A researcher trained neural networks to detect lateral movement cyberattacks using only synthetic data from simulated corporate networks, then validated the approach against 1.65 billion real authentication logs from Los Alamos National Laboratory. The synthetic-trained models ranked suspicious login windows effectively, identifying real attacks in the top results with far fewer false alarms than traditional threshold methods.
BEAR-C2 is an adversary simulation framework designed for red team operations and defensive security research, based on real-world tactics from Russian, Chinese, North Korean, and Iranian APT groups. It provides customizable C2 listeners with configurable encryption, exfiltration profiles, and connection protocols to accurately replicate modern intrusion scenarios. The framework is explicitly for educational and authorized security testing purposes only.
A blog post explores a Linux PAM (Pluggable Authentication Modules) security feature that can enable lateral movement during red team engagements. The author explains how PAM centralizes authentication across Linux systems and focuses on the account stage, highlighting the pam_access module as relevant to the vulnerability.