Hi everybody, welcome to my DEF CON 29 Adversary Village talk. It's called Exploiting Blue Team Upsack Figures with Red Elk. My name is Marksmates and I hope you liked the presentation. I will be available in the Discord room or you can ask me questions any time later after talk. You can hit me up via Twitter or some other way that you can find me. So let's dive into the talk. Exploiting Blue Team Upsack Figures with Red Elk, a lot to dive into. A little bit about me for who doesn't know who I am. My name is Marksmates. Hobby wise I'm from InfoSeclares over 1998, professionally since 2006 and I have a very big background in system and network engineering and from 2006 I started doing pentesting. In 2016 I co-founded a company called Outflank which you might know or might not know. My core roles in there are red team operations as well as building some tools and doing some of the trainings that we have created within Outflank. Mainly on the offensive side, mainly on the red side I also have a little bit of experience on the blue team side at some of our clients where I had some threatening experience which is actually pretty fun to do. So that's me, the company Outflank. We are a boutique firm and we specialize in red teaming as well as trainings mainly aimed for blue although nowadays we also have a red aimed training and we have tooling. Since the beginning, since 2016 we have created lots of tools, given lots of presentations and the majority of our tools are available on our GitHub although during the time we have come aware of the fact that some tools are simply too powerful to be shared publicly online and that's why we have created just a few months ago our Outflank security tooling service which is basically a private tool set of all the tools that we use during our own engagements that are too powerful to be used during operations. Hats up, those tools also integrate into what is Red Elk and that's where this is the topic of today. So we're busting blue team, object failures with Red Elk. Red Elk is the tooling and I want to dive through well the whole concept of Red Elk, what it is, why we have created it and how you can use it and then of course there is the whole blue team side and the blue team makes mistakes as well, object mistakes the same as Red Team does. So those are the main two topics for today but before we dive into that broader sense we need to discuss how we, with me, we I mean Outflank as well as myself, how we see Red teaming. If there is one thing that I would like you to take away from this talk is that we believe that Red exists solely to improve blue. Yes, we do similarly to the techs but it's not a wrecking ball approach, it's not that we come by, smash everything apart, knock down the blue team, walk away, loot the gold and start laughing, no, no, far from. We see it as a sparring match, we see it as a training for blue which means that it's fundamentally a different goal. We try to train the weaknesses of the blue team and try to improve them for actually when the real deal happens with the real attackers. Yes, our simulations, our Red Team engagements contain real punches, real movements, it actually may hurt both sides but it's always better to have a practice hit on your face than a real hit on your face. So we exist to train blue, no wrecking ball. When we are talking about our boxing ring, if you like, just a quick overview of how our modern offensive infrastructure would look like, most likely yours looks about the same conceptually wise although there are many different technical bits and pieces. Going from right to left we first have our own attacking infrastructure while we have our command and control servers, multiple most likely. We have our delivery services, web servers where we do tracking, we have all kinds of decoy things, we might have social media profiles, all on the true infrastructure that is on your own, a span of control. On the complete left side there is the victim network or the target network where you eventually have your implant running that calls back via HTTP or DNS or some other spooky protocol that you have as well as internally within that victim network. You've got your things running, your implants connected, things like that. In the middle there is what we roughly call Rida characters or deflecting ways. It's in the modern nature of the modern times with cloud enabled infrastructure, it's very easy to have lots of flexible, disposable, resilient systems in there that is just simply a layer in between to obfuscate some of your own true attacking infrastructure as well as making some smart decisions in the go. Going nearer I hope, but there is a reason that I'm telling you this, because this concept can become quite big if you count the amount of components that you have for your offensive infrastructure during operations. So let's talk about a single engagement which might have several scenarios. For example if you use a Tyber-based approach for a RAD team, you will have multiple scenarios within the same operation, which also means that you will have multiple C2 servers, typical engagement for us around five different C2 servers. We also have multiple Rida vectors, different proxies and things like that. The main fronting CDN type of players, multiple. You will be creating multiple fake identities to do, well the whole social nearing thing. You might create a website, I wanted to. Tracking pixels everywhere, we track everything, both in emails as in delivery as in multiple different aspects, tracking pixels, tracking pixels, tracking pixels. You need to be catching them, you need to be setting them up, things to manage. And I don't know the delivery side, we got multiple web servers, multiple email boxes, maybe some file sharing services, messaging platforms, whatever, all the new hot stuff there is, but there's multiple aspects that you need to manage. That's all front facing, on your backend side you will have generic backend components. Let's talk about communication channels that you have internally with your team or also with the white team. You will have your own test labs, you will have all kinds of log aggregation. Log aggregation is where RHEL actually comes in. The reason that I'm telling you this is that it, this is our boxing ring, this is what we need to use and it's becoming quite big per operation and even if you have multiple operations at the same time, which many running firms actually do, to keep track of that infrastructure is actually becoming challenging. It's not something that it cannot be solved but it's becoming challenging. So when we look at our offensive infrastructure we have two main typical challenges. One being oversight, the other one being insight. With oversight I mean just keeping track of where your infrastructure is, what the state of it is it up, is it running? Is it okay? Is it, in some way you are hurting your own infrastructure, multiple components, multiple different things, multiple engagements altogether, a lot of data components to keep track of. Insight is more oriented on the fact, well besides if it's up and running, is there data in there that can help us to do a better operation? Do we have the proper insight over infrastructure? Looking at other fields we see quite a resemblance if you look on how those challenges are being solved. So if we look at Cowboys, I just said the term hurting, to some extent we need to hurt our own infrastructure and Cowboys have the same way of hurting their cattle, they use dogs to keep everything in control and that gives them some way to manage the hurt in that sense. If you look at the insight I'd like to refer back to Mr. Edmund Locage, which was actually the true Sherlock Holmes, he was a French Sherlock Holmes and he was the one who put forensic science into the field of forensics. He was the one first to start measuring things, having forensic scientific approaches to forensic science, scientific approaches. Early 20th century, and why do I bring in this guy into the talk? Because he's most commonly known for his own, the Locage exchange principle, which means every contact leaves a trace. And this is actually very much true for our own operation. As you know, every offensive action that we do, it will leave a trace on the system. It's up to blue to digest, to see and digest and inspect the trace. But it's impossible to touch a system, to perform an action, to remotely do something without leaving a trace. But now it's the fun thing, it also goes the other way around. It's impossible for blue to do things without leaving a trace. So if you know where you need to look for, both blue side as well as red side, you can see actions of the other ones going. And if you're looking, if you're talking about traces by adversaries, by red teams, it's quite common to have a thing like a seam or have a security operation center, a cyber defense center, or anyway a team of people investigating traces and seeing things. The other way around, well, during operations, we were in need of such a thing. So looking at the tools that we had at Waze, there is ways of hurting your infrastructure, and we needed a way to actually do some investigation on our infrastructure. We started looking in the open source world, and we didn't find anything, and that is what actually Red Elk came about. Red Elk is a tool ready to be used, open sourced, it's available on our GitHub, and you can use it for keeping oversight of your infrastructure, as well as having insight into what is happening in the operation. And it's important to understand both aspects of this. And Red Elk is, during operation, by us and by the other ones, we use it most often used. You've got your live hacking console of your C2 infrastructure, your C2 server, your COPS pipeline, for example, you do your live hacky-hacky-hacky commands, and then there is a second window open where you have the Red Elk interface, a web interface Red Elk available, and it helps you with just having, well, the oversight of the operation inside, and you will see traffic data coming in, operation data coming in, et cetera, et cetera. Like I said, it's available on our GitHub, and I've written a few blog posts explaining why we need it, getting you up and running and achieving operational oversight, and in the next few months there will be some more blogs probably coming out. Red Elk, the name of course comes from Red being offensively oriented, and Elk being Elastic Search, Logstash, Kibana, the technical stack that we choose for actually making this tool. So, diving into Red Elk. Looking at your infrastructure again, a slightly different approach to this. On the most left you have the target network, you've got your implant running, so there's attack and C2 traffic going first to your redirectors or your first line infra, and from there on it's being filtered and it's being put onto your C2 service that you have in your backend. Nothing near here. How does Red Elk fit into this whole process? Well, here you've got Red Elk. It's a year of local infrastructure, we have it on-prem. You could be running it in cloud, we prefer to have it on-prem, but there are connectors installed both on your redirectors as well as on your C2 service. Data connectors, data feeds, we use file data a lot. And from there on it is put into Logstash filtering and it's put into an Elastic NoSQL database and Kibana is the interface, the web interface, we're actually searching through the data. And that goes both for the redirectors as well as for the C2 server components or you could be hosting your own website or whatever, you can pull the data and actually put it into the index of Red Elk. And there's also data copy happening on the back end, so there are some arcing scripts happening to actually copy downloaded files to have screenshots and all kinds of other operation on data of your operation and pull it back to your central Red Elk server. Because, well, in the end you will have five, six or whatever C2 service for a single operation and you do not want to be logging into every specific C2 server to search for that specific screenshot. You want to