifications ranging from frameworks, management, and hands-on hacking. Matt is a Technical SME at Cybrary, focusing on Adversarial Emulation and Red Teaming for course content.
After too many years of security operations work, Chris Daywalt tries to turn his phone off at 5:00 pm EST. While there are a bunch of training classes and education somewhere on his resume, much of what he has to teach was learned at the school of hard knocks, often at the expense of his previous clients. He wants to help you spend more time detecting and denying adversaries and less time banging your head against your keyboard. He dips his blueberry donuts in orange juice.
Chris’ 19-year career includes work for organizations of all sizes, both government and private sector, and is distributed roughly like so:
