KEMBAR78
Introduction to red team operations | PDF
Sunny Neo, profile picture
Uploaded bySunny Neo
PDF, PPTX2,118 views

Introduction to red team operations

This document provides an introduction to red team operations from the perspective of a penetration tester transitioning to become a red teamer. It discusses some of the key differences between penetration testing and red teaming such as scope, reconnaissance required, stealth, and infrastructure setup. The document outlines principles for red team operations including protecting infrastructure, logging everything, managing information, and avoiding detection. It also provides examples of tactics, techniques and procedures used in red team operations as well as considerations for tools like Cobalt Strike to help evade detection.

Download as PDF, PPTX
Introduction to Red Team Operations Sunny Neo (@sunn_y_k) sunny@live.com.sg
#whoami •Perpetual Information Security Student •Penetration Tester @ Centurion Information Security •It was really hard to get here - On and Off Fever Last Night
Disclaimer •All views are mine and not the company I work for or any organisation that I am affiliated with. •I take NULL credit for all the materials presented here •I am here just to share the good work from awesome people and have fun
Shout Out Raphael Mudge (@armitagehacker) •Awesome resource on Red Team Operations •Advanced Threat Tactics (2015) https://blog.cobaltstrike.com/2015/09/30/advanced-threat-tactics-cou rse-and-notes/ https://www.youtube.com/watch?v=4w7krkqxRck&list=PL9HO6M_MU 2nf8Fa5bVefBW-9bg5Rx94_c •https://blog.cobaltstrike.com/
Shout Out - Jeff Dimmock (@bluscreenofjeff) •Awesome materials on Red Team Infrastructure •https://bluescreenofjeff.com/2017-12-05-designing-effective-covert- red-team-attack-infrastructure/ •https://speakerdeck.com/bluscreenofjeff/building-a-better-moat-des igning-an-effective-covert-red-team-attack-infrastructure •https://github.com/bluscreenofjeff/Red-Team-Infrastructure-Wiki
Shout Out •Anyone who shared their experience with me or answer my stupid questions over Twitter / Slack (BloodHoundGang) / Beer(s)
Objective •Share my journey on learning about Red Team Operations •Bridge the gap between Penetration Testers and Red Teamers
Penetration Testing •Scope Provided • Limited to No Reconnaissance Required •No Stealth required • Scan everything in Scope • Run tools out of the box (Did you rebuild the tool?) •Simple to No Infrastructure setup
Red Team Operation • Test your security investment in a realistic way – objective based • Depend on the type of operations • Full Scope Testing (Physical, Social and Cyber) • Long-Term Operation • Threat Emulation (Emulating a real-world actor) Source: https://blog.cobaltstrike.com/2015/07/09/models-for-red-team-operations/ https://blog.cobaltstrike.com/2016/02/17/the-threat-emulation-problem/
Red Team Operation •Generally • Limited Information Provided • Require Stealth • Require Appropriate Infrastructure Setup for the operation
Transitional Challenges •Mindset •Habits •Scale Pen Tester Red Teamer
Mindset •Boxed-in by Scope •Emphasize on Coverage for Systems and Vulnerabilities in Scope •Does not look for the easiest path to objective
Habits •Guided by Mindset •Scan everything in Scope due to emphasis on coverage •Does not apply adversary’s tradecraft but whatever that gets the job done
Scale •No clearly defined scope - How to start? •Excessive Information - How do you manage information gathered along the way due to the vague scope?
Principles for Red Team Operations (Mine) •Protect your Infrastructure •Log Everything! •Less is More •Don’t Get Caught
Protect Your Infrastructure •Why the need for Infrastructure? •Why the need to protect your infrastructure?
Protect Your Infrastructure •Why the need for Infrastructure? •Why the need to protect your infrastructure?
Typical Penetration Test Infrastructure Source: https://bluescreenofjeff.com/2017-12-05-designing-effective-covert-red-team-attack-infrastruct ure/
Services Required for Red Team Operations •SMTP Server – Phishing •Web and Database Servers – Phishing and Storing Stolen Credentials •Payload/Staging Servers – Storing and Sending Payloads •Multiple Teamservers – C2
Shell Management •Never do anything from just one shell and one team server •Always try to persist and expand more shell accesses •Red team infrastructure design is critical for covert operations • Short Haul Servers – Initial Access + Post Exploitation Activities • Long Haul Servers – Low and Slow Callbacks + Session Passing •https://blog.cobaltstrike.com/2014/09/09/infrastructure-for-ongoing -red-team-operations/
Redirector and Filtering Source: https://bluescreenofjeff.com/2017-12-05-designing-effective-covert-red-team-attack-infrastructure/
