Think Bad, Do Good: menuPass

### Overview In this episode of "Think Bad, Do Good," host Jonathan speaks with AttackIQ malware researcher Jose Barajas about adversary emulation specifically focusing on the Chinese cyber actor menuPass. The emulation is derived from research produced by the MITRE Engenuity Center for Threat-Informed Defense, an initiative in which AttackIQ participates and sponsors.

### Key Topics - **menuPass Background and Strategy**: menuPass is identified as a China-based threat group whose strategic objectives align with the People's Republic of China's five-year plans. Rather than targeting victim networks directly, the actor frequently compromises third-party Managed Security Service Providers (MSSPs) to abuse existing RDP access and credentials into customer environments. - **Adversary Emulation Plans**: The Center for Threat-Informed Defense previously released emulation plans for FIN6, APT29, and APT3, with menuPass being their recent focus. AttackIQ codified these research findings into actionable attack graphs within its platform. - **AttackIQ's Anatomic Engine**: Moving beyond isolated atomic unit tests, AttackIQ uses an Anatomic Engine (built on Directed Acyclic Graph/DAG specifications) to chain multi-stage attacker TTPs into automated scenarios that replicate adversary decision points, fallback procedures, and full attack chains.

### Technical Details - **Attack Graph Execution**: In the demonstrated menuPass scenario, the attack begins with multiple discovery behaviors run concurrently. Execution paths are tracked using visual indicators: red lines show behaviors that were not prevented, while green lines represent actions that security controls successfully stopped. - **Lateral Movement & Persistence Options**: Following initial discovery, the scenario reaches a decision point where it attempts lateral movement using tools such as `PAExec`. If blocked, it automatically attempts alternate paths, including Remote Desktop Protocol (RDP) or secondary persistence mechanisms. - **Testing AI/ML Detection Controls**: The multi-stage chained approach specifically helps evaluate AI and machine learning security tools. Rather than alerting on benign-looking individual unit tests, ML solutions rely on cumulative behavioral reputation on a host to trigger alerts, which the multi-step emulation exercises effectively. - **Platform Abstraction**: While users could previously construct complex multi-stage attack scenarios manually using AttackIQ's open Python framework, the Anatomic Engine automates and abstracts this workflow into configurable graphs.

### Takeaways - Emulating menuPass enables organizations to pinpoint gaps in detection and prevention controls—particularly regarding MSP compromise, credential abuse, lateral movement, and persistence. - Multi-stage emulation provides a realistic benchmark for modern ML- and reputation-based security controls by testing comprehensive attacker behaviors rather than isolated unit tests.