have it all centrally, locally in your Red Elk instance. Red Elk does a few things, it indexes data, it enriches data that is coming in, it has lots of dashboards in there, you can create your own dashboards and there's lots of search, well, it's a search-based solution. So that's the core functionality of any Logstash or Elastic Stack. It's based on open source tools, so you can modify it yourself and change dashboards or whatever, you are free to do that for yourself. In recent versions we have also added a Neo4j Docker instance as well as a Jupyter Notebook Docker instance meaning that the Neo4j is used to import output from Bloodhound. So, besides the Elastic Stack you will have also a Docker instance with Neo4j and you have a Jupyter Notebook for quick searching through data and this is really awesome because now you have operational data of your C2 infrastructure as well as from traffic data but you also have knowledge about the active directory environment of your target. And by using the power of Jupyter Notebooks you can make very quick queries on pooling data or matching data, both output from your C2 server as well as data that is within your Neo4j instance. For example, you could be searching for usernames that are, or new incoming beacons pick out the username and immediately go through your Neo4j instance and see what if this is a path going to actually domain admin or any type of admin group that you would like. The Jupyter Notebooks is a way to actually quickly make those queries and have you generate quick output. It's really awesome and once you get used to it it's really powerful during the operation. That's the core RedOg with both the Red team and you might as well give the Y team some access to dashboards and as well as you hold the whole interface. Right now we mainly use for the Red team and we use Jupyter Notebooks to make data extracts that we can give to the Y team, but do your thing, you can quickly give access to your Y team, give the Y team access to Red out. But looking at the oversight there's still a target SOC or a SOC within the target network. And as analysts do, they start analyzing when they have a hunch of something that's going bad. So they are doing several things. They are analyzing, investigating your info. So they might be querying your specific redirectors or they will put data onto what I call online security search providers. Think Spamhouse, VirusTotal, IBM X4, multiple different domain classifiers, Spam, Sandboxes, all kinds of different ways of analyzing the business malware as well as infrastructure. Now it's the fun thing that those security search providers as well will be, these are automated things, they start querying your infrastructure as well. So if you look at the log data of your redirector, you will see, you might have the option of actually having a SOC analyst investigating as well as some online security search providers. They might be investigating your infrastructure, they might be querying it, they might be looking at your specific URI path of your implant with different user agents, for example. And now we're getting into the whole scene part because if you have a big pile of logs about your operations, C2 service, as well as from your redirectors, traffic data, you've got a big pile of logs and you have a rule-based approach of looking for things that might be suspicious in your own data as well as querying online resources like Firebase Total to see if an IUC of your own implant or your own uploaded file is already known at Firebase Total, for example. Well, all of a sudden you have a scene type of functionality. So this is where redirectors fits and introduce a bigger picture. If you look at the logs of your redirectors, whether it's your C2 service, you will see that there's not that much data in there, so we will be needing to do some enrichment. And this is where, well, the data enrichment that we have when a redirector comes in. We do multiple things. If we talk about traffic data, we map it to GUIP data. We check if it's a TORG-based address. We take your ownership from IANA databases. We look at reverse DNS and all that type of data, we are put it into the same record and it's stored within the stack, within the database. We also query gray noise. And for those who do not know gray noise, gray noise is an excellent tool for seeing if it's the traffic that hits you, if it's background noise of the internet, yes or no. Background noise of the internet is just the common scanners. Could be Google indexing or could be common type of or C2 botnets.  It is created for blue teams, but it also for red-oriented amids. It's also very interesting because if an address that is querying our infrastructure on a very specific path that matches or is our implant path, and it is not known by gray noise, then most likely you want to be aware of it and most likely an analyst is actually looking into it, looking into your operation. If it's just, if it's known by gray noise, it's most likely just something like the background noise of the internet. Online resources, we can check at Harvard analysis, virus total, the abuse databases, IBM X-Force multiple, online resources that we can query and take data from and use that for enrichment of the data within our stack. And if you talk about C2 data, there is a component within Red Hat that takes the logs from the C2 frameworks. It needs to be aware of how it is, the logs are being set up and needs to reach them and that's what we do. We have full support for Cobblestrike up to the latest version, as well as our own custom on-flank Stage 1 C2, which is also part of our tooling offering. Full support in there and we are working for the other public ones, C2 is let's say halfway, basic logs are being ingested, but the data copying of screenshots and things like that is not yet fully done. About the same stage for Mythic, Mythic has created an option, seem logging option that you need to enable if you install the team server. And thereon, if you install the Red Hat component, it actually takes away, takes up the logs, ingests them properly, but there's no data copying happening on screenshots just yet working on that. On the Longer Road map, we're also working at Covenant as well as Skype. And you are free to make your own, connect it to your own C2 infrastructure or your own C2 tool. In the end, it's just based on normal log-stage rules. It's all open source and you can go nuts if you like. Okay, data enrichment. It's a lot about talking about what we do. Let's see how it works into practice. Let's start with the interface that you as a vet team operator will see and from there on, we go into investigation of our brute team's brute team activity. First about, let's see how it works. Kibana is the web interface and from here on, you just log in to the interface. Username password base and from here on, you will see that it's a normal Kibana interface. And we have several pre-made views for you that are most often used, meaning that it has the right columns and the right names and the right filters already made. So I click here on the redirect traffic, meaning that it will give you a tabular view of, in this case, the last seven days of traffic that came in on anywhere where the data's been taken from. You will see that there is a timestamp and an attack scenario, the backend name of the redirecter, the redirect traffic source IP, source DNS and the extra HTTP request. The attack scenario is an important one because during an operation, you will most likely have short-haul, long-haul or scenario one, scenario two, scenario X if you're using a TIGRA. So multiple scenarios during that specific attack and all the other names actually make sense if you look at the specific index that we're talking about. So if we talk about redirecter traffic, let's go actually use that. So let's filter. This is just normally about interface stuff. Let's filter on only seeing attack scenario, short-haul. You can expand the data component or the object and you will see that there's GUIP data being enriched. You will see the full log message as it was provided within the log and you will see several aspects as in the actual IP address of the font address, the name that you use, that refresh proxy name, so the font and name. The program I was used in this case was Apache. You will also see that it knows how to digest the different headers. In this case, it makes sense because it was done via a CDN network and a CDN actually puts in the proper X4 to the full headers, et cetera. That's being taken up by relq and it replaces to have the proper source IP investment there. Lots of chopping data in there happening and it presents to you an easy and queryable interface. If we talk about C2 logs, so no traffic logs, but talking about your own C2 logs, then we have the same approach. It's still the same division between multiples attack scenarios. You will already see that there isn't a target username, target IP address, internal IP address, hosting things like that. That is the normal log message from Cobblestrike and you will see that for every action within Cobblestrike being done, it has mapped the data from the top line being the username, IP address, et cetera. You can click on the link to have the full beacon log which most often can be pretty big. And from here on, within your browser, you can just simply control F to do quicker viewing. Sometimes just having such beacon log in tech space is actually easier to use than the Kibana interface. So from the Kibana interface, you have immediately just clicky, you will have the actual beacon log. Same goes for the other C2 frameworks. Now, in some cases, you have during the operation, you have made multiple screenshots and going back, you will remember, well, there was this one system where I had the screenshot that kind of looks like it had this specific application in there, well, Kibana or Redock has an interface with quick previews as well as full click to full resolution screenshots and more directly available to your web interface. So because it's pulling from all the different team servers, there's no need to log into all the different team servers. The same approach goes for keystrokes as well as downloaded files. Another one is a central overview of all your IOCs. As you know that Koppelstreich and Niederhaag see to a friend that will generate an IOC indicator that is being adjusted. And from here on, you have that view and you can search through it, but with the power of Kibana, you will also have the option to quickly just export the data and present it to your writing.  It will take some time, but now the Redock interface or the Redock service is making the file for you. And it's just a CSV based of the tab that you see right now. The same can be done with Jupyter notebooks, but from here on it's just a quicky, quick clicky way of having data in there. Easy to use. This is about operation. Might be already that you think, well, this might be useful for your operation. Well, I hope you do because it actually is really useful during your venting operations. Let's talk about spotting blue team activity. There are multiple ways or multiple areas on where we could be spotting any action of, well, action of a blue team and where they leave traces. I'm talking about directly to your info, so traffic that is directly hitting our offensive infrastructure. Got a few examples in here. We also have got indirect where we are querying online security service providers for any blue team activity. And then there's a third category where we're talking about internal checks. So checks that you're implant that is already inside the target network running. It can do some queries and if it's doing the proper queries, you will might spot some activity of the blue team. Some of these are fully included into Redock. Some we are working on and some are for a longer approach, but first we want to talk about the concept and then we can talk about the specifics that are implemented in Redock as well. And if you believe that we are not quick enough with development, it's an open source project. Come join us, come help us. We need to discuss how the redirectors make the decision and how Redock feeds into this. So when we're talking about traffic that is originating from the actual implant, that's one way. The other traffic that might be hitting a redirector is non-target related. Could be scanners, could be just a regular internet traffic. Your redirector makes a decision based on whatever rule you put in there. So this is just a HA proxy or Apache or any way that you configure your reverse proxy. And it will make a decision to either forward that session to the backend, the true C2 backend or a decoder website or forward it to a different website. The logs that are being put out by HA proxy or Apache or NGNX or whatever reverse proxy that you use, those are being ingested by Redock and you saw them in the interface. But for Redock, it's important to have the proper logging. So when you do the installation, you actually need to change the logging of your reverse proxy tooling, but also specific requirements for the naming of your backends. If you, Redock needs to be aware of what is a decoy and what is a C2 backend. So any type of C2 could be or should be named with C2 dash, whatever. Any type of decoy or deflecting should be starting with decoy dash and then whatever. Based on that decision, Redock will also help you with alarms. The redirectors making decisions, that's important. Okay, once you have that up and running, you will see in the interface of Redock that an analyst might be connecting to your info. Could be, well, eventually be routed to a decoy website or to a C2 backend. And especially traffic going to your C2 backend is interesting. And more than once, you will see, or at least we have seen, and I guess you will as well, that when a blue team is doing an investigation, manual investigation, they're using Python or Curl or maybe PowerShell or, and not every time, they will be changing the actual user agent. So well, you will see Python and user agents coming in. And more than once, we've seen that they first tried it from the breakout point of their SOC internet uplink, but also maybe via a top address. So multiple ways that will be querying your, and depending on the actual path and the backend that is being chosen by the redirector, this is interesting to see, well, is there any happening, any investigation going on. Another one that once you have the logs in there is interesting to see is that if they are, the blue team is sharing the URL of a thing to be investigated, some instant messaging clients actually try to preview that specific website. So in this case, it's an example of Telegram, but all the other ones are basically the same. They will try to make a preview. And as you type, for every new character, they will be trying to get a preview of the door, so they will be connecting to that host. Interesting to see, and a clear indicator, if, well, you see these types of instant messaging apps with the user agent come by and querying your C2 backend infrastructure. That's interesting. So that's directly oriented at your own infra. Let's talk about indirect, so via online security service providers. What I'm showing you here is the interface that a blue team would have, in this case, for the ADR products in the ATP. And I've highlighted those little checks or options where it says submit to send box or submit to VirusTodo. Well, you might think that's not smart to do because once it's in VirusTodo, it will have a hash and we, as a red team, we know the hash is over our pieces of malware, so we can query VirusTodo. Well, have you got results for this specific hash? And VirusTodo will tell you, no, it's not. Or if it's there, then most likely, as we have not uploaded the malware piece ourselves, the blue team has, and then there is a big indicator that you have been compromised, that the attack is compromised. Any blue team should know this, but it's made very easy for them to still click on it button. This is semantic. This is Microsoft, the WDATP, so the Mora Protection Central Portal. There is a check for VirusTodo and there is an option of clicking it to or submit it to their deep analysis, which is just a sandbox. It's made very easy for them to click on those links. Talking about sandboxes, you could be deflecting traffic from your, coming from sandboxes based on source IP address to a specific decode backend on your reader vector, or you could just let them come in. Either way, you could be, check the characteristics of that AV sandbox connection and have an alarm in there and having a clear indicator. So, doing some tests during the training that we did, this is just a mapping of, I believe it was over an eight hour period when on purpose, we actually tried to hit sandbox connections. Just to have a bigger data set of how sandbox connections looks like and it most likely maps back to your own experience that you might have with sandbox connection. The funny thing is that they are not very creative with the naming. So, on the right side, you will see the actual names of the computers and on the horizontal bar, you will see the different students that they have tried to, and the amount of new AV beacons that they're connected. So, let me just zoom in.  So, this is a clear indicator, which of course you already know, is that there is something fishy going on. But we could also generate alarms based on this, even if it's not coming back to the C2 packet. Another one that I want to highlight is domain classification. You will see where that already does this. There is a config file where you enter domain names and from there on, in this case, I entered outflank.nl, and it's querying on DMXforce, McAfee as well as BlueCode, in a pretty other way. And you will see that for some reason, at DMXforce, we have an error-getting reputation, but that's okay, we still have two left. What's interesting here to see or to look for is changes in those classifications and to see if it's actually a bad reputation, so if it's a rogue type of thing. We went through all the different data or the different classification groups that those domain classifiers have. We picked out the rogue ones and as soon as there is a mapping of your domain into one of those categories, you should be getting an alarm. Interesting other area we can do spalling losing activity is on the internal. So checks on the internal, coming from your implant on the internal network. And let me give you just a few examples.  Many networks still have not an automated way of changing the password of the KGB TGT. So if you come into a network and you will see that in this case, even 2010, the last password set of that specific conference 2010 and later on in your operation, all of a sudden it's being reset. Well, chances are big that it was a blue team initiated change. So the KGB TGT is very specific, but you can use the same thing for specific admin accounts or other accounts. And it's hard to judge when a normal password change would be, but if you have five admin accounts and all of a sudden they are changed in the last day, it's a clear indicator that, well, if all admins start changing their passwords, they are onto something. So blue check is a thing that helps you with actually outputting this information. It's a calm-based thing that communicates via Etsy. And it outputs in a certain way that Raddel is actually able to ingest. I'm not sure if we have open source did just yet. How about certificates? Here we do a set check for a specific website our AdVan.gl website, and this check gets the data from the certificate out. It checks to see if it's been SSL intercepted or if there's SSL intercepting a corporate proxy in a way. If this changes during an operation, then the blue team has enabled SSL interceptions, which they might often not always do from the beginning. And it's a clear indicator that what something has changed you need to be aware of. Or blue team investigations. Okay, as a summary, if we're talking about direct based types of indicators of investigation or maybe we should call it indicator of analysis or indicator of detection, I don't know, I don't care. But if we look at the directly based things, we can check for analyst traffic. So specific toll IP addresses, curl user agents, good data going straight to your C2 backend. That's a clear indicator for analysis. Deflected traffic. For some reason, your redirect or logic has said, well, we need to deflect this to our decoy website or some to other thing. We can make alarms based on that. Blue code, other specific security vendors have very specific ways of querying your infrastructure. You can have insight into the data and later on we can have alarms on that as well. It's messaging I show you. Funny thing is if you know the IP ranges of blue teams, which you might know over some time, if those IP ranges are connecting to your infrastructure and even if they go to a decoy, if they are going to deflected decoy backend or if they go to your true C2 backend, you wanna be aware of any type of blue team IP address accessing your infrastructure because it immediately is that suspicious. And then there's generic C2 scanners and AV send boxes. Having Red Dog, you will have proper insight into what those C2 scanners are doing and where they're coming from. Not directly alarm related, but it's very helpful to have that insight. That's on a direct traffic. If we talk about indirect, we're talking about AV hash. Let's check virus total, Harvard analysis, but it's also an infra blacklist. So if you have configured to Red Dog, if it's aware of the URLs that you use, if you're aware of the IP addresses of the infrastructure, specific TLS sets, so the hash of your set, we can check that data onto public lists of known IP, bad IP addresses, URLs and certificates. And the domain classifiers I already showed you. Looking at the internal side, we can check for the password resets TLS interception. Another one that we have already included is the security tool checks. So an unexpected change of the EDR tool is being installed. That's a clear indicator. All of a sudden, they have done something for more investigation. We are working on checks for log forwarding, security config, as well as accounts login, where we log forwarding, if there is a change, all of a sudden, web is being enabled or winlog lead is being enabled, things like that. It's a clear indicator that something has changed that you need to be aware of and most likely is related to blue team activity. We can check for very specific security config changes. This is a very broad topic, but it is a category that needs to be mentioned. So if you have an implant doing some checks and all of a sudden, you can check many different security parameters, local security policies, and if those change, why would they be changing during operation? And then there is an unexpected change of the accounts are logging in. If you land on an inbox and if you go through the witness event view of the past 10 logins or the past 100 logins, you will most often see a clear approach of what accounts are logging into this machine. All of a sudden, you see service accounts logging in or all kinds of different things, in my view or in my view indicator for you, that you're not as stealthy as you think. How did it get started? Need to tell you a few things. On the planning side, my Red Oak installation is intended per operation. Could be having multiple scenarios, but it's for one client, if you like. Do not mix client. Do not make a central Red Oak server where you put into everything together. You want a new system because it contains highly confidential data. You want a new system after the operation. It has three main components, the Red Oak server itself, a connector that you install on your C2 servers and a connector that you install on your redirectors. There are several important identifiers used during the operation and you want to make them clear at the beginning of your installation. That is the attack scenario name that you use as well as the component name that you use. The component name is interesting or relevant for the C2 servers and redirectors and the attack scenario as well. Those are also parameters that you need to put onto the installer on a C2 server as a redirector. An important thing to know, and I mentioned it before, is that the default logging of Apache or HA proxy or any type of other reverse proxy is not sufficient. We've put on the wiki, which is on GitHub and both on the blog post series. We have told you or we put examples, conflicts in the Red Oak code as well. How you change the logging to be specifically ready for Apache to include header logging and the explicit names of the front and the back end. Things like that is already in there, but you need to enable it otherwise. Well, Red Elk is blind for traffic data.  