Redirector and Filtering Source: https://bluescreenofjeff.com/2017-12-05-designing-effective-covert-red-team-attack-infrastructure/
Apache Redirector - .htaccess Source: https://bluescreenofjeff.com/2016-04-12-combatting-incident-responders-with-apache-mod_rewrite/
.htaccess Blacklisting •Jason Lang (@curi0usJack) •.htaccess to redirect • known AV companies IP address ranges • TOR Exit Nodes •https://gist.github.com/c uri0usJack/971385e8334e 189d93a6cb4671238b10
Automate Your Infrastructure • Painful to rebuild everything for each engagement • Automate Infrastructure setup with CoalFire’s Red Baron TerraForm Examples • https://rastamouse.me/2017/08/automated-red-team-infrastructure-deploy ment-with-terraform---part-1/ • https://rastamouse.me/2017/08/automated-red-team-infrastructure-deploy ment-with-terraform---part-2/ • https://github.com/Coalfire-Research/Red-Baron
Red Baron Source: https://github.com/Coalfire-Research/Red-Baron/blob/master/exampl es/complete_c2.tf
C2 Protocol Considerations Source: https://bluescreenofjeff.com/2017-12-05-designing-effective-covert-red-team-attack-infrastructure/
Command and Control (C2) Security • Protect your customer’s systems and data • You don’t want your agents/beacons to be hijacked or confidential data leaked • Evaluate the C2 security based on • Encryption • Authentication • Anti Replay Attacks • https://medium.com/@malcomvetter/responsible-red-teams-1c6209fd43cc
Staged Beacon Process Staged Payload Public Key TeamServer Victim Meta Data Session Key VictimTeamServer TeamServer Victim Initial Callback Encrypted with TeamServer Public Key
Staged Beacon Process Tasks TeamServer Victim Task Output VictimTeamServer Encrypted with Session Key Encrypted with Session Key Source: Raphael Mudge - Advanced Threat Tactics (2 of 9): Infrastructure https://www.youtube.com/watch?v=3gBJOJb8Oi0&feature=youtu.be&t=49m55s
Log Everything! • Important to have timestamped logs for • Timeline of Events • Clean up • Investigation if anything goes down • Empire and Cobalt Strike are fine… • cmd.exe? • PowerShell? • bash? • Metasploit? • RDP?
Log Everything! Tool Command Command Prompt prompt $D$S$T$S$P$G PowerShell PowerShell Profile/GPO Start-Transcript -Path C:psloggingtranscript.txt -NoClobber –IncludeInvocationHeader OR Computer Configuration – Administrative Templates – Windows Components – Windows PowerShell -“Turn on PowerShell Transcription” Bash ~/.bashrc #Enable Timestamp for Command Line and Use Screen to log session PS1='D{%F %T} [u@h W] $ ‘ screen -L -Logfile engagementXX.log bash #Expand History Limits, Enable TimeStamp and Append commands to History for multiple terminal export HISTSIZE= export HISTFILESIZE= export HISTTIMEFORMAT="%d/%m/%y %T " export HISTCONTROL=ignoredups:erasedups shopt -s histappend export PROMPT_COMMAND="history -a; history -c; history -r; $PROMPT_COMMAND" Msfconsole ~/.msf4/msfconsole.rc set ConsoleLogging true set LogLevel 5 set SessionLogging true set TimestampOutput true set PromptTimeFormat %Y/%m/%d %H:%M:%S
Less Is More: Information Management •Don’t just collect information mindlessly •Use as many scripts as possible to perform data mining •Have some processes/tools to categorise the information/logs collected so that it can be easily lookup •http://www.harmj0y.net/blog/redteaming/push-it-push-it-real-good/ •https://vincentyiu.co.uk/cobaltsplunk/
Don’t Get Caught? Toolset TTPsTarget
Target • Knowing your target • Knowing what kind of controls they have • Controls • Email Filtering Gateway • Egress Filtering and Authenticated Proxy with Domain Categorization • IDS/IPS (This Gen, Next Gen, Future Gen) • Sandbox • Antivirus (This Gen, Next Gen, Future Gen) • Endpoint Detection & Response • Security Operation Center with Analyst looking at alerts
Tactics, Techniques and Procedures (TTPs) •What is the mode of operation? • Smash and Grab • Diversion • Long-Term Operation
Tactics, Techniques and Procedures (TTPs) •Tradecraft – Bad Guy’s Best Practices •Learn from the Bad Guys • Threat Intelligence Reports • https://github.com/kbandla/APTnotes • https://github.com/aptnotes/data • MITRE ATT&CK Framework • https://attack.mitre.org/wiki/Main_Page • https://github.com/redcanaryco/atomic-red-team
Toolset •Are your tools suitable for the operation? •Are you able to make operation trade-offs based on your knowledge of your tools? • What is the workflow of the tool? • What artifacts are created?
Metasploit & Meterpreter •Web Delivery Module with windows/meterpreter/reverse_tcp
Web Delivery Module Process 1. Run the PowerShell One-Liner to download and execute PowerShell Stager 2. Stager fetches the (encoded) Stage (DLL) and pass control to the Stage 3. Stage performs (decoding) and Reflective DLL Injection to run the actual payload
PowerShell Stager on Wire • Run the PowerShell One-liner to download and execute PowerShell Stager
