ASATA
Advanced Skills & Adversary Tactics Articulation
ASATA is an advanced research interface and is meant to augment Red/Blue Team capabilities. Users can interact with ASATA in MITRE lexicon and access trending offensive tactics, derived from ASATA’s unique, cyber counterintelligence. ASATA analyzes human momentum within the cybersecurity ecosystem and aggregates offensive tradecraft resources (source code / blogs) which match a user requested behavior type.
Offensive tradecraft pertaining to Windows, ASATA can dismantle and scrutinize how Windows functions and parameters are used maliciously, then visualize that to the operator. Operators can quickly see how Windows functions are grouped by MITRE defined behavior types, get function and parameter definitions, and see a visual map of the offensive codebase. ASATA analyzes and makes available to the operator, over 500,000 Windows functions used in modern-day, offensive tradecraft.
ASATA’s core value:
1. ASATA has advanced intelligence gathering capabilities
2. ASATA correlates tradecraft: by behavior similarity, code similarity or developer social relationships
3. ASATA visually lays out offensive Windows tradecraft
Bottom line…ASATA is automation meant to enhance the Red/Blue Team’s ability to build and understand offensive tradecraft used by advanced adversaries.
Offensive tradecraft pertaining to Windows, ASATA can dismantle and scrutinize how Windows functions and parameters are used maliciously, then visualize that to the operator. Operators can quickly see how Windows functions are grouped by MITRE defined behavior types, get function and parameter definitions, and see a visual map of the offensive codebase. ASATA analyzes and makes available to the operator, over 500,000 Windows functions used in modern-day, offensive tradecraft.
ASATA’s core value:
1. ASATA has advanced intelligence gathering capabilities
2. ASATA correlates tradecraft: by behavior similarity, code similarity or developer social relationships
3. ASATA visually lays out offensive Windows tradecraft
Bottom line…ASATA is automation meant to enhance the Red/Blue Team’s ability to build and understand offensive tradecraft used by advanced adversaries.
ASATA in Action
In the coming weeks, we will be launching a video series where we use our ASATA research interface to build some awesome offensive security tools, mostly in C# and CPP. As many of you know, I am an intelligence tool developer by trade and don’t have formal skill as a red team operator. I will be leveraging ASATA’s half-a-million, analyzed, offensive functions to help me build these tools for which I have no previous experience in building. Whether you are a red teamer that wants to see how to build some interesting stuff or are a defender that wants a deeper understanding of how this stuff works…this series will be for you. We will focus on Windows tradecraft, building a process ghoster in C#, a phantom dll injector and some other interesting OSTs.
In the coming weeks, we will be launching a video series where we use our ASATA research interface to build some awesome offensive security tools, mostly in C# and CPP. As many of you know, I am an intelligence tool developer by trade and don’t have formal skill as a red team operator. I will be leveraging ASATA’s half-a-million, analyzed, offensive functions to help me build these tools for which I have no previous experience in building. Whether you are a red teamer that wants to see how to build some interesting stuff or are a defender that wants a deeper understanding of how this stuff works…this series will be for you. We will focus on Windows tradecraft, building a process ghoster in C#, a phantom dll injector and some other interesting OSTs.