Then there is a first step in creating certificates and the installation packages for both the Elk server, the C2 server, as well as the redirector. You do that with the initial setup. You generate certificates that are being used for the transport of the data from those other components back to the Red Elk server. It's encrypted. The less encrypted, you need to configure that. And from there on, you run the installers on your readers, on your C2 servers, as well on the main Red Elk server. And very important, there are post installation configurations that need to be done and you will find that on the Elk server at the specific part that you will see there. There you enable specific alarms and other kinds of things. And it's all explained into the documentation that we have both on GitHub as well in the blog post series. Little bit about the roadmap. Version one, which was 2018, 2019, I believe, we focused mainly on oversight and not very much on the alarms. We had support for Corporate Strike, HAProxy, and as well as Apache Redirectors. But version two, we've been working on since 2019, I believe. It's still a better stage, but almost there. It's a major improvement both on the setup, but majority on the types of alarms, as well as the ups data and supported tech. So lots of more C2s supported, Part C2, but also NGINX and their own C2 framework. And of course, like I mentioned, we have the integrated Neo4j and the Jupyter notebooks. It's in constant development, more alarms, more improved dashboards and things like that. And we're also working on other C2 frameworks and you're happy to join us if you like. In summary, we believe red teaming is to make blue teams better. That's why we do proper sparring. And we, having that insight of movement of your opponent during a sparring fight is actually better. So Red Dog helps you with that specific case. It will help you to see activities that the blue teams are doing. And dear blue, think of your upset. You can make use of Red Dog, you will find it on our getup and you will find information about this also on our blog. And with that, I would like to thank you for your time.


Alright, let's watch the whole thing here. I see through her little act of being a nice person who brings you gifts in go Okay So you are pretty open to changes looking at your email. I think The first time I watched this this is not like a hundred percent confusion, but Because the cat does this I Was assuming you know, especially because the joys not opening That the cat was talking that the tricky thing is that once you're past that moment And I know he moves that when he says her act But then We're supposed to look here, but we're almost not seeing I mean not seeing this I at all But we're covering this in this current layout form here It's kind of hard to connect and then as it continues to talk the cat doesn't move that's Kind of working with the audios if you just watch this and imagine that what we're hearing is Actually coming from the cat and I know that you wouldn't say it is as you play There's just something about we're supposed to listen to this character But we're not quite connecting because of the face and there's so much movement here that we're always looking at the cat I'm not sure. I'm not sure if this is the right Idea is very subjective, but I'm not quite sure I'm connecting enough with this It's a bit tricky too as there's no audio Then it's just suddenly like you already have a move And then it kind of clicks it. I'm not sure if you have more. I hear birds in the background So I don't know if you can have a bit of a ambient sound with little birds and stuff that kind of matches the the room tone here You can't really copy paste anything because they're always talking so there's a couple things the sound suddenly starts and There's already like to me. It's almost like the cat would be Saying I see during here and you always have a bigger head move. I see and this is your C part Instead of starting here and then the other thing is I Wonder if a staging wise you want to bring in thinking out a lot.  So you can go what I don't want to do this I'm thinking out loud here imagine the dog is a bit more here and the cat is here So center there, but they're both on that side and then here the ball will be here and Then you would just see part of maybe a leg upper body and an arm and just the finishing move of A character dropping the ball and then exiting and then they will they will both kind of follow I darts and head moves in the cat, too, and then let's see imagine Imagining here in real time So you have that and it's very clear that the character brought this and And then when she says now we're connecting that okay, that's what they're referring to was right now the ball and everything I know it's all a bit nebulous. I'm being super picky. I mean, it's I mean once you watch it you understand Okay, I know what they're thinking but what they're meaning, but I wonder if we can make it just clear Yeah, just the the main thing I'm reacting to is that all he's saying I'm starting to connect it with those moves, but then it's not its dog actually saying it She's not really listening. She's kind of just playing with it. And then she says bingo I don't know. I'm not quite sure and I hate to just say do the whole thing over with something else Ha But I know what you're saying here in the email. You're saying that you want to You want to capture a very typical cat behavior and mix them in with the audio I Just wonder if we can get more or different behavior that Fits the audio and and the conversation more so where she can do things and then stop it and look back where we can tell their They're engaged together. So if I'm extrapolating again with my idea that ruins everything with the cat here ball here and then I See through relax imagine you're almost mirroring this where she's here and goes down and ends Here she would end looking at You know at the the ball then stops When he says her act That's when she would turn her head and then look at the dog and she you know take a few steps But she would turn around and then they will look they would face each other. So there's that connection there And after nice person you then you could potentially start playing with it and then it would be here So then you will be almost around here And then you just ended like that, but I still wonder if This is too much. It's too big. There's too much energy For then the cat to be all relaxed and go bingo So I wonder if you can take This idea of now there the cat is playing with it, but turning it down Excuse me doing something a bit smaller with it. It's not this ginormous jump in that action So it's a bit more relaxed so that then it ends with this with a relaxed cat pose and With her saying bingo. So to me the whole performance would be Yeah, it's a bit more. Yeah, I know what she's doing. Yeah bingo. It's that kind of feel And I feel like that amount of action kind of betrays that that energy and the feel of the voice And I think if you have dog here a bit further out there, right cat here ball You just see that arm plopped down the thing and then arm disappears And then you do basically this idea Down here Stops and then her act she looks back Their faces are connecting visually right to look at each other. He says all this and Then because there's a pause nice person and then Right before that pause the cat starts to play and that's kind of him pausing because he's not suddenly looking at the cat and Kind of processing that the cat is playing with this and that's why the pauses could work And that's kind of it so I don't know that it's very destructive My notes are super destructive But I don't know that's just those are my very subjective Thoughts on this was even here. The dog looks this way. We don't quite see the eyes cat looks this way I just never quite feel like they're connecting together and I'm I'm Even though I'm giving you horrible notes by destroying what you did To me this would feel a bit more connected where they're both on the same side So they're not they're not gonna fight like visually to me. They're together and then with that color That's a nice separate thing where maybe you know the adults colors are green or something So there's just a very clear connection and that's this side and then the cat goes on to this side and looks back There's a there's complexity in this they look at each other. They connect Then there's still some playfulness and at the end of that where again They can connect like this and there's movement in the cat. I don't know this that's kind of how I would imagine The shot in my head now that being said, let me know Email me. Let me know what you think and we can email each other and kind of do a bit of brainstorming to see how much you want to Change if at all, I mean you're saying you're open to changes, but I know this was a very destructive Feedback round. So let me know what you want to do and we can Plan it out together. All right. Thank you All right, there's an email you can sign up you can start whenever you want You can submit whatever you want you get 16 submissions either way a like and subscribe would be awesome. All right. Thank you


Chief of Wagner, we should not be in Bakhmut any longer. Wagner group personnel will complete their pullout from Bakhmut by June the 5th, Russia's most powerful mercenary leader Yevgeny Prigozin told a group of Russian military correspondents on June the 1st. On a video released by his press service, Prigozin, wearing military fatigues, is seen shaking hands and speaking to a group of his men, telling them, we should not be in Bakhmut any longer. In a separate video also released by the Wagner press service, Prigozin is seen speaking to a group of Russian reporters saying his Wagner group would fight on in Ukraine if his men got a separate section of the front without having to depend on clowns who ran swathes of the Russian armed forces. Celebrating his 62nd birthday on June the 1st at a training camp, Prigozin again confirmed that his men would finally leave the eastern Ukrainian city of Bakhmut on June the 5th after handing it to the Russian army. The Wagner mercenaries captured the devastated city in late May after months of grinding warfare. If the whole chain of command is 100% failed and will only be led by clowns who turn people into meat, then we will not participate in it, said Prigozin, known for his blunt, often expletive, laced commentary on the conduct of the war. Beautiful, isn't it? He said to Russian reporters with a smile, gazing at a night sky lit up with blasts and red flares against bursts of automatic gunfire from his mercenaries. Prigozin said his men wanted to rest at camps in Russian controlled Ukraine for around a month and then things would become clearer. The rest-a-retur turned mercenary has gained widespread notoriety during the 15-month war in Ukraine and has regularly insulted President Vladimir Putin's top military brass, especially Defense Minister Sergei Shoygu and Chief of the General Staff, Valery Gerasimov, over their performance. Neither Shoygu or Gerasimov have responded to his insults in public. Prigozin, who quipped last week that his nickname should be Putin's butcher, rather than Putin's chef, said he had asked prosecutors to investigate whether senior Russian defense officials had committed any crime before or during the war in Ukraine.


