Adversary Emulation - Red Team Village - Mayhem 2020
âą
2 gostaramâą772 visualizaçÔes
Jorge Orchilles is an experienced red team leader who has led offensive security assessments for large financial institutions. The document discusses adversary emulation, which involves the red team emulating realistic adversary tactics, techniques, and procedures to obtain access to an organization. This helps evaluate an organization's preparedness against sophisticated attacks. It describes measuring how people, processes, and technologies prevent or detect the red team's activities to identify areas for improvement.
Recomendados
Recomendados
Mais conteĂșdo relacionado
Mais procurados
Mais procurados (20)
Semelhante a Adversary Emulation - Red Team Village - Mayhem 2020
Semelhante a Adversary Emulation - Red Team Village - Mayhem 2020 (20)
Mais de Jorge Orchilles
Mais de Jorge Orchilles (16)
Ăltimo
Ăltimo (20)
Adversary Emulation - Red Team Village - Mayhem 2020
- 2. #WHOAMILed offensive security team at large financial for past 10 years Published industry contributions include: â Founding member MITRE Engenuity Center â Co-Author GFMA Threat-led Penetration Testing & Red Team Framework â SANS Instructor and author of Red Team course: SEC564 â NSI Technologist Fellow; ISSA Fellow â Common Vulnerability Scoring System (CVSSv3.1) â Author of Windows 7 Administrators reference (Syngress) @JORGEORCHILLES
- 3. 3 VULNERABILITY SCANNING VULNERABILITY ASSESSMENT PENETRATION TESTING RED TEAM IN PERSON PURPLE TEAM CONTINOUS PURPLE TEAM ADVERSARY EMULATION Definition: A type of Red Team exercise where the Red Team emulates how an adversary operates, following the same tactics, techniques, and procedures (TTPs), with a specific objective like those of realistic adversary. Goal: Emulate an end-to-end attack against a target organization. Obtain a holistic view of the organizationâs preparedness for a real, sophisticated attack. @JORGEORCHILLES
- 4. 4 An end to end assessment of the entire organization â Main differentiator from penetration testing - Tests the defenders not the defenses (detection vs. prevention) - People, Process, and Technology - Not a limited scope test targeting just a particular product, infrastructure, network, application, URL, or domain â Full Cyber Kill Chain from Recon to Objective â Often blind, unannounced exercise â Determine what TTPs would work, undetected if a true attack occurred and action plan to remediate @JORGEORCHILLES
- 5. 5 Measuring the effectiveness of People, Process, and Technology Documented metrics and timeline of entire exercise â Time and TTPs to obtain initial access â TTPs that allowed moving laterally â Identify TTPs not prevented or detected â Process and time to escalate events into an incident â Time to contain â Time to eradicate â Process to engage hunt team, coordinate communications, alert leadership and correlate all events and realize sophisticated, targeted attack @JORGEORCHILLES
- 6. 6 ASSUMPTIONS That attack wonât work here because⊠âWe applied all patchesâ âWe have outbound DLPâ âOur users would never open a macroâ âOur applications have MFAâ âOur network is segmented and only way out is through proxyâ âWe have firewalls, AV, and IDSâ Trust but verify Can the Iranians breach us? @JORGEORCHILLES
- 7. 7 Training and improving the Blue Team â Every Red Team Exercise will result in Blue Team getting better â As you measure the people, process, and technology you will see improvements â Lessons will be learned, and processes improved â The more you train, the more you improve @JORGEORCHILLES
