It's a pleasure to be virtually present at this inaugural meeting of the Pacific Centre for Flexible and Open Learning for Development. This is an important event in the life of the Commonwealth of Learning. As you know, our mission is to help Commonwealth Member States and institutions to harness the potential of distance learning and technologies for expanding access to education and training, and our motto is learning for development. Following Nobel Laureate Professor Amartya Sen, we believe that giving people the opportunity to learn increases their freedoms to be and to do, and helps accelerate progress towards achieving the international development goals and the Commonwealth values of peace, equality, democracy and good governance. In addition to placing our work within the context of internationally agreed development goals, we have a strong country focus and tailor our programs to suit the needs of Member States. We have a very active network of focal points nominated by Commonwealth Ministers of Education, and this network identifies the priorities that call must address. The focal points for the Pacific at their meeting in 2011, which happened in Auckland, believed that call should make TVET materials available, bring good practice in open and distance learning to the region, provide technical advice in open education resources. Our next specific focal points meeting will be held this year and is being co-hosted by the Honourable Minister of Education Samoa at the end of September, where we hope to formally inaugurate Backfold. As a result of the wide consultations in all the four regions of the Commonwealth, call developed a strategic plan for 2012-2015. Within this frame, call has organized its work in two sectors, education and livelihoods and health. These two sectors have seven initiatives and two cross-cutting themes of e-learning and gender. Call has also identified five core strategies to implement its work, partnerships, capacity, materials, models and policies. As a small organization, each of these strategies helps us to leverage our impact. Let me give you examples of some of our activities in the Pacific and you will understand what I mean. As countries achieve success in providing universal primary education, there are still significant barriers preventing many young people from entering secondary education. Call works in 26 Commonwealth countries in expanding open schooling to increase learning opportunities for secondary education, particularly for girls out of school youth and people in remote regions. In the Pacific, Call initiated its open schooling work by commissioning a 12-country report to identify the need for open schools. As a result, Call in collaboration with the University of South Pacific supported the establishment of open schools in Tonga, Kiribati and the Solomon Islands. Call has facilitated a twinning arrangement between the Tecura Correspondence College Wellington and Vanuatu Open School. The 22-country consortium of the Commonwealth Open Schools Association has six members from the region, which include New Zealand and Australia. One of the key obstacles to achieving universal primary education is the shortfall in teacher supply in most developing countries. Therefore, Call provides support to teacher training institutions to strengthen and expand their programs through the use of open and distance learning and technology. Call's work in teacher education in the Pacific has focused on building capacity in quality assurance, curriculum development and multigrid teacher training. Many Commonwealth countries are trying to improve participation rates in higher education. Call is using distance learning approaches to help achieve this. In the Pacific, Call's legislative drafting program is offered through the Vanuatu campus of USP and Call provides scholarships for learners from the region. North Ministers of Education directed Call to establish a virtual university for the small states, a network of 31 countries. Nine institutions covering all Commonwealth regions are now offering WASC developed courses. The first cohort of students of the Sustainable Agriculture Course has graduated from the University of Samoa under the WASC arrangement and a common transnational qualifications framework is in place. The National University of Samoa, the University of PNG, Vanuatu Institute of Technology and the Tonga Institute of Higher Education are all active participants in the WASC initiative. Call's work in skills development builds the capacity of institutions to offer new flexible courses for people working in the informal sector, especially women. Call has developed courses in basic trades and in vocational literacy and these are being used in the Solomon Islands, Vanuatu, PNG, Tuvalu and Nauru. A strategic plan for the TVET division of the Department of Education in PNG has been developed supported by Call. Working with the Ministry of Education, Call supported a training program on working with concrete and 167 young people qualified to work with concrete as a result of this training and this is a large number for Nauru. Schools of farm families do not have access to learning in developing countries. Call offers a new approach called the Lifelong Learning for Farmers or L3F. It's a very interesting model because Call catalyzes the links between the civil society, institutions and microfinance institutions to develop multimedia based learning. Such a linkage in which every agricultural borrower is also a learner has led to vibrant entrepreneurial behaviors among the poorer and marginalized communities. Here are the participants of a recently initiated L3F program in PNG. The Healthy Communities initiative helps local organizations to create non-formal educational programs about community health and development. These photographs depict a learning program called a bag of life in a district of Malawi in Africa with very high rates of maternal and child mortality. Here again is a very interesting model. The community develops programs in the local languages that reach thousands of learners resulting in health seeking behaviors in the community. Building on consistent advocacy and capacity building, the Isabel Province government has accepted a proposal to support technology mediated learning through the Isabel Learning Network and this is in the Solomon Islands. Capacity building programs in community health and development include participants from PNG, Kiribati, Solomon Islands and Vanuatu. Our work in e-learning cuts across all initiatives. In the Pacific we have established a chair in Open Education Resources or OER at Otago Polytechnic. The Open Polytechnic of New Zealand's or Opens's certificate in e-learning reaches many stakeholders in Africa and the Pacific through call support. Calls directory of OER has a consolidated list of open and free courses in four areas higher education, teacher education, skills development and secondary education that anyone can adopt and adapt. This is an important resource for both teachers and learners. Here is another cross-cutting theme that underpins all calls work. As we know violence against women is a critical issue in several Pacific nations and elsewhere in the Commonwealth, particularly South Asia. Lima Gobi, the Nobel laureate from Liberia, said that one way to stop this is to put more women in power. Women hold just 21% of the parliamentary seats across the Commonwealth. In the Pacific, if we don't include Australia and New Zealand, the figure drops to a mere 4%. Call is in the process of discussing how to develop a multimedia leadership training course for women in the region. Call approaches emerging technologies from the point of view of developing member states. How can we reach students under this tree with quality learning materials? Access or the classroom without walls is one possible solution. It is developed by using readily available and low-cost components, open-source software, and the entire cost of these two little devices is $100. Aptus does not require power from the mains or electrical grids. We can use solar chargers instead. It does not require any connectivity. We use a wireless router. All this enables teachers and students to access good quality digital materials through this device. As of now, learners can access the Wikipedia for schools containing over 6,000 articles or the over 2,000 Khan Academy videos covering topics relevant to learners in primary schools or high schools. A whole library of free books is also made available. And to supplement all this, local content can be generated and added quite easily. As Dennis Pack from Kiribati writes, and I quote him, I was very impressed with the speed at which the resources loaded. If we add our own content, I can visualize the Aptus featuring as the main technology on many of our island primary and secondary schools, unquote. Finally, Kohl recognizes the need to further strengthen its work in the Pacific. Backfold will be a key step in this direction. We are very grateful to the Vice Chancellor of USP, Professor Rajesh Chandra, for making this possible. And to Mr. Hasmukh Lal for his hard work and commitment. Let me also thank each one of you who as members of the advisory group will shape and guide the center to become a hub of world-class expertise in distance learning and technology in the region. We look forward to working with you. Thank you very much for your support.


Welcome to Toffy TV, it is the Everton News Daily. Luigi de Baggio has encouraged AS Roma to sign Moise Keane from Everton if they get the opportunity. He said the young Italian striker would score 20 goals in Serie A for Roma. He said when he plays in a team that attacks and plays vertical, he is devastating. He was speaking after Keane had scored a couple of goals for the Italian under 21, and a six in the win over Armenia. Roberto Mantini, the Italian national side manager, also suggested that Keane could leave Everton if he isn't given more playing time as he attempts to force his way into the Italian side, or the Italian squad rather, for the 2020 European Championship. He said he'd got to get into the Everton side or move to a team that is going to give him guarantee playing time if he's to force his way into the squad. Personally, I just hope he stays at Everton and scores goals. Great to see him getting a couple of goals last night. Needs a chance at Everton, needs to work hard at Everton. Get his head down, force his way into the Marco Silva's wreck and then do the business when he's in there. Paul Robinson, the former legionator goalkeeper, says that he understands now why Moise Keane has left out of the Everton squad in the 2-1 win at Southampton. He said, we obviously know now that he's got a bit of an attitude problem. I don't agree with that, but this is what he's saying. Now, the frustrating thing with this is that it just plays into, you know, Graham Sheehanus' comments about him and things like that.  But the lad just needs to get his head down and do exactly what he did last night at 121 level for Italy. Score the goals and force his way into the Everton side. Cos I think once he gets one, I think he'll be up and running and do really well. Anthony Gordon, young Everton striker, has said that he has the ability and the belief to get into the Everton first team. The young lad has been training with Everton first team all season. So far, he was in the squad for the Waffa game, but didn't get on the bench. He was on the bench in the 2-1 win at Southampton last time out, and he scored an absolutely cracker for England while away on international duty. He said that he's working hard on getting better every day. To be around the first team obviously shows I'm doing some things right. I'm harsh on myself and I'm always trying to get better. He said he ignores all the hype around him. He said I'm not one for thinking I've made it. He said if I don't play perfectly in training every day, then I'm disappointed in myself, so I'm always working hard to better myself. Looks like he's a real talent, the lad. Hopefully the manager will continue to have him around the squad. Get him on the bench and maybe give him some minutes. He made his debut at 16 in the 3-0 win in the Europa League in Limersall. So be good to see him get on the pitch and make his Premier League debut as soon as possible. Under-23 striker Cairn Phillips has been allowed to join Sheffield United on trial rather. He scored in the Sheffield United under-23 3-0 draw with Bolton on Monday. Scored 12 goals in 11 games for David Underates under-23 side last season. This comes a couple of years after having a serious injury, in which he thought he may not even walk again. So he's obviously come back absolutely brilliantly, got himself fit and worked hard. He did sign his first professional contract with Everton in the summer, but now the club are prepared to let him leave just a few months later. So hopefully it works out for Cairn at Sheffield United. And finally I want to say thank you to Gary White who cleaned my carpet and sofa today from home care. Thanks guys, I said that shout you're out, there you go. Make sure you subscribe, make sure you check out the Duncan Ferguson interview on our YouTube channel tonight, part one of the playing years. Check it out, give it a subscribe, give this video and that video a thumbs up. If you want more videos, get over to Peyton. Thanks for watching, see you later.


Hello, everyone, welcome to a few people filing in from the waiting room. A couple of familiar names. I'll give folks a few. A couple of minutes to file in. But welcome. If you've been to one of my workshops before you will recognize this slide so welcome. As you join, feel free to answer these questions in the chat, like where are you joining us from and what you do with WordPress. Hey, Michael, good to see you again. Yeah, so the chat button at the bottom of your screen or under the view menu in the zoom, if you're looking for that. Me, I'm based in Hawaii in the US. I do all sorts of things with WordPress, mainly a contributor to the open source project so doing workshops like these for the training team. I started as a blogger, but I do all sorts of things. I see once you're joining from Connecticut, making websites for people. Great. I have camey with me and he's here from Portland, Oregon. I'll be introducing her shortly. Michael from Los Angeles building client and personal sites, everything from informational sites to e-commerce to sites that house applications and products. Cool. Great. Good to have you. Finally, we have Sally. Hello, Sally. We're just doing some quick introductions for you to say hello in the chat. Alrighty, so if you've never joined one of these online workshops before, here's another slide that I share every time so we're here to learn together and encourage you to ask questions at any time. If you want to answer to someone else's question or have anything else to add to the conversation, always feel free to contribute live in the chat. I see Sally has said hello in the chat. Hello. So this and other online workshops are recorded and then we upload these to WordPress TV, WordPress dot TV. The reminder that online workshops like these are hosted by folks like myself and canny who enjoy WordPress and giving back to the community so if you're interested in hosting workshop if you have something that WordPress related that you're enthusiastic about. I'd love to help you hold one of these workshops. So please reach out if you're interested in that. So today, we'll be talking about an introduction to the eib and WordPress and we have our guest canny here. So what we'll be talking about today is what is the eib. What is the importance of the eib work and how it applies to WordPress. So there's a lot to talk about in relation to the eib so just to, to be clear what we won't be covering today is actually using WordPress, and also any advanced eib topics like privilege in intersectionality. Although I mentioned that canny is going to have some resources to share at the end if folks are interested. We'll see. I'd like to introduce you to Kami chaos and let her take it from here. Hi, hello everyone. I'm Kami chaos. I'm a former leader of the WordPress community team. I'm currently focusing my volunteer efforts and WordPress on diversity, equity, inclusion and belonging, which is a sneak peek of the d eib explanation. And that is also work that I'm doing with an automatic in our talent division. So I'm really happy to see all of you here today. Thank you for joining me. I know Michael mentioned that he saw my talk at work camp us. This is going to have a lot of similarities to it. This was part of the reason that Courtney and I decided to do this workshop today and so at the end, feel free to ask questions if there's anything that's unclear. But for the time being, let's just get uncomfortable with this. This is awkward for me. I've spent most of the past decade trying to create safe and comfortable spaces for people within the WordPress community. And sometimes I did a really great job with that. And sometimes I did not. And when I didn't do a great job I made a point to work harder and try to do better. It's just a cycle that doesn't end. Because what I've learned is that just letting some people sit in their own comfort leaves a lot of other people on the outside looking in, feeling excluded and welcome, unrepresented and other and uncomfortable. So, I like to say from the outset that if you are not being intentionally inclusive you are being unintentionally exclusive. And especially with these talks there's a subtle message about DEI being everyone's responsibility. I would like that message to not be subtle. I want all of you to hear it very clearly. If you are someone in a position of privilege or power especially I invite you to get uncomfortable with me. And we're just going to dive right into some definitions. Let's talk about diversity, which is our first D here. There are two days, even though it only shows one. It's in the context of meeting people with different lived experiences from a range of different social and ethnic backgrounds of different races genders sexual orientations religions cast education levels income partner status, just to name a few. So if I didn't include the other important piece of the puzzle that is also a D and that is disability, there is no diversity without accessibility. So, we need to make sure that that is a really important part of the diversity that we're representing equity. There are actually two words. Everything's doubled up. We're talking specifically about equity but oftentimes people think about equality as well. So equity means each individual or group of people is given the same resources or opportunities, whereas equity recognizes that each person has a different set of circumstances and allocates resources and opportunities needed to reach an equal outcome. I would like you to imagine two kids standing outside of a park with a fence, wanting to watch a soccer game that's being played. The second kid can see over the fence. The second kid can just see the fence and has no hope of looking over it. They've tried climbing up they grab with their hands and try to do the pull ups and they can barely get their head up there. The next to them are two crates that they could be standing on. If we were working from a point of equality, we would give each one of those kids a box. That would be equal, each kid would have one box. And that might sound like it's kind of fair, but when the taller kid stands on the box they can still see over the fence. It doesn't really do anything to help. When the shorter kid stands on the box they can just see the fence. So, equity says that the person who can already see over the fence doesn't need help. They can give the shorter of the two kids two boxes and then they can see everything too. Next inclusion. Inclusion is the action or state of including or being included within a group or a structure. It doesn't reference how you're being included or how the person feels in being included it is just the act of making sure that there is space for someone whether it's welcoming or not. I think we need to make sure that it's more than just making the space. It's about making a place that works for others based on their needs and lived experiences, not just on the lived experiences of the people already involved. And that's where we get into the last important letter here is the letter B, which in this case stands for belonging. Sometimes we leave this out sometimes people work from an assumption that if they are being diverse, equitable and inclusive that it creates a sense of belonging. I like to call that last one out and say it takes all of those things, but it also takes us some additional work. Even as someone who's actively doing the work I make mistakes. The first time I saw the phrase the abbreviation DE IB I thought it was de and I and business because I was attending a workshop on it for work. I googled it and understood that my mistake was a common one. But belonging speaks to making that space for people to bring their whole and authentic selves to work to the communities to a project to a role and ensuring that everyone feels welcome accepted and value. A good and easy way to think about this is, you can invite someone into your home and say hey make yourself at home. But they're never going to really feel at home if you want to make them feel like they belong, you find out how you can make the space feel more like a home to them than just accepting that they might be uncomfortable in the space as it is. And now I want to talk about whose job this work is back at the beginning I was saying if you are a person in a place of privilege that you should not ask humans particularly underrepresented or marginalized individuals to do the work of DE IB for you because that is asking them to do emotional labor.  The person should accept that it is sexist or racist or ableist sincerely apologize do some research on how you can do better and move along, but do not ask the person who called out the issue to teach you how to do it. We have vast resources at our fingertips most days. If you're not sure of something. If you don't know what that means if you're concerned that something that you are saying or doing or building is racist sexist classes ableist exclusionary then do some research look it up and see what you can find online when I was a kid and I wanted to know how to spell a word my parents constantly need me look it up in the dictionary. They must have said that five times a day some days, and in my home. It's Google it when my daughter asked me something that I know she could find on our own I tell her to Google it. I am now just telling everyone to Google it. I know we have a lot of things on our plates but this is something that matters, and the more power and the more privilege that you have the more of an obligation that you have to understand the importance of diversity equity inclusion and belonging. And yes Sally it is awkward to look something up in the dictionary when you can't spell it that was my main argument as a child. So you might be wondering, how does this play to WordPress because this is a WordPress workshop right WordPress is a global project the software itself runs last I checked 42.3% of the internet. It's easy to go into your own little world when you're working with your website your blog your organization your business and forget that WordPress isn't just made for you it's made for everyone. The mission of democratizing publishing which WordPress holds at its core is so that we are uplifting the words and stories of those who wouldn't otherwise have a chance to share their stories with the world. So without uplifting the voices of marginalized communities and individuals WordPress would be failing at its primary goal. So as we build WordPress or build our own communities using WordPress it's important to keep in mind that we need to do this to be work but not just for the software for the community as well. Not just because it's the right thing to do though, it is the right thing to do but that's not why we do it. When we work together to develop more diverse and inclusive teams data shows that we will be more productive more innovative and more profitable. We encourage and promote folks from diverse backgrounds they give their perspective to the project and that makes it more inclusive stronger and something that can be used by even more people. That's it. That's the bottom line. In fact that is so important that it's just it has its own slide to some people completely honestly this stuff does not matter. What they think are sound and make sense that they go along in business the way they always have with a homogenous group of like minded individuals. And I have heard people complain that this is a business or a project it's not a family and the business is the survival of the fittest and if someone wants to do something they should just work harder for it. That's how equity works right for Carter. I want to ask me why DEI is important my personal reaction is to tell you that it's the right thing to do as a person I shared already that I want everyone to be comfortable, but it goes beyond that I want to be able to feel safe, wanted, welcome. I want them to feel seen and heard and know that their input matters that our communities and spaces are made better for the wealth of diversity we can welcome. I will do whatever I need to do to make that happen so that I can make this space where we can all be together a space where we can be our real selves, but that's still feelings right it's not business. So the business side of it is as I said before. When we work together to develop more diverse and inclusive teams, everything goes better. When you have one person you have a single perspective. The skill set that they bring to the table the lived experience that that one person has had, and that one person can build and create and make many, many things with that experience. But the things that they're making are likely to be for people who are like them, or for someone who is directly involved in their lives, so much so that the person they're creating the thing for is already a part of their lived experience. But an easy example of this is that my partner loves to cook. He cooks all of the time. I cannot have gluten and he has become an amazing gluten free chef. The meals that he makes are phenomenal. And he makes them because I can't have gluten. So my lived experience has become part of his lived experience. We do see a lot of that. So if you bring in a second person to work on this thing, do you want another person who has that same lived experience you want another person who's like, oh, I can myself and I can cook for a person who's gluten free. No, you might want someone who can cook for a person who is vegan that person who has peanut allergies, etc. Apparently I skipped lunch and very hungry. So if you bring a second person to this thing, you don't want them to have the same exact training and knowledge. If you've learned all of the same things that the other person learned, you want someone who will see another side of things because more diverse and inclusive teams are more innovative and build better products. A homogenous group of people will just reinforce its own experiences and become an echo chamber. So let's stay uncomfortable. The next step is to just keep going. This isn't a box that we can take off and say, okay, my DEI be work is done. It's an ongoing way of life. The more we grow in our DEI be work. More often, we create more work and see more work that needs to be done we meet people with new perspectives to us we gain a better understanding of how we can make the project and the software better and more inclusive. So that's what we're here to talk about today. I like to keep these instructional portions short so that we can have a discussion. And I'd really love to hear from all of you now. Thanks, Kami. Do we have any questions out there. Thank you all for you to throw your questions in the chat or if you'd like. Any clarification anything that came in presented or any details. Thanks for people under 25 doing all the designing for things used by senior citizens. Absolutely. Michael says thanks for that such a clear and helpful definition yeah thank you. Maybe so clear that there are no questions. That's possible. Then Courtney and I can have a conversation because this is work that she and I have done together for years so maybe there's stuff that comes to mind that we should. I said I wasn't going to talk about privilege but maybe we should talk about privilege and intersectionality. Oh what are the most common mistakes that people make. Good question. That is a wide open question. So, the common mistakes that people make are thinking that because they've learned something. It's always going to be that way. I'm going to use my parents as an example. When I was young I thought my parents were the most inclusive welcoming opening open people like I was raised very much in a household where everyone needed to be themselves. I encouraged to respect others for who they are and understand and learn. And as I've gotten older and my parents have gotten older. That hasn't changed. Right they still want to be inclusive they still want to be welcoming, but they are set in their ways and there is some residual. There's no connection racism or homophobia or sexism that sticks around and they're not aware that it's there. And without anyone to call them on it, they will continue to just cycle through that same thing and it's not just my parents I mean, I fear the day that that is going to be the case with me as well. And I think that all of the changes that have happened in society to make this a more inclusive place and to understand 30 years ago we would not have been having this conversation. And we are now so what conversations are we're going to be having it again in 30 years. Another common mistake is when you say something that was not the right thing to say or that was offensive. When you say I'm sorry what was I supposed to say, or I'm sorry I made you feel that way, or I'm sorry you felt that way that's not an apology. That's not owning a mistake that you've made that's putting the onus on the person who you offended. You're sorry that they felt that way or not sorry about what you said. So make sure if you make a mistake.  