Security Boulevard

A new Mythic add-on for Windows Agents

Mythic provides flexibility to agent developers for how they want to describe and execute techniques. While this is great, it also means that when operators hop from agent to agent, they can have issues with slight differences between similar commands. Because of this, there have been some requests within the Mythic community to provide a feature similar to Sliver’s amazing Armory project so that, if desired, there can be a more standardized way of executing beacon object files (BOFs) and .NET assemblies.

Introducing Forge Forge in Mythic

Mythic uses Docker to provide a plug-and-play framework of adding/removing agents and communication profiles dynamically. This means that adding a new Docker container to Mythic simply adds that new agent. You can use that agent to build payloads, get callbacks, and run commands, but that’s all specific to that one agent. The commands from Apollo are not available to another agent like Poseidon, so how can Mythic provide some standardized command across multiple agents?

Mythic 3.3 introduced the concept of a “Command Augmentation” container that in many ways acts the same as a normal agent container. This container brings along new commands to Mythic; however, instead of having them tied to a specific agent, they’re automatically added to all callbacks that meet certain criteria. This criteria can be callbacks on certain operating systems or callbacks based on certain other agents. These “Command Augmentation” containers process the command like normal, but instead of handing that finished command to the agent for execution, it’s handed to another agent’s container for further processing.

Forge is the first “Command Augmentation” container released on the MythicAgents GitHub organization. The Forge Docker image is built with all of Flangvik’s SharpCollection compiled assemblies and Sliver’s Armory of compiled BOFs. Forge offers a few management commands that allow you to list out collections of commands, register assemblies/BOFs within your callbacks, add support for other agents, and more. Let’s look at two examples of what Forge can do.

.NET Assembly Support Forge Collections SharpCollection

The forge_collections command allows you to list out the available commands that are part of a collection. The SharpCollection and SliverArmory collections exist by default, but you can add new ones at any time. In the output above, we can see the ability to re-download the command (this fetches the .NET versions again from GitHub and can be helpful if there’s a new version released), to register the command (make it available to execute), and some information about the command name and what the assembly does. Clicking the download or register buttons will register the command within this callback and all callbacks that have support with Forge. Let’s say we click the register button for the Rubeus entry. We’ll get a new command we can issue called forge_net_Rubeus; the name of this command allows you to easily identify commands added as part of Forge and if this is a .NET command or a BOF command.

New assembly commands always have the same arguments: the argument string that’s passed to the .NET assembly, the version of the assembly to use, and if this should be executed via execute_assembly (fork-and-run) or inline_assembly (in process).

Forge .NET Parameters

These parameters are always the same for each .NET assembly because in the offensive security community, .NET assemblies are made to take in a single string and do the parsing themselves instead of using named parameters.

BOF Support Forge Collections Sliver Armory

BOF support in Forge works a little differently thanks to the amazing work that the Sliver team did for their Armory plugins. Unlike .NET assemblies, BOFs have a very specific set of arguments they take, in a specific order, and with specific formats. Many people use BOFs with Cobalt Strike, so they have Aggressor Scripting files created for them that describe these parameters. Unfortunately, this format isn’t usable outside of Cobalt Strike, but the Sliver team went above and beyond to convert many of these to JSON. As part of this, the Sliver team has forked versions many common BOF projects (e.g., https://github.com/sliverarmory/CS-Situational-Awareness-BOF) where they store compiled versions of the BOFs and this converted JSON data in tagged releases.

Forge hooks into their work by fetching the latest tagged release for the command you want to register and extracts the object files along with the extension.json file that describes the BOF’s arguments. Since Mythic already supports defining commands with named parameters, their types, and their orders, Mythic can use the extension.json file to dynamically create Mythic styled parameters.

BOF Argument Support

In this example, the BOF command forge_bof_sa-netgroup , takes three parameters: a number (0 or 1 based on the description) and two strings. Due to Sliver’s format, we can even identify which arguments are required and which ones are optional. Unfortunately, we miss additional context about default values that could be pre-populated, so that’s still up to the individual BOFs or for them to call out in their parameter descriptions.

When an operator submits this task, Forge looks up the associated extension.json file and converts these named parameters back into a normal Mythic TypedArray format that is then passed to a supporting agent’s command (like Apollo’s execute_coff ) for processing before a callback picks it up.

