SlideShare ist ein Scribd-Unternehmen logo

Managing & Showing Value during Red Team Engagements & Purple Team Exercises - VECTR SANS Webcast

•
•
Jorge Orchilles
Jorge Orchilles

Join Jorge Orchilles and Phil Wainwright as they cover how to show value during Red and Purple Team exercises with a free platform, VECTR. VECTR is included in SANS Slingshot C2 Matrix Edition so you can follow along the presentation and live demos. VECTR is a free platform for planning and tracking of your red and purple team exercises and alignment to blue team detection and prevention capabilities across different attack scenarios. VECTR provides the ability to create assessment groups, which consist of a collection of Campaigns and supporting Test Cases to simulate adversary threats. Campaigns can be broad and span activity across the kill chain or ATT&CK tactics, from initial access to privilege escalation and lateral movement and so on, or can be a narrow in scope to focus on specific defensive controls, tools, and infrastructure. VECTR is designed to promote full transparency between offense and defense, encourage training between team members, and improve detection, prevention & response capabilities across cloud and on-premise environments. Common use cases for VECTR are measuring your defenses over time against the MITRE ATT&CK framework, creating custom red team scenarios and adversary emulation plans, and assisting with toolset evaluations. VECTR is meant to be used over time with targeted campaigns, iteration, and measurable enhancements to both red team skills and blue team detection capabilities. Ultimately the goal of VECTR is to help organizations level up and promote a platform that encourages community sharing of CTI that is useful for red teamers, blue teamers, threat intel teams, security engineering, any number of other cyber roles, and helps management show increasing maturity in their programs and justification of whats working, whats not, and where additional investment might be needed in tools and team members to bring it all together.