- 8. 8 FRAMEWORK & METHODOLOGIES â Cyber Kill Chain â Lockheed Martin â Unified Cyber Kill Chain â Paul Pols â ATT&CK â MITRE Regulatory â CBEST Intelligence Led Testing â Bank of England â Threat Intelligence-Based Ethical Red Teaming â TIBER-EU â Red Team: Adversarial Attack Simulation Exercises â ABS (Association of Banks of Singapore) â intelligence-led Cyber Attack Simulation Testing (iCAST) â HKMA (Hong Kong Monetary Authority) â G-7 Fundamental Elements for Threat-Led Penetration Testing (G7FE-TLPT) â A Framework for the Regulatory Use of Penetration Testing and Red Teaming in the Financial Services Industry â GFMA (Global Financial Markets Association) @JORGEORCHILLES
- 9. INITIAL ACCESS EXECUTION PERSISTENCE PRIVILEGE ESCALATION DEFENSIVE EVASION CREDENTIAL ACCESS DISCOVERY LATERAL MOVEMENT COLLECTION COMMAND AND CONTROL EXFILTRATION IMPACT DRIVE- BY COMPROMISE APPLESCRIPT .BASH_PROFULE AND .BASHRC ACCESS TOKEN MANIPULATION ACCESS TOKEN MANIPULATION ACCOUNT MANIPULATION ACCOUNT DISCOVERY APPLESCRIPT AUDIO CAPTURE COMMONLY USED PORT AUTOMATED EXFILTRATION DATA DESTRUCTION EXPLOIT PUBLIC- FACING APPLICATION CMSTP ACCESIBILITY FEATURES ACCESIBILITY FEATURES BITS JOBS BASH HISTORY APPLICATION WINDOW DISCOVERY APPLICATION DEPLOYMENT SOFTWARE AUTOMATED COLLECTION COMMUINICTION THROUGH REMOVABLE DATA DATA COMPRESSED DATA ENCRYPTED FOR IMPACT EXTERNAL REMOTE SERVICES COMMAND-LINE INTERFACE ACCOUNT MANIPULATION APPCERT DLLS DINARY PADDING BRUTE FORCE BROWSER BOOKMARK DISCOVERY DISTRUBETED COMPONENT OBJECT MODEL CLIPBOARD DATA CONNECTION PROXY DATA ENCRYPTED DEFACEMENT HARDWARE ADDITIONS COMPILED HTML FILE APPCERT DLLS APPINIT DLLS ACCOUNT CONTROL BYPASS USER CREDENTIAL DUMPING DOMAIN TRUST DISCOVERY EXPLOITATION OF REMOTE SERVICES DATA STAGE CUSTOM COMMAND AND CONTROL PROTOCOL DATA TRANSFER SIZE LIMIT DISK CONTENT WIPE REPLICATION THROUGH REMOVABLE MEDIA CONTORL PANEL ITEMS APPINIT DLLS APPLICATION SHIMMIMG CMSTP CREDENTIALS IN FILES FILE AND DIRECTORY DISCOVERY LOGON SCRIPT DATA FROM INFORMATION REPOSITORIES CUSTOM CRYPTOGRAPHIC PROTOCOL EXFILTRATION OVER ALTERNATIVE PROTOCOL DISK STRUCTURE WIPE SPEARPHISHING ATTACHMENT DYNAMIC DATA EXCHANGE APPLICATION SHIMMING BYPASS USER ACCOUNT CONTROL CLEAR COMMAND HISTORY CREDENTIALS IN REGISTRY NETWORK SERVICE SCANNING PASS THE HASH DATA FROM LOCAL SYSTEM DATA ENCODING EXFILTRATION OVER COMMAND AND CONTROL CHANNEL ENDPOINT DENIAL OF SERVICE SPEARPHISHING LINK EXECUTION THROUGH API AUTHENTICATION PACKAGE DLL SEARCH ORDER HIJACKING CODE SIGNING EXPLOITATION FOR CREDENTIAL ACCESS NETWORK SHARE DISCOVERY PASS THE TICKET DATA FROM NETWORK SHARE DRIVE DATA OBFUSCATION EXFILTRATION OVER OTHER NETWORK MEDIUM FIRMWARE CORRUPTION MITRE has developed the ATT&CK Matrix as a central repository for adversary TTPs. It is used by both red and blue teams. It is rapidly gaining traction as a de facto standard! @JORGEORCHILLES
- 10. FRAMEWORK Most organizations will take a hybrid approach based on the frameworks and methodologies just introduced â Threat Intelligence â Planning â Testing â Closure @JORGEORCHILLES
- 11. T1086 â PowerShell T1068 â Exploitation for Privilege Escalation T1003 â Credential Dumping S0194 â PowerSploit S0192 â Pupy S0002 â Mimikatz S0129 â AutoIT Hash Value IP Address TACTICS | TECHNIQUES | PROCEDURES https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html @JORGEORCHILLES
- 12. ATT&CK Navigator
- 13. @JORGEORCHILLES Category Description Description APT19 is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing, and legal services. Goal and Intent Exist in the network to enumerate systems and information in order to maintain Command and Control to support future attacks. Command and Control Commonly Used Port (T1043) - TCP port 80; Standard Application Layer Protocol (T1071) - HTTP; Deobfuscate/Decode Files or Information (T1140); Data Encoding (T1132) - used Base64 to encode communications to the C2 server Initial Access Spearphishing attachment (T1193); Spearphishing link (T1192) Execution PowerShell (T1086); User Execution; Hidden Windows (T1143) - used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden; Obfuscated Files or Information (T1027) - used Base64 to obfuscate commands and the payload; DLL Side-Loading (T1073) Discovery System Owner/User Discovery (T1033); System Information Discovery (T1082) System Network Configuration Discovery (T1016) Persistence Registry Run Keys/ Start up Folder (T1060) - establishes persistence by setting the Registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRun Defense Evasion Regsvr32 (T1117); Scripting (T1064) - downloaded and launched code within a SCT file to bypass application whitelisting techniques
- 14. 14 TRUSTED AGENTS RULES OF ENGAGEMENT ATTACK INFRASTRUCTURE o Limited number of people with knowledge of the exercise o When players find out about exercise their behavior changes o Individuals whose daily roles and responsibilities put them in a position to contribute to reducing the risk of causing unintended impact to production systems and/or inaccurate senior or external escalation Establish the responsibility, relationship, and guidelines between Trusted Agents and Players o Rules for Blue Team o Carry out all activity as any other incident o Trusted Agents will report what incidents are being investigated o Do not report exercise related items to regulators o Rules for Red Team o Do not bring down any business process or operation o Communicate all actions during daily brief Red Team is responsible for setting up infrastructure to emulate TTPs o Choose and procure external hosting service providers o Purchase domain names o Generate domain certificates o Setup mail servers o Setup phishing and credential theft sites o Confirm reputation and categorization of all domain and IPs o Setup Short and Long Haul C2 infrastructure o Configure custom C2 tooling o Test external C2 communication PLANNING @JORGEORCHILLES White Team or White Cell
- 15. 15 Matrix of command and control frameworks for Red Teamers â Google doc of most C2 frameworks: www.thec2matrix.com â Documents various capabilities of each framework â There is no right or wrong, better or worse framework â Find ideal C2 for your current objective â Wizard like UI to select which one: ask.thec2matrix.com â How-To Site for using C2s: howto.thec2matrix.com â SANS Slingshot C2 Matrix Edition @JORGEORCHILLES
- 16. Letâs do it Live! @JORGEORCHILLES
- 20. 20
- 21. 21 VULNERABILITY SCANNING VULNERABILITY ASSESSMENT PENETRATION TESTING RED TEAM Emulate APT19 with Empire3 & Starkiller https://howto.thec2matrix.com/c2/empire#red-team-village-mayhem-demo-of-apt19 @JORGEORCHILLES
- 22. 22 â What TTPs were prevented? Why? Document these too! â What was detected? How long did it take? - Time to contain - Time to eradicate â Where processes followed? - Process and time to escalate events into an incident - Process to engage hunt team - Process to coordinate communications & alert leadership - Process to corelate all events and realize sophisticated, targeted attack CLOSURE @JORGEORCHILLES
- 24. 24
- 25. 25
- 26. Threat Catalog Cyber Threat Intelligence Emulation Plan C2 Server & Reports for the Business MITRE ATT&CK Production Automated Emulation Initial Access https://medium.com/@jorgeorchilles/purple-team-exercise-tools-a85187ce341 â Red Team will be asked to repeat TTPs â Donât waste Red Team Operator time re- doing the same TTP while engineers, operations, and SOC get detection working
- 27. Thank you! Q & A?@JorgeOrchilles @C2_Matrix https://www.thec2matrix.com/ https://www.sans.org/sec564