Normally, BOF execution requires an operator to upload the right object file, know the exact types and orderings of parameters for the bof (ex: zisZZZ), and provide the right values in that order. This would require execution like some_bof_command zisZZZ test 3 0 bob testing.com Mozilla. Naturally, this is error prone and not very operator friendly. With Forge, you could instead issue a task like forge_bof_myBof -location test -loops 3 -useAdmin 0 -user bob -domain testing.com -useragent Mozilla. Notice how, especially with all of the parameters being tab-completable, it’s much more operator friendly, especially if you don’t already know all of the parameters needed for the BOF.

Forging Forward

Forge is based on a series of JSON files on disk that describe things like what agents work with Forge, what collections are available, and what commands are available in each collection. You aren’t limited to SharpCollection and SliverArmory though. With the forge_create command, you can upload your own .NET assembly or BOF files (including extension.json) and have those turned into new commands on the fly. If you want to set this up ahead of time though, you can always edit the JSON files directly on disk or through the Mythic UI.

Forge comes with default support for the Apollo and Athena agents, but pull requests are always welcome to provide default support for other agents as well. Additionally, only Flangvik’s SharpCollection and Sliver’s Armory are pre-installed in the container. If the community has other sources of tooling they’d like to see pre-installed, PRs are also welcome.

Mythic has many different kinds of containers and features available, so hopefully Forge will inspire the community about other kinds of “Command Augmentation” containers they can make.

If you aren’t already aware, the BloodHound slack has open invites with a thriving community that discusses Mythic in the #mythic channel. I’m also available on Twitter, BlueSky, and Mastodon if you want to reach out.

Forging a Better Operator Quality of Life was originally published in Posts By SpecterOps Team Members on Medium, where people are continuing the conversation by highlighting and responding to this story.

The post Forging a Better Operator Quality of Life appeared first on Security Boulevard.

By Kelly Kaoudis and Evan Sultanik This blog post highlights key points from our new white paper Preventing Account Takeovers on Centralized Cryptocurrency Exchanges, which documents ATO-related attack vectors and defenses tailored to CEXes. Imagine trying to log in to your centralized cryptocurrency exchange (CEX) account and your password and username just… don’t work. You […]

The post Preventing account takeover on centralized cryptocurrency exchanges in 2025 appeared first on Security Boulevard.

Our zLabs research team has discovered a mobile malware campaign consisting of almost 900 malware samples primarily targeting users of Indian banks.

The post Mobile Indian Cyber Heist: FatBoyPanel And His Massive Data Breach appeared first on Zimperium.

The post Mobile Indian Cyber Heist: FatBoyPanel And His Massive Data Breach appeared first on Security Boulevard.

Rhode Island disclosed in December that a ransomware attack had resulted in a data breach of its RIBridges social services database, exposing personal data of about 650,000 residents that included Social Security numbers, dates of birth, and individual bank account numbers. The impact was enormous — more than half of the state’s population was affected. 

The post Sandboxes Alone Won’t Stop the Malware Onslaught. Here’s What Will. appeared first on Security Boulevard.

Explore our analysis into the eight vulnerabilities discovered in LogicalDOC DMS. Vulnerabilities include SQL injection, remote code execution, and XSS.

The post CyRC Advisory: Eight vulnerabilities discovered in LogicalDOC appeared first on Blog.

The post CyRC Advisory: Eight vulnerabilities discovered in LogicalDOC appeared first on Security Boulevard.

PAM aims to provide a privileged identity-centric approach to controlling access as part of the bigger identity ecosystem.

The post The Path of Least Resistance to Privileged Access Management appeared first on Security Boulevard.

As companies dive deeper into the digital age, beefing up cybersecurity is key — it's not just an IT thing; it's a must-have for everyone on board.

The post Cybersecurity in IT Infrastructure: Protecting Digital Assets appeared first on Security Boulevard.

Cybersecurity risk management company Tenable announced plans to acquire Vulcan Cyber for approximately $147 million in cash and $3 million in restricted stock units.

The post Tenable Acquires Vulcan Cyber, Building on AI-Powered Risk Prioritization appeared first on Security Boulevard.

The Age of AI Is Upon Us The current pace of technological change beggars’ belief. Generative Artificial Intelligence (GenAI), released to the world a mere two years ago, promises to eliminate much of the tedium of the digital world. Software engineers around the world are already using it to speed up their development times (making […]

The post How Imperva Infused AI Throughout Research and Development appeared first on Blog.

The post How Imperva Infused AI Throughout Research and Development appeared first on Security Boulevard.

The relationship between the two software security initiatives promoted by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) can be misunderstood. Sometimes Secure by Design and Secure by Default are even pitted against each other. The reality is, though, that they are complementary approaches to security.