Technologie
1 von 34
Downloaden Sie, um offline zu lesen
SEC564 Demo Managing & Showing Value during Red Team Engagements & Purple Team Exercises Red Team Exercises and Adversary Emulation © 2020 Jorge Orchilles & PhilWainwright | All Rights Reserved
SEC564 | RedTeam Exercises and Adversary Emulation T1033 - System Owner/User Discovery – Jorge Orchilles • Chief Technology Officer - SCYTHE • C2 Matrix Co-Creator • Certified SANS Instructor: SEC560, SEC504 • Author SEC564: Red Team Exercises and Adversary Emulation • 10 years @ Citi leading offensive security team • CVSSv3.1 Working Group Voting Member • GFMA: Threat-Led Pen Test Framework • ISSA Fellow; NSI Technologist Fellow
SEC564 | RedTeam Exercises and Adversary Emulation T1033 - System Owner/User Discovery – Phil Wainwright • Director at Security Risk Advisors, focus on technical testing and software delivery • InfoSec consultant for 15 years, promoted to “cyber” in recent years • Background in pen testing, appsec/product security, network & cloud security • More recent focus in purple teaming & adversary emulation past ~7 years • Manages team working on the VECTR platform • Black Hat Arsenal 2019 & FS-ISAC speaker
SEC564 | RedTeam Exercises and Adversary Emulation About SEC564 Red Team Exercises and Adversary Emulation • Learn the skills needed to perform safe, professional Red Team Exercises and Adversary Emulations • Introduce and follow repeatable frameworks and methodologies • Tips and tricks to save time, enhance quality, and avoid risk • Perform hands-on exercises to reinforce the topics, in a class- long, intelligence led, Adversary Emulation Red Team Exercise 4
SEC564 | RedTeam Exercises and Adversary Emulation Agenda • Definitions – because we said Red Team and must debate • Framework and Methodology • Cyber Threat Intelligence • Planning an Adversary Emulation • Emulating an Adversary • Exercise Closure – Showing Value with VECTR • ~70% Live Demos – And screenshots for those that only read slides – Yeah, we know who you are 5
SEC564 | RedTeam Exercises and Adversary Emulation RedTeam • Definition: Red Team performs Tactics, Techniques, and Procedures (TTPs) to test people, processes, and technology in a target environment. “The practice of looking at a problem or situation from the perspective of an adversary” – Red Team Journal 1997 • Goal: Make Blue Team better. Train and measure blue teams' detection and response policies, procedures, and technologies are effective. • Effort: Manual; lots of tools (see C2 Matrix) • Frequency: Intelligence-led (new exploit, tool, or TTP) • Customer: Blue Teams 6
SEC564 | RedTeam Exercises and Adversary Emulation BlueTeam • Definition: the defenders in an organization entrusted with identifying and remediating attacks. Generally associated with Security Operations Center or Managed Security Service Provider (MSSP), Hunt Team, Incident Response, and Digital Forensics. Really, it is everyone's responsibility! • Goal: identify, report the attack, contain, and eradicate attacks • Effort: Automated and Manual. People are the best defenders • Frequency: Every Day 24/7 • Customer: entire organization 7
SEC564 | RedTeam Exercises and Adversary Emulation Adversary Emulation 8 • Definition: A type of Red Team exercise where the Red Team emulates how an adversary operates, following the same tactics, techniques, and procedures (TTPs), with a specific objective like those of realistic threats or adversaries. • Goal: Emulate an end-to-end attack against a target organization. Obtain a holistic view of the organization’s preparedness for a real, sophisticated attack. • Effort: Manual; more setup than a limited scope Penetration Test • Frequency: Twice a year or yearly • Customer: Entire organization
SEC564 | RedTeam Exercises and Adversary Emulation PurpleTeam • Definition: A function, or virtual team, where red and blue work together to improve the overall security of the organization. Red Team does not focus on stealth as they normally would. • Goal: Red Team emulates adversary TTPs while blue teams watch and improve detection and response policies, procedures, and technologies in real time. • Effort: Manual • Frequency: Intelligence-led (new exploit, tool, or TTP) • Customer: Red Team & Blue Team 9
SEC564 | RedTeam Exercises and Adversary Emulation Framework for SEC564 Like most organizations, this course will take a hybrid approach based on the frameworks and methodologies just introduced 10 • Threat Intelligence • Planning • Testing − Red Team Exercise Execution • Closure − Analysis and Response − Report − Remediation and Action Plan FRAMEWORK
SEC564 | RedTeam Exercises and Adversary Emulation Threat Intelligence for RedTeam & PurpleTeam Exercises "Threat intelligence is evidence-based knowledge, including context, mechanisms, indicators, implications and actionable advice about an existing or emerging menace or hazard to assets that can be used to inform decisions regarding the subject's response to that menace or hazard." (Gartner) 11 Understand the Target Org Gather Threat Intelligence Analyze & Organize Emulate the Adversary Identify the Adversary ExtractTTPs Create a Plan
SEC564 | RedTeam Exercises and Adversary Emulation MITRE® ATT&CK™ 12
SEC564 | RedTeam Exercises and Adversary Emulation Planning The planning phase covers test preparation activities 13 • Triggers • Objectives • Scope • Trusted Agents • Roles and Responsibilities • Rules of Engagement FRAMEWORK
SEC564 | RedTeam Exercises and Adversary Emulation Assumed Breach Philosophy and understanding one will be breached 14 • Based on assumption an endpoint is already compromised • Answers “what can attacker do with this initial access” – Tests for malicious insider threat as well • Start with a base build of OS and account just like a new hire • Simulate a user being compromised, then emulate an adversary • All other ATT&CK™ Tactics are in play • See Red Siege’s Mike Saunders presentation
SEC564 | RedTeam Exercises and Adversary Emulation 15 Role Responsibilities Governance Approve the attack scenario, the final report and remediation action items. Governance agents should also receive status updates throughout the exercise Project Management Coordinate entire Red Team Exercise including threat intelligence gathering; target reconnaissance; Testing Phase communication; and management of timeline and objectives Threat Intelligence Identify cyber threat actor(s) with the sophistication and desire to attack the organization; provide the group’s technical and behavioral profile including TTPs Risk Avoidance Receive daily updates on all Red Team actions and are responsible for avoiding or reducing the material impact of the exercise to business operations Action Item Remediation Owners Own actions related to remediation plan. Owners of Technology related findings will be privy to more briefings and overall action items than those that fall in the Exercise and Process categories as the need to know becomes lower and the risk of knowledge transfer becomes higher
SEC564 | RedTeam Exercises and Adversary Emulation RedTeam Planning • Red Team Planning – Fill any planning gaps – Attack Infrastructure/C2 – Reconnaissance – Social Engineering – Weaponization • Initial Access/Foothold • Network Propagation • Action on Objectives 16 FRAMEWORK
SEC564 | RedTeam Exercises and Adversary Emulation The C2 Matrix Matrix of command and control frameworks for RedTeamers 17 • Google doc of most C2 frameworks • Documents various capabilities of each framework • There is no right or wrong, better or worse framework • Find ideal C2 for your current objective • Wizard like UI to select which one • www.thec2matrix.com • howto.thec2matrix.com
SEC564 | RedTeam Exercises and Adversary Emulation 18
SEC564 | RedTeam Exercises and Adversary Emulation ShowValue • Analysis and Response – Red Team Reveal – Replay – Purple Team • Reporting • Remediation and Action Plan – People – Process – Technology 19 FRAMEWORK
SEC564 | RedTeam Exercises and Adversary Emulation What isVECTR? • Free platform for planning and tracking red team and purple team assessments • Heavy focus on collaborative testing between red & blue teams with tracking of specific red team activities and defensive outcomes • Designed to promote transparency and education between red team operators, security operations, engineering, threat intel & hunt teams 20
SEC564 | RedTeam Exercises and Adversary Emulation Common Use Cases forVECTR • Measure enterprise defenses across the MITRE ATT&CK framework • Structured testing and evaluations for existing and PoC security tools in the environment • Import structured CTI (STIX 2.0 bundles) for adversary emulation planning • Create custom assessments, campaigns, and test case templates for repeatable testing across multiple environments and targets • Report on executive summary level or drill-down into assessment results, visualize with dynamic heat map, historical trending, and detailed reporting views 21
SEC564 | RedTeam Exercises and Adversary Emulation Getting Started • Download VECTR at https://github.com/SecurityRiskAdvisors/VECTR • Read the docs: https://docs.vectr.io • Join the community: https://vectr.io • Contact the team at vectr@sra.io with questions & feedback 22
SEC564 | RedTeam Exercises and Adversary Emulation VECTR Concepts 23 Testing Scope Assessments Groups of Tests Campaigns Individual Tests Test Cases Organization Unit Databases
SEC564 | RedTeam Exercises and Adversary Emulation Data Hierarchy 24 Assessments (Test Scope) Campaigns (Groups of Tests) Test Cases (Individual Tests) Databases (Organization Unit / Function) Purple Team Tracking Nov 2019 Purple Team APT 39 Emulation APT 39 Lateral Movement SSH APT 39 Phishing Word Doc Macros APT 39 Web Shell ASPXSPY
SEC564 | RedTeam Exercises and Adversary Emulation Importing AssessmentTemplates 25
SEC564 | RedTeam Exercises and Adversary Emulation Importing Content fromThird-party Sources 26 Import latest MITRE ATT&CK enterprise bundle Import latest Red Canary Atomic Red index
SEC564 | RedTeam Exercises and Adversary Emulation Importing Custom Assessments (VECTR-to-VECTR sharing) 27
SEC564 | RedTeam Exercises and Adversary Emulation Reporting Dashboard 28
SEC564 | RedTeam Exercises and Adversary Emulation Dynamic Heat Map 29
SEC564 | RedTeam Exercises and Adversary Emulation HistoricalTrending with sub-charts 30
SEC564 | RedTeam Exercises and Adversary Emulation Campaign Dashboard 31
SEC564 | RedTeam Exercises and Adversary Emulation Test Case Panel 32
SEC564 | RedTeam Exercises and Adversary Emulation VECTR: On Deck Features 33 • New auth layer with SSO and MFA support • VECTR Portable Runtime Automation and structured logging format – ATTiRe – Attack Tool Timing and Reporting – Support import of data from SCYTHE • Test Case Panel re-design • Detection Rules re-design • Reporting View updates and more customization • More granular RBAC than current roles • Public API & TAXII Server
SEC564 Demo Thank You! Questions? Red Team Exercises and Adversary Emulation © 2020 Jorge Orchilles & PhilWainwright | All Rights Reserved