Stage on Wire •Stager fetches the (encoded) Stage (DLL) and pass control to the Stage
EnableStageEncoding Option •Web Delivery Module with windows/meterpreter/reverse_tcp •EnableStageEncoding => true
Encoded Stage (DLL)
Memory Artifacts
(Reflective) DLL Injection Overview Process B Process AAttach Write DLLPath or Write DLL ContentProcess B Process A DLL Process B Process A New Memory Section Allocate Memory Execute - LoadLibrary / Reflective LoaderProcess B Process A DLL Process A New Thread Source: http://blog.opensecurityresearch.com/2013/01/windows-dll-injection-basics.html Step 2 Step 1 Step 3 Step 4 *For DLL Injection, DLL File has to be written to disk
Staged Meterpreter Memory Artifact Payload: windows/meterpreter/reverse_http
Staged Meterpreter Memory Artifact Decoded Stage
Staged Meterpreter Memory Artifact Actual Payload (metsrv.dll) Running
Metasploit Paranoid Mode •(Generally) Metasploit should not be used for Red Teaming because most of its payloads can be hijacked and many signatures have been created for them •Use Paranoid Mode if need to - Payload UUID Whitelisting and SSL Certificate Pinning to prevent hijacking •Use “reverse_winhttps” instead of “reverse_https” to enable SSL Certificate Pinning for Stager
Cobalt Strike •Adversary Simulation Tool •Features • Team Operation • Client Side Exploitation • Asynchronous Post Exploitation • Covert Communication Flexibility
Cobalt Strike - Default Staged Beacon
Cobalt Strike - Default Stage Memory
Cobalt Strike - Default Beacon Memory
Cobalt Strike - Default String in Stage and Beacon
Memory Detection Heuristic • Thread or Memory are not mapped to a file • Static Image Size • RWX Page Memory Permission • Known Strings and PE headers • William Burgess & Matt Watkins - Advanced Attack Detection https://www.youtube.com/watch?v=ihElrBBJQo8 • Raphael Mudge – In-memory Evasion (1 of 4) - Detections https://www.youtube.com/watch?v=lz2ARbZ_5tE
Cobalt Strike – Malleable PE •https://www.cobaltstrike.com/help-malleable-c2#memory
Cobalt Strike – Malleable PE • obfuscate: “true” – >=3.11 • Reflective Loader does not initialise any unnecessary PE headers in allocated memory section for Beacon • Mask DLL Import Tables • Obfuscate any known strings for Beacon • cleanup: “true” • Free the memory of the Stage • module_x86 / module_x64 • Module Stomping • LoadLibrary a DLL that is not loaded and copy Beacon DLL into its memory space
Cobalt Strike – Malleable PE Demo
Cobalt Strike – Malleable PE •Additional Modification Options • prepend – Prepend strings before the DLL headers • strrep – replace string found •Could be used for Threat Emulation • peclone known malware binaries • Configure based on known YARA rule strings for malwares
Cobalt Strike – Best Practices •Things you could do to make your beacon harder to be detected • Use Malleable Profile and PE • Do Session Prepping • Use “spawnto” to change the default process for Post Exploitation Activities • Use In-memory .NET Assembly Execution for Post Exploitation activities • Avoid using Stager • Avoid using PowerShell • Avoid Remote Process Injection
Cobalt Strike – Best Practices •Recommended to Read/Watch • https://blog.cobaltstrike.com/2018/04/23/fighting-the-toolset • https://blog.cobaltstrike.com/2018/04/09/cobalt-strike-3-11-the-snake-that- eats-its-tail/ • https://blog.cobaltstrike.com/2017/10/25/modern-defenses-and-you/ • https://blog.cobaltstrike.com/2017/06/23/opsec-considerations-for-beacon- commands/
Other approaches to Detect Beacon Source: https://twitter.com/jackcr/status/992390807268352001
Question ?
Answer:
Other Reference • https://medium.com/@malcomvetter/safe-red-team-infrastructure-c5d6a0f13fac • https://www.netscylla.com/whitepapers/Crestcon18_Common_Pitfalls_in_Redteaming.pdf • https://blog.cobaltstrike.com/2013/06/28/staged-payloads-what-pen-testers-should-know/ • https://www.slideshare.net/44Con/44con-meterpreter-internalsv2 • http://buffered.io/posts/staged-vs-stageless-handlers/ • https://blog.rapid7.com/2015/03/25/stageless-meterpreter-payloads/ • https://www.blackhat.com/docs/us-16/materials/us-16-Nipravsky-Certificate-Bypass-Hiding-And-Executing-Malware-From-A-Digitally-Signed-Exec utable-wp.pdf • https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process • https://www.slideshare.net/JoeDesimone4/taking-hunting-to-the-next-level-hunting-in-memory • https://ketansingh.net/make-executable-harder-to-recover-from-memory/ • https://media.defcon.org/DEF%20CON%2024/DEF%20CON%2024%20presentations/DEFCON-24-Int0X80-Anti-Forensics-AF.pdf • https://www.veil-framework.com/least-privilege-removing-unnecessary-memory-permissions/ • Michael Hale Ligh, Andrew Case, Jamie Levy, Aaron Walters (2014) - The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux and Mac Memory