It's something that ticked a box that is from years and years and years of both direct and circumvented oppression micro aggressions build up and eventually there's something that you can't deal with. So, as a woman, as a great example, I'm a woman, and I've lived my entire life as a woman that is my lived experience. And I would very much like to wake up one morning and have someone hand me a beautiful gluten free cookie and tell me that from now on, I will be paid the same as my straight white male cis co workers. And that no one's going to talk over me in meetings anymore and that people aren't going to pass my ideas off as their own. And that would be really dandy and I would really like it. It's, it's not, that's just not how it is so it's also an mistake that's being made on the other side is probably not recognizing incremental growth, we need huge growth. But I sometimes forget that incremental growth is important as well. And so, I know that I get so involved with wanting everything to be perfect. But sometimes I just need to step back and go, what did this look like six months ago, what have we done to improve. Okay, let's move forward. Um, yeah, those are my, those are my things. That's, that's my biggest mistakes. That's my soapbox for right now. Yeah. And Michael did ask any sense of what type of conversation we'd like to have here. Because some guidance would be welcome like, I know that you like to use talks with like, you know, just say an open, open floor basically so I don't know. I wonder what kind of problems you all are seeing in your daily life that you can identify as a problem of diversity, equity, inclusion and belonging. Is there something that you are seeing happening either at work or in your social circles that you can identify where you could do some work to make this a better place like I said this is ongoing work that we all have to do. So this is your, this is your, this is your time to ask someone to do emotional labor for you. I'm here right now to do some emotional labor if anyone has any questions or has a topic that they'd like to hear more about. In terms of DEA be otherwise I'm going to start talking about intersectionality.  Even though we said we wouldn't. It's a great topic so I'll discuss it. If you are willing to riff on that. That's what we're here for. I have a question in the chat discussions on DEI seem to be solely focused on one or two racial groups and exclude others in cisgender women. What about all the other topics within this area. That is a fantastic question. Thank you. So there are two specific areas that I would point to with this. The first one being disability. It's specifically physical disability so something that you are physically unable to do that someone else is able to do. We don't think enough about that in the diversity equity inclusion space and that's something that's not just an emotional blocker. It's a physical blocker for people we are creating spaces where people are literally not welcome and not being included. That is a huge point that I don't think we focus on enough. Even though when we look at software, right, we do have programs within software to build up that accessibility. But not necessarily enough. And it is just as important in our physical spaces as well. And let me reread that one or two racial groups and cisgendered women. What about all the other topics within this area neurodiversity is another one that I seriously take the heart as a person who considers myself and is clinically considered neurodiverse. I think that we pay a lot of attention to how the standard mind works and to making spaces that work for people who think the same way as a homogenous group of people who are comfortable with specific things. And the fact of the matter is that there's not a normal mindset there's not a normal way that a brain processes things. And especially during this pandemic I've seen a lot of growth and paying attention to neurodiversity and the important city place and but I still think that it is an area that we're not really looking at. And then if I would tack one other thing I think every, I think we have so much of our society is unnecessarily gendered. For some reason it seems so important. If you want somebody to use your pronouns share your pronouns. That's totally fine. But why do we need to know what your gender is before you use a bathroom, or what why do we need to specify the gender of a nursing parent, or why do we like when you sign up to take a course. Why would we ask what your gender is, unless unless you're trying to find that information, we should just be making something that's inclusive for people of all genders. That's my bonus one. Oh, you attended a DEI meeting but no one would even turn on those auto jet. I'm just going to say corrections because that's the, I love it. Those auto generated corrections are better than nothing. I agree, I'm not sure why they wouldn't turn that on that is incredibly frustrating. And that's a prime example of a very simple thing that technology has built. We have built within technology in order to make things more accessible and people often just don't bother to do it. Oh, now the questions are coming in Courtney you want to tell me what I'm answering and I'll dive in. Yeah, let's see. There's a couple of chats but I'll go to the next question. I will ask. This might be tricky to address, but can you speak to ways to handle the pushback to the generic generic sense of DEI be practices that get labeled some conveniently dismissible phrase like wokeness. I think it's important that awareness, empathy and inclusion is just a bandwagon of sorts, and has become a derivable concept by those who wish to keep things at the status quo. That is that I like a tricky conversation. I like to feel uncomfortable. That's something I've learned about myself. It is tricky to address. And I don't know if, if any of you have seen some of the conversations that are being had in the WordPress community right now but wokeness in particular is is someone being woke used to be, I believe a compliment I think it's a compliment if you told me I was woke I would be like well thank you very much I try. I tried very hard to be woke, and then my daughter would laugh at me but we are turning wokeness is the new politically correct right. We try to be politically correct and what we're actually trying to say is, I want to be inclusive and welcoming. I want people who have the power. So people who already have that privilege people who are part of a privileged group and who have never had to walk through the day with microaggressions, just flowing at them from every direction to the point where they would rather have a house. Of course they don't think that things need to change and so they're going to cling to that for themselves. And when someone pushes too hard to make that change, they're going to try to rebel against it and say, No, it's fine the way it is your just too Why do you have to change things in my space go make your own space that's the opposite of being inclusive. And that's a level of privilege that is truly spectacular, I have a lot of privilege, I have a lot of privilege. And the other part of multiple marginalized groups doesn't mean I don't have a lot of privilege. It is the job of people with privilege to educate themselves to look for those resources, and to not tear other people down. And that really is what I believe that is it's a defense mechanism for people who are afraid of being unseated from their privilege. So if we're anything away from other people we're trying to give things to others we're trying to make this space more inclusive and more welcoming. And so I, I particularly hate. I don't like using the word hate I particularly dislike when people act like because we're trying to be more inclusive because we're trying to be more welcoming, because we are trying to have equity in a project that we are hurting the status quo, because the status quo is broken. And there's no way around that. We have to keep building in order to make it better. And there are going to be ripples. I mean, how long ago did women in the United States of America earn the right to vote. The status quo said that women of any race or ethnicity, and men who weren't white, couldn't vote. And we know that that was incredibly wrong. So, we're just going to have to keep building on that. Thank you for asking. Thank you for giving me a soapbox to stand on. I have a comment from Sally that just like to read out loud. She says she's always arguing with her husband that there's nothing at all wrong with social justice. The problem is people who are out there doing a lot of virtue signaling without helping. Absolutely and I agree with that. And she says also to all the white folks like her if you don't know Sally you could look up white privilege in the dictionary and see her picture. She said to all the white folks who want to decide how changes get made and how underrepresented people get represented instead of shutting up and getting out of the way. It took her a couple times of getting smacked down for her to clue in. She should shut up and not barge into things no matter how well meaning she is. Thank you. And there's a huge balance there because you, you should not speak for marginalized people, but as a privileged person you should be using your privilege to uplift their voices to raise them up and to force other people in places of privilege to understand that their way is not the only way.  That is a real concern because that feeling creates more division. That is a difficult one to politely answer. And I often start this out by saying I love a straight white cis man, literally, my partner is a straight white cis man. He has done more work for DEIB than I have I think in this world. He is a champion for other people's voices. And I think he still gets his feelings hurts sometimes, because you can't help it. I do understand that straight white cis men are feeling battered. And the fact of the matter is, is that they have been in the driver's seat for all of society in the United States, and much of Europe. So we're looking at, let's look at DEIB just in the US right now. The only group who has never been marginalized in the US is straight white cis men. And I'm not saying we should marginalize them. I'm saying that our society was built around their comfort and their lived experience. And if someone were trying to take away all of my comfort and tell me that all of my lived experiences were wrong, I would be uncomfortable too. It doesn't mean the change doesn't need to happen. So they can have all the feelings they want. I would liken this to, if I have plans to go out with a friend, and I am sick, and I say, hey friend, I can't go out tonight. I'm sick. I made the right decision not to go out. If they get to feel however they want to feel, they can have their feelings, they can own their feelings, they can feel their feelings, but they shouldn't be like, well that was wrong. Is that, I hope that makes sense. I may have had that may have been a great comparison it may have been horrible I'm not sure what. Sally mentions there's some terrific stuff by Bell Hooks about how destructive patriarchy is to men. Thanks. I will Google that. Sally has a comment about explainer husband toxic masculinity and how it is toxic to men as well. We raise our children, even unintentionally I talked about my parents and how woke my parents were when I was young. But even with that I have an older brother and he was allowed to do all sorts of things that I was never allowed to do. I had to cook dinner twice a week and I wouldn't consider my parents sexist but boy howdy that was pretty sexist I had to cook dinner and clean the kitchen and my brother got to do yard work. Turns out I was better suited to doing yard work quite frankly, and my brother was probably better suited to cooking dinner, but we were raised in a society that said girls cook dinner and boys do yard work. Toxic masculinity isn't toxic, just to other people outside of the male landscape it is toxic to the upbringing of young men who are we we're putting in a position that they don't need to be in. Another thing to mention in relation to that is, again like tying this back into WordPress in the WordPress community. People make this assumption that all people that are contributing with code are straight whites his males, usually because and because most of the folks that are out there and they're representing themselves are. Those folks. And so we're we're doing some work to like uplift those those folks and like the, the all like women and non binary lead release was was a fantastic example of uplifting that those folks that community. I would, is it okay if I that sparked something for me. I remember, I remember there were some hard feelings around having an all women and non binary release squad. I remember watching some people be really frustrated with that and watching others be very supportive of it. Back, I believe it was Ruth Bader Ginsburg said that there would be enough women on the Supreme Court when they were all women and people took issue with that as well. The fact of the matter is the in our history. I don't know why I keep saying the fact of the matter is like that somehow makes what I'm saying more important in our history in our society, there have been any number of completely male lead releases groups, rule makers lawmakers court systems police forces. That used to just be the normal you would find women as teachers and nurses and cafeteria ladies. We, we didn't have a lot secretaries we could be secretaries I made a great secretary it doesn't mean that's what I want to do with my life. So, I think that the, the all women and non binary lead release was a huge step in the right direction. But I do think that there were people who felt really sensitive about that and they didn't realize necessarily that there have been plenty of all male releases. It also speaks to if you go to a conference and 50% of the women 50% of the speakers are women, and 50% of the men of the speakers are men. It will be perceived that it is a women's conference the perception is that there are too many women speaking and not enough men, whereas if you have 70% of the speakers that are men and 30% of the speakers that are women. We will often identify that it was a proper balance. And that's not even bringing non binary into the equation that those are just studies that were done when we were talking about men and women. It's something that we have to build on appreciating the, the chat that's going on right now and I do want to read it for the sake of the recording as well. I think this is referring back to when you were talking about your experience with your parents and your brother. There's a comment here that says that then there's the premise that anything traditional is wrong. What if you like to cook and your brother loves landscaping. How does that work. And Sally says, the, the issue is having a choice about it. Though she has read one, this writers think that women who choose to be homemakers are somehow undercutting them she doesn't agree with that. I think Sally answered that I don't think I have to. I will say that I was a stay at home mom and homemaker for 10 years. It was something I needed to do for myself and something that I needed to do for my daughter. It wasn't a man's choice to do that it was mine and I was fortunate that I had the privilege of doing that. And to this day I am ridiculously close to my child so I know I made the right decision. But I felt judged by men by women by everyone the entire time I was doing that I felt like I should be doing something in the real world out having a career and making a difference in the world. But that was my priority at the time and I would take great offense to anyone and told me that I made the wrong choice. Wrong choice for me, maybe the wrong. Everyone should make their own choice in that particular. And I know I know men who are stay at home fathers and homemakers, because they have either either because they are both men in a relationship because that happens to them or because their wife is a breadwinner. I don't. I don't see the traditional ways wrong if everyone is a willing participant in it and is educated and knows what they're doing and getting into. I'm just read the chats coming in faster than I can read. And I think that Michael says he doesn't think that quote unquote traditional is necessarily wrong, but the assumption that those traditions apply to everyone and should be the expected foundation for understanding one another is the problem. I'd like to read and comment if that's okay so much tech so much tech medicine, etc. It is designed around abled white men of a certain height features etc.  It is absolutely true. Even if we're going back to this round of coven. Let's talk about that for a moment. Coven vaccines were primarily tested on on men. And so people coven vaccines were primarily tested on people without uteruses.  We're just now verifying that it's causing problems for people with uteruses.  Oftentimes you put your hand underneath that faucet and nothing happens, the lights don't turn on in the bathroom. And the facial recognition will not pick you up. It's a problem for facial recognition is a problem. If you ever have to go through passport control when you're coming into another country. Oftentimes they will not be able to read your face unless you happen to be a skin tone that they find readable. And even with the auto captions I have found that people with a particularly with a Jersey accent or a deep Southern accent it doesn't make heads or tails of what they're saying as well. So, yes, we have designed everything for able bodied 5 to 10 to 6 to men who speak with a California newscaster accent. And that's just not the way that they are not the majority of our population they are just the people who have always had the controlling interest. I really I believe that WordPress is doing better than that. I believe that we have a lot of work to do and a lot of growth but I believe we are doing better than that and I do believe it's a priority right now. And it's part of the reason that I'm still doing the work that I'm doing that I'm still at automatic that I'm still in the WordPress community. I think open source is one of the only ways that we are over going to have software that is truly equitable and inclusive. I'm not sure if I can keep up here and some of the conversation is related to the earlier question. Yeah. Oh wow thanks to us like quickly I think some of this we want to move on from all valley comments just I don't think anything that we need to bring into the workshop. Anyway, I learned from you just now is that that term newscaster accent. I've heard like radio voice or I don't know if that's like the same like accent or the way people speak but the reason the reason I'm familiar with that term is because I grew up in Texas, in south Texas and my learn to speak so I was born in California I moved to Texas, I spent my form of speech years and then I made back to California. And I was immediately taken and put into speech therapy in the California school system because they said they couldn't understand what I was saying, and they declared my accent a speech impediment. And so the state of California required me to go through speech therapy for years. That is where I learned the West Coast newscaster. There's a certain way that you're supposed to speak as a newscaster. And if you'll notice newscasters all of the United States tend to have the same West Coast accent. Because that's how they're trying to speak clearly. And that's what we consider clearly. And one thing I tried to do with these workshops or any like recording that we do is that I do run it through another captioning service because, as folks have already mentioned the auto captioning is not very good. So trying to run those through another captioning software but then I manually go over it and correct it because we have folks with all sorts of speaking styles and accents. And this is a global community. So, you know, we want to be able to have those captions of the spoken words to be accurate. And I realize that sometimes like with word camps maybe that have like dozens of talks they might not have the, I don't know the volunteer power to do that. And well, I'm going to make a plug right now for folks to contribute to the WordPress TV team because yeah, you can volunteer to do captions for any of the videos. So the first contribution outside of organizing and speaking at word camps my first contributor day contribution was captioning videos for WordPress TV, and it is a lot of work, and it's so worthwhile. It does take a lot of time and needs a lot of volunteers. And headphones. Easy way to yeah it's an easy way to get started to contributing to the project. One more question time for one more question. Michael asks, speaking of WordPress and of not asking disadvantaged people to do the emotional work of explanations. Has there been any work to put together a site or resource where we can send people to investigate the issues around problematic behavior or statements. Bit of a more formalized starting point. Yes, ish. The community team has a site where you can go. It very much reads like you're reporting a violation of something but anytime that there is an issue that comes up. You can go and send a report through Courtney do you happen to remember the URL for that. Courtney will get that one all ferret of the jet. So yes we do have a system where people can bring up issues that are problematic, whether it is something that is an ongoing issue that they're seeing or whether it is something that happened at a WordPress social learning space meet up word camp either online or in person. So that's something that you should bring to the community team. I am also working with someone within the community to build out our db resources so that we have a dedicated police that people can come to to talk about that but that's something I'm working with Ali Nimmons on and I'm really excited. And I hope that she and I get to bring that to fruition but it's still in its early stages. So it sounds like it's very much a code of conduct violation, but it is the catch all for things like that right