Hey what's going on guys welcome to the craft folks my name is Sven and today I'm joined here with Andrew Dragonblade James Emerald Blade and David Titan who the hell is he? Journeyman Conjurer Do any of you? Oh he's going to ask us a question here let's maintain Let's just answer this question Let's see what he says Know where the Beatles are Ah yes And your mum Not really Sorry Sol's M9 Oh shit I put it in And I am sorry Finnegan Dornbider Sol's Also known as Zirani and Andrew is also known as Brent Good old Brent and good old Cyberclaw and James is just here as well So we're going You couldn't say who else I'm known as So we're going to do a dungeon today Yeah Aren't we?  Okay you need to talk to him as well by the way So you need to she procs Oh okay And we're going to listen to You don't need to listen to her James After a stop in Kimbalung Near Distant Mu Shu The trade ship arrived on schedule But Beagle and his team weren't aboard I fear something may have happened to them Our hands are full here And I can't spare a single soul Can you go to Kimbalung to search for Beagle and his expeditionary force? What is it? It was called Lost Beagle You have so many quests I have two I do As soon as I talk to people for too long Oh by the way guys we have a mount that we can ride together So the adventure we're doing it together this time Yeah Yay What do you want to take you to Kimbalung? Do I look like a spiral cruise line? I run a trade operation kid But Oh god I've got a buyer waiting for the Crocatopian week I was supposed to receive in exchange For bringing some big shard to Marlaboni in here But the big shot stood me up in Kimbalung Now I'm out that wheat I'm ruined without it You get me Crocatopian wheat And I'll get you to Kimbalung You certainly don't see any fields around here Perhaps Sergeant Major Talbot knows where you can find some Crocatopian wheat Oh it's like Crocatopian wheat like Marijuana Wheat not weed Ah It's true I suppose But but but Doesn't really match does it Charlie is the gardener here He knows how to Oh wait actually we need to talk to Sergeant Major Talbot first I'm getting too ahead of myself Bring no sword to go I've done this too much It's just like No offence but I was hoping not to see you again so soon Is there a problem? The ship's captain is demanding Crocatopian wheat Hmm Hmm I'm no expert in desert agriculture But I know someone who is Go speak with Charlie The Oasis' resident green thong About Crocatopian wheat What do you want now? I loathe taking you away from your study Please come to visit me at the first Okay then I'll come and visit you after this quiz Now I'm so annoyed Hmm Me lagging behind you because I'm sitting next to each other And I see you're so far ahead tonight Sergeant Major Talbot sent you to ask me about Crocatopian wheat Well I just so happened to have packed up these crates Of Crocatopian wheat for some But he never came to claim them I sure hate for the wheat to rot You should take them No charge I hope they help Wow We'll go this way this time Oh we need to talk to them again Oh god Can't we just get on with this This is an annoying way we have to do this Yeah it is isn't it Any luck? Charlie gave you the Crocatopian wheat Smashing Now then go to Captain Woku And chart a passage to the Himalayan village of Kimbalan When you get there search for the expeditionary forces base camp With luck you'll find clues to their whereabouts Okay we're going to Kimbalan village James Support to us when I say We're going to some Asian village We're going to Mushu What? This early on? Yeah We haven't even searched Malibu Are those crates of Crocatopian wheat or is that your luggage? Very good Consider your passage booked kid You may board my ship The haggling dragon Enjoy your cruise Okay just port to me when you're ready We're in the outskirts of Mushu Traveler come quickly I need help My team needs help Or you need to go and get on the haggling dragon So hop off and go back Damn it It's bugged Got my wee antenna in the space Enjoy it Nah I wouldn't do this I'm from here taking the whole one day melts We were on a diplomatic mission to Mushu But we're denied audience with the emperor They said he was napping and couldn't be bothered Talk to him again So Lord Beagle decided to chase a rumor he'd heard The fabled paradise of Shangraba And we were blind in close to We were treating with the venerable Dalilamba In the pagoda of harmony When a devious band of old ninjas appeared Right The strangest thing that happened Their leader played an eerie song That somehow bewitched the monks They turned on us The frightful boar ordered us to be taken hostage But I managed to escape in the confusion What could he want with hostage?  Tempest now Has it enchanted? Yes good Just in case he fizzles Good he still has a chance to fizzle Just help me That's what you're meant to do help Especially when James is here You have full accuracy if you have that as well So yeah This is going to do nothing You have too many sheds This is going to do a lot Yeah Did he actually die?  Do you want me to 0?    Yeah that's good Good work young wizard Now meditate at the shrine of the mind And contemplate all that it teaches I need to write down one of those Star All that was done Of a color shall undo Long live the hoof And the master Tonkatsu Totsui One must be of sound body To withstand the long arduous walk Along the path of harmony Stay strong What's that? It's a gift box Ooh What does this gift box do? Okay put it in mass storm prison James? Put in mass storm prison I don't know storm Just look for mass storm prison It's on like the second or first page Mass storm prison One You ready? Okay I'm going in You actually made it this time Congrats everyone So put mass storm prison up as soon as you get it Good It's a storm prison but it goes to everyone Oh convert Yeah it says convert storm damage To myth damage for all enemies Dude I don't agree Well you should Wow they think they're really good Casting blades Casting blades That's so good Blading 420 bladed 420 bladed No 420 bladed Oh my god amazing They're 89 damage It's blade 420 bladed Yeah level 70 spell for ya Nicely executed Let's get a helper out here Just so I don't have to heal Just so I don't have to heal Finn doesn't want to heal I don't want to heal anymore Why? He feels James too much Can you get that as a spell?  I'm meant to be I got told to do a life I got a helper I got a helper because I don't have to heal now Thank god Why would you do that? I'd just heal myself anyway so I got a storm on it Nah I got the helper so I can get the heals going Should I hit? Yes Okay storm mold in it Storm molding? You can't even storm mold I can't You don't have enough pips Storm mold 6 I thought it was 7 I thought it was 7 pips It's 7 Pretty short You're shipping me mate Are you tripping me?  It is as I feared, Tonkatsu has found a vessel for Hamakala, who must be stopped. But first, let us help these battered pups to the base camp. Go through the teleporter. Where? There. Where? Where? Where? You rescued the team, but where's Lord Beagle? I don't know! How is he? He needs to have fun. We need to do the other bit now. An Asura is a malevolent power secret. The other dungeon. The most evil of them all was Hamakala. Long ago, the monks of my order took advantage of Hamakala's vanity and trapped his spirit inside a statue. I believe Master Tonkatsu aims to release Hamakala's spirit into the body of Lord Beagle. Beagle's political status would grant them audience with every ruling party of the spiral. They could topple them all from the inside. No, you need to help. Just wait. You have learned the secrets of the Pagoda of Harmony. Next leg of your journey begins now. Follow me, James. I got a message. Good job, young wizard. I can now teach you a new spell to add to your deck. To your deck? Ooh, I can add a spell to my deck. I want to do deck, right? No, you don't. Before us lies the entrance to the Harmony. You can't get any more room. It is the sacred final pathway to Shangri-Baz. Only the harmonies. Don't get on, James. Just before the entrance to Paradise.  Lies the temple of discord. But it is no mere joke. It is Hamakala's tour. By playing to his vanity, it costs the monks their lives. But the spell has kept Hamakala prisoner for a thousand years. As a Batashiva, I am not allowed to enter the Hollow Mountain before my time. This journey is yours alone. A time will come when you see we are all one. Harmony flows within you and without you. Just remember all that you have learned. Now we can enter. We'll enter. Well, Ripper only is your favourite, isn't it? So you need to hit as soon as possible for all of these? No. Yes, you. Oh god, they're big. These guys are stunned. I couldn't move. Oh, they're so good. He doesn't address your third or second or first. Do you want me to shield? No. You're hitting. Hitting as soon as... Not hit right now. Blade and then hit. Shields and blades are different. Shields and blades are different. No, they're not. Blade, it's here. Shields and defense. Yup. No. No. Go use them on Lost Souls in Unicorn Way, not here.  Trust me. They're blading because they're smart. 420 blade it.  I'm going to have to hit. And she did I take my Trisha cut out? No, I didn't. Blade? No, don't. Why can't you hit? Why not? Okay, cool. Do you want to crit your blade? No. Yeah, it doesn't crit. No. No more damage. They're not really. Yeah, they've lost a quarter of their health. They've still got three quarters to go. I'm sorry, I didn't have any good. I'm confused. They told you they'd stun as soon as they have the chance. They'll probably stun you next. Trust me. They will. Oh, dude, what's he doing? They love these stuns. He body slashed you. Okay, you're out of nowhere.  He's got all John Cena. I thought I could play something good now. I have to do this. I'll hit with a Storm Lord. I can't. Yes, you can. Well, what do you have?   I don't know. I don't know. I still have one of those things. One of what things? No, just keep it on. Just remove the Leviathan and the other colossal. Remove the colossal and the Leviathan. Just go and see if you shred. There you are. This is why I got James. They're white shrieks. James OP. They're white shrieks. Thanks, man. All good, bro. Hamulay and Blizzard Boots. I didn't get anything from that. You're for only. Oh, it's not a woolly. Just a wizard. What are you doing? What are you doing? Did I fall you to heal? Yeah, you did. Fall you to heal. We've got a puzzle next. Oh, Jack and Brick took it. No, I didn't. James did. No, you got it. No, James got it. Hospital. No. I know this. No. They're not fighting me. Look at him. No. No. Okay, James, I'm going in. They are high. They're dragging themselves right up in here. They're putting chloroform on their face. I would never tell. We are bested, Scatter. Run quickly before Master Tonkatsu brings Hamakala down. I got the helm with the smoking imba. Okay, I'm going in. Oh, wait. I'm going in. I'm racing. Go, big James. It's not my James, it's not them. Yeah. I don't make it. Is this a final battle? No. It's a final battle. Is that fun? Final battle is next. Well, you have to hit as soon as possible. Really? Yeah, you do. You need to hit with Siren, so... So, just boost Talosium, James? So, I should... what? I don't need Talosium. One of the best defensive ones. He does, actually. Everyone should have one. Who should I have it? You do, I've got it, because I... Should I even... Should I put up a Stormblade? Yes, actually yes. Because there's a boss that put up a Stormblade. A cheap one? It doesn't matter, just put up a Stormblade. I'll put up a cheap one. Cheap but sturdy one. Let's go, does he have the same attack? Yeah, he does, of course he does. Yeah, they have the same attack. I wouldn't call him a boss. He is a boss. He's got boss written on him, he's a boss. He's got the boss to make. Do you remember that ring? My name's Jill. My name's James. Do you know a ring there? Oh, you casted a blade, well. And you did that one round too early. Yeah, I did. Just cause Brent got hurt. What's he gonna do, what's he gonna do?   It doesn't matter, he's not gonna fizzle. Are you sure? No, I'm not sure. I feel a fizzle coming off. I feel a fizzle coming off. I feel the fizz. What's he hitting me? I'm lucky, babe. I'm lucky, bro. If he hits me, I'll cry. I'm lucky, bro. He's got a grudge. I'm lucky about it. Damn it, I need to get that minor blessing. Why did you even hurt Brent? Because he's a boss. Just in case he fizzles. He doesn't have too much health. Okay, kill the second guy with the shield. I told you he was fizzle. That's good though, cause I actually need a heal. I'm too fizzled. I need a heal. Oh no, not reshuff. Don't! No, James, don't! Let me heal and then let me blade and then you'll be fine. Let me heal and then let me guidance and then you'll be fine. That's fine. You can, actually. Why does he know length? That's such a weird thing. He's death, not fire. Oh yeah, these bosses are weird because they actually have mustries in other schools. That's right. Don't worry. We hit Brent this time. Of course he hit me. There's something you don't tell a man when he's about to sleep in a bed. James, can you please just shut up? You're so annoying.  He has no good chat. It's all bad guys. Bedbents. Uh-huh. Rainbows. Rainbows and pixies. Rainbows. Rainbows. Then he gets to boost. Why does he get to boost? Because he has boost of life. Well, James, keep it up. Give me a fizzle glass time.  That wouldn't have killed if I didn't hurt. It wouldn't have killed if... Why is he... We know that. That's not obvious. Oh, I got hips as well. I got a piece zapper.  He's a pest. Okay, this is the boss. You need to have your storm... Put your mess prison on. James? Do you have mess prison on? Do you have sirens? Yeah. Okay, go on.  It doesn't matter. You just won't be hit as much. So, do I put mess prison on now? Yes, right now. Actually, wait, why am I bleeding myself? I'm bleeding you. Oops, that was awkward. Did the bulls attack also? No. They shield. That's why I want them to die quick. They're naughty. See, they shield. Yeah, and themselves. Oh, smoke screen. D-dubs, right? Oh, and he's hitting me, of course.  So, yeah. I'll try and get a tower shield on. Yes, hit as soon as you get sirens. Like, blade... Do storm lord, actually. Blade and do storm lord next. James, you should have probably let me and God first, because then I could have used my guidance before you shot. Why did you not put it in? What do you have in your deck? D-dubs. Blade. I just played it, myself. Good. Me, myself, and I. Bizzle. James Fizzle, so be funny. Bizzle's a blade. Bye, deal again. Guidance. Okay. Yeah, when you can. Oh, my God, I'm not the minus 40. Don't worry, this is just easy. Bosses in the future get much harder than this. How's it confusing? I don't know. We might die, then. How's that funny? Jesus. That's a blade head, as well. Dude, here he goes. I'm the only one that resists that, which is really upsetting. Please, please don't fizzle on this. Dude, you got it. I just made two more. Wait. How do you enchant? How do I enchant with TC's? I have a lot of them. That's what I got on my life before PvP. Any fizzles? No. Oh! It was 100% as well. How embarrassed are you? Don't scream. We're going to, like, blow the... I need to put a headphone warning now. Jesus. Can you just heal again, please?  I'm really trying to, but...  Man. Um... Can you... You can't even storm lord. Damn it. Okay, I'm going to shield. Actually, no, I'm going to... Shit, why did you... I've got a questioner. What is it? Did you try and heal... even heal Bri? I can't. You can. With your healing current. Your healing current.  Oh, damn it. It's so annoying. You're telling me. How did you do this at the right level? You need, like, four people. Dude, we're going to lose. Can you swing? No, you didn't. Oh, I still can't do it. Come on, James. Dude, I can't do nothing. You can't do nothing. You can do something then. Well, at least do a hit. I have no hits. Tempest. You could... One storm. If I used Tempest...  That smoke screen is so annoying. It's fine. Why does your pip have to fail at this?  That one doesn't actually matter. Because now they're all shielding from you, so you're going to do nothing. Well, mate. Yeah, you. Yeah, but I'm not even going to do this.  Yeah, Storm Lord hits everyone.  Storm Lord time! Is it enchanted? It's fine, fine. Just let him do his own thing, honestly. It's going to kill half of them anyway, so it's fine. That's not the deal. Why do you think so? James is going to fix all that. What? One smoke screen on you. That's what I said to her last time. Minus 40. Mm-hmm. Mr. Not Gonna Fizzle. Oh, he didn't fizzle. That's so surprising. Oh, it's kind of against the odds of you. Based on percentage, James, you would have fizzled. You should have fizzled. You probably had, like, 10% chance to not fizzle.  I wasn't doubting that. Because I know that. Kill the boss now. Yeah, well...  Why did the... When did the thing get taken off? James can't hit anymore. It has to be me or you. Because you don't have a prism. That's what I haven't got my pips to do.  That'll be fun. Can you heal me? Yeah, I can. Okay, I don't have enough shields. How much else does he get? He has 931. How much are you going to hit for? Nothing at this stage next to him. No. Do you want me to heal you? Yeah. If you get me 9 pips, then I can pips. Well, I can't be tempest. I won't look at it. You said you did last time. Why? I had to discard to heal. I had to discard to get... So that I could get back. Getting well on myself, by the way. You should heal yourself next. No, I'm going to take you. I'm going to take you. I'm going to take you, just in case. Should I play guidance? No, I'm going to pass. Mm-hmm. I'm just going to get hurt. Please don't do that. Oh, this does OP damage with that. OP damage? It's like a one-pip spell. It's crazy. It's so hot. I'm going to get there. I'm going to get there. Okay, cool. I only need to get one more level, and then I can get my satyr. Yeah. Okay, I'm hitting. I'm in a corner. James, just a little hurt. He has done any little hits. You know, if I actually did put two hits, I'd probably put it. Wait, did I put two hits? He probably could have been hit. Wait a minute. He's so dumb. He probably could have been hit by now. He let me put two hits. Well, if you put the Anana Pips I told you to put in, and it didn't come down, and you actually didn't pit fail all the time, then we would have actually killed them already on that first hit. Kill them, please. Please kill them. Oh, damn it. You didn't die, James. It's so annoying. I'm at 1294. It's so annoying. Okay, I'll kill them next round. Hopefully, possibly around after. Huh? You just cut that. I could siren. See what treasure cards we've got. Oh, nothing there. This is the most... This is the worst battle ever. And if you don't use it? No, it's only if you use it. This is the worst battle. Like, honestly. This is the worst battle ever. It's so hard.  Oh, this storm guy. If James dies, it's fine. Please kill him. Kill him!  Now a storm bubble. Oh, yes, dude. They'll be great. No, it's not.   I got 800. I have more than 100. Dude, I can hit! Go! Use your hits, James! Yeah, this may or may not kill him. I'm just going to pass because you can. I'm going to do that. Oh, would it trust me? To belay him, unfortunately. Open your mouth. That's Ariel. No, it's Sirens.  She's obviously Ariel, right there. Yeah, you kill them, that's great. JJ. We did it. Yes, I did as well, secretly. Yay, we got cart stuff. Is that good? Oh, I got a pet. Is that the most annoying thing about having a boot-seed dot in the pack? That was quite the other chat, wasn't it? What do you say you and I make haste for a less hostile venue? Did you get some crowns? Yeah. I don't use the thing. I'm going to use it. Don't.  Are they actually bad? Yes. Can I give it one go? Yes. You leveled up as well, I think. I do. Wait, guys. Everyone, take a picture of me with my cat. Breed, you know what that means? Finally, Fury is redundant. No, it's never redundant. It's not ever redundant. Okay, we're done now. No time to celebrate, though. We have to get a move on. There's no way to catch it. I hope it hasn't left yet. Thank you. Okay, thank you for watching. I hope you guys enjoyed this episode of the Craft Box Road to 110. No, we're still going to 100. We're stopping after that. No, just kidding. We're not. We're going to have a new series for that. It will be called Road to 110. Anyway, thank you for watching. It's going to be the same series, though. Seriously. No, it will be a different series and a different playlist. Anyway, thank you for watching. We'll see you next time. Next time, we will do the Cats and Stines Lab. Yay, more dungeons. Yeah. Bye. And remember, Craft Outside the Box.