More Related Content

PDF
Carlos GarcĂ­a - Pentesting Active Directory Forests [rooted2019]
byRootedCON
 
PDF
No Easy Breach DerbyCon 2016
byMatthew Dunwoody
 
PDF
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
byMITRE - ATT&CKcon
 
PDF
How to Hunt for Lateral Movement on Your Network
bySqrrl
 
PPTX
I hunt sys admins 2.0
byWill Schroeder
 
PPTX
Adversary Emulation and Its Importance for Improving Security Posture in Orga...
byDigit Oktavianto
 
PDF
Adversary Emulation and Red Team Exercises - EDUCAUSE
byJorge Orchilles
 
PDF
Attacker's Perspective of Active Directory
bySunny Neo
 
Carlos GarcĂ­a - Pentesting Active Directory Forests [rooted2019]
byRootedCON
 
No Easy Breach DerbyCon 2016
byMatthew Dunwoody
 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
byMITRE - ATT&CKcon
 
How to Hunt for Lateral Movement on Your Network
bySqrrl
 
I hunt sys admins 2.0
byWill Schroeder
 
Adversary Emulation and Its Importance for Improving Security Posture in Orga...
byDigit Oktavianto
 
Adversary Emulation and Red Team Exercises - EDUCAUSE
byJorge Orchilles
 
Attacker's Perspective of Active Directory
bySunny Neo
 

What's hot

PDF
Red Team Methodology - A Naked Look
byJason Lang
 
PDF
Red Team Framework
by👀 Joe Gray
 
PPTX
Red team Engagement
byIndranil Banerjee
 
PDF
PHDays 2018 Threat Hunting Hands-On Lab
byTeymur Kheirkhabarov
 
PDF
How MITRE ATT&CK helps security operations
bySergey Soldatov
 
PDF
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
byMITRE ATT&CK
 
PDF
Windows Threat Hunting
byGIBIN JOHN
 
PDF
Fantastic Red Team Attacks and How to Find Them
byRoss Wolf
 
PPTX
Threat Hunting with Splunk Hands-on
bySplunk
 
PPTX
Detection Rules Coverage
bySunny Neo
 
PPTX
Cyber Threat Hunting Workshop
byDigit Oktavianto
 
PDF
Threat Hunting Workshop
bySplunk
 
PPTX
Effective Threat Hunting with Tactical Threat Intelligence
byDhruv Majumdar
 
PDF
Building an InfoSec RedTeam
byDan Vasile
 
PPTX
Red team and blue team in ethical hacking
byVikram Khanna
 
PPTX
Adversary Emulation and the C2 Matrix
byJorge Orchilles
 
PPTX
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
 
PPTX
Purple Teaming with ATT&CK - x33fcon 2018
byChristopher Korban
 
PPTX
Red Team Framework
byAdrian Sanabria
 
PPTX
(Ab)Using GPOs for Active Directory Pwnage
byPetros Koutroumpis
 
Red Team Methodology - A Naked Look
byJason Lang
 
Red Team Framework
by👀 Joe Gray
 
Red team Engagement
byIndranil Banerjee
 
PHDays 2018 Threat Hunting Hands-On Lab
byTeymur Kheirkhabarov
 
How MITRE ATT&CK helps security operations
bySergey Soldatov
 
Intelligence Failures of Lincolns Top Spies: What CTI Analysts Can Learn Fro...
byMITRE ATT&CK
 
Windows Threat Hunting
byGIBIN JOHN
 
Fantastic Red Team Attacks and How to Find Them
byRoss Wolf
 
Threat Hunting with Splunk Hands-on
bySplunk
 
Detection Rules Coverage
bySunny Neo
 
Cyber Threat Hunting Workshop
byDigit Oktavianto
 
Threat Hunting Workshop
bySplunk
 
Effective Threat Hunting with Tactical Threat Intelligence
byDhruv Majumdar
 
Building an InfoSec RedTeam
byDan Vasile
 
Red team and blue team in ethical hacking
byVikram Khanna
 
Adversary Emulation and the C2 Matrix
byJorge Orchilles
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
byKatie Nickels
 
Purple Teaming with ATT&CK - x33fcon 2018
byChristopher Korban
 
Red Team Framework
byAdrian Sanabria
 
(Ab)Using GPOs for Active Directory Pwnage
byPetros Koutroumpis
 

Similar to Introduction to red team operations

PDF
SecurityOperations
byAntonio (Tony) Robinson
 
PDF
Cyber Security 101 - Back to Basics (HP Secure Print Event 2018)
byShah Sheikh
 
PPTX
Security Risk Advisors - BSides PGH 2018 - Red Team SIEM
byDouglas Webster
 
PPTX
Modern Red Teaming - subverting mature defenses on a budget
bymatt806068
 
PPT
Port of seattle security presentation david morris
byEmily2014
 
PPTX
SANSFIRE18: War Stories on Using Automated Threat Intelligence for Defense
byJohn Bambenek
 
PDF
Today's Cyber Challenges: Methodology to Secure Your Business
byJoAnna Cheshire
 
PPTX
Adversary Emulation - DerpCon
byJorge Orchilles
 
PDF
RSA: Security Analytics Architecture for APT
byLee Wei Yeong
 
PPTX
Python-Assisted Red-Teaming Operation
bySatria Ady Pradana
 
PDF
Are you ready for the next attack? Reviewing the SP Security Checklist
byAPNIC
 
PDF
Are you ready for the next attack? reviewing the sp security checklist (apnic...
byBarry Greene
 
PPTX
Using IOCs to Design and Control Threat Activities During a Red Team Engagement
byJoe Vest
 
PPTX
You Spent All That Money And Still Got Owned
byJoe McCray
 
PDF
Red Team: Emulating Advanced Adversaries in Cyberspace
byDon Anto
 
PPT
Event - Internet Thailand - Total Security Perimeters
bySomyos U.
 