now. Courtney has dropped it in its. I was going to it's make that wordpress.org slash community slash handbook slash word camp dash organizer slash planning dash details slash code dash of dash conduct slash incident dash reporting. We should probably get like a short URL for that at some point, so people can more easily access that because that is not accessible. There's a lot of work to get there. Yeah, that's actually the handbook page on incident reporting in the for word camp organizers, but the actual incident reporting form is a lot shorter. And even though this is on word camp.org, it does apply to the WordPress project so Michael did clarify that he meant more to help others understand the impact of the behaviors rather than putting like is there a resource. That is something. And Michael if you want to ping me on make WordPress lack about something that you'd be interested in getting involved with let me know because we are putting together a group of people to work on these things. And I think that's a fantastic idea and I would love to figure out how we can make that a priority right from the beginning of what we're working on not from the beginning of the project because then we need a time machine. And I think that the WordPress project has a yet does not have it this yet, but yes, it's been the works. Yeah. And finally and mentioned it has been hit or miss on inclusion, even at these WordPress events. When the instructor introduces something that goes against accessibility. Some will accept feedback that corrects it but some will make comments like accessibility is out of scope of the discussion. I don't like that. I don't like that that happens. I, I'm not saying I don't like that you said that I'm glad that you said that I have seen that accessibility needs to be in scope for every discussion. I understand if we are saying, hey, let's figure out the functions, and then we figure out the accessibility but just like we look at cost, and the amount of time that's put involved that is involved in something we need to look at accessibility from the outset. It should not be an afterthought it should be something that we are building into everything that we do. It should, it should be doesn't make it happen, but know that yes it is very much something that some people in the project or super keen on ensuring that we work on it is something that I hear at every event. It is something I would like to see and hear more of but I don't think I've ever remember ever Matt doing a state of the word without someone asking about accessibility and the q amp a afterwards. So, I think we just need to get it to the point where it's discussed before the Q amp a at every event. And I think as, as a matter of fact, a workshop that is focused on accessibility has been an ask for a while so I will mention that I've been doing some research and reaching out to some folks that may have a little more expertise there so we can all learn. I can learn along with you to. So, um, yeah. That isn't works. And mentions that was probably probably them asking for accessibility for a while. And a few folks ask at our camp us as well. I think that is it for a question since we're almost at the top of the hour. Yeah, again thanks for this conversation camey I think that the conversations after your presentation are always the most useful or I like having those conversations with folks and just hearing and learning along with folks so. Yeah, just to close up, say thank you everyone for learning with us. You can join more online workshops like these and watch some tutorials at learn.wordpress.org. And again, if you're interested in hosting one or co hosting along with me, I would love to hear from you. If you have any other conversations at chat.wordpress.org that is a slack instance where all the folks that are contributing to the WordPress open source project and work on the project, and we can chat there. So thank you folks for for being here and thank you can me for your presentation. Thanks for having me Courtney and thank all of you. I'm really passionate about this and so any chance for people to willingly listen that brings me great joy I really appreciate you learning more and being involved and you're all great thank you. Yeah, this is important for not just the WordPress project and community but for everyone so I'm glad that that we have this conversation. Thanks all.


Welcome to Project Obsidian, Scythian Hefton, Kill Chain One. The title of this is Go Fish, Visualizing Basic Malice. And this will be by myself, Salmanoske-X. A little bit about myself, who I am. I'm Salmanoske-X. I'm a tinkerer. I'm also a SOC team member for an organization. I am a blue team enthusiast, have been for many, many years. I am also an instructor, but most of all, I am also a student. So let's take a look at what we're going to be learning today. First of all, we're going to learn what fishing is and what is a fishing payload in context of fishing. We're going to be learning what visual basic for applications is. We're also going to learn what macros are and what does this have to do with fishing and threat hunting. And we'll also learn how to walk through the process from a hypothesis to tangible results during a threat hunt. Also, we're going to recognize what tools do we have in our arsenal and what can we do with it for our threat hunt. So let's take a look at fishing. So fishing is still one of the most common attack methods in use today. Generally what fishing means is that it's a way for an adversary to get credentials or information from an individual via nefarious or malicious means. A fishing payload is the method of getting that data. So a fishing payload could be a document, a zip file, a link and an email. We also are going to learn there are differences between these different types of payloads. We'll see that a little bit later. Here are a couple of examples of some fishing payloads that I've seen in my actual day to day experience. Here's an example. So this is an IT security update from the IT help desk. And if you look at this, it has so many warnings that a user would be, I'd be surprised if a user would actually click on the email link that's in it. However, let's take a look at it. Microsoft gives you an email header that says it's this person's from outside of your organization. They also have another one inside saying that the email was from an external source. The warnings are there. In the actual body of the email, we see it says your email account will be deactivated shortly to stop deactivation click here. Companies are not going to do that. They click on the, if somebody were to click on the click here button, it would take them to a site that would have them enter the credentials. Part of what makes fishing a little bit more concerning is that the attack the adversaries will try to use a sense of urgency or you need to do this immediately or you need to do this before the end of the day. Or you'll lose something or will charge you or something like that. Take another look at another one. Say the user clicks on a link that says, Hey, there's something that here's some money that you owe. We need you to review it. So they would click on the link, and it would get something like this. This is obviously inside of a webpage. And there's a box that says that your authentication is needed to log into this document. This is not legit. We have another one as well this is comes from goes back to the urgency that we discussed earlier. This is an invoice that's urgent. If you take a look at the spelling in the email. There's often misspellings that's not always a absolute tell, but it's one of those signs that could mean that it is potentially malicious. And then we have the invoice that DSTX, which is a Microsoft Word document that most likely has a malicious payload inside of via a macro, which we'll learn about later. So visual basic for applications. We call it BBA for short. Microsoft's generous gift for extensibility in office. So what this does this allows for adding functionality in Microsoft Word PowerPoint Excel, access Microsoft project, I believe, or publisher. But what that does is it allows the file to interact with the operating underlying operating system or other office applications to transfer data, or do different things between different applications automatically. That's it could be a good thing but it more than likely is a bad thing. We refer to these functions as macros. As I discussed, it's not limited in scope to just the office applications, which is what makes this kind of a bigger issue, except if it were not just limited to the office applications. As I said, this can be rather large concern with the amount of privilege and the actions that can be done with this functionality. This can actually be weaponized by adversaries, and we'll see an example that here shortly. The macros can perform the actions automatically and without sometimes without obvious signs just by opening a document or file that contains active macros. What are the implications. If a user downloads an email, a file from an email, and they open the document, and it clicked a button that could activate additional downloads of malicious files from an adversaries systems. What does the macro look like. Here's an example of a macro that is not legitimate. But this is what the macro interface looks like in Microsoft Office applications. Let's think a little bit about what our scenario is right now. Let's say I'm a new team member of the Magnum Tempest MT security team. I've been asked to build a threat hunt based on what I think might have been missed in the environment. I've never done a threat hunt before. Where do I start. So first things first, what you need to do is we need to start with a hypothesis. I'll put you to start with a hypothesis in mind because you need to know what you're looking for. For me, I'm focusing on macro usage in the environment so visual basic for applications macros. I'm going to start with a broad hypothesis. And I'm going to presume that Magnum Tempest employees receive malicious documents or malicious emails. This is a good starting point, but it's far too broad because malicious emails. Yes, we will get that, but we need to kind of refine that hypothesis a little more direct. So let's, let's refine. And what we come up with is Magnum Tempest employees are targeted with malicious Microsoft documents containing BBA macros the official email. And we're going to presume that some employees will download and open and detonate these malicious documents. What we're going to talk about this is that a lot of what we're going to be going over and doing here is specifically structured towards the Splunk query language. But these concepts can be applied to any platform, any query language. And there were also online applications or tools that will allow you to convert from one query language to another. I'm not asking that here, but that is available. So let's start with the threat hunt. So we need to start with a query in Splunk, but we need to know what sources we have available. So yeah, we could start by just going across the entire platform and just go index equals asterisk. You can see what we get when we do that. We're going to have index equals star. We have no, no hits right now. But that's because we need to go to the timeline here. And for, for lack of a better time, time period, let's go with all time. And then click on search. Interesting, we have nothing. So let's take a look. Let's kind of refine a little bit more. Let's see what we do. As you see, the search is increasing. This is more, these are more entries than we could ever want to go through and parse. And this number is just going to go higher and higher. Let's stop this right now. Let's go back to our drawing board. Let's see what else we can do. So this is bad practice to do the asterisk with a query. It's one, it's a great way to get server admins mad at you for slowing down the system. But you might also get not get exactly what you're expecting you might get more, and you won't be able to kind of refine your query as much. So let's take a look at a query that we could use. One will summarize all of the log sources that we have in Splunk. Now I'm going to cheat because I already have this as a search in my, my history. So I'm going to add that to my search. I'm going to do all time. And I'm going to search. Okay, so we see we have a number of different indexes we have 12 results. And the ones that kind of stand up to me right now is Zeke, because Zeke will allow me to get information about data that is being transmitted over the wire so over the network. Let's go back and look and see what we can do with that information. So this is what we saw. We're going to start with Zeke. Let's see what what files are transmitted over the network. So instead of putting the asterisk we're going to index the Zeke. And as I said previously we need to set a date range for the what we're going through. And for the example, we're going to use February 11 to February 13 of 2022 index equals Zeke. So we're going to set a date range between February 11 and February 13. I'm going to apply that. And then we're going to search. As you see, we still have a rather large amount of events. So we need to refine that a little bit better. So back to our drawing board. We know that we're dealing with Microsoft Office documents and with the macro behavior. So let's see what we can do. So our typical Microsoft document files that we typically see being transmitted over email and attacks are .doc.docx.xls and .xlsx. So Microsoft Word documents and Excel documents. Let's see if we can add that to the query like this. And next to .doc.or.doc.x or .xls or .xlsx. So let's add that to our query. And I have that here. Let's query that. Okay, we're getting better. We have 863 events. So let's scroll through and see what we can see. It's still a lot of documents. So we want to see if we can refine that a little bit better. See what we can do. As you see, we saw 863 events. What do we find? There were a lot of events. We can probably never done this more. So we've got the initial entry index. .doc.doc. These document formats. But this is also probably a great point to bring up something that's integral for mind hunting. Take notes. We need to know what we did, what worked, what didn't work. And for the purposes of this, we're keeping track as we go along. How could we refine this search? Since we're focusing on supposed phishing emails, we can look at common terms that are used in phishing documents. SAMHSA has a cool extensive list. It's not comprehensive, but it's very useful at this link here. And we can use some terms to fine tune the search. So let's add some of the ones that I found in voice. We see a lot of that for remit or payment or order. So let's go back to Splunk and see how that looks. So while these are common phishing email document names, or it could be part of emails, we're not getting very many hits. We're actually getting no hits. So let's go back to the drawing board. Let's try using another index. This is Sysmon. So what Sysmon will do, Sysmon is essentially giving you telemetry from the endpoint. That's how he gives you telemetry from the network. So let's add Sysmon to that and see if we have any hits. Again, no hits. So perhaps we should try a different approach. Let's go back. As you see, we had no event. Okay. What can we do to get better results? Again, we want to probably go back to our notes. Kind of see what we've done so far, what hasn't worked. And let's see what else we can do to kind of fine tune. Maybe do some external searching. See what we can kind of do to get better results. But we need to go back and remember what we're looking for when we started, right? We're looking for visual basic for applications, macro evidence tied to office documents obtained via email. Is there a way for us to determine via logs that a macro has been executed? Yes, obviously. The fans actually have a really nice explanation of registry entries that will indicate that the macro has been activated. According to sans, we can look for something called trust records. And this indicates macro execution on a system. And this is from the webpage from sans. It points out one of the few places where macro execution these traces is in the trust records entry in the registry. And we can see that right here in this box. And that's something that we can use in our search. So let's try to add that and see if we can try and find trust records in our query. So we're going to stick with our initial index in the consistent one. And we're going to add trust records to that. We're going to take this off. I'm going to do. And let's see what we did. So we get 48 events. Here we have a real look here. We see this as far right here. Employee conduct code of conduct. But this one appears on a file server. So let's take a look and see. Okay. This is evidence of a macro. Let's go back and look at this. Okay, we have a result. And the first event we see. It's a personal internal file share, as we noticed. What's the significance of it being a power share. It appears to be a company file share. We're looking for documents downloaded by a user via email. We're not going to likely see this on a file share, at least not initially. We would expect to see it on a user's desktop or endpoint. So let's take a look at see how many of these events are located on the file share. So by doing that and doing that, we're going to have the trust records, and then and files that magnum template, magnum tempest financial.com. Let's go back to our. Look. And I have that here. Magnum tempest.com. We get 26 events. Okay, employee code of conduct. Employee code of conduct. Marketing template. Marketing template. Okay, so at this point, I am fairly confident that that's not necessarily malicious could be, but going based off of my hypothesis of being from an email. I'm going to disregard these files for now. So going back to our, we saw 26 events. So associated with the file. Well, let's do the inverse. Removing the file share events from our query. So all we're going to change is not in the query. Let's give us 22 events, which is better because this is a little bit more for us to work with. Okay, so let's look at this. So the first one is trust records. Use of corporate downloads downloads. That's what we're looking for. Magnum tempest policy violation. Matt. So this one stands out because I would not expect to see a user's email. Address in a document. That is being sent from. A legitimate internal. Group. What we do know is that. Having. Templates and setting out the mass users. You might see the name like this. But having the entire email just kind of signifies that this might be. Could be malicious, but we need to kind of dig a little bit deeper. Let's see what else we have here. Okay, we have another similar one. From a different user. Amanda. Okay, so let's go back to our drawing board. So we ran the query. So we do have 22 events. Are we done? No. But we do have 22 events. And like I said, we do have that. File name stands out to me. As potentially an issue. And it stands out because the naming convention is odd. Why would there. Have an email address in the file name, right? The location indicates that it's downloaded on the user's endpoint and both scenarios. Downloads and desktop. What you'd expect if you were downloading an email from. On the actual endpoint. The, it also indicates that the trust record section was triggered for the file, which as we know indicates. Macro activity. Can we find similar files? Let's refine our query knowing that we know the file name. And what we may suspect to be a malicious file. So we're going to stick with indexing Zeke. And Sysmon. But we're going to go with. Magnum Tempest dash policy dash violation dash. And I see what this results. So we have 40 events for this. Let's take a look at this. I'm not sure what this is. This looks like these are. Logs, but these might not be parsed. So that could be an issue. But let's look down a little bit deeper. Okay. So we knew Amanda Nunes. Nunes. Download this file. And it looks like. It was caught. As a force authentication. However, we also know that this was not parsed as well. So that's another new force to add to our notes. And we scroll down. She more. Man, I mean, Nunes this. So she met Matt Tristeke again. And. That's a steep. So right now I wish he's met and Amanda. So let's go back and see. Can we refine this more? Well, we know we have 40 events available. We looked at what we saw in the first events. There's not been parsed. Let's notice. So we can notice in our findings. But like we said. We saw that there was one that had a drive by compromise. The program use was Thunderbird. And it fits the. Target's final name. That we were discussing previously. Now. I don't know a whole lot about the organization yet. But it appears that the organization uses Thunderbird as a male client. So can we refine that a little bit deeper. Knowing that. That little bit of information. So let's go back and we're going to add Thunderbird. To our query. Are we down to 12 events? Again, if we look at these, they're not done. They're not parked correctly. So that's something to note that. Going through Amanda downloaded it. Amanda. Karen. Mutants. Also appears to have downloaded this. So let's see what do we have. So go back. At this point. With a previous query, we see that we have 12 entries. Scrolling we see two additional users downloaded. Amanda Nunez. And. Karen mutants. What does this mean? At this point, we've validated. Our initial hypothesis that a Microsoft office document with downloaded. From email by the end users. And that it contained visual basic for applications, macros. Are we done? With can be. We've satisfied our hypothesis. And our investigation or our threat hunt. However, if you're like me, you like, might be interested in digging a bit deeper to see if you can find more information about these files. So. What does mean. We need to go deeper. So. What's next. So we have other tools available to us. That. Might be useful. We have access to the packet capture. For network traffic. That's done. That's a Zeke. But we can actually be able to. Look at. Traffic close and actually rebuild those traffic. Close. And that's what we call a packet capture. Or we call it P cap for short. A common tool that we use to browse and hunt. In a P cap file. It's called. Let's load up. Well, with the appropriate P cap. And let's see what we can find. Once we load the P cap. We're going to be able to. Start searching for some information that we located in our hunt. Let's look back and remember. That we found a file name. That was opened. By multiple users. And the file name was. Magnum Tempest. That's policy. That's violation. That's user email. Dot doc. Okay. So we know that. Knowing that the company's name is Magnum Tempest. So. We probably should avoid using that because it's possible we could end up with other. Events that we were not really interested in. What stands out to me in this. Would be the policy that's violation. Dash. It could be very unique. To the file name. So let's proceed. We're searching for this because if you remember, we only had 12 hits. For that file name. Let's load up. Wireshark. So I already have Wireshark already. Up and ready to go. What we want to do. If you want to. You can call out. We'll change this. It starts off the packet list. Packet details. This starts off as display filter. We're going to switch this. I already have policy violation in here, but if you didn't have anything in there, it would be read. So you would type policy. Violation. Dash. And you hit enter. And it's going to take a little bit of time to search for it. But we did. We found one right here. So if you see. We're going to. We're going to switch this thing. I already have policy violation in here, but if you didn't have anything in there, it would be read. So you would type policy. We found one right here. So if you see here says action required. Internal IT policy violation. From legal dash internal. At magnum tempest. Financial. At this point, we can right click. We can follow PCP stream. So what this will do, this will bring up the. Stream of data. That is. Associated with this particular packet. So see that now. This will take a little bit. To load. Go back to our. Dr. So here's an explanation of how to switch the. This play filter the string. So as we saw, we saw action required internal IT policy violation. From legal dash internal. At magnum tempest financial. As we saw. Again, this is where we will right click and follow. PCP stream. Again, PCP stream will give you the actual data. Flow for that particular packet where it's. Exists. The colors indicate whether data was sent or received. Let's go back to our operation. So there's a lot of data here. But so if we scroll a little bit, we will see. The. Our original, the email that we're referring to the subject. Is actually required internal IT policy violation. From legal dash internal at magnum tempest. Financial. So this one was sent to. So, so this. So let's say. So this file. This is the email itself, the actual email text. That was sent. What stands out here is this is. Network traffic. Network traffic by. In a, in a. Good network should be encrypted, especially with emails. She never be able to see email text over a. Over a network. That's a security issue. That's also something to note. When you're. Keeping track. What we see here too, this is the. File name that we were expecting. Megan tempest. Policy violation. And then we have the username here. That doc is what we expected. And then what we have here is a base 64 encoded. Lobo text. But what this will do. Is if you were to take this. And send this to. The base 64 encryption. What will happen is. You can recreate this attachment, this document. That contains the macro. Files. So let's go back to our. So like we said, we needed to scroll a little bit to get to the. What we needed. Again, so let's take a look at what we said and one and two, we're seeing the subject and the. And the from. That we saw before. And number three, we're seeing what appears to be the email contents. In plain text. This is concerning as I said previously that. Unencrypted. Email over the wire is not a good thing. Could be a misconfiguration. By the server admins when they set up email. In number four at five, we noticed that this is a base 64 encoded attachment. And the file name matches what we would expect to see based on what we did in Splunk. Again, it's important to recognize that. Because it's basically for we have the ability to turn that into an actual document or file. At this point, what's next. At this point, we could dive further investigate. We could try to download the attachment and see what. What we want to do is go for our playbook. Our playbook title is going to be detecting enterprise macro activity from emails. The minor tactic is T. 1566. But it might be a good point for us to stop. And pass off to the next team. To forgive with their investigation or their threat hunt. But it's also a chance for us to take a look and. Check our notes. What we want to do is go for our playbook. Our playbook title is going to be detecting enterprise macro activity from emails. To forgive with their investigation. So we're going to go for our playbook. 1566, which is fishing. But we're also going to use the sub technique. Zero zero one spear phishing attachment. Because based on what we've known so far. This could be. A spear phishing attachment. So we're going to take our initial hypothesis. Which is that employees are targeted with malicious documents. With VBA macro code. And some employees will open the documents and detonate the data as the case. The proposed detection query is index in. Zeke insist log. Dot doc. Or XLS or dot dot X or XLS X trust records. And not files dot magnum tempest financial.com. We have no simulation details. And for the hunter limitations observation notes. We discovered that there were log sources that were not properly parsed. Which made finding details difficult. Hunt findings. Three users download the malicious document. Two users appear to have been affected by the payload. And that brings us to the end of the talk. Thank you so much. To join the conversation. Join us at. Discord dot blue team village dot org. Thank you.


Tim asks, the U.S. Department of Justice recently brought charges against the U.S. citizen for operating a custodial Bitcoin mining service. The service had apparently been advertised explicitly to clean Bitcoin used on dark web systems. Can you discuss what you think are the risks, maybe, for participating in mixing services? Either custodial or non-custodial for privacy purposes within the U.S. and other jurisdictions. Do you think that U.S. citizens should be worried if they have used systems like Wasabi or Samurai, even if they have not done anything illegal with their Bitcoin? That's a tough question. I'm going to do my best to answer it for you, Tim. Please note the distinction the charges brought by the U.S. Justice Department recently are not against the user of a coin join or mixing service, but against the operator of the servers that are involved in a coin join or mixing service. I'm assuming it has something to do with facilitating money laundering or something like that in this particular case. Now, there are a number of ways to do transactions on Bitcoin that have more than one participant. These transactions can be done in a number of ways. One of the ways is to use a wallet that provides this as a service using a decentralized or centralized infrastructure, something like the Samurai wallet, the Wasabi wallet, services such as join market, etc. Now, all of these types of services provide for privacy. Since Bitcoin and many other blockchains are open and transparent public ledgers, you can do a lot of statistical analysis on the transactions and see the balances people have. If their addresses have touched a system that has information that ties their identity, such as an exchange that does KYC or a merchant service that has delivered something to their name and house, then it's fairly easy to associate those addresses and the future movement of coins and breach the privacy of these users. First of all, a very, very important disclaimer. I am not a lawyer and what I'm going to say now is not legal advice. Especially even if I was a lawyer, no one can have a crystal ball that tells them what the US Department of Justice will do next and what charges they might bring against someone. Furthermore, just because charges are brought against someone doesn't mean that these charges can be proven in a court of law effectively and that a jury will convict on these charges. Although the American justice system is now approaching totalitarian levels of conviction where the vast majority of federal cases that are brought result in guilty pleas, deals or convictions. Having said all that, let me try it to be as candid as possible with Tim's question. I think that at least for now, there is a serious risk for people who operate the servers or supporting infrastructure for mixing services. I am unsure about what the implications are for US citizens who use mixing services in order to increase their privacy. Theoretically speaking from what I understand, if you're not a money transmitter and you're engaging in a private transaction, I don't know whether that can be considered money laundering. But then again, the Justice Department can claim it is and bring charges against anyone they want at any time for any charge. You can't stop someone from suing you and it's not until you reach a conviction that the law will decide whether in fact that conviction is fair. Given the climate of fear and suspicion and the degree to which authorities are able to paint people as evil and paint any type of financial transaction as potentially criminal if it's not under the traditional financial system, I wouldn't be surprised if people were convicted for using mixing services even if they're not running them. This is a challenging environment. I think participating in a mixing service is just doing a transaction, but then again, I am not a prosecutor. So Tim, this is a really, really tricky area at the moment and it can be a high risk area for people who reside in the US or for people who reside in totalitarian countries or any country where the government is likely to prosecute for these kinds of things.