Empfohlen

ATT&CKing the Red/Blue Divide
ATT&CKing the Red/Blue DivideATT&CKing the Red/Blue Divide
ATT&CKing the Red/Blue Divide
MITRE ATT&CK
 
Purple Team Exercise Framework Workshop #PTEF
Purple Team Exercise Framework Workshop #PTEFPurple Team Exercise Framework Workshop #PTEF
Purple Team Exercise Framework Workshop #PTEF
Jorge Orchilles
 
Purple Team Exercises - GRIMMCon
Purple Team Exercises - GRIMMConPurple Team Exercises - GRIMMCon
Purple Team Exercises - GRIMMCon
Jorge Orchilles
 
Red team Engagement
Red team EngagementRed team Engagement
Red team Engagement
Indranil Banerjee
 
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CKTracking Noisy Behavior and Risk-Based Alerting with ATT&CK
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
MITRE ATT&CK
 
Red teaming probably isn't for you
Red teaming probably isn't for youRed teaming probably isn't for you
Red teaming probably isn't for you
Toby Kohlenberg
 
How MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsHow MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operations
Sergey Soldatov
 
Adversary Emulation - Red Team Village - Mayhem 2020
Adversary Emulation - Red Team Village - Mayhem 2020Adversary Emulation - Red Team Village - Mayhem 2020
Adversary Emulation - Red Team Village - Mayhem 2020
Jorge Orchilles
 

Empfohlen

ATT&CKing the Red/Blue Divide
ATT&CKing the Red/Blue DivideATT&CKing the Red/Blue Divide
ATT&CKing the Red/Blue Divide
MITRE ATT&CK
 
Purple Team Exercise Framework Workshop #PTEF
Purple Team Exercise Framework Workshop #PTEFPurple Team Exercise Framework Workshop #PTEF
Purple Team Exercise Framework Workshop #PTEF
Jorge Orchilles
 
Purple Team Exercises - GRIMMCon
Purple Team Exercises - GRIMMConPurple Team Exercises - GRIMMCon
Purple Team Exercises - GRIMMCon
Jorge Orