Welcome to the Azure Security Podcast,
where we discuss topics relating to security, privacy,
reliability, and compliance on the Microsoft Cloud Platform.
Hey everybody, welcome to Episode 37.
This week, we have a full house.
We have myself, Michael, and we have Gladys, Sarah, and Mark.
We also have a guest, Roberto Rodriguez,
who's here to talk to us about
attacker tradecraft and a tool that we have named Simuland.
But before we get to Roberto, let's talk about the news.
I'd like to kick things off.
I really like to kick the news off the last couple of weeks,
but I really want to get this front and center.
So the first one I want to get out of the way is,
there is now a public preview for
PrivateLink user-defined route support.
There's also public preview for
PrivateLink network security group support.
Now, I know that I think a lot of people who have been working
with PrivateLink, some private endpoints,
have really been looking forward to this.
So it's now in public preview.
Talking of PrivateLink,
the Azure PrivateLink service is now generally
available in our Chinese region,
probably not a lot more to say other than
it's available in China now.
Next one is Azure Virtual Desktop.
We now have screen capture protection.
This mitigates things like taking a screen grab,
using print screen or snipping tools,
and third-party applications that can be used,
essentially leak sensitive information from a screen grab.
This secures a single session host,
or you can use Active Directory to
manage different host pools centrally.
So this is another nice thing to see and also,
there's no extra cost to actually use it.
Finally, for me, Azure Files now supports SMB 3.1.1.
The big change here is the inclusion of
AES-128 and AES-256 in Galois Counter Mode.
So for those that require more modern ciphers,
there you are, SMB 3.1.1.
This is Gladys. For some time now,
the Azure AD team has been working on
moving the Azure AD graph features into Microsoft Graph.
A lot of documentation has been released about this move,
and now on June 30th, 2022,
Microsoft is retiring the Azure AD Graph.
This means that to avoid service disruption before that day,
organizations will need to update all applications that
use the Azure AD Graph to use Microsoft Graph instead.
Some of the new features that will be included with
the Microsoft Graph are a single endpoint for APIs from
Azure AD and other services such as Microsoft Team,
Exchange, and Intune.
Built-in support for retry handling,
secure redirect, transparent authentication,
and payload compression.
To help migrating applications,
Microsoft has also provided a checklist which
contains key differences between the APIs,
ways to examine the APIs being used within
your application and the permissions required.
It also provides guidance for using
the Graph Explorer to experiment,
and guidance to deploy tests and extend your application.
The next news that I wanted to share is that in
on August 31st, 2021,
all 1x version of Azure Active Directory Connect will be
retired because they include SQL Server 2012 components
that will no longer be supported.
It is recommended to upgrade to the most recent version of
Azure AD Connect by that date.
Within the information provided, Microsoft shares
how to do in-place migration,
swing migration which may be necessary if you need to
upgrade the server OS.
It provides guidance on how to move a custom configuration
from the Active Server to a staging service
and some other information.
Last but not least,
Windows 11 will become generally available on October 5th.
Windows 11 is in public preview as part of Azure Virtual Desktop.
Go and play with Windows 11 and validate
your environment using Azure Virtual Desktop.
From my side, the long-awaited videos
covering the latest cybersecurity reference architecture,
affectionately known as the MCRA for a number of folks,
are released and so they're up there on YouTube and ready to be watched.
Actually, there's about 1,200 last time I checked.
People that have already watched it so far.
There's also a company-ing set of videos that are focused a little bit more on
security program rather than security architecture
for the Cloud Adoption Framework Secure methodology.
I did those with our executive security advisors here at Microsoft.
Really enjoyed the conversations.
They're anywhere from 10 to 20 minutes typically.
Most of them are around 15 to 20 minutes,
but really got deep into these topics and
just walk through each of the architectures and
the elements, what they mean, etc.
So definitely check them out, share and
enjoy and links are in the show-outs.
So hi everybody. It's good to be back.
Apologies I've been away for a couple of weeks just because of
some tricky time zone scheduling stuff that we couldn't resolve, unfortunately.
So for my news this week,
first of all, it's now generally available that you can run
cross-service queries between Azure Monitor and Azure Data Explorer.
Now, this is something very cool.
What it means is if you're using Azure Monitor Services,
which includes log analytics and then by proxy Azure Sentinel.
If you're using application insights and other Azure Monitor services,
you can now also cross-query over to Azure Data Explorer.
So if you've got things that you need to correlate between those two services,
you can actually do a cross-service query.
You can also query from ADX back to Azure Monitor.
In the log analytics side of things,
you do this with a KQL operator,
but it's not just queries,
you can also use things like workbooks,
PowerShell and REST APIs.
So very cool. That's as close to Sentinel as I get this week,
so which is surprising for me, I know.
So yeah, go and check it out.
Next up is a load of Azure Security Center things and Azure Defender.
So couple of things going into public preview.
Defender for endpoint for Linux is now supported by Azure Defender for servers.
We've got some new recommendations around managing endpoint protection solutions,
and Security Center is now able to auto provision
the Azure Policy Guest Configuration extension.
So that's just really good for being efficient and being
consistent and reducing some manual work.
In terms of GA things for Azure Security Center,
we've now got more built-in troubleshooting and guidance for solving common issues
that ASC highlights.
We also have the regulatory compliance dashboards Azure Audit Reports,
they're now GA.
We've also got rid of the deprecated recommendation,
the log analytics agent health issue should be resolved on your machines.
I've seen that many times before myself.
It is a bit of a pain because sometimes it's not obvious why it's there.
And for that reason, it's actually been deprecated because it was,
for at least some people, a little bit difficult to troubleshoot.
Recommendations in Azure Defender,
you can now support in force.
So if there's a recommendation and you choose as an organization to enforce that,
Azure Defender can help enforce that rather than just alert you that something's happening.
There's a couple of other things.
We'll put the links in the show notes, but I could be here a while.
So I'll move on to my next one,
which is there's general availability for the update and policy compliance
for AKS or the Azure Kubernetes Service policies.
So if you've got policies, if you've got policy assignments that actually have conflicts,
you will now get a notification and you will have to resolve that before the policies become active.
If you manage to have a conflict with any of your prior policies,
then unfortunately they will still work, but you'll have a notification.
But it is quite easy to have these conflicts.
So hopefully this is going to help people resolve those a lot and keep their AKS clusters nice and slick.
And then last but not least for me, it's Windows Server IoT 2022 is now generally available.
So if you are using one of the earlier versions, it's definitely time to maybe start checking it out.
As you know, we do give customers a lot of time,
but of course when we bring out new versions, we're generally deprecating something else as well.
And it's always good to be on the most recent OS that you possibly can be
because of course that's how we keep things in support and patched and up to date.
And that's the news for me.
Well, thanks for getting the news out the way.
Now let's turn our attention to our guest, Roberto Rodriguez, who's here to talk to us about Simuland.
Roberto, welcome to the podcast.
Would you like to spend a moment just to explain what you do at Microsoft?
Yeah, thank you very much for the opportunity guys.
So yeah, once again, my name is Roberto.
I'm part of the Microsoft Threat Intelligence Center known as Mystic, specifically in the R&D division.
So my role, I guess, is, well, there's a lot of things that I do, but in general, I would say
is to empower other security researchers, either if it's in my own team or other teams at Mystic
or any other team outside of Mystic, and then just collaborate.
And then I start building open source tools and start sharing all that knowledge with the community.
So that summarizes what I do at Microsoft.
And because of that, there is a lot of projects that I work on and a lot of collaboration efforts
also across different teams on Microsoft as well.
So one of the tools that you work on is this tool called Simuland.
Johnny, there was an explanation of what that is, why it was invented, what does it do,
and then let's sort of drill down into some of the nuances about the product.
Yeah, yeah, definitely.
So Simuland is an open source initiative by Microsoft.
It's to help security researchers around the world to deploy, let's say, lab environments
or research environments where they can start testing, for example, different techniques
performed by threat actors out there, like known threat actors, for example,
because we share some of those steps as well into how to go through a simulation plan.
And then also to validate detections, to trigger a few alerts,
just make sure that what we are providing also through our products
and what people are building and sharing in the community, it's being validated, right?
Because you want to know if something happens in your environment, make sure that you're covered.
And maybe that also could help you to start creating your own rules, for example,
start kind of sharing, for example, what telemetry can be enabled.
We try to also pack all these simulation labs with, for example, security controls for example,
Microsoft 365 Defender. We also deploy an Azure Sentinel, make sure that we send all the alerts
from M365 to Azure Sentinel. And then we also try to, for example, enable other data sources
that, for example, such as, you know, system for Windows, for example, I'm thinking about
system for Linux already, but that's coming next. But all these telemetry that we can collect
from a computer can go through Sentinel and then anything that we get from M365 Defender,
also, you know, can be flown through, you know, through Azure Sentinel. So we try to just provide
all these different technologies into one place and then allow customers or anyone in the community
just to experience that in their own environments. That's kind of like the main idea. And of course,
we want to make sure that all this is open source so that people can, you know, replicate the whole
thing. And also, we try to make sure that anything that we share is well documented. At the same time,
we want to expedite a lot of this process. So we share a lot of, for example, Azure
Resource Manager templates so that we can deploy everything like in a few minutes. So we try to
make it easy for someone to go through the whole, you know, project. I'm going to be honest. I mean,
I kind of know of Simuland. I'm not going to pretend to be an expert by any stretch. So what's
kind of the elevator pitch here? Like, why would anybody even be remotely interested in this tool?
I mean, what's its job at the end of the day? Yeah, yeah, yeah, definitely. So for example,
there is a lot of lap, well, first, there is a lot of lap environments that get shared in the
community, right? So there's a lot of different templates that people share to build something.
But the first thing that I would say with Simuland is that a lot of the environments that I've seen
do not cover much of the, for example, hybrid approach that a lot of customers and a lot of
people in the community also are moving towards. So, you know, having their own prem Active Directory
and then syncing, for example, accounts to Azure AD or having that federated access, for example,
and try to simulate some of the stuff that we see also like in real life, right? So that's the first
thing that I would say that Simuland provides a way to simulate some of that, a federated environment
first. And that's something that I haven't seen out there yet. So I think that people that want to
experience that, this is the first, I would say, project open source that has that type of environment.
Number two, I would say that there is a lot of security controls that, of course, all these
research environments are missing. So in my opinion, when we start also sharing how to deploy,
for example, once again, Microsoft 365 security controls such as Microsoft Defender for Endpoint,
Identity, you know, Cloud Application Security, you know, etc. Right? There is a lot of stuff
that we can test. So a lot of the even instructions of Simuland allows you to, for example, like,
you know, get a trial license for, you know, 30 days, and then you can extend it for maybe 60 days,
and then you can go through that whole experience so that you can also get an idea
into what it is that you might be missing, what it is that you might probably complement with what
you have right now. And at the same time, having something like Azure Sentinel in the middle,
then allows you to see how you can just start connecting a lot of the things that you might get
with, you know, from these products, but at the same time, how can you connect what you currently
have? Right? So let's say you are a company or someone in the community doing research
that is very comfortable with, let's say, once again, Sysmon for Windows, right? And then you
can start seeing that telemetry being correlated with additional telemetry from other controls.
So you can see the value and you can start identifying maybe what it is that you might need
right now in your environment. Or if you want to do research and identify additional telemetry
that could tell you more about the adversary tradecraft, then this is a place where you can
start doing those type of experiments. So if you want to learn about adversary tradecraft,
identify some new telemetry, or complement what you have, and experience a hybrid environment,
I think that Simulant is definitely the place to actually start working with and go with.
So I want to make sure I understand this. So if I were an organization, let's say I'm a healthcare
organization, and I want to make sure that I understand the craft of being an attacker,
as it were, tradecraft of being an attacker, am I also going to get data out of that that's going
to show me what common kinds of attacks look like to make sure that my systems are going to respond?
Is that a fair way of looking at like, it's all very well saying, hey, you know, we bought all
this stuff, we have Sentinel, and we have Defender for this and Defender for that and whatever,
you know, in my events I'm malware and we have intrusion detection, we have intrusion protection.
At some point you've got to exercise it, right? You got to make sure that this stuff actually
works. Can I use this tool for that? Yes, yes, yes. So Simulant is, I would say, a whole framework.
So it's definitely modular enough for someone to pick what it is that you want to do with it.
For example, Simulant is broken down into a few parts. So the first one is the preparation part.
Second one is deployment. So preparation and deployment technically is to help you to have
the whole environment set up so you can do testing, etc. But then the other part is the
simulation detection. And also we have like a few recommendations like mitigations for a few things.
So technically, if you already have your environment where you have, for example, a similar setup,
let's say a lot of people would have a hybrid environment already. And of course, if you're
working with Azure, then you're going to start testing anything that we share through the simulation
and detection section of the project. So you can take everything that you did in your lab
environment, you're going to start taking it all the way to your production environment. Of course,
by having the right processes to do some simulations in your environment. And then with
all the detections and maybe alerts that we map every single simulation to, then you're going to
start validating that also in your environment. Now to your question also into, how can we take
this into practice as well? That's also one of the goals of Simulant, that every time, for example,
we talk about a new threat actor or a new technique that came out. We share detections,
we as Microsoft, we share detections, we start maybe building a few alerts on the
top of some of the security products that we have. But you as a security analyst or as a threat
researcher, you might not understand the whole context around that detection or alert. And a
lot of the research actually comes from that, where you say, okay, someone, for example,
acts as my active directory federation server. And there is four detections through Azure Sentinel
that I can take a look at. Great. But is there anything else that I can do with it? Is there
any maybe additional telemetry that I can complement that with and maybe create a new detection or
maybe try to enhance by built-in detections? So Simulant allows you to then create that
additional context if, of course, it exists in your environment. Because you might once again be
collecting more telemetry, maybe that behavior in your environment needs some tweaking. So that
additional experience is definitely what Simulant is built for. So you can get that additional
exercise that your security analyst, ENSEA responders, threat hunters, definitely need.
From a forensic perspective, for example, there's a lot of forensic artifacts that are going to be
generated. But if I just share a detection query or just an alert with you, you will not be able
to experience the forensic side of things. So that's also one of the ideas of why it's good to
have something like Simulant walk you through a whole end-to-end scenario.
So what kind of services are being used in this lab environment?
Yeah, good question. So we have first, I would say, every single micro 365 defender product,
I would say. So we're talking about endpoint, talking about cloud app security. So we have
MCAS MDE, MDI. And then we have also the Azure Sentinel solution as well. That will, I would say,
open the doors to other services where we can collect data from. So we have, for example,
data from Azure AD, like audit logs, the new signing logs also from ADFS. So you have all these
things going through Azure Sentinel. Other stuff that we deploy and configure would be related
more towards, for example, Azure AD Connect. So trying to have those hybrid AD services,
so communications between the on-prem domain controllers with Azure AD. Other than that,
I would say that we also have, what else do we have in there? The Azure Monitor agents, for example,
getting data from our Windows endpoints. And I would say that that's pretty much it from when
it comes down to Azure services. So every security product that it's out there that we share, when
there is a detection to share, it's there installed. So all of that, I think that that would be pretty
much it. Yeah. So how is this deployed? Is the tenant provided, the licenses provided? Yeah,
good question. So we do not provide the tenant or the licenses. So what we provide is an automatic
way to deploy it, you know, whatever you want to. So it could be in your own right tenants,
like, for example, free subscription where you can acquire a free license as well or not free,
but try a license for some of the products. So for example, the project is modular enough
so that you could say, I want to deploy only the environment without any other security products.
The Azure Resource Manager templates that we share allow you to do that. You can actually modify it
so that you do not deploy any other security controls. And that's up to you, right? It's open
source where you can do anything you want with it. And in that case, you can have it in a,
you know, free tenant. You know, Azure Sentinel also has a free tier so you can collect some data
from a lab environment and play with that. But then if you want to, of course, use, for example,
things such as Microsoft, right, 365 defender products, then you need to have a license. So
once again, this could be a trial, EFI license. And the reason why we need the EFI is to enable
every single capability from a security perspective. And then, and then from there, I guess that
that will be the only license that someone would need to buy if you want to continue, right,
doing this whole testing. A lot of the people that we have talked to already have their environments,
you know, they already have their licenses so they can just deploy it in their own tenants.
And of course, people in the community that we have talked to, a lot of them like the trial
licenses, right, like 60 days, you can extend it and then you can test it out. And then from there,
so I guess that it's up to you what you do next, right? But it's like the whole experience to go
through the process, I think it's very valuable. So you're saying that in order to get,
it's said that the customer want to try out licenses. Do you have a link or
somewhere where they can go through the process of requesting those licenses?
Yes, yes, great question. So part of the preparation section of Simulant goes through
that process and shows you how to actually request a trial license. And it goes through every single
step. So that was also one of the goals with the whole documentation in there was to make sure that
I also go through the process as if I didn't work from Microsoft and then share every single step
that I did, you know, to get to the scenario. So yes, everything is in the preparation part
of the project, which is a folder in the GitHub repo. So Roberto, I love Sentinel, it's my baby.
And so I've got to ask a question in relation to it. Obviously, Simulant is about simulating attacks
Azure Sentinel monitors for attacks. So I know I've definitely had customers ask me,
what can I do with Simulant? How can I use this? Is it something I can do to test my Sentinel
deployment? And I was just wondering if you could tell us a bit more about your thoughts on what we
could do there. Yeah, yeah. So I would say that so there's a couple of things that we can do with
Simulant and Sentinel, right? So the first one to me would be that the correlation with, for example,
like if you only have Sentinel right now, and you want to see how you can start correlating even
alerts with things that come from Microsoft Defender for endpoint, for example, right, MDE.
And you can understand what type of context you get out of that correlation. That would be one
use case, right, trying to understand how what you currently have can complement with other security
controls. Like, that's just like the first one. That of course takes you to, for example, there is
a couple of visualizations to understand a whole chain of events into what it would look like,
how it maps to incidents. You can create even like your own incident teams channel as well. So
you can pretty much go through a whole kind of like incident response process if you want to.
And so that would first be good for training, understanding that you have the right, you know,
processes to go through that exercise. I think that that's huge because a lot of people once again,
just receive the detections, receive the alerts, built in detections, get shared across all the
share across all the customers, but they do not experience the what will happen if something like
that would trigger, right? So that's kind of like the, in my opinion, the idea of that. Now,
for example, companies can, yes, use, for example, other frameworks such as, for example, like Metasplore
or like PowerShell Empire or any other open source, maybe framework, right? But in in Simulant,
that will be only, for example, so when we talk about Simulant once again, it's a framework,
right? So we have the environment all the way to a simulation lab. So a lot of stuff that we want
to do also is to focus on the adversary tradecraft. So either if you want to, for example, execute
the scripts that we provide with Simulant, we try to get all the way to the specifics into
what actually each action is going to be. So for example, if I have something from PowerShell
Empire or Metasplore that says this module is going to export the ADFS configuration, right?
The Active Directory Federation Service Server, they will just give you the module, you click on it,
and then by magic, you get the configuration back, right? So that's how it would work if you use some
of those open source projects that automate some of these simulations. With Simulant, we want to be
very specific. Like we want to make sure that you understand what each step is doing. So if we say
export the ADFS configuration of a server, that takes a lot of steps. We're talking about
connecting to the ADFS server, exporting the ADFS settings, getting the settings of the
server, exporting the certificate in the encrypted format, try to get the key from the Active Directory,
which is going to then allow you to derive another key and then to encrypt the certificate that was
encrypted in the first place, and then be able to do something with that. Like for example, in this case,
try to use a certificate to start signing tokens, right? And what I meant with exporting
the ADFS configuration actually meant exporting the key to sign tokens. So still if you do it with
an open source project, you're going to get to that goal, and it might take only a few seconds.
We want to show you exactly what each step would do. And then as we explain each step,
we start mapping detections, alerts, et cetera. So it's kind of like walking a researcher
through the process by each step and not just try to automate everything and tell you, hey,
click this button, run this module, and then move to the next topic. No, no, no, we want to know
exactly what would happen. So in Simulant, for example, if you go to one of the first steps
of the simulation plan, you can see that if you click on the first one, it's going to start opening
up to, oh, we have five steps. The next step or sub step is going to have two or three variations.
So we try to also share those variations with the community so they understand also why certain
detections might work in certain cases, why some alerts will trigger in one way or the other.
So I believe that that definitely is valuable if you're working with something like Azure Sentinel,
because you might end up also, for example, identifying once again that there is some
additional telemetry that you might be collecting that might also shine some light in a specific
technique. So I think that that's also one of the values of why you want to run through this
and then have Azure Sentinel where you can collect more telemetry than if you're only using,
for example, let's say, M365 Advanced Hunting Queries, which gives you a lot of stuff. But of
course, we know the Azure Sentinel was built to collect additional telemetry that clients might
be collecting already. So let me see if I understand this correctly. We have scripts to deploy the
lab kind of like infrastructure as a code. And then we have scripts that are in phases to basically
do certain tasks that normally attackers would do, right? And help the customer or the user
to learn how the attacker does these things and how the tool behaves. Is that correct?
That's correct. Yes, we want to get to the behavior, like the adversary tradecraft. And so in order
to do that, we want to, you know, breaking it down into different sections, and we can start
addressing each section with some code. At the end of the day, once again, other solutions would
pack all this in a module and just tell you, run it. Now granted, there will be some cases where
maybe a module will make sense, but we're trying to be very specific so that people understand exactly
what's going on in each step of the simulation plan. So can I create my own custom environment,
or does it come sort of air quotes, shrink wraps? I would say that you can create your own labs as
long as you understand, for example, the Azure Resource Manager templates that come with the
products. So for example, one thing that I didn't mention is that Simulant is built on the top of
two open source projects that are also managed by me in the community. So I also run the open
thread research community in the infoset community. And so one of the projects is called Blacksmith,
and the other one is called Azure Sentinel to Go. So Blacksmith is a project where I decided to
start sharing all the templates that I use to deploy a Windows box, to deploy a Linux box,
you know, deploy a lot of different resources that I use for research. And then the other one,
Azure Sentinel to Go is to grab those templates from Blacksmith and then deploy an Azure Sentinel
solution on the top. So the reason why I mentioned this is because if you go to Simulant, what you
get is a template that is going to leverage all the research that has been already shared with a
community that has all the different building blocks into, for example, this environment requires
two computers with a domain controller and an ADFS server. All right, let's go to Blacksmith and
let's take a look at what it is that we can use and we can just point to that instead of rewriting
the whole code, we just point to those resources and then we deploy it. And then we go to Azure
Sentinel and say, hey, this actually works well with these resources. Let's just point to those
templates as well. So if you go to Simulant, you're going to get to those resources. So,
which means that you could say, you know what, I'm going to maybe deploy also an exchange server
in this template. So all you have to do is point to the exchange server in Blacksmith,
and then that would allow you to also deploy it through Simulant. So it's very modular and that's
what we wanted to make it open source. So people can just go and say, I understand how to build
this myself. So let me reuse some of this code in here and then use it. So it's very flexible if
you really understand like how the ARM templates work and all this stuff, which is pretty straightforward.
Yeah. So these scripts basically integrate all the tools together, right? That's correct.
That's correct. We have a script for the tools, the security controls from M365 and also from
Azure Sentinel. For example, something that we do also with Azure Sentinel is we enable a few
detections. So we have the templates already, right? But we have to enable them. So instead of
telling someone to go and click and enable some of the templates in Azure Sentinel, we just use
the API and then we just enable the alerts for whoever is using Azure Sentinel. I'm glad about
this because one of the value of our tools is that integration with other products, not just
Microsoft but third party. So this is a great way that customers can see how all the information
is correlated within one service and across. That experience of having everything together
plus the potential forensic artifacts that will be generated and it's so valuable for a researcher
in general, security analyst, threat hunter. At the end, we're all researchers, right? Because
we're trying to learn a little bit about what the adversary is doing out there. So I believe that
even if you don't want to deploy the whole thing and you want to test some of the steps of the
simulation plans in your environment, I think that that itself is also eye-opening because
the first scenario that we share is, for example, the golden sample techniques, right? So it kind of
makes you wonder a little bit what it is that you also can do in your own organization to maybe
start, for example, testing some of those mitigations. And that's also one of the big advantages of
having something like Simulant because you can see each step. Yes, you experience a whole scenario.
You maybe see some new telemetry that you did not even think of, something that you can complement
with what you have already. But at the same time, you will say, wait a minute, that's something that
we haven't even done yet in our environment. So our ADFS might be exposed already. We don't know.
So you can start doing some of that testing first with the LAP environment, but also you can
directly just start testing it with your own environment. Of course, once again, following
the right best practices to simulate something in your environment, right? Which changes across
organizations. So, Roberto, could you tell us a little bit about what's coming up for Simulant
and what you've released since its big release a little while back? I know also now Cloud Katana
is a thing as well. Let's say Simulant was released in May. And since then, so we've been first trying
to get a lot of feedback from customers, from people in the community. I have added a few
variations to some of the simulations that I initially shared through the project.