Hello, how are you? Hello, thank you. That's my daughter, I'm Sharwani. This is Derek. Hello, hello, how are you? So, how long have you been here?  You're the one, guys. Thank you.  She's the one with the dog. You're the one with the dog. But Molly also. Okay, enough.  Let's not talk about it. She's been on a two-hour, three-hour trip. Thank you.


Hubertropics is a CGI research program that aims to improve the lives of millions of farmers across Africa, Asia, and Central America, using an integrated systems approach and unique platforms of partnerships. These platforms, often known as innovation platforms or multi-stakeholder platforms, are spaces of learning and change. They bring together individuals who often represent organizations, who come together with different interests by working together towards a joint goal. Because of the systems focus, the partnership focus, and the platform focus of the human tropics, it is essential that we have a large group of champions who can lead and facilitate and implement such platforms. That's the main reason why we're holding this workshop here, bringing people from Asia, from Africa, from Central America, all together to discuss innovation platforms, to decipher their DNA, if you will, to see how they fit in the overall agricultural innovation system and look at monitoring and evaluation aspects. And our hope is that when they go back, they'll be more confident and more able to facilitate and to lead such platforms in all of the areas where they work. I think the key aim for me was to encourage people to think about different ways of agricultural innovation. So you have very technology-oriented approaches, you have very systems-oriented approaches, and within the human tropics, we want to promote systems-oriented approaches to innovations. Actually, I want to share what I know with the participants on how they can monitor and evaluate processes that are usually very uncertain and that have no clear objectives yet. It's a workshop that's focusing on really looking at what constitutes platforms and looking at the differences between research for development platforms and innovation platforms within the human tropics. The IMITATOX program is a program that's come out of its books to engage all the various stakeholders in the generation and development of technologies that will help improve the level of participle people. I see human tropics coming at the right time when there's a fatigue as far as doing research is concerned. The platform is a new thing in the world of development, agricultural development, innovation system. And it's about the things that we see as challenges are bordered around, you know, people looking at it as what is there for me, you know, how do I benefit from it? But it's taking time for them to understand that it's all about their level of system. So I think we are getting around it, but hopefully within a year or two they'll begin to see value in it. I'm going to give you a learning point. The first one is that we learn that the only permanent thing is change. So that's good. We learn a lot about using different tools to wrap it up, or is that of what the problems are? Scoping information from relevant stakeholders. We learn how to move people together, how you can carry out your role as a facilitator. I've been really stimulated by the different case studies that have come up, both from the participants and also by the case studies we did, for example, this morning. And because now when I go back to Centromeco and I can tell people, well, this is what happened. People come from different locations and different countries with different experiences and lessons. So you can see that there's cross-legging going on. A couple of aha moments that resonated well within the groups were looking at complexity and terming complexity as being part of the DNA of innovation platforms really helped a number of people sort of grasp the concept. Likewise, the constant evolving nature in that change is really the only constant that we have in this system is really also something that helps a lot of people connect with the topic and adapt their thinking. Well, I think one of the key things that's been happening is the exchange of the participants amongst themselves, the learning that's actually going on outside of the workshop itself. We have such a diversity here from across the globe and also at different stages of how they're working. So it seems to me the most important thing that's coming out is this exchange of ideas of learning beyond the workshop setting. I just hope that the capacity building will go down the ladder to all the relevant stakeholders in the implementation process of the project. Fantastic workshop.


For today's video, I'm going to show you how to create this glittery green smokey eye. If you're new to the makeup to your channel and you like these type of tutorials, then make sure to click the subscribe button below. And if you're already subscribed, then thank you and welcome back. Now it already showed you how to create just a basic smokey eye using two eyeshadows, but now we're going to add a few extra steps to make it kind of glittery and fun. So to create this look, you're going to need an eyeshadow primer, some mascara, and some falsies. A small pencil brush, I'm using the E01 by Blanquem Viscosmetics. A fluffy brush, I'm using the E20 by Blanquem Viscosmetics. And for eyeshadow, you're going to need a deep green with like a metallic finish. A medium matte shade, this should be about one shade darker than your skin tone, or you can use your contour or bronzer. And then a light mint green or a silver. And I'm also going to be applying some glitter. This is by Blanquem Viscosmetics as well. So we're going to start off with that eyeshadow primer. I've already applied it all over my lids. This is going to give the eyeshadow something to hold on to while creating a Blanquem Viscos for us to work on as well. So it's a very important step. We're going to start off with that green shade. And what I want to do is I want to really coat the lower part of the lid right by the lashes. In order to do this, I'm going to take my ring finger and I'm going to press a little bit of the shadow onto the lash line and then use a clean finger to kind of buff and blend this in. Take your time with this. You really want to create a nice base. Alternatively, you could use like a green or a black pencil liner and apply that to start with. However, if you don't have one of those handy, this is a great alternative. So we're basically creating a base. Now it doesn't look like much here, but as we start to apply the shadow, then we're going to end up with something like this and that works out a lot better. So you should end up with something like this and then you're going to take your EO1 and I'm going to take that green eyeshadow again. And what we like to do here in the makeup chair is we like to squash the EO1 down to create a fan shape and then tap the eyeshadow over the top. And this just gives us a lot of control. So we're taking that green eyeshadow and placing this over the base that we've already applied with the same shadow. And this time it's going to sit really nicely and that shine and that glitter is going to show up a lot more. And you should end up with something that looks like this. Now we want to make sure we fade this shadow out because we can't just have harsh lines. So we're going to take that mid-tone shade, your bronze or your contour, and take that fluffy brush and start to blend this above the shadow that we've already applied. So into the crease of the eye, a little bit on the lid. If you end up kind of smudging the green, you can always just reapply a little bit more, but just make sure you're very slowly building this up and blending it out. And then I'm going to take that mint green shade. I'm going to tap this on the inner corner of the eye. Now I actually would have preferred if I'd used like a silver. Afterwards, I was thinking about it. I think a silver would work better. But once you've applied a lighter shade to the inner corner, you can then apply a liner on the waterline. This is optional. I actually again kind of second-guessed myself. I should have used a black or even a green, but I ended up using a new shade, but it's totally up to you what you use. Going back in with that green shade, I'm applying this on the outer corner of the eye and then using my fingertips to kind of blend it in. This just prevents it from getting too low. I want it to be kind of lower on the outer edge and then blending upwards. And now for glitter. This is White Diamonds by Blancavas Cosmetics. And all I did was tap this on the inner two thirds pretty much above and below. I've applied lots of mascara then, lots of lashes. And there you go. A super easy glittery look. Again, make some changes if you like. I actually really think I should have gone for silver and black liner. But there you go, that is the finished look. I hope you guys enjoyed it. If you did, then please give it a thumbs up. I'd really appreciate it. Remember, be kind to yourself. Be careful and gentle with yourself. And I will see you in the next one on Monday. Bye.


Hello everyone. Thank you for joining us today in threat report roulette. We have some amazing guests today and I'm going to go through the list really quick. We have Chris Russell and he's the head of information security for T zero group. We have Koran and he's a CTI analyst for a big for consulting cybersecurity firm. We have will Thomas with us and he is a security researcher for side jacks. We have me as in Olson or cheerio and I am a senior cybersecurity analyst at a fortune 500. And we have the stakeholders we have the blind hacker he's representing red team.  We have Danny D Henderson and he hails from being previously a CTI analyst but moving more in deeper so he's going to represent the deeper slash CTI angle of threat report roulette. We have Jorge and he's the most awesome unicorn joining us from side he represents red and purple is the CTO. And the co creator of the C2 matrix which I love and also a ton of other stuff and I'm a huge I stand Jorge like honestly I do. I can't help it he's awesome. And then finally we have Ricky Banda and he has a really fancy title he's the incident commander for Amazon security incident response team so all of these people are big deal super awesome season professionals coming in to share their knowledge and wisdom. For the threat reports that we have selected and for the purposes of this talk they are all TLP white. So we will not be discussing any TLP amber anything or TLP red or TLP green so. And also to the focus of this talk is and panel is more actionable takeaways taking the information to the next level and you know we wanted to bring Vegas to you in case you're not there in person so threat report roulette. And as you can see on the screen we have a threat report roulette wheel. And what we're going to do we're going to spin the wheel will call on an analyst. And then they will give their insights for a couple of minutes and then from there, we will have our stakeholders and the reason why we have stakeholders is because, well they're the consumers of all of the info. And if they don't like it, that's bad. So we want to make things that they like and want to consume and are actionable within their org. And for the sake of debate and all of that all of the reports we're going to assume are actionable and relevant to their organization as they're as the analysts are performing their analysis. All right, so is everyone ready to get started for threat report roulette. Yay. Okay, so, and audience just just before warned, I have a timer. And so I'm going to be timing the participants responses. And they have approximately five minutes to respond. So if they meet time I'm going to yell time. So don't just before warned that I will be very vocal in moving the session along. So I am going to spin the wheel. What's it going to be the deeper report number two. So I am going to the GitHub going to look at the deeper report number two. Oh, that's so to know kiwi and reval and in case you guys want to play along in the audience. It is at bit.ly or it's a bit.ly link DC 29 roulette DC 29 roulette and that takes you to the GitHub page. So, let's see deeper report to, and that goes to Kruster. And you have 15 seconds to organize your thoughts and I'm going to start the countdown right now. Excellent. So, right off the bat, these DFI reports are very extensive. These are the type of things that multiple consumers in your org can use from the technical and strategic side. So among the reports we've gone through I found these to be the most beneficial for the widest audience. In the particular report I went through and looked and saw some particular things that I would key on on for kind of creating some custom indicate indicators, aside from the static hashes and IPs and domains that we all know, change, pretty, pretty rapidly. So for this one with reval. One of the things I noticed during the processes is that they have Excel calling WMIC.exe. If you're not familiar with that process that's a kind of information kind of system gathering process. There's really no reason why an Excel document should ever be calling that in a normal environment. Maybe you have a developer or a sys admin that built their own custom tool but in that case you'd know about that and this would be something that would be, you know whitelist in some way but right off the bat if you have an Excel document calling WMIC.exe right off the bat if you create a word for that. That's one of the early stages of this kind of kicking off you can get an indicator there. But again, there'll be fringe case here and there with an admin that may be built an Excel spreadsheet with all their scripts, it's possible. Another thing here I noticed is that as we know with any of these with reval and either malware ransomware samples, they're going to want to maintain persistence so they're going to try and do some registry key modifications and whatnot. For this they're going to they created a run once key. And that's something that's you know pretty common for programs that want to boot up every time the system starts but they use an asterisk meaning that it is, it is also boots up in safe mode. So if you think about it what other applications that do you have users that want to have to open up during safe mode. So right off the bat if someone, you know, makes a registry modification for one once key and uses the asterisk that means it has to be open during safe mode, and that would be another thing I learned on because again what what user what what normal normal circumstance in your environment is that is that necessary. If this is like a custom server that has software that has to boot up during safe mode this is all going to be done during configuration this is all going to be created while you're not in an alerting mode. So, while these things in the wild and people are actually servers this isn't something a user and admin is going to make changes to they're not going to they're not going to have it boot up in safe mode unless they're in some sort of change window configuration menu period where you would know when if you saw the story when you're concerned about it with it. Another thing to do again changes schedule tasks, although you know changes schedule tasks as an indicator. That's a key thing to look at because how many of your common users are making changes to schedule tasks on their own it's just not that common you find that the situations where in the, you know, certain key value pairs that kind of indicate the schedule passes something that keeps your system since another good indicator. Let's see. Oh, another thing is, so prior to executing the ransomware to threat actors created GPO disabled windows defender cluster system. If you don't have some sort of alert that alerts when your any viruses turned off then you know that's kind of table stakes but that's another key one right there. So that's from, you know, GPO is being pushed in general they should be getting some sort of change window so it's being pushed from a non admin or a new account or something. So those are some of the, you know, aside from the obvious ones that I picked up on from the stock. Anyone have any thoughts. Awesome. So that is actually perfect within the time. So now our stakeholders will be able to comment on this particular report for the next five minutes. And I am going to start the timer and Jorge is raising his hand so please feel free. Awesome. Awesome review there. Thanks so much on something you said very briefly at the beginning that some of you might not have caught and that is that the deeper report is a great resource and goes to the widest audience and I think we're going to see this as we go through the roulette here. There are going to be some reports that target different audience some are targeted to people in the detection world some are targeted to red teams some are targeted to analysts looking up IOC and things like that right so that we love the deeper report. Sponsor them if you can I definitely sponsored them out of pocket. They're amazing. And yes this report right everyone's heard about. Right, especially after to say, and I like the intro right you can read the first couple paragraphs without being that technical and still get something out of this report, but once you dive deeper into it, we get all the way to the point where you have actual procedures. And one that you touched on right now was adding a registry key that has an asterisk in it. I was actually today days old so first five minutes of roulette you taught me something I did not know that an asterisk in front of a registry key meant that it could start in safe mode so thank you for that bit of knowledge and again shout out to the deeper report I'll let someone else weigh in. Oh, I just want to say I was today years old as well when I heard that so thank you so much for your insights this is why I love this. And I wanted to add to besides me being a sponsor of the deeper report as well or I pay out of pocket, because I think awesome.  Is actually the community involvement with the deeper report to like beyond, beyond analysts using it, something that I thought was really interesting was black matter 23. And he tweeted out eight detection ideas and 18 rules, 18 rules. And so he has a whole GitHub with detection ideas detection rules, based solely on the deeper report and so I just really love to see the positive impact that the deeper is having within the community, and all of these amazing professionals around the world, kind of like the people on this panel they're people from around the world, coming together and discussing cybersecurity and protecting organizations. So, thank you. Anyone else want to comment on this. Okay, Danny. So for me as a incident responders L three sock analyst. Some of the things that I like about this is that it tells me what the it gives me information of what to look for if I'm trying to find the intrusion. I don't know about where the files can be located. There are some things that will change, but there are some things that are static based on how the adversary likes to place things so finding things and say a public folder is out of the ordinary. So those are artifacts that I will look for. And furthermore, some things that I would also try. We usually get a week, usually respond to alerts. And so some of the alerts is generally when a fishing occurs, but finding finding any sort of registry. And such as the safe mode is definitely definitely a interesting indicator to look into. So looking into the auto runs. So the so the deeper report is definitely a good one for us and responders. Okay, thank you and will any comments. So just as quick one is, I believe that this was one of the first instances of ice ID being used as the initial access factor for our evil, which was a, which was an interesting evolution for that particular malware family because it has is associated with other ransomware actors so it's definitely a malware family want to prioritize if you're worried about being targeted by ransomware operators. I totally agree with this initial access brokers, like that's where the money's at right. Okay, so I, if everyone's okay, we're going to move on to the next threat report thumbs up. Good. All right, so I'm going to spin the wheel and secure list. So this one. Who goes to who wants it who wants it first. Is this the black kingdom. Yes, do you want this one Danny. Yeah, I'll take this one. Okay, it's all yours and I'm starting the timer right now. Okay so black black kingdom that one was one of the more interesting ones. I don't remember. This one was actually using Python Python for the entries, especially web shells. Since this one doesn't web shells. This one, the web shells are generally targeting for facing public facing servers. So the, as far as a public facing servers go, these are some ways that we want to take a look at one, finding out that there's no. There's no ordinary PHP files or any sort within our servers and especially the for this one this one targeted the Microsoft Exchange server, which was it one of the big, big events back in the couple months ago. Once that was out we did. In fact, thinking of my last. People are work for. I had to go around making sure that no one made any authentications and uploads into the exchange servers. But the way that this was interestingly done. They part coded some when some folders to exclude rather than using regex. For me as an incident responder, I would be looking for any sort of anomalous PHP files or execution within the exchange server stat the client owns. And that's pretty much about it this one was. It's more into depth and how it was programmed but from a TTP perspective, it's what it would generally upload in. And so that for me is where I would be focusing on to make sure the client does not have any anomalous uploads into their servers. Oh, that's great. That's great and definitely. You know, look at patching those CDs that are in the report to right. Yeah, yeah, like, and prioritizing them if they aren't already done, and any stakeholders that are interested in commenting on this particular report. I'll be glad to take that. Okay, thanks Joe. From the explanation here. You know, again, so as a red teamer, my job with the most of these reports is to either because this report does is not as in depth as the, you know, DFI our reports deeper reports, which are again plus one fantastic. The report is pretty in depth though but they do the specific report the CTI channel that, you know, we're getting it from here on the stakeholders panel is really telling me, you know, the things that I do as a red team with these is I either have to try to write the same ransom where the same tactics TTPs they have to help try to break into the network to again help write IOCs. Take it to my detection engineering team say, Have you guys seen these things we're about to run these things for you guys to help you see if we can commit to creating better detections and better IOCs for the indicators of compromise so while writing these things. This report is thorough enough that I could take it and then from a CTI perspective, you know, it's one of the things that I have to ask though is is looking at this report. Am I even a potential affected, you know, an affected client. Am I a target of this report, you know, I want to spend the time that I have an NA 95 40 hour work week making sure that I'm writing the right defenses here for my, my company for the company here. So when it comes to this report. Some of that stuff is here and it but again some of the TTPs are definitely here and I can see that the CBEs they're attacking so I can again try to reverse engineer find POC's proof of concepts that'll work and then develop again a single executable or string or an individual POC that mimics this specific kind of ransomware malware. Okay, thank you very much. And oh it looks like we have Ricky chiming in. Do you want to chime in really quick Ricky. Yeah, yeah. So, looking at the report. Listening to what we have folks saying right. It's something like this. And I'm thinking, this is impacting me, or this is affecting anywhere at work or an organization I'm responsible for business, something like to that effect. And I have to be able to look at these reports and take action. Right. So, I'm looking at something like this. And I have multiple lines of pipelines of work kind of already kind of going out of my mind right now. I'm thinking, okay. We have this scenario. Are we prepared from a insurance perspective. Are we prepared from a PR perspective. We have a lot of stakeholders in these areas. Meanwhile, I'm assigning two to three incident response engineers to go into log dives network are in points making sure that we have detection and engaging with the service owners and service teams to go and get me, you know, data. So that can also make those types of assessments. In the end or I'm probably also on the phone with our legal team.  I have a, you know, a potential right for exfiltration within an environment I own or, you know, something that is going to impact the business in some way shape or form. And so, of course, I don't want to take up, you know, some time, but the thought process when I look at something that's related to ransomware or exfiltration data or anything like that is, I have to think through what the actions on objective are what the impact is going to be. And that I am collecting the right people in the room to make sure that we have an appropriate response to handle everything from PR to legal to financial to investigation risks all in kind of the same room organizing all of these cats. No, that's great. And so Ricky makes a really great point that I need to point out, especially for people in the audience that are in larger organizations, building those relationships ahead of time so that you know the product donors and you know the people and you understand their their backup schedule let's say your go to person is on vacation. And you don't know who to contact other than that, you know, and just understanding who to contact building the relationships and forming those connections before something horrible happens. I know it sounds simple but it's definitely been very beneficial in my experience to be able to just be like yo, I need your help with something and already have that report established. I hope everyone's okay I'm going to click on another report unless anyone else has something to add. We're good. Thumbs up. All right. And I'm spinning the wheel. Ooh, BC security to let's see which one that one is. Let's see that one is the overview of Empire 4.0 C sharp. And let's see who wants to take that one we have. You want that one will. Um, could I pass for the next one. Okay. Let's see who wants this one. No takers. I can take it. Okay, go for it. Um, BC security are the makers of Empire Empire, what was originally called PowerShell Empire is one of the most popular command and control frameworks. I know that because of a project called the seat to matrix. I also chose Empire as the seat to to teach people read to me and my security 564 class. The sans red team exercise and adversary in relation course, because in a classroom environment you want a tool that is consistent and reliable, and does what you tell it to do every time. And with a lot of C twos that's just not the case, but Empire is one of those so back in July 2019. The original creators of Empire said that they were ending development and the folks over at BC security took over development which is fantastic. In this case, we're going to talk about in this blog post it's talking about the latest version of Empire which is 4.0 and C sharp and right off the bat in the intro. You can see that a lot of the new C twos are popping up and the way to create implants actual payload, or the stage or that runs in your environment is before was PowerShell right. Lots of people say PowerShell is dead. Sometimes it was Python, but we're definitely seeing an uptake in C sharp and C sharp is a language you can anyone can actually write C sharp code you can download a version of visual studio community and compile your own C sharp code. So, in this case, we take a look at well how Empire works the latest updates to it how to run it to C to framework so you have the server component, which is your listener listens on a particular port. And then you can see that Empire has mostly HTTP listeners. So, we know that the C to will be over HTTP and HTTPS, you set the delay and jitter which is how often that end points going to call out, and then you have to create a payload. And they call the stager. So the net new here is the ability of creating this C sharp stager. It's just the code used to compile that payload, and get it to execute on a window system. So if you see this just like PowerShell when PowerShell was starting to be used that infamous Derby contact or def contact by Dave Kennedy. There was no detections right and even today PowerShell is tough to catch, but essentially what what we're seeing is the move to see sharp because of that same thing right. PowerShell is able to execute a lot of antivirus and anti malware and anti exploit solutions aren't catching a lot of C sharp code. So that's really the biggest net new here in this case if you haven't tested or used Empire, by all means, check them out. There's a whole bunch of C twos out there, and understand how these work right. A lot of these are open source they're used by red teamers and adversaries alike, and the ability to understand and be able to see how those stages execute on the target system as a C to server and look at it is it is going to be important. So definitely more of a red team CTI report, not much talk on detection or anything like that. So, back over to you. So the reason why I included this one is because PowerShell Empire Empire, as for me said, it's really popular with the threat actors and so before the new release of PowerShell Empire, there was a paper called disrupting the empire, identifying PowerShell Empire C two activity and it's a sands white paper. That's available on the sands website under their resources and paper section, just apply I and so in it they talk about HTTP request behavior. They talk about anomalous URIs and a bunch of other network based indicators to be able to detect PowerShell Empire. So, there's even whole get hubs with like detection rules that are for those specific configurations of Empire so now that they released a new version. You know, I wanted to highlight this report to bring attention that we need some defenders to come in here and be like, to do another sands white paper on this new edition of PowerShell Empire and to perform security research and to try to find a way to find those unique tool marks. I believe key dot 89. Let me let me get his proper Twitter handle so I don't miss quote here. Stand by key dot 89. He changed his name. So I'll have to look it up later. Anyways, I'll put it in the chat and I'll put it in the GitHub, but he's a big proponent of something called tool marks. So, trying to detect the custom out of the box and I'm horribly paraphrasing it, but detecting custom out of the box features of like you know cobalt strike PowerShell Empire, or a lot of the other really popular tools that ransomware actors and cyber criminals and all of that use. And they just use it straight up the box and they don't try to reconfigure stuff sometimes so like taking that low hanging fruit essentially building detections around it of course it's easy whatever but getting it out of the way so that at least you have that as an alert in the event they decide not to modify any of the settings. I wanted to bring that to people's attention. Does anyone else want to comment on this particular report. Oh, Danny. Yes, and then in the meantime I'll look up what he changed his name to on Twitter. So with this one is definitely looking for network based indicators at this point. So some of the signatures that we've I've seen before was going to news dot PHP. Now, whether it's that change or not for this one. So we're looking for indicators that is by net flow, or any of the same that's letting me know that there's rapid connections going on to a certain IP or domain. And really quick I did find the person's name. I just spelled it wrong. I apologize. It is ke y dt 89 Harlan Carby. He is an author of books and super smart, and he talks about tool marks and he's a deeper professional sorry for interrupting Don't no worries. And then from there, I can pivot to the host that is emitting that connection and try to find any other indicators from there that may be agnostic of the C two. But for now with this one, especially with update, I'm going to have to rely on network indicators that that indicators are beginning. Okay, anyone else talk quickly say so the, you know, tool marks. There's, there's a lovely tool out there for cobalt strike called charm J arm. If you think you're being targeted by a cobalt strike tool server, you can turn around and use charm to scan the endpoint, and it will literally see if it can find like the proper files that usually cobalt strike user running so tool marking be a real valid way to do that because again Empire, when it boots up there are certain ports that need to be open. When you are executing from a external source. And as Georgia said that there's a lot of a lot of these things the reason that they became popular was because the PowerShell and then when people said PowerShell was dead, people like not really put sort of and then so they're like but here's this sharp thing that you know you've been worried about PowerShell so long. It's like an ira construct that's been here all along. And then, you know, again using the C2 matrix. This will tell you that this is one of the most popular ones and I love Empire myself so. Thank you. Yeah, I know it's a great. It's a great tool. Okay, so are we good to move on to the next threat report. I took a couple host based indicators I came up with for that one that I'll slip in real quick so first of all CSI.exe fsi.exe without any command line arguments that's going to be an indication of interactive session. Any sort of arguments being passed from those two executables renamed instances for those binaries network connections from those binaries.  And if, and then, you know, whitelist what your developers or whatever is doing but other than that the average user is not going to be using either one of these. So simply the presence of those executables without any command line arguments right off the back should be indicator that someone is not on the host running that. Okay, thank you so much. Are we good. Anyone else, we're good. Oh, okay. I will move on and spin the wheel. Okay, what's going to land on. D for report number one. Let's see what that one is and who iced ID and cobalt strike versus antivirus. Ooh, let's see. Who wants to speak to that one who wants to start on that one. Any takers. Danny. All right, Danny, go for it. Let me get myself mentally prepared for this one. Yeah, you have 15 seconds. So, yep, thank you. I can jump in on that one afterwards too. Okay. I was just muted. All right. Based on what I was reading on this report this one, this one is a resurgence of the use of ice ice ID and some big interesting key points is the use of not only the cobalt strike but WMI. And from what I've seen, they were trying to use the it start to start off with the, with the word of spear phishing word doc, which will release an HTA file and close a JPEG that is actually a library. It was executed by run deal deal 32 or rich serve 32. And then it tries to do is tries to do the host discovery, as well as encoder PowerShell payloads for month that what I like about this deeper report is the fact that it goes through the very stages of how it operates is credential access is it's how it tries to do a host discovery and the actual manipulation of WMI see other processes and also shows that the antivirus has already installed can detect some of those anomalies. But it's also a good to know of what WMI sees that should not be coming consecutively in the environment, especially when it's trying to do a view in the domain and trust domain admins and trying to find your domain list. See some visible on the lateral movement, some other key takeaways with this one that I do like is for me as a sock analyst, not only am I looking for any strange WMI see activities, but processes ran by services or certain PowerShell activities, especially when IEX is used, which is trying to execute something. No, that's great.  Chris. Okay, I have a little bit of comment to, and then well it looks like. So, you know, getting mentioned, pretty much a lot of stuff I'm going to cover I'm just going to kind of get a little specific on a couple of them so we're at the bat. If you see Mimi cats bad. So anytime that pops up, you should have some sort of learning for that. Second, JPEG, making any sort of process command line arguments. That should be some sort of indicator there. There's no reason why JPEG ever needs to do call for system info IP config anything like that so although you know, it would be hard to basically do every single file type that does that they may not use JPEG they may kind of pivot you should probably figure out you know what what file type you can include in some sort of list to do as you recon next. The adf continued Intel and scanning piece. So, calling the adf.bat to do again more system gathering information that's not something that any user does it's not something you just add it's going to do. They've got tools to gather information they've got all sorts of other things that you're never going to sit in there and gather it that way. So, if adf.bat is calling any sort of process and command line this information gathering that should be some sort of I will see. Last thing, a lot of movement registry value set, we're using encoded PowerShell. There's never a time we're going to have any users that need to hop to another device using registry value set and within coded encoded PowerShell. As we know you're going to use that if there's some sort of escape character in there or something that will make the code not run there's nothing that you would need as a normal host that are a normal user that can pivot to another host legally in an environment. There's never an argument you'd have to run that would require you to use encoded PowerShell, except for some really rare edge cases in which case there's probably some sort of change window. No that's great unless you're in some environments where the where the people like to use encoded commands all the time. A lot of people just like doing it for, for, for, you know, moles. But like, you know, Sentinel one all these tools now they'll they'll decode it for you they'll check through it you can you can still dig into it but yeah you're right people use it when they don't even need to. Yes, and will, did you want to comment on this one. Did I get that right. Okay. So this another another blog piece on I study attacks and as we know it's it's associated with ransomware but it's it's another important piece because I study so in this specific one, the I study variant is using a loader called what the research is the photo loader so it uses a JPEG file to sort of deploy a hidden payload. Like following I study and the overall campaign that so it's been it began as a banking chosen and turned into an access broker but more recently in like the last maybe six to nine months it has been pushed by a spam botnet called the shatak botnet linked to to a T a 551 and it's distributed a range of payloads but more recently it's it's iced ID has been it's primarily primary payloads so it's, it's another example of what to expect if you're if one of your endpoints is infected by study but I mean the main point that an analyst should be bringing if they decide to write this report up and you know document as an instant before they should be sort of explaining why I study is an important threat and it's it's basically taking over from emo tech the emo tech botnet that got shut down in January by the European and Ukrainian police and things that's there's been a vacuum and iced ID and quackpot have basically taken over and pushed in parallel campaigns between them. So it's, and then you know cobalt strike. That's what we normally see with with a lot of these malware family so it's the two to sort of staple threats to be aware of be aware of be aware of and as as the guys have explained some good detection that you should be using to alert on. Okay, great. Thanks well and the little comment that I wanted to add and we'll hop on over to the stakeholders really quick is from a point perspective, I saw the discovery and I saw dubby make IP config system info net and I'll test net and a bunch of other related processes that would need to execute within a short amount of time. And so if you're performing a hunt for this type of thing instead of making it per se specific about command line arguments, grouping the processes, you know, of like all of these all of these within this particular report that are used and then you time bound it by like you know 24 hours or even an hour or whatever right because they move very quick. And so, I believe if you do that, it'll cut down on false positives within your organization of, you know, the random person just doing IP can beg right because you don't want to learn on that because that'll, that'll create a lot of traffic a lot of alerts to you. So aggregating the whole report as a whole, and then creating a hunt around that specifically and then investigating any potential anomalous activity of any matching results if you do have any, which I'm hoping you don't. That was my contribution. Anyone else want to say anything. Well, as a stakeholder I'll say, you know, again another from from my CTI panel if you guys were feeding me this information again as a red team or I can definitely help you recreate the actual IOC's actual detections with our tools. The DFI report and what you guys have explained is again one of the like the level of detail they go into that then comes to you guys that can then come to me. And then I can take to the operations team is just phenomenal but the the the tooling here again being things that are free simple easy to use. And and but good news is it's highly detailed so we can write the right detections and build the right tooling to emulate it. Okay, thank you. And I want to throw a little bit of a mix in and have Karen speak about our mystery threat report that we picked. So, Karen's going to have three minutes to speak to this mystery threat report. And then we're going to close on out with for Hey, and the rest of us commenting on a size threat Thursday, because a I love it, and be I warned you all that I'm a huge standard for Hey so. Okay, so, Karen has the floor and you have three minutes. Okay. Um, okay, so this report mystery report is basically for the recent basal odor bizarre backdoor campaign. It's the report in in terms of you know how it's reporting is done it's it's very good. But I feel that it's not very accessible because some stakeholders for example, DFI are they would like quick access to the TTPs they would like quick access to the IOCs. The TTPs and IOCs is generally like you need to siphon off by reading there's a lot of reading involved so. But the good thing about it, like this has good content this has good screenshots diagrams explaining the attack chain screenshots about the email. Even the you could say the the unique unique IDs that the attackers used to identify all of the victims. And another good point about this that there there are hunting rules where which which can be used with Microsoft 365 defender. It's pretty good. The only disadvantage as I said before is which heavily relies on actually reading the report and some stakeholders might not like it. In terms of key takeaways this is particularly very interesting because I think Microsoft has been tracking this for around a month and this is like one of the newer campaigns. So, and due to it resulting into ransomware which is I think it's Conti or Ryuk. It's definitely interesting in that sense because basal odor is a prolific mother and any updates on their TTPs the new campaigns is particularly interesting. In terms of speaking about the the detection rules, the detection rules, particularly provided by them are extremely good because it provides tracking for the, you know, hunting for the emails. It even includes hunting for the exfiltration to of the ransomware, which is I think our clone. Yeah. And other than that, there's very particular interesting thing and I want to like focus on this is the use of social engineering in in like this whole campaign. Because the highlight of this is they use the attackers the threat actors use like a fraudulent call center to in case the victim decides to call that number which is provided in the email that can actually lead to like a person without a call center and social engineer the victim victim into, you know, malicious execution link attachment whatever it can cost more harm. But that is very interesting in my opinion. And other than that, nothing else for this report. It's a good report but I feel like they could have included the TTPs and the ICs like a particular table in the last to make it easier for people who are researching it. Okay, and the comment that I would like to add to this is Unit 42 Palo Alto's unit 42 recently came out with a report 729 2021 on Baza Loader. And so in it they have like they have a bitly link that has a bunch of IOC's and stuff like that it may not necessarily be tied to the Baza call campaign. You know, I would need to perform analysis to see the difference between the Microsoft report that was the mystery report. It was called Baza call. Let me go to the top of the report Baza call phony call centers lead to ex filtration and ransomware. So I would have to compare the Baza call report to the one that was produced by Palo Alto with the IOC's but the point is that it both that both of them involve Baza Loader. So I would look at that and take a look at those IOC's as well as, you know, that's BAU activity. But the whole point of this is that if you get a report and they don't have the TTPs or IOC's or whatever, pivoting on that and looking for other organizations that may have done reporting such as Palo Alto unit 42 they do some awesome work to and supplementing the reports that come out for that. Anyone else want to comment on that before we move over to Jorge. Okay, Will, and then Danny. Yeah, so the Baza Loader Baza Baza call campaign is, is a really interesting one to me. It's linked to the infamous riot can Conti gang, which I think crowd strike tracks as Wizard spider. This group is very well known for using like a range of delivery techniques that purposely are designed to evade detection. I wrote a blog about all the different techniques they use and Baza call is the one that currently running and the thing that makes it so interesting is there's no malicious links inside the email itself it's just a phone number that you call and are guided to. And then once you reach the fake website that they created, you have to enter a code to be able to download like the spreadsheet that they give you so there's so many different ways to thwart researchers like myself and methods to evade detection. It just makes this gang really prolific threat and one to definitely, you know, actively hunt for because there's a chance your tools won't pick them up. Thank you so much for stating that and Danny. Okay, so this one is a very interesting one because this one actually involves more than just going into the network and trying to hunt this one involves working with your organization to put out a message. As far as dealing with fake call centers, just a reminder to the end to the core to the employees. Hey, you are you have a call center in the organization. You, this is an external email that's out. You're not using that you're using this particular one. And I bring this up because there's been cases where there's been. There's been a lot of calls acting as Microsoft trying to help with situation with computer issues by running commands was a fake call center. So a little similar but not quite it was involving running scripts, which inevitably effect infected the host. This is where you want to leverage your departments to help put out a message. Now, from the forensic side, I see a couple of things of say the use of cert util depending, especially when certain tools being used to do URL cash to grab things from another location. So I'm going to watch out for. Okay, great. And now we will take it over to the final report. Just an overarching discussion of threat Thursday. I had the wonderful opportunity through independent research to speak with some really awesome professionals and they've actually operationalized this threat Thursday, where every Thursday it comes out they mobilize their team. And we need to like perform an actual real purple team exercise related to this particular report that they put out and we happen to have Jorge with us. So I thought it would be nice if he could just speak to it really quick and another reason why I'm really really like this is that they include not only community based information sourced information, but they also have like a detect and respond section as well, which I feel is exceedingly exceedingly important so thank you very much Jorge take us take us out. Yeah, no just real quick. So this was something that I started early when I joined site been there for about a year, essentially was to make some of these threat Intel reports and reports from instant responses more actionable and bring value to organizations. We do kind of what we did here right which is consume the cyber threat Intel reports and make them actionable for the purposes of adversary emulation and essentially what we're now calling attack detect and respond right. Essentially, everything we talked about today was something post initial access I think all organizations nowadays are working under that assume to breach of, you know, whether it was an O day which we've heard a lot of, or I see or trick bar or whatever, what happens next right. So we take these reports the deeper reports, a fun one. Right, and actually get those procedures and that's, I think something where the CTI world can improve on is actually providing the procedures the deeper report being a great example of that, because then people like myself like Joe blind hacker. So we grab those actual procedures, and then we can create these emulation plans and, of course, we build these emulation plans and share them with everyone. We share them with our customers in JSON format they can simply import it. But of course we want to contribute to the community as well so we publish them as attack navigator heat maps as well. We can also give the actual procedure so just want to copy and paste them or use something like atomic red team, you can still get value out of it right we don't foresee that to have to use site and things like that but here's a perfect example of the the the one you're Microsoft published how a nobellum was getting around defenses, leveraging this attraction and what we read through the attraction say wait, there's a new procedure here, and I looked it up on atomic red team it wasn't there. All right, let's play with this figured it out. And then of course contributed back and this particular case actually ended up PRing it into atomic red team as well. But of course you want to do it manually I showed how you can create an ISO file with malicious payload in it. And then just through Twitter kind of purple themed it with cyber monk and Florian and black matter. Essentially just finding ways to do the detections I believe Ryan also was pregnant was on there. So, so yeah it's a lot of fun, it's probably one of the funnest things that I do is get to read some of these reports and build these adversary emulation plans and share them with the community and yeah they're they're all free. Like I said, you don't have to use site for this, we're big believers and giving back to the community and doing purple teaming so thank you for for a little for that shout out I appreciate it and like I said just trying to give back to the community. Yeah, thank you so much and thank you to all the panelists to. I really appreciate you coming to share your insights and wisdom and knowledge I learned something I hope the audience learned something as well. Thank you very much I hope you enjoy the rest of deaf con I believe this airs on the last day. So thanks for taking time out to watch threat report roulette. Once again, the bit.ly link is bit.ly slash DC 29 roulette. And that's how you can get it or you can find it on my GitHub it's Ontario and it's called deaf con 29 BT, BTB threat report roulette, and it provides the list of all the threat reports the threat report roulette will as well as our favorite resources and more information if you want to contact any of the panelists. So thank you very much and have a great summer.


For this example, I'm again going to start with a number in our floating point format, and convert this back into a decimal number. So the first step is to take this number and to put it into the floating point format so we can see what the various fields are. C is 1, 1, 0, 0. 5 is 1, 0, 1. And B is 1, 0, 1, 1. I have 0s for the rest of my precision bits, so they're not going to be terribly important. First I've got a 1, so I have a negative number. We'll have a leading 1, and then the rest of my mantissa. Now I have my exponent. I have 128, which gives me my bias plus 1. And then I have 11. So 11 plus 1 will give me 12. Now I need to convert this back into decimal. I could move my binary point 12 places to the right and figure out what those three bits, the value of those three bits are. Add them up, or I can try something else. I can convert this to 11 times 2 to the 9th. So in this case, I've moved my binary point over three places. Dropped my exponent accordingly, but I still have the exponent. Now, I know that 2 to the 10th is 1,024, so half of that is 512, and I know that this is 11. So really I want to do 11 times 512, which is reasonable to do by hand. 11 times 512 is 5120 plus 512. And this is a negative number because we have one for our sign bit. This floating point number corresponds to negative 5,632 in decimal.


Yeah, it's been fantastic. I've had four years. I'm at the club first year in the youth team and then, you know, to get fast-tracked into the first team the way I did, I was very fortunate to be given the opportunity by the club to play at such a young age, you know, to play in the first team and then to go on and represent the club in the continental sense in the Asian Champions League was fantastic. And I'll be forever grateful for the chance that the club gave me, you know, until the day I retire. So the clubs done great things for me and the club will continue to grow and grow. I've no doubt about that. Yeah, I've been really fortunate to have a really good couple of coaching staffs at the club to make me, you know, come along as a player. And, you know, from day one I was all about improvement for myself and improving every week and showing that I could be a consistent player at such a high level. So it was just about improving. And like I said, I was lucky that I had a good coaching staff around me and great players around me to support me and to help me through that process of getting better all the time. Obviously, the people that you meet at the club, everyone's fantastic and the relationship you build with people at the club, you know, over a four-year period obviously you build such a strong relationship with a lot of people. And then obviously the fans, everyone knows that the fans are some of the best in the league.   But, you know, I'll look back on that stuff with fond memories later on. But, you know, now it's just about progressing and looking forward to my next step in my career.


Hello and welcome back to the crowd folks. My name is Brenton today, we're on episode 12 of the Wizard101 Death Walkthrough. If you haven't checked out last episode, go do that. We defeated things and collected things and did the whole of the Palace of Fire. So if you haven't checked that out, go do that. And this episode we are going into the Throne Room of Fire, which is a dungeon and it will take about 30 minutes. Or if you log out or leave for more than 30 minutes, you'll have to restart from the beginning. Yeah, we understand. So yeah, we are doing that and hopefully finding out with the Order of the Fang now. It's basically what we do in this place. Okay, Serpent Stuff. That is the quest, isn't that? Yes it is. Yes it is. We also last episode of So Good New Spell and it's Vampire, so that's cool. That's the exit. Oh, I don't want to leave. I am going this way. There's two ways you can enter this place. You can enter it from either side of the hallway thingy. And what's funny, you can like walk outside the map now. Oh no, don't worry, don't worry. There's a different place that I'm thinking of. Unlucky. Unlucky, Brent, you had one job. Okay, 15 gold, that's cheeky. Professor Winthrop. There you are. I've got my notes now. Let's get to work tracking down the Order of the Fang, shall we? We'll most likely need the use of a Serpent Stuff, so I'll trust you to procure one for us. Okay. According to my notes, the Order of the Fang used magic to hide their location. Only by using a powerful artifact in this Bat Room can we undo their spell. There, that slot must be where the Serpent Staff would go. And I remember Prince Manunirini swung it at my head when the Tuts attacked. I'd rather not have a repeat of that. Could you go down the hall and battle Prince Manunirini for the Serpent Staff? We must set things right. Okay, let's go do that. Yeah, this is Crocatopia, you know. It's quite cool. It's the model of Crocatopia. Wow. So yeah, let us go and defeat Manunirini, who is down this way. This is the first dungeon of Crocatopia, which is kind of cool. I don't think we actually ever go into a dungeon in Woodland City. So this is the first dungeon ever, I think. Unless you do Sunken City, but I don't do that because it's quite hard. I will have to do it on some time soon because I need to go to the end and defeat Grubb, who's at the end of it, for one of the quests for death. None shall pass through the door unless all the braziers burn with red flames. Um, yeah, these challenges are really, really hard, especially when you get stuck. No, they're actually super easy. Just read the book and basically I'll tell you what to do. One color, red, red, red. And here is Prince Manunirini. You are in the presence of royalty. Bow or suffer my wrath. Okay, let us do this. I put in the death prism just for the Croco-Mummy, just in case. By just in case, I mean, if we ever get it and need it, we'll be great.  Oh, dark sprite, eh? Oh, death trap. No, dark sprite. That's cheeky. It's quite a feisty start there. Already very offensive. Didn't even have time to prepare. Um, okay. I mean, two blades are fine. We need two blades in the end, so sure.  Thanks a lot. Much appreciated. Much appreciated.  Okay, and you're going to do a goal, I know you're not. That's unfortunate. Dark Fury. He thinks he's good, but he just keeps spamming Dark Fury as it's kind of stupid. Like, that's what all death people do, like, at low levels. I think they're so good, but they just keep spamming Dark Furies. 350. Um, yeah, we're going to discover in a year, we won't need to heal much. We are going to just buff you up with it, and we're going to hit the buffs. Hit the buffs. Here we go. Here we go. Boop. Boop. Blade 40. Boom. 6, 6, 7. Full health again, which is absolutely fantastic. 3, 3, 3. And we will then play... No, we've already played it. We need to diff prism, and then we will... Boss. I mean, Banshee. Yep, Banshee, definitely. No, what's the sidebox? What? Since when? Since when? Why? Why? No phone, who dis? What? Um, okay, Banshee. Okay, that's fine. We will wait another round. We will wait another round, another round, Dark Sprite. Yeah, okay. 1, 1, 4. Oh, 83, that's pathetic, geez. This would have done, like, 60, probably, if there wasn't a trap there. Might as well. We have the pips for it, so might as well use bigger spells. I mean, we get health back from it, so not complaining. Boop. Boop. Boop. Blop. 603. Oh, so that's pretty good. Okay. 301, that's good. That's... that's dumb. Serpent Staff collected. We got a Fire, a Robe, and a Pink Dandelion. Pink Dandelions are so common that I don't really care. So, yeah, getting pulled in here is really common, so don't do that. Just saying. And let's go back to Professor Winthrop. This way. And this way. And don't get pulled ever again, because that's bad. Because they're all death. Yeah, no, getting pulled is so easy. Like, terribly easy. And we'll go through this way. And this way. And this way. And Map Room. And we'll go down here. And we will talk to Professor Winthrop. Good work. Now to use the staff. We'll soon figure out the order's secret location. It's no use. The staff isn't working. What could I have done wrong? Professor Winthrop stares at his notes in frustration. Then looks up suddenly with a bright gleam in his eye. That's it. In ancient times, the Eye of Croc was placed here in this room. But Croc and Common recently took it in a show of power. You must go further into Croc and Common's lair, defeat him, and take back the Eye of Croc. Then we can find the Order of the Fang at last. Okay. I'll be back once I am at Croc and Common, because he is very far away, very, very far away. Because we can't go this way, because there's a gate there. So we have to go all the way around there. No, we can't go that way, because there's a gate there. We have to go all the way down there, and then up, and then around, and then find him somewhere around here, because he circles around. So like, what? I'll be back in a sec. Okay, so there is another puzzle room here. Where the two suns shine, the way will be clear. But not if there is any moon shining. So basically, we need to turn the obelisks into sun. It's a very self-explanatory, but I thought I'd show it just because some people don't know this. And I did recently get, like, when we did our last series on this one-on-one. We got a whole lot of comments like saying, oh my god, I didn't realize this. Like, it's so simple now. But yeah, it's just like that. So then we go through here, and we see all of these um, death people. So yeah, that's pretty um, pretty, pretty, pretty, pretty, pretty intimidating for me, because they're all death. But you know what? We carry on, and we, we just, just take, take the punches a second. Oh god, no, we don't want you. Geez, get out of here.  Get out of here. Don't want you. Watchman, nice. Where are you? Where is Kraken Common? There she is. Okay. Uh-oh, we're gonna get a death guy just as well. I keep my prism in. Um, yeah. See? Just as well. Um, do we get the death guy? Hopefully we don't. That'll be bad. No, we're getting the death guy, definitely. Yep, here he comes. Oh, well, that's fine.  So I'm not, oh, I didn't restock TCs. That's not good. That ain't good.  Oh well, we'll do that. Get some good damage on here to start with. Um, three seven eight is pretty good. It's half health. Um, nearly 400 as well, which is crazy. Yes, I can math, I know. It's a shock, isn't it? Um, and then we'll just try and whistle, whittle it down just a bit more. We'll do a banshee probably on the New England ancient guard once we get a blade or we will vampire the boss. I don't know. We'll see what happens. See how it goes. Look at this. It's a weakness. Told ya. That's not funny. Don't like that. Don't 450, oh man. Oh jeez. I don't know if I can do this. Yeah, we'll get that weakness off. Get some more damage on the boss. Don't know how much that did because can't see.  But anyway, she's less health now, which is good.  Two power pips, what, what? I've never had two power pips before, jeez. Um, okay. We will definitely go for a, um, excuse me, wait. Wait, wait, wait, wait, wait, why would you do that? What, what, what is this? What is this, jeez? What is this? This is, this is, I'm gonna fizzle. I don't even know why I'm casting it. I'm gonna fizzle.  Smoke screen? What? Why? Since when? Geez. Okay. Three power pips.  What is this? What is this witchcraft, jeez? Okay. Well, we'll vampire you. You're gone. Get some health. Um, then I mean we can vampire Grucking Comet as well, so that's fine. 603301. There we go. Perfect map that time. Fizzle, thank you. And we will vampire once more. We don't have a vampire. Banshee it is. Fizzle it is. Gotta love those fizzles. Oh, sunbird, jeez. We're gonna go down to at 600 and, oh, 505 even was. I did 310. That is quite a lot. I was expecting 200, not 300. Let's do a wraith just for fun. We haven't done this for a while. Okay, good. No fizzle, which is good. Boop. Boop. Boop. 585. Nice. Laugh. There we go. 298. Done. There we go. That is perfect. So, yeah, now we can head back to Professor Winthrop. The easy way. Um, because gate's now open. It's a normal thing as you know. Gate opening after you've already done the thing that requires you to walk all the way there. Just normal. Not this one, the other one. There's a chest. Second chance chest if anybody wanted to know. Um, and look, we can go through this way now. Wow, what a surprise. Oh look, we are right there. What a shot. Oh my gosh. Okay, and we will talk to Professor Winthrop. Who is over here still? Splendid! We have the Eye of Croc. Since you defeated Croc and Common and Prince Manunarini, you deserve the honor of discovering the Order of the Pang. Go on, take the Eye of Croc and the Serpent Staff and place them in the slots on the platform. Then, repeat the ancient words I taught you. I don't remember you teaching me any ancient words, but you know that's fine. You do as the Professor says, and shout the ancient words Alka-Sharah-Kazam. A bright light flashes, and with a crackle, the map reveals the secret meeting place of the Order of the Pang. You've done it! The secret location of the Order of the Pang is revealed. Never would have thought to look there. It's on another island. I need to gather one or two other things here. Meet me back in the Order of Kings. We can continue from there. Okay, let's go back to the Oasis, and we will meet them in the Order of Kings, and then we'll head on over to the Order of the Pang basically. Um, boop, boop, boop, boop. Oh yeah, in between episodes, I completed the other two cycles that we got last episode, so yeah. If you're wondering why I didn't have any other quests, that's why. Yeah, if you ever saw, I don't even know if you cared either, so yeah, you know, that's fine. If you don't care, you know, that's cool. You can do that as well. Excellent! We finally know where the Order of the Pang is. Now we can find them, get the Krokonomicon, and keep it from falling into evil hands. Now that we know where to find the Order of the Pang, we'll need permission to explore there. Go speak with Sergeant Major Talbot by the lake outside. Tell him we may have found a way to set things right again. Okay, let's do this. This is going to be good. Oh god. Lag, lag, thank you. What's how? The Order of the Pang may have the secret to defeating the Tatse, and it's an old book. Indeed, we must ensure that book doesn't fall into the wrong hands then. Their inner layer must be explored at once. There is no time to lose. We set up ferries to Krokosphinx before the crocs attack. Good thing too, I barely have time to think. The boat's there in front of me. Take it across to the island. I hope you find this layer where the Order of the Pang hides out. We could use some good news. Okay, so next episode we will cross over into Krokosphinx. There's some good old secrets hidden there, and some fun stuff if you don't know. See you anyway. Thank you for watching. We'll receive a like and subscribe. If you're very subscribed, press the little bell so you know exactly when I post another video. Follow us on Twitter, links in the description below. And remember, craft outside the box.