Good morning cyber trainers welcome to this lovely Thursday of January 10th as everybody doing good to see you Ed Good to see you Ben. Good to see you. All right, Judy Ken we got our new coach For football good to see you Grant Mike Jean good to see you. All right Well, welcome back everybody. First of all yesterday was a in phase three was a phenomenal Phenomenal class listen, you know, I always think every class is great But if you're a student of CT you got to go check out The recording of yesterday's class. I know a lot of you were too busy trading some of you a lot of you went in there But I'll tell you yesterday's afternoon's class if you want to see how easy is to find a short You know, I mean it was just like off the charts great great short in the market Hold on me just Bring that Bring something up here so we can see something a little bit better. All right So we had a great great short yesterday in the market and which one was it the hold on We had the BL. We had the BL the BIL of the BI li which was a nice push the AMR and Which was a nice little push the H I Mx Which was a great push look at all these stocks everybody all of them moved really really well and then and then we had that great short yesterday which everybody Know too easy and You guys remember the short. Let's see how everybody remembers it has a good memory. What was the short that we traded yesterday? Who remembers it? There you go Ken remembers it the SG MO There you go SG MO look at that one which by the way I want to keep an eye on this morning because it was awfully weak yesterday the SG MO But look at that short right at the gate that thing just went from to right at 230 ran from 2880 all the way down to 2020 and it was just that was You know like you just said Ken it was just too easy that one unbelievable stock So a lot of good movers yesterday and that's and we're gonna talk about what's moving this morning But before we do that, I just want to give everybody a little heads up Hopefully everybody could see the screen really quick CTU's got a lot of upcoming events that are going on first of all today is a very very big day It is lesson 3 phase 3 Actually, it's wrong. They got a mistake there. It's not lesson 1 It's lesson 3 and lesson 4 and then we also have the cyber expo that is going on today with some great speakers So guys take the opportunity to make sure you're there and you always look listen and learn You know always learn from top traders in today's in markets. All right So What we're gonna be looking going on to this morning there are a couple of stocks that are doing quite horribly and One of them we're gonna start right off the bat is what's going on the retail stocks. Holy cow Look at Macy's taking a huge hit. You know, I thought we were doing so great in the market You know with jobs and this and that I didn't expect Macy's To take a nasty hit like that look at it's down 17% 1.8 million shares already traded now for some of you if you go back to your journals like we trained you what to do You know Macy's is a little bit of a volatile stock So the be a little let's be a little cautious on that Macy's trade But but a lot of retails came out today also look what happened to Coles Coles also down 10% another one great little pop You know beginning of the year and now she's kind of like giving a lot of it back and then what was that? I like L was it LBB LB. I don't know What's it called L bean whatever it's called something like that L brands whatever it is There's another one taking a little bit of a hit right here But look at the spreads, you know, you got to be really really careful when it comes to trading these stocks But there are a lot of them that are going on Frank's is Macy shares are trading low at the company's lower It's 2018 same-source stales as Expectations, you know Macy's has been all over the place. I mean we traded Macy's many a times even in the past They're doing great. They're doing bad. It's a great It's a great story to hear when it's how that stock is doing knowing that, you know, they they are the how can I say it the the big kahuna in the in the industry everybody knows Macy's and You know when you see how that stock trades publicly, you know, it's not like looking at Nordstroms or any of those stocks, but And then I'm hearing that what it was bigger department store might be going out of business Actually here in New York. They just closed one of the biggest stores. What was it? What's the name of one of Manhattan that was one of the biggest there not Bloomingdale's Lord and Taylor huge huge store. They closed in Lord and Taylor Which shockingly let me tell you the rent here in New York is ridiculous. I can see a little bit of a Bubble going on in there. Especially now. They just raised all the minimum wage I know a lot of people taking big big hits and the rent has just been ridiculous.  It's cheaper. It saves time Everybody wants things instance instantly, you know, so it's why Amazon I guess did so well But anyway, these stocks are gonna be affected the market a little bit But there are a lot of the ones that are moving. Also, let's start off talking with the something I think what might be at least a lot less riskier with more reward. Let's start off with the DCI X Here's a stock got nice little penny spread. It's got good iceberg orders Look at the matrix right there 9,000 share buyer out there 3,000 shares. So so we got some good support and resistance levels not really making the big Pop in this premium in pre-market, but it sure did well yesterday After the hours, you could see had gorgeous falstil flags right there. So that one looks pretty interesting, you know Very inexpensive. We'll keep an eye on that INPX This stock gapped up huge this morning up 41% This stock some of you remember we traded back in October. It went from 6 to 20 We made a lot of money on the stock So go back to your journals and remember and make sure you know what level it's at But you could see it's got some really really nice orders in in the matrix and everything else So that one's gonna make the watch list. I'm gonna have fun trading that one. Hopefully in today's class GSUM is another one that came up on my radar Now this stock right here up a little bit big stock up been taking a nasty nasty hit Did you more towards the end of the year from 6 when only that dollar 60? She was doing pretty good I don't know what just happened. She gapped up pretty nicely now. She's starting to trend down I don't know I might pass on it now I've been looking at it because it's breaking lower lows not what we're looking for she looked pretty good about 30 minutes ago So I don't know what I'm gonna might want to consider taking that one out. Let me just scratch that one hold on No, we're not interested You know one minute guys, they're good. Well next minute they're shot, you know, they kind of like fall off the full out of bed UX IN is gonna be on our watch list 9% 781,000 shares who remembers UX IN when we traded it Back here back in September when this thing just literally just went I think it was about November It ran from 3 all the way to 10. Look at that talking about a good short squeeze that thing was There's no other way explaining it seeing how it dropped the way it did MDB is gonna be a nice little day trading stock right here got good volatility stock took a big hit Only issue. It's expensive. All right, so unless you got some deep pockets If you're a level 4 level 5 trader, you're probably gonna do a little pretty well with this You could see how the stock was at 88 went all the way down to 72 Listen, don't give me the whole story. Well, if I trade a hundred shares, you know Could I say I still have money in my account? It doesn't I don't care if you could buy one share You're not learning anything and we talked a lot about that in class Okay. Oh, I've told forgot to mention another one that goes with all these Retailers bed bath and beyond. I don't know where this came from.  She had a nice little move there at after hours When going from like 12 25 all the way to 15 and she's come right back down So she's got some good volatility in it. So that's gonna help out. We're gonna have to look at we definitely got great support resistance levels not the greatest iceberg orders out there, but you know, it's gonna have some good volatility be careful the stock is a Fun stock to trade it's pretty volatile too. So you might consider trading this into in our class in phase 3 so What is the ETF for retail debt? I have no idea if anyone else knows let me know But you know that we rarely trade ETFs All right anything I'm missing That thinks something's moving around, you know, you don't know what the story with this thing is ORG Oh Are you joking with me Dan Dana? Yeah, I thought so you were I Thanks X RT Okay, HD is saying is that the ETF for for That's the ETF for the retailers. Okay Looks about right guys, you know and just give you guys a heads up. It's not that we don't Trade ETFs. It's just that when you're dealing with ETFs, you're dealing with the best traders on Wall Street Okay, yes, they got good volume. Yes, they got good volatility But when it comes to trading, you know, let's just trade the retail stock It's very hard to trade these stocks when you deal with these ETFs So but there's money to meet everywhere All right, so we got it we got a decent list now I know we have a lot of new traders here always like to always welcome them and you know Hopefully they're learning a lot and they see you know like we traded yesterday like the SGMO how you can make money going short and so on but um Listen, just look sit back. It's not trading Everybody wants to trade doesn't mean you should so watch everybody So we find these stocks and if this is something you want to do Just make sure you talk to education advisor and we'll let you know if if this is something that might be sustainable For you to do a career, but in the meantime everyone I see everybody in class. Don't forget we have The cyber expo we got class going on today. So today's a busy day. So it's hump day So let's go out there look listen and learn and make our money quick early in the morning So we get to go back and you sit back and enjoy and listen to some great presenters. All right guys. Good luck everyone. Happy trading


QuickBooks Online 2023. Create reports after second month of data input. Get ready to start moving on up with QuickBooks Online 2023. Here we are in our Get Great Guitars practice file. We started up in a prior presentation with the 30 day free trial. We also have opened the free QuickBooks Online sample company. If you want the to open at the same time we suggest using incognito or you can use another browser. You can open incognito window if you have Google Chrome with the three dots in the browser and then incognito window type into the search engine QuickBooks Online Test Drive. We're using the sample company to compare the accounting view the one Get Great Guitars is in and the business view the one the sample company is in. You can toggle between the two by going to the car drop down and switch the view down below. We're going to be duplicating some tabs as we do every time fairly quick because we do it every time. Right click in the tab up top to duplicate it and then we right click on the tab up top and duplicate it and then we go back to the tab in the middle down to the reports on the left open up one of the favorites the two major financial statement reports the balance sheet and then if you're in the other view by the way the business view that is it's in the business overview and the reports that's where the reports are located back to the accounting view that's not the accounting view support accounting instruction by clicking the link below giving you a free month membership to all of the content on our website broken out by category further broken out by course each course then organized in a logical reasonable fashion making it much more easy to find what you need than can be done on a youtube page we also include added resources such as excel practice problems pdf files and more like quickbooks backup files when applicable so once again click the link below for a free month membership to our website and all the content on it k the heck passo dang it that's not it either here we go back to the report to the right we're going to go down to the reports and then open up the profit and loss reports and let's close up the hand boogie and do a range change from 010123 to 022823 and then we'll hit the drop down and change it to months and run it so we've got the month by month side by side jan feb tote and then up to the top closing up the boogie and change the range from 010123 to 022823 and run it run nine at this point in the practice problem we've done two months of data input let's just do a recap of the business and bookkeeping goals the business goal in general is revenue generation which we can generally see on the income statement that's the top part of the income statement the income line items on the income statement that's what we're trying to do here everything else on the income statement is in essence some kind of expense we have some other income down here but generally everything else is an expense those are the things that we consumed in order to generate the revenue typically in the same time frame when we look at the balance sheet we can break that down to the accounting equation assets equal liabilities and equity the assets are things that we have in the business as opposed to in our personal uh possession because they're going to be like investments that are used to generate revenue such as investments in property plant and equipment that we're going to use in the future to create revenue the liabilities and equity are how we're financing the assets that we are investing in the business to use to generate revenue liabilities representing loans and stuff that are claims to those assets by third parties the equity representing our portion of the assets which could be generated either from us making an initial investment or through the accumulation of revenue that we've had retained earnings earnings that we're keeping in the company that we haven't distributed in the form of dividends or draws in the case of a corporation or sole proprietorship respectively so let's just take a quick recap if we look at these line items and think about how each of those these accounts have been built we'll do it a little bit quicker this time because we did this after the first month but I think it's useful to see what the end product is because from the bookkeeping standpoint what we're trying to do is one make the end product of the financial statements balance sheet and income statement and two try to facilitate the transactions as easily as possible to have foster a good relationship with people we're doing business with customers vendors and employees and also to make it so the business itself can focus most of its time not on the bookkeeping but on whatever the business does to generate the revenue the revenue generation is the key otherwise the business does not thrive obviously so if so this is going to be one of the end results the financial statements that we might at least need to use for taxes if not for external reporting purposes now of course the cash account that's the lifeblood of the company so if I look at it if I drill down on the cash account at this point in time there's more types of transactions in the cash account than any other account so this looks like a very convoluted account and because it's the top one on the list we start to think that the whole accounting system is quite chaotic but that's just because the cash is the lifeblood of the company it runs through every cycle vendor cycle customer cycle employee cycle and that's why the reconciliation of cash that we'll do shortly is so important because it not only double checks the cash balance but all the transactions that are running through cash so that's going to be a huge internal control we'll talk about later and then we've got the accounts receivable which is a good example of an accrual type of account meaning it's an account that deviates from a general cash basis meaning it has some transactions in it that have nothing to do with cash like an invoice doesn't have any cash involved but we still need it if we're in the type of company that has to track accounts receivable that would be one where we do the work first and we gotta bill the client or send them an invoice receive the payment and then make the deposit now clearly the accounts receivable is a lot less chaotic it goes up with an invoice it goes down with a payment we've done two months that's all you see here that's all you're gonna see in the accounts receivable generally the accounts receivable has the subsidiary reports tracking the information not only by date which is what that transaction detail like a general ledger did but also we need to track it by customer we've got the inventory the inventory we can track different ways we're we're tracking it with a perpetual system within the quickbook system kind of the more sophisticated way to be tracking inventory but it takes a little bit more setup process to do in the inventory account we would expect we have the starting amounts this is when we set up the inventory balance to just start out with we're gonna buy the inventory with checks or with bills or with expense forms and then we're gonna sell the inventory with invoices and sales receipts so that's what you would expect to see in the inventory account it goes up when we buy it we buy stuff with check forms expense forms or bill forms and then we sell this inventory with invoices and sales receipts it's gonna go back down and then we might have inventory adjustments that need to happen periodically to tie up the inventory to the physical count remember that the inventory also has a sub ledger breaking the inventory out by units if you're tracking it on a perpetual inventory system the payments to deposit account is that clearing account notice it just goes up and down goes and so we expect the same kind of things to happen we have payment forms sales receipts increase in it and then we make the deposit and after we make the deposits it should go back down to zero as it does periodically here through our our practice problem that's what you would expect to see there if you don't see that there's probably a problem and oftentimes people have problems with that particular account short-term investments whether it was an investment account that we closed out here so I won't go into that in detail the furniture and fixture or our fixed asset accounts notice that in this account it's not something that we do all the time because we don't purchase furniture and equipment all the time so you don't expect to see much activity in here and what you would expect to see is purchases typically with expense forms if you paid cash or check forms or you might purchase and finance the equipment which means you might have an increase due to a journal entry this is the one that you want to have detail in so that you can provide the documentation to your to your accountant so they can give you the information necessary to record the adjusting entries and we'll talk more about that later this is a type of a cruel account by the way so which is which means we have to put it on the books as an asset even if we paid cash for it and you can't really deviate from that even if you're on a cash-based system and it's because there's such a big difference between when you buy something and when you're going to use it that you have to deviate from a cash-based system or your books are getting quite distorted in timing differences so that's that we'll talk more about it when we get to the to the uh adjusting entries uh section or course accounts payable you'll expect the accounts payable to be going uh up with a bill down with a bill check that's all you expect to be seen typically in the accounts payable it's another example of an accrual type an account it's another example of an account that has a sub ledger like the accounts receivable broken out not by customer this time but vendor the credit card we didn't have a lot of activity in the credit card but it can be treated like a checking account if you use the credit card a lot functioning in a similar way as a checking account except that the the liability goes up when you purchase stuff instead of the cash going down we'll talk more about that when we get to the bank feed course or section and then we've got the loans we put the two loans on the books so let's look at the big loan here so the loans aren't something that we take out all the time but once we make loan payments if it's an installment loan we would expect the loan payments to happen periodically say monthly for example and they're gonna have a similar structure although the amount that's broken out between principal and interest will differ so we've talked about some different kind of strategies you can have for making those payments and then we've got the taxes so the taxes are going to be processed through payroll if you're running payroll through the system I won't go into that in detail but it's got a lot of sub ledgers and what not related to it to comply with the laws and then the equity section let's go down here net income is how the income statement is tied into equity this is what we have earned so that increases equity so that's how we are now financing our assets in part through the income that we've earned through the business which we're not which we have not yet given to the owner in the terms and the form of dividends or draws in the case of a sole proprietorship this owner's equity is represents the the amount that we've earned that we haven't given back to the owners and the investment you could break out separately but you might just put that into owner's equity if it was a sole proprietorship and then we might have draws that we'll talk more about later that would be us taking money out of the business reducing the equity section the income statement is tied to the equity section the net income it's part of the that's how it's part of the so this is where we stand as of a point in time the story of how we got there is the income statement which has income and then expenses so top line income line and the income lines would go up as you would expect with just invoices and sales receipts now if you're in some kinds of businesses it might go up with a deposit if you're just if you're just using bank fees to record it but if you're using a full service accounting system we would expect income only to go up and we would expect it to go up with just the sales forms invoices and sales receipts that's it we wouldn't want too many accounts for inventory typically just a major the major accounts there are exceptions to that rule such as if you're doing gig work and you're doing deposit forms you might label the names of the accounts by by customer but that but if you're using a full service accounting system with invoices and sales receipts you want to generally have a limited amount of income accounts usually because you then have the sub ledgers that you can use cost of goods sold is a special expense account related to inventory we're using a perpetual inventory system you would only expect it to go up in general and it would only do so with the invoices and the sales receipts because those are the sales forms that in a perpetual inventory system are are going to record the expense of us selling the inventory and then you've got all the other expenses down below again expenses all income statement accounts usually only go up and then you got income minus expenses is the net income so you've got all of our expense we've got the comparison accounts there we have our total down below now when we give these reports now to a third part to like the to our client let's say now we have to think about how we're going to present these to our client because we have to pick which reports we want to give number one and number two now we have multiple periods so we could have comparative reports that we can add so remember how we can structure this we can generate the reports i'm going to memorize the reports i'm going to memorize them on a monthly basis then i can get into them easily and provide them to the client either by by emailing them printing them which is less common these days or we can save them as a PDF file and then possibly email them with multiple attachments but that's still kind of tedious we could zip them which i think is a better solution or we can we can also create an excel file we can also put them on the cloud so that they can access them on a cloud drive we can make an excel file and then generate one PDF file from the excel file or use excel and word to create a sophisticated more sophisticated and customized format or if i go to the first tab we can go down to the reports on the left hand side we can use this this manage reports tool to try to customize our reports so let's first just group and memorize our reports i'm going to go into the custom reports here last time we set up the balance sheet report a summary balance sheet and the balance sheet standard balance sheet and then a summary income and and an income statement in general so we've got the general reports now those reports if i go to the let's go to the tab to the right right click and duplicate just so you can see where those are generated from if you wanted to pull those up i went to the to the reports on the left hand side we went into down here there's the there's the balance sheet standard of course and then hold on a second here let me scroll down a little there's the summary balance sheet now the summary balance sheet is just basically a balance sheet report but it only has the account types instead of all the detail so that's a good report to start with and and then i customized all the reports by doing our standard i'm getting rid of the pennies negative numbers i'm doing and i'm and i'm doing the red numbers and i'm getting rid of the date time report basis so that's my standard formatting that i've done so that would be the summary report what it's going to look like and then if i go back into the reports we have of course the income statement that we put together the profit and loss and the summary income statement i just collapsed some of the the total lines so we'll look a little bit more about them later at them a little bit more later but now let's do a couple comparative reports and add those into the mix here so i'm going to say let's say that i want now that i have two periods i'm going to say all right well let's go into like a normal prompt let's do a normal like balance sheet report and then i'm going to say okay let's see if there's a couple comparative out reports that we could make if i wanted to make a side-by-side comparison of the two periods that i have now i could do this this way i can go from 010123 to 022823 and then i could hit the drop down and say that i want to see it months a month by month and again you could do it week by week that's more less less common if you had multiple quarters you can also run one quarter by quarter and you can also do it year by year if you had multiple years so you can see how much many more options we have as time passes by just manipulating these reports to have comparative options to them so i'm going to do the quarters and run it and not quarters what am i doing months and then run it so now we've got the side-by-side of the balance sheet january in february it puts the older month first and if i have multiple months like three months then i can do three months on the same report but if i only have two periods then it's often useful for me to do it a different way and take the difference between the two so i might say okay maybe i'm going to go back to the total this way and then the way i can do the difference is i can run it for the second period which in this case is 0201 23 so just for the month of february 0201 so just for the month of february now which is the end of february of course because it's a balance sheet and it's a total only but then i'm going to select the drop down and say that i want to see the previous period which is january and then i can also pick the dollar change and the percent change and run that so now i've got february first the current period the prior period the difference and the change and i can call this something like maybe a comparative comparative balance sheet and so again we only have two periods now two months but if we had multiple months you can imagine doing multiple comparisons for different months different quarters quarter by quarter and so on and so forth so you can start to think about how what kind of reports you would have at the beginning of the year versus the end of the year and what kind of reports you might be comparing to prior years as well there's also a question now of should i just give them this report which gives them the total balance sheet as well as a summary balance sheet which is kind of redundant and a standard balance sheet which is kind of redundant sometimes it might be useful to do that because it's easier to start out looking at a summary balance sheet and then expand on the detail go into a more longer balance sheet the standard and then go into something like this which is a comparative balance sheet if i but but you might say hey maybe i just want to give them this because it has all the information in there and given them the other reports is redundant in my experience the redundancy is good if you're doing a presentation for example or even just given the reports to someone oftentimes because you don't want to overwhelm them with a report with too many numbers you'd like to impress them with a report with too many numbers but you probably want that one buried somewhere deeper into the into the stack of reports and have the top report be as simple as possible because that might entice them to actually look at it for a little bit more than a second before they roll their eyes so in any case i'm going to customize this up top and then let's say we're going to get rid of the sense and bracket the numbers and then we'll say that i'm going to say headers and footers get rid of the date time report basis i'm going to run that and then i'm going to go back to the first tab and see where i want to save it i'm going to save it as like a balance sheet number number i want to make this one well i'll make it number five report i'll just make it number five so i'm so i'm going to try to cut number them so i'm going to save customization i'm going to make it just number five report and i'm going to put them under the report group that i made here month in report so i can pull them up each month and just generate them so i'm going to save that so then if i go back to the first tab and refresh it it's going to go into this customized customized area so now i can just generate it each month and just change the dates here which we'll do in the following presentation all right let's do another one for the income statement so i'm gonna let's let's just i'll just hit the i'll just do right here reports and let's do an income statement a side by side income statement income statement and so now i'm going to say i could do the same thing here on the income statement note i could hit the drop down well let's change the range first don't get ahead of yourself 010123 but myself is so slow i hate waiting for myself anyways so i could do it this way and then i can do the month the side by side as we saw now this is more better this is more better for the income statement because now you've got a january and a feb and it gives you the total so that's great because an income statement is a timing statement it didn't do that with a balance sheet because the balance sheet is as of a point in time so now this report and a comparative report often would be good like you might run something like this for multiple months or multiple quarters that has that has each period and the total which is great and then you might do a comparative report comparing two periods so i'm just going to do the comparative report for our purposes so i'm going to go up top we can do the same thing on the comparative side going back to the totals i'm going to run it and i'm going to do just the month of february 020123 i think my voice is going don't go voice i need you you're all i got you got it so we're gonna hit the previous period and then we're gonna say let's go the dollar and the percent okay so there we have it so now we've got february 1st january and the difference so that looks good and let's do the customization up top and get rid of the uh the the all right it's already there now i'm gonna say without sense because i i kept the other report okay so the formatting is done okay so let's run that so that looks good and then i'm gonna call it i'm gonna call it a comparative comparative income statement i think i ran this not from a standard income statement but from my customized area so in any case that's the idea and i'm gonna customize i'm gonna save customization see yeah i did i'm gonna save it as number seven i think we're on now number seven i think comparative income statement let's see if i messed it did i mess everything up you bested all up you knocked over my sand castle again i didn't mean to where's that one should have been number number six let's edit it all right let's save it okay all right let's go back to the tab so that looks good let's just run our transaction detail report now which is not a report that we often provide to the client but it's a great report for internal reporting and we might use it for billing as we've discussed in the past so i'm gonna right click on the tab up top and duplicate it and let's first i'm gonna look at the trial balance and then our transaction report so we're gonna go to the reports on the left hand side and then i'm gonna close this up open up the trial that well i'm gonna go to the standard reports open up the trial balance the trusty trial balance and then run that from 010123 to 022823 run it and so this is where we stand as of this point in time so if you're checking your numbers you can check them to this report this is not a typical report that we provide to the client because it's got debits and credits and the whole point is to try to use the debits and credits to make the final product but not give them debits and credits because they don't understand the debits and credits and maybe we don't typically need to fully understand the debits and credits but it's still a useful uh report the debits and credits are actually a more a more