So one of the efforts that we also have going on in the community is a collaboration with some
researchers that are very interested, for example, in identity management and Azure AD
like in general. So we have been testing a few things, discovering some new ways that
something could be done or executed in an environment. So we have added some of those.
So we have created also new detections. I contributed a few already to the Azure Sentinel
GitHub repository. So that's also one of the goals is that if you as either customer or in
general community member try Simulant and you identify some new detections, that would be
amazing to also get that contribution back to Azure Sentinel GitHub repository, right?
So we've done that a lot for, so we're trying to maintain the current scenario, the golden
SAML attack, try to add more variations and then contribute more detections. Now that's from a
concept of Simulant as how it was built initially. The other thing that we have been working on is
Cloud Katana. Cloud Katana is a cloud native serverless application that is built on the
top of Azure Functions that allows the orchestration and execution of simulations. So this could be
as a single action, right? You can request via a serverless API, you can request the action,
and then the Azure Function application will execute the action in your environment.
In this case, it will be in Simulant. So what we're trying to do is now take the basic concept of
execution of an action to a sequence of actions, which we're calling workflows,
and then taking those workflows and start translating what we show through Simulant,
like every single step, but now do it in an automatic way. So using an Azure Function,
send an API request, and then execute the whole scenario. So this is because we also got some
feedback of companies that were very excited to go through the whole scenario, but then after that,
they wanted to see how they could actually now, after understanding the tradecraft,
all the detections, can we have this running on a regular basis? So I think that that's why,
and I started thinking about it this year, and then Cloud Catana came out. So that's something
that was released on August the 4th, and then I have updated already this past couple of weeks,
so I'm currently working on that project. And so far, I think that it's almost there to simulate
the whole thing. And one of the things also that is very interesting about Cloud Catana is that
some of the scenarios that we're trying to build are going to be hybrid scenarios. So that's something
that is coming for Simulan as well. So we want to keep building things on-prem and cloud, but at
the same time, we're trying to do cross-cloud providers type of scenarios, so with other
cloud providers. So maybe a company uses Azure and then uses also other cloud providers as well.
So why not set up a scenario that would allow somebody to go through those steps that maybe
a cloud provider gets compromised and how they move from there to Azure? Or who knows? Vice versa,
right? Depends who is holding the identity provider. So I think that that's kind of like what we're
trying to do as well is to expand those scenarios and not just try to share something also only
Azure, but expand it. And the same thing applies to Cloud Catana. The Cloud Catana is, in my opinion,
the technology behind is flexible enough to be able to take care of those scenarios as well.
That's like the whole idea in the roadmap for Simulan and Cloud Catana.
So, Reverser, if you had one final thought, you would like to leave our listeners, what would it be?
I would say that in my opinion, it would be be curious, stay curious with what you can do with
your environment, because there is a lot of stuff that you will see in Simulan that it would make
you think that the moment you execute one step, second and step, and third step, there is a lot
of context that you can build some new detections from. So keep that in mind. Once again, we don't
just want to share detection, share an alert, and just feel like that's it. Your job is done.
Depends on your environment, you can start helping your organization, but also helping us,
if you would like to contribute, how you can also improve everything that we share. The feedback
to all the detections that we share or the alerts that we create are definitely very valuable and
can help you and also can help others in the community as well. So, stay curious and please
give us some feedback if you have it and stay tuned. There is just a lot of stuff coming out and I hope
that Simulan can help you also to focus a lot on adversary behavior, adversary tradecraft,
and that's what it was built for. This is really cool. Thanks so much for turning up this week,
Roberto. I really appreciate it. I know you're a busy guy and I appreciate you taking the time to
come talk to us. Although I learned a lot about Simulan, I mean, my exposure to Simulan has been
relatively remote, but I'm certainly going to start kicking the tires on it. I certainly know a
couple of customers that come to mind, especially in healthcare, who would be really interested in
understanding, mainly to make sure that their tools kind of work with these simulated attacks.
I think that's very cool. So once again, thank you so much for turning up. Thank you to all of you
out there for taking the time to listen to this podcast. We really appreciate it. Stay safe and
we'll see you next time. Thanks for listening to the Azure Security Podcast. You can find show notes
and other resources at our website azsecuritypodcast.net. If you have any questions,
please find us on Twitter at azuresecpod. Background music is from ccmixter.com and licensed
under the Creative Commons license.