PPTX
Cross interface attack
bypiyushml20
 
PPTX
Cross Interface Attacks
byn|u - The Open Security Community
 
PDF
Are you ready for the next attack? Reviewing the SP Security Checklist
byMyNOG
 
PDF
Security Delivery Platform: Best practices
byMihajlo Prerad
 
SecurityOperations
byAntonio (Tony) Robinson
 
Cyber Security 101 - Back to Basics (HP Secure Print Event 2018)
byShah Sheikh
 
Security Risk Advisors - BSides PGH 2018 - Red Team SIEM
byDouglas Webster
 
Modern Red Teaming - subverting mature defenses on a budget
bymatt806068
 
Port of seattle security presentation david morris
byEmily2014
 
SANSFIRE18: War Stories on Using Automated Threat Intelligence for Defense
byJohn Bambenek
 
Today's Cyber Challenges: Methodology to Secure Your Business
byJoAnna Cheshire
 
Adversary Emulation - DerpCon
byJorge Orchilles
 
RSA: Security Analytics Architecture for APT
byLee Wei Yeong
 
Python-Assisted Red-Teaming Operation
bySatria Ady Pradana
 
Are you ready for the next attack? Reviewing the SP Security Checklist
byAPNIC
 
Are you ready for the next attack? reviewing the sp security checklist (apnic...
byBarry Greene
 
Using IOCs to Design and Control Threat Activities During a Red Team Engagement
byJoe Vest
 
You Spent All That Money And Still Got Owned
byJoe McCray
 
Red Team: Emulating Advanced Adversaries in Cyberspace
byDon Anto
 
Event - Internet Thailand - Total Security Perimeters
bySomyos U.
 
Cross interface attack
bypiyushml20
 
Cross Interface Attacks
byn|u - The Open Security Community
 
Are you ready for the next attack? Reviewing the SP Security Checklist
byMyNOG
 
Security Delivery Platform: Best practices
byMihajlo Prerad
 

Recently uploaded

PDF
Getting the Best of TrueDEM – October News & Updates
bypanagenda
 
PDF
GPUS and How to Program Them by Manya Bansal
byScyllaDB
 
PDF
Rivian's Push Notification Sub Stream with Mega Filter by Marcus Kim & Saahil...
byScyllaDB
 
PDF
Session 4 - Specialized AI Associate Series: UiPath Document Understanding O...
byDianaGray10
 
PPTX
Hybrid Active Directory Cyber Resiliency
byFrancesco Faenzi
 
PDF
From Bots to Brains: Getting Started with Agentic Automation in UiPath
byUiPathCommunity
 
PDF
A fool with a tool is still a fool - Plone Conference 2025
byAndreas Jung
 
PDF
Expert Python App Development Company for Modern Enterprises
bySynapseIndia
 
PDF
Ethical Initiatives in AI and accountability.pdf
byShiwani Gupta
 
PDF
UnityNet Digital Sovereignty Checklist 2025-10-13
byLHelferty
 
PDF
Session 2 - Agentic Orchestration with UiPath Maestro
byDianaGray10
 
PDF
Fairness and Bias in AI Ethics and Explainability
byShiwani Gupta
 
PPTX
Agentic AI Solutions and Services | Aeologic
byankitaeologic
 
PDF
Meta and Apple close to settling EU cases.pdf
byLUMINATIVE MEDIA/PROJECT COUNSEL MEDIA GROUP
 
PPTX
CBD Belgium 2025 - The adventures of a Microsoft 365 Platform Owner.pptx
byJasper Oosterveld
 
PDF
UiPath DevConnect 2025: Introduction to Agentic Automation
byDianaGray10
 
PDF
Application Monitoring and Observability: Elastic Stack Solution for Producti...
byPattabhi Amperayani
 
PDF
Ask Me Anything About AI Assist: Practical Answers for Real Workflows
bySafe Software
 
PDF
From Data Chaos to Copilot Confidence: A Step-by-Step Microsoft 365 Copilot R...
byNikki Chapple
 
PDF
Unlocking Full-Stack Observability for AIOps: A Precisely Ironstream for Big ...
byPrecisely
 
Getting the Best of TrueDEM – October News & Updates
bypanagenda
 
GPUS and How to Program Them by Manya Bansal
byScyllaDB
 
Rivian's Push Notification Sub Stream with Mega Filter by Marcus Kim & Saahil...
byScyllaDB
 
Session 4 - Specialized AI Associate Series: UiPath Document Understanding O...
byDianaGray10
 
Hybrid Active Directory Cyber Resiliency
byFrancesco Faenzi
 
From Bots to Brains: Getting Started with Agentic Automation in UiPath
byUiPathCommunity
 
A fool with a tool is still a fool - Plone Conference 2025
byAndreas Jung
 
Expert Python App Development Company for Modern Enterprises
bySynapseIndia
 
Ethical Initiatives in AI and accountability.pdf
byShiwani Gupta
 
UnityNet Digital Sovereignty Checklist 2025-10-13
byLHelferty
 
Session 2 - Agentic Orchestration with UiPath Maestro
byDianaGray10
 
Fairness and Bias in AI Ethics and Explainability
byShiwani Gupta
 
Agentic AI Solutions and Services | Aeologic
byankitaeologic
 
Meta and Apple close to settling EU cases.pdf
byLUMINATIVE MEDIA/PROJECT COUNSEL MEDIA GROUP
 
CBD Belgium 2025 - The adventures of a Microsoft 365 Platform Owner.pptx
byJasper Oosterveld
 
UiPath DevConnect 2025: Introduction to Agentic Automation
byDianaGray10
 
Application Monitoring and Observability: Elastic Stack Solution for Producti...
byPattabhi Amperayani
 
Ask Me Anything About AI Assist: Practical Answers for Real Workflows
bySafe Software
 
From Data Chaos to Copilot Confidence: A Step-by-Step Microsoft 365 Copilot R...
byNikki Chapple
 
Unlocking Full-Stack Observability for AIOps: A Precisely Ironstream for Big ...
byPrecisely
 

Introduction to red team operations

  • 1.
    Introduction to RedTeam Operations Sunny Neo (@sunn_y_k) sunny@live.com.sg
  • 2.
    #whoami •Perpetual Information SecurityStudent •Penetration Tester @ Centurion Information Security •It was really hard to get here - On and Off Fever Last Night
  • 3.
    Disclaimer •All views aremine and not the company I work for or any organisation that I am affiliated with. •I take NULL credit for all the materials presented here •I am here just to share the good work from awesome people and have fun
  • 4.
    Shout Out RaphaelMudge (@armitagehacker) •Awesome resource on Red Team Operations •Advanced Threat Tactics (2015) https://blog.cobaltstrike.com/2015/09/30/advanced-threat-tactics-cou rse-and-notes/ https://www.youtube.com/watch?v=4w7krkqxRck&list=PL9HO6M_MU 2nf8Fa5bVefBW-9bg5Rx94_c •https://blog.cobaltstrike.com/
  • 5.
    Shout Out -Jeff Dimmock (@bluscreenofjeff) •Awesome materials on Red Team Infrastructure •https://bluescreenofjeff.com/2017-12-05-designing-effective-covert- red-team-attack-infrastructure/ •https://speakerdeck.com/bluscreenofjeff/building-a-better-moat-des igning-an-effective-covert-red-team-attack-infrastructure •https://github.com/bluscreenofjeff/Red-Team-Infrastructure-Wiki
  • 6.
    Shout Out •Anyone whoshared their experience with me or answer my stupid questions over Twitter / Slack (BloodHoundGang) / Beer(s)
  • 7.
    Objective •Share my journeyon learning about Red Team Operations •Bridge the gap between Penetration Testers and Red Teamers
  • 8.
    Penetration Testing •Scope Provided •Limited to No Reconnaissance Required •No Stealth required • Scan everything in Scope • Run tools out of the box (Did you rebuild the tool?) •Simple to No Infrastructure setup
  • 9.
    Red Team Operation •Test your security investment in a realistic way – objective based • Depend on the type of operations • Full Scope Testing (Physical, Social and Cyber) • Long-Term Operation • Threat Emulation (Emulating a real-world actor) Source: https://blog.cobaltstrike.com/2015/07/09/models-for-red-team-operations/ https://blog.cobaltstrike.com/2016/02/17/the-threat-emulation-problem/
  • 10.
    Red Team Operation •Generally •Limited Information Provided • Require Stealth • Require Appropriate Infrastructure Setup for the operation
  • 11.
  • 12.
    Mindset •Boxed-in by Scope •Emphasizeon Coverage for Systems and Vulnerabilities in Scope •Does not look for the easiest path to objective
  • 13.
    Habits •Guided by Mindset •Scaneverything in Scope due to emphasis on coverage •Does not apply adversary’s tradecraft but whatever that gets the job done
  • 14.
    Scale •No clearly definedscope - How to start? •Excessive Information - How do you manage information gathered along the way due to the vague scope?
  • 15.
    Principles for RedTeam Operations (Mine) •Protect your Infrastructure •Log Everything! •Less is More •Don’t Get Caught
  • 16.
    Protect Your Infrastructure •Whythe need for Infrastructure? •Why the need to protect your infrastructure?
  • 17.
    Protect Your Infrastructure •Whythe need for Infrastructure? •Why the need to protect your infrastructure?
  • 18.
    Typical Penetration TestInfrastructure Source: https://bluescreenofjeff.com/2017-12-05-designing-effective-covert-red-team-attack-infrastruct ure/
  • 19.
    Services Required forRed Team Operations •SMTP Server – Phishing •Web and Database Servers – Phishing and Storing Stolen Credentials •Payload/Staging Servers – Storing and Sending Payloads •Multiple Teamservers – C2
  • 20.
    Shell Management •Never doanything from just one shell and one team server •Always try to persist and expand more shell accesses •Red team infrastructure design is critical for covert operations • Short Haul Servers – Initial Access + Post Exploitation Activities • Long Haul Servers – Low and Slow Callbacks + Session Passing •https://blog.cobaltstrike.com/2014/09/09/infrastructure-for-ongoing -red-team-operations/
  • 21.
    Redirector and Filtering Source:https://bluescreenofjeff.com/2017-12-05-designing-effective-covert-red-team-attack-infrastructure/
  • 22.
  • 23.
    Apache Redirector -.htaccess Source: https://bluescreenofjeff.com/2016-04-12-combatting-incident-responders-with-apache-mod_rewrite/
  • 24.
    .htaccess Blacklisting •Jason Lang (@curi0usJack) •.htaccessto redirect • known AV companies IP address ranges • TOR Exit Nodes •https://gist.github.com/c uri0usJack/971385e8334e 189d93a6cb4671238b10
  • 25.
    Automate Your Infrastructure •Painful to rebuild everything for each engagement • Automate Infrastructure setup with CoalFire’s Red Baron TerraForm Examples • https://rastamouse.me/2017/08/automated-red-team-infrastructure-deploy ment-with-terraform---part-1/ • https://rastamouse.me/2017/08/automated-red-team-infrastructure-deploy ment-with-terraform---part-2/ • https://github.com/Coalfire-Research/Red-Baron
  • 26.
  • 27.
  • 28.
    Command and Control(C2) Security • Protect your customer’s systems and data • You don’t want your agents/beacons to be hijacked or confidential data leaked • Evaluate the C2 security based on • Encryption • Authentication • Anti Replay Attacks • https://medium.com/@malcomvetter/responsible-red-teams-1c6209fd43cc
  • 29.
    Staged Beacon Process StagedPayload Public Key TeamServer Victim Meta Data Session Key VictimTeamServer TeamServer Victim Initial Callback Encrypted with TeamServer Public Key
  • 30.
    Staged Beacon Process Tasks TeamServerVictim Task Output VictimTeamServer Encrypted with Session Key Encrypted with Session Key Source: Raphael Mudge - Advanced Threat Tactics (2 of 9): Infrastructure https://www.youtube.com/watch?v=3gBJOJb8Oi0&feature=youtu.be&t=49m55s
  • 31.
    Log Everything! • Importantto have timestamped logs for • Timeline of Events • Clean up • Investigation if anything goes down • Empire and Cobalt Strike are fine… • cmd.exe? • PowerShell? • bash? • Metasploit? • RDP?
  • 32.
    Log Everything! Tool Command CommandPrompt prompt $D$S$T$S$P$G PowerShell PowerShell Profile/GPO Start-Transcript -Path C:psloggingtranscript.txt -NoClobber –IncludeInvocationHeader OR Computer Configuration – Administrative Templates – Windows Components – Windows PowerShell -“Turn on PowerShell Transcription” Bash ~/.bashrc #Enable Timestamp for Command Line and Use Screen to log session PS1='D{%F %T} [u@h W] $ ‘ screen -L -Logfile engagementXX.log bash #Expand History Limits, Enable TimeStamp and Append commands to History for multiple terminal export HISTSIZE= export HISTFILESIZE= export HISTTIMEFORMAT="%d/%m/%y %T " export HISTCONTROL=ignoredups:erasedups shopt -s histappend export PROMPT_COMMAND="history -a; history -c; history -r; $PROMPT_COMMAND" Msfconsole ~/.msf4/msfconsole.rc set ConsoleLogging true set LogLevel 5 set SessionLogging true set TimestampOutput true set PromptTimeFormat %Y/%m/%d %H:%M:%S
  • 33.
    Less Is More:Information Management •Don’t just collect information mindlessly •Use as many scripts as possible to perform data mining •Have some processes/tools to categorise the information/logs collected so that it can be easily lookup •http://www.harmj0y.net/blog/redteaming/push-it-push-it-real-good/ •https://vincentyiu.co.uk/cobaltsplunk/
  • 34.
  • 35.
    Target • Knowing yourtarget • Knowing what kind of controls they have • Controls • Email Filtering Gateway • Egress Filtering and Authenticated Proxy with Domain Categorization • IDS/IPS (This Gen, Next Gen, Future Gen) • Sandbox • Antivirus (This Gen, Next Gen, Future Gen) • Endpoint Detection & Response • Security Operation Center with Analyst looking at alerts
  • 36.
    Tactics, Techniques andProcedures (TTPs) •What is the mode of operation? • Smash and Grab • Diversion • Long-Term Operation
  • 37.
    Tactics, Techniques andProcedures (TTPs) •Tradecraft – Bad Guy’s Best Practices •Learn from the Bad Guys • Threat Intelligence Reports • https://github.com/kbandla/APTnotes • https://github.com/aptnotes/data • MITRE ATT&CK Framework • https://attack.mitre.org/wiki/Main_Page • https://github.com/redcanaryco/atomic-red-team
  • 38.
    Toolset •Are your toolssuitable for the operation? •Are you able to make operation trade-offs based on your knowledge of your tools? • What is the workflow of the tool? • What artifacts are created?
  • 39.
    Metasploit & Meterpreter •WebDelivery Module with windows/meterpreter/reverse_tcp
  • 40.
    Web Delivery ModuleProcess 1. Run the PowerShell One-Liner to download and execute PowerShell Stager 2. Stager fetches the (encoded) Stage (DLL) and pass control to the Stage 3. Stage performs (decoding) and Reflective DLL Injection to run the actual payload
  • 41.
    PowerShell Stager onWire • Run the PowerShell One-liner to download and execute PowerShell Stager
  • 42.
    Stage on Wire •Stagerfetches the (encoded) Stage (DLL) and pass control to the Stage
  • 43.
    EnableStageEncoding Option •Web DeliveryModule with windows/meterpreter/reverse_tcp •EnableStageEncoding => true
  • 44.
  • 45.
  • 46.
    (Reflective) DLL InjectionOverview Process B Process AAttach Write DLLPath or Write DLL ContentProcess B Process A DLL Process B Process A New Memory Section Allocate Memory Execute - LoadLibrary / Reflective LoaderProcess B Process A DLL Process A New Thread Source: http://blog.opensecurityresearch.com/2013/01/windows-dll-injection-basics.html Step 2 Step 1 Step 3 Step 4 *For DLL Injection, DLL File has to be written to disk
  • 47.
    Staged Meterpreter MemoryArtifact Payload: windows/meterpreter/reverse_http
  • 48.
    Staged Meterpreter MemoryArtifact Decoded Stage
  • 49.
    Staged Meterpreter MemoryArtifact Actual Payload (metsrv.dll) Running
  • 50.
    Metasploit Paranoid Mode •(Generally)Metasploit should not be used for Red Teaming because most of its payloads can be hijacked and many signatures have been created for them •Use Paranoid Mode if need to - Payload UUID Whitelisting and SSL Certificate Pinning to prevent hijacking •Use “reverse_winhttps” instead of “reverse_https” to enable SSL Certificate Pinning for Stager
  • 51.
    Cobalt Strike •Adversary SimulationTool •Features • Team Operation • Client Side Exploitation • Asynchronous Post Exploitation • Covert Communication Flexibility
  • 52.
    Cobalt Strike -Default Staged Beacon
  • 53.
    Cobalt Strike -Default Stage Memory
  • 54.
    Cobalt Strike -Default Beacon Memory
  • 55.
    Cobalt Strike -Default String in Stage and Beacon
  • 56.
    Memory Detection Heuristic •Thread or Memory are not mapped to a file • Static Image Size • RWX Page Memory Permission • Known Strings and PE headers • William Burgess & Matt Watkins - Advanced Attack Detection https://www.youtube.com/watch?v=ihElrBBJQo8 • Raphael Mudge – In-memory Evasion (1 of 4) - Detections https://www.youtube.com/watch?v=lz2ARbZ_5tE
  • 57.
    Cobalt Strike –Malleable PE •https://www.cobaltstrike.com/help-malleable-c2#memory
  • 58.
    Cobalt Strike –Malleable PE • obfuscate: “true” – >=3.11 • Reflective Loader does not initialise any unnecessary PE headers in allocated memory section for Beacon • Mask DLL Import Tables • Obfuscate any known strings for Beacon • cleanup: “true” • Free the memory of the Stage • module_x86 / module_x64 • Module Stomping • LoadLibrary a DLL that is not loaded and copy Beacon DLL into its memory space
  • 59.
    Cobalt Strike –Malleable PE Demo
  • 60.
    Cobalt Strike –Malleable PE •Additional Modification Options • prepend – Prepend strings before the DLL headers • strrep – replace string found •Could be used for Threat Emulation • peclone known malware binaries • Configure based on known YARA rule strings for malwares
  • 61.
    Cobalt Strike –Best Practices •Things you could do to make your beacon harder to be detected • Use Malleable Profile and PE • Do Session Prepping • Use “spawnto” to change the default process for Post Exploitation Activities • Use In-memory .NET Assembly Execution for Post Exploitation activities • Avoid using Stager • Avoid using PowerShell • Avoid Remote Process Injection
  • 62.
    Cobalt Strike –Best Practices •Recommended to Read/Watch • https://blog.cobaltstrike.com/2018/04/23/fighting-the-toolset • https://blog.cobaltstrike.com/2018/04/09/cobalt-strike-3-11-the-snake-that- eats-its-tail/ • https://blog.cobaltstrike.com/2017/10/25/modern-defenses-and-you/ • https://blog.cobaltstrike.com/2017/06/23/opsec-considerations-for-beacon- commands/
  • 63.
    Other approaches toDetect Beacon Source: https://twitter.com/jackcr/status/992390807268352001
  • 64.
  • 65.
  • 66.
    Other Reference • https://medium.com/@malcomvetter/safe-red-team-infrastructure-c5d6a0f13fac •https://www.netscylla.com/whitepapers/Crestcon18_Common_Pitfalls_in_Redteaming.pdf • https://blog.cobaltstrike.com/2013/06/28/staged-payloads-what-pen-testers-should-know/ • https://www.slideshare.net/44Con/44con-meterpreter-internalsv2 • http://buffered.io/posts/staged-vs-stageless-handlers/ • https://blog.rapid7.com/2015/03/25/stageless-meterpreter-payloads/ • https://www.blackhat.com/docs/us-16/materials/us-16-Nipravsky-Certificate-Bypass-Hiding-And-Executing-Malware-From-A-Digitally-Signed-Exec utable-wp.pdf • https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process • https://www.slideshare.net/JoeDesimone4/taking-hunting-to-the-next-level-hunting-in-memory • https://ketansingh.net/make-executable-harder-to-recover-from-memory/ • https://media.defcon.org/DEF%20CON%2024/DEF%20CON%2024%20presentations/DEFCON-24-Int0X80-Anti-Forensics-AF.pdf • https://www.veil-framework.com/least-privilege-removing-unnecessary-memory-permissions/ • Michael Hale Ligh, Andrew Case, Jamie Levy, Aaron Walters (2014) - The Art of Memory Forensics: Detecting Malware and Threats in Windows, Linux and Mac Memory