The post Secure by Design and Secure by Default: Why you need both for AppSec appeared first on Security Boulevard.

Author/Presenter: Harriet Farlow

Our sincere appreciation to DEF CON, and the Authors/Presenters for publishing their erudite DEF CON 32 content. Originating from the conference’s events located at the Las Vegas Convention Center; and via the organizations YouTube channel.

Permalink

The post DEF CON 32 – Hacker Vs. AI Perspectives From An Ex-Spy appeared first on Security Boulevard.

Explore how the Cyberhaven attack exposes the dangers of 'consent phishing', a tactic that bypasses even robust security measures like MFA.

The post Cyberhaven: A Wake-Up Call for Consent Phishing Risks | Grip appeared first on Security Boulevard.

via the comic humor & dry wit of Randall Munroe, creator of XKCD

Permalink

The post Randall Munroe’s XKCD ‘Stromatolites’ appeared first on Security Boulevard.

A survey of 150 security decision makers in the U.S., published today, finds that close to two thirds of cybersecurity incidents (62%) involved issues that were previously known to be a potential threat. Conducted by ZEST Security, the survey finds half of respondents work for organizations where 56% of risks identified can’t for one reason..

The post Survey Sees Organizations Being Overwhelmed by Remediation Challenges appeared first on Security Boulevard.

Mitre Att&ck as Context

Introduction:

A common theme of science fiction authors, and these days policymakers and think tanks, is how will the humans work with the machines, as the machines begin to surpass us across many dimensions.

In cybersecurity humans and their systems are at a crossroads, their limitations daily exposed by ever more innovative, aggressive, well-funded, and AI-wielding attackers.

The humans are burned out. Dissatisfied by their cybersecurity careers and their day-to-day work.

And the machines are all too often either too literal — a set of if-then statements packaged into thickets of rules — or too brittle — seeing useful patterns from the noise, but only when carefully tuned, oiled, and interpreted by overstretched humans with rare expertise.

For years those of us building tools for defenders have been building point solutions for new attack vectors, and hoping that we could catch up with ever-widening and complex attack surfaces of enterprises, utilities, governments, service providers, and all of us humans.

We have built DeepTempo and our LogLMs to buttress the eroding foundations of cybersecurity. Our results thus far show accuracy and resilience superior to that of rules and traditional ML-based incident identification both in terms of accuracy and adaptability.

In this blog, I turn my attention to another dimension — explainability. We must bring along with us humans, and give the professionals protecting us all a way to interpret the results of these deep learning models. Otherwise, our human defenders will not trust the insights of the models.

As one of our first advisors, Chris Bates — who helped build SentinellOne as CISO and chief trust officer — reminds us:

“A smart black box could be useful — but it risks becoming a curiosity.”

We won’t buttress our defenses’ foundations with only curiosity.

Explainability: by design

If you get the data model wrong — a rewrite is in your future.

Technical debt is inevitable, but the wrong data layer and data model will quickly bankrupt even the most overfunded start-up.

So before we built our LogLMs — and in so doing created a new vocabulary and approach to tokenization — we thought a lot about several key attributes including explainability.

Explainability is built into the foundations of our Tempo LogLM. Much like the construct of a sentence can be useful in certain LLMs, we use human interpretable sequences within our model. When our Tempo LogLM suggests that a particular set of events is worrisome, it gives you a UID that maps back to a conversation between entities in your environment — it shows which sentence seems to have a grammatical error and this conversation is saved by the model. This enables a user experience our early users enjoy. It fits very well into their existing SIEMs, and allows them to use those SIEMs to add a lot of relevant context, including external and internal threat intelligence.

You can see the value of this UID tying back to the underlying data on our free-to-try Snowflake Tempo NativeApp. You can see our partner and user exploring this capability in the following demo video:

https://medium.com/media/20e20a4796f38786882dbe4ff9a8253f/href

We also realized that deep learning could help us to solve the explainability challenges of deep learning. We decided to use deep learning to translate the insights of the model back into the language of the security operations center. So far we have done this translation in two ways:

• Entity resolution and grouping
• Mitre Att&ck mapping

I’ll leave the internals of entity resolution and grouping for a later date; we have an engineering-focused blog on the way and are hopeful that these blogs will help others consider building and adapting their own purpose-built models. The short summary is foundation models like our Tempo learn the meaning of the nouns within each sentence of communications they examine. Just as an LLM can distinguish between a Queen ruling a country vs. the most powerful piece in Chess, so too can our LogLMs learn which sort of mail server might be in a given sequence, and inform its expectations about the behavior of that mail server based on its experience with hundreds of thousands of mail servers. Concretely, we tag our sequences with the types of entities included, helping our end users to understand what they are looking at — is it email servers, or just a particular few email servers, for example that are behaving strangely.