quicker and easier way to look at things a lot of times uh actually as you can see with this report being a lot more streamlined than the balance sheet and income statement themselves in a lot of ways so let's now then right click again i need some coffee my voice is my voice is going don't do it voice don't go don't go i'm gonna scroll all the way down to the bottom and then we're gonna say for my accountant so we got the general the journal report and we which is a similar report transaction list by date that's the one we're gonna take a look at it's a little bit more streamlined than the journal report let's open that up i'm gonna make this let's make it just for the month of february so i'm gonna go from 0202 that i said 0201 23 to 0228 23 run it and so the way this the way this works is if you look at the trial balance here let's run the trial balance on a side by side month by month and if you run your trial balance and as of the end of january and your january numbers tie out to our january numbers then if then the difference between january and february is reflected by the transaction detail report meaning if all of your transactions in this report match hours then we have to be at the same end point which is going to be february now it's a little bit difficult to to kind of check all your numbers on the transaction detail report because as we saw before it has just the date the transaction the the name and then the account the primary account and then the split account it's a little difficult to see sometimes because sometimes they just have a split if there's more than two accounts affected but this gives us a nice quick summary that you can look at and and say okay if there's something on my side that isn't on your side then you might need to you might need to expand the date range and see if it's a date issue and then you might need to add that if there's something on your side that's not on this side then you want to see what happened is it a duplicate transaction or was it miskeyed or something like that and then check your numbers in that way this is also a good report for like i say billing possibly because you might try to bill someone instead of by hour by how many transactions you enter let's just open the one last report the journal report i'm going to right click and duplicate this i know i'm going long here so i'm going to do this fast and i'm going to go to the reports on the left hand side and close up the boogie close up the boogie and my i have to wrap this up because my voice is threatening to leave me i'll give you some coffee voice and i'm going to go into the the journal report this time and this is let's make this from 020123 to 022823 and so now we've got a similar report but this gives you all the details gives you the the transactions that we did and then it gives you like the detailed accounts that were impacted from those transactions instead of just giving you a split line this is also a useful report possibly for billing in that you can see you can kind of take into consideration how many accounts were impacted in your billing structure and you might do this by exporting it to excel to use excel to count all the lines right you don't want to physically count all the lines but you can export them to excel and use some count if functions like count if there's something in there to count the lines so let's just scroll through this it's quite a long report of course and so there's that now next time we'll get into now that we have our reports in our custom area here we'll get into actually grouping them together to provide them to the client


I'm feeling effin fantastic, I was just about to go to the gym, the sun came out so I figured why not charge up real quick, so that's what I did today. I'm super excited because I realized I should do some sprints and what I mean by that is I haven't been having sprints on my mind lately because my hamstring was messed up but now that's healthy and also just a lot of force on my knee but now I'm all healthy, everything's feeling great and it also feels like the perfect activity for what I need because as you know if you've been watching I've been trying to get over that mental block of running and being fully explosive on my injured knee, it's not really injured, jumpers knee, you get the point but sprinting is just a very safe way to do something that's super elastic and kind of get that stimulus. I don't want to do one foot jumping which is what I need sort of for my tendon but it's just way too much force for my tendon right now but sprinting is more unilateral, it's one foot at a time and it feels exactly what I need and I'm still not going to go 100% all out on sprints because I don't want to go from not sprinting to just doing that but I probably do like 75-80% and just get that ball rolling and really get my elastic training going all the way. I might do a little bit of jumping to warm up like some dynamic warm up of course but then also maybe a little bit of dunking because it's a low rim, keep my mindset on attacking the rim and get my footwork hammered home and just having that mindset of light jumping and having no goals with jumping is a great way to kind of ease into it and maybe have a great day footwork wise and just really get those reps in and other than that super pump to sprint and also I might do a little bit of jump squats just to feel a little bit of power because I'm feeling the most shredded ever which is the best. My body feels like it's the healthiest it's ever been but I also feel like so shredded that I'm almost like light like I want to feel a little bit more power that might be a mental thing so I might do some jump squats just feel like I'm maintaining my strength even though I kind of know now that I'm not really losing strength I just want to kind of feel that stimulus a little bit but we'll see how I feel at the gym if I jump really well and I feel powerful while I'm jumping everything's good. Dunk life we out here and we're dunking dunk life. I just got to work and you know I'm doing that never stop never stop always on the tap locked in the path never getting off track whatever I lack added to my bag and I got playing and moving that way from and my price is right I'm gonna take a ride don't get it done get it done right and that's every day that's done right.  Quick tip dunk in between games get warm during the game as much as you can second they finish playing you get the court to yourself for that solid three minutes pushed off both completely equal and really hard and just like mentally I'm feeling bare let's go. Still keeping it super gradual though because I don't want to jump stages I don't want to go from warm-up jumps to max jumps but feeling really good and I'm actually just cramping because I think I'm dehydrated but feeling great I think I'm about to fly I'm not gonna jump today so bonus baby bonus and too high I gotta cool out I haven't been in front of people in a while so I just went for one and I'm out of breath but I really want to bang one in front of people god it's been a while okay I let the height get to me their intermission between games is like literally a minute and they checked on this side I had no time I had no time whatsoever also another tip cheer for the team that's going this way because if they make a bucket it slows the game down it's not back and forth so you want to cheer for this side the second the shot goes up start going in your position second it goes in you're lined up okay that's how you know you're feeling it I'm jumping a lot of my right and landing a lot of my right two is his game over partner's dunk is that game that ball was far I haven't gone off like that in a while shout out to air pods I don't know how they're staying in but it's keeping me hype not that I need more hype I'm happy I went for it and made it but I still was like 90 percent I didn't go crazy hard it's it's weird I might it might look good but I'm happy with the progress by all means but I mean I want to bang that you know I rimmed this way not like on top of it so it just didn't move at all it hurt myself slow it down keep it more controlled just make the dunk with good footwork that's what I did obviously not satisfied I want to freaking bang it but I'll take it today I'll take it aka decent harder time mentally going off the dribble because it's a lot more force on my leg my footwork is worse my footwork is worse so I'm just more fearful of it but definitely making good progress and have a great mindset during these sessions I think I'm done for today um I don't know all right so fantastic session wasn't even planning on really jumping today but like I said it felt too good everything feels great and I'm obviously pushing it but not pushing it more than I think I could handle and uh one sec yeah my legs feel really great definitely got a little too high and a little bit too fast but I but I I kept it gradual I was conscious of that so I was able to adjust my jumping and go back to be in control and really focus on my footwork so I can keep building on it because if I go too hard it overdo it overdo it I'm going to build a bad habit like I I've done all these years so feeling really good dribble dunks have a long way to go uh lob dunks feeling great but I have to just get more in tune and get a little bit more practice going but everything's feeling great probably a couple sprints and we out of here yeah since I jumped so much this week or today I'm probably going to hold off just like I did this last past week and just test how my body feels because it's really adapting well to this now I feel like I'm primed and ready for this elastic phase and as soon as I start jumping well measure my vert a little bit try to hit my head on the backward of 10 feet which should be like 43 inches about and see if I can get a little higher and then right back to strength getting ready for dunk camping like three months two and a half months it's coming up quick and I just want to prime for that yeah yeah did so much jumping today that those two half-ass sprints I think it's enough I can feel my left hamstring from jumping I haven't put that much load on it in a while so uh definitely going to stretch out take care of my body body love for these next couple days but feeling freaking good so happy to be jumping so happy to be getting over it mentally and feeling that adrenaline and that height and that unconscious take off I'm feeling it's coming new heights new levels dunk life you know it's a beautiful effin day yeah so really feeling it in my hamstring already it feels like super tight and like painful already but uh so definitely going to take really close care of it these next couple days might have done a little bit too much but I got way too hype it's that was like six months of energy built up into one day but it feels okay I stretched it out as much as I could gently and I'm just going to keep an eye on it and if I need to take some time for body love I know now from all these years of training where's my car that um it's not going to I'm not going to lose my gains I'm going to hold on to them so that gives me a little bit more patience but just stay on your grind find your car oh and uh and that's it and just uh stay in tune with your body that's the best advice I can give stay patient and keep working because it does oh my god he almost hit that car um it doesn't really matter when the gains come as long as the gains come eventually you don't want to never make progress like me I did for five years you get the point gang gang dunk life we out here you know it