Mitre Att&ck mapping:

Today we are announcing that our Tempo LogLM now maps concerning anomalies to the most likely Mitre Att&ck sequence.

Using only network logs, which themselves are of course metadata, the model can see whether a particular type of reconnaissance is occurring, or perhaps lateral movement, or even exfiltration. Starting today our Tempo NativeApp on Snowflake now adds the closest Mitre Att&ck or Att&cks to all stored sequences and the underlying embeddings, which are massively smaller than the underlying logs.

This allows the security operations teams to run workflows and investigations informed in part based on their understanding of Mitre Att&ck. Many organizations have prepared plans to respond to particular attack methods. They now can invoke these plans quickly once the alert is fired from Tempo to their SIEM, cutting minutes or hours off of their meantime to respond.

We are in the course of providing an additional free way to try out Tempo — focused Mitre Att&ck mapping — and we will shortly be open-sourcing the raw materials we used to add these capabilities. Please watch this space — stay tuned.

Conclusion:

The future is here now. The need to help the humans to keep up with the machines has already arrived.

In cybersecurity we need to get much more intelligent — immediately — since we know our attackers are too often winning and are increasingly using LLMs to do so. Sometimes it seems like the dystopian future of Leave the World Behind is unfolding on our front pages.

The collective wisdom embedded in Mitre Att&ck — the many thousands of hours of effort that went into collecting and designing this taxonomy — offers a way for us to use deep learning to explain the insights of deep learning-based LogLMs.

Try it out today. As always — you can find Tempo on the Snowflake NativeApp marketplace where we even make available an example data set for initial evaluation.

https://app.snowflake.com/marketplace/listing/GZTYZOYXHP3/deeptempo-cybersecurity-tempo

We hope you’ll see that collective defense via deep learning is useful today as a cost-effective way to provide more defense in depth, making better sense out of streams of logs than traditional rules-based indicators or brittle ML models allow.

Anomalies are not Enough was originally published in DeepTempo on Medium, where people are continuing the conversation by highlighting and responding to this story.

The post Anomalies are not Enough appeared first on Security Boulevard.

In today’s thoroughly digital world, technology decisions are business decisions, with cybersecurity standing out as a crucial area where this dynamic unfolds. It’s no longer just a box for IT

Read More

The post Why Every Enterprise Needs a Cybersecurity System of Record appeared first on Axio.

The post Why Every Enterprise Needs a Cybersecurity System of Record appeared first on Security Boulevard.

In a world in which cyberattacks have become both more frequent and costly, organizations are under growing pressure to manage digital threats more effectively. Cyber Risk Quantification (CRQ), a means

Read More

The post Why Traditional CRQ Falls Short — and How Modern Solutions Fill the Gaps appeared first on Axio.

The post Why Traditional CRQ Falls Short — and How Modern Solutions Fill the Gaps appeared first on Security Boulevard.

This week, AttackIQ acquired DeepSurface to broaden its vulnerability and attack path management capabilities to help enterprises identify and mitigate the most pressing vulnerabilities in their environments. The acquisition enables AttackIQ to add automated vulnerability prioritization within complex IT environments. Founded in 2017 and headquartered in Portland, Oregon, DeepSurface’s RiskAnalyzer platform contextualizes, using roughly 50..

The post AttackIQ Bolsters Cyber Defenses with DeepSurface’s Risk-Analysis Tech appeared first on Security Boulevard.

The latest wave of artificial intelligence (AI) improvements significantly improved the quality of models for image and text generation. Several companies, such as OpenAI (ChatGPT) and Claude provide services, often in the form of software as a service (SaaS) that make it easy for users to interact with these AI

The post How bots and fraudsters exploit free tiers in AI SaaS appeared first on Security Boulevard.

How to strengthen your executive protection program to address and mitigate the impacts of stalking aimed at executives A customer becomes obsessed with an executive due to their relatable social media presence and desperately wants their attention. An anonymous admirer sends love letters and gifts to the CEO. A former employee holds a grudge and…

The post When Stalking Looks Like Affection, Admiration, or Anger — The Challenge for EP Teams appeared first on Ontic.

The post When Stalking Looks Like Affection, Admiration, or Anger — The Challenge for EP Teams appeared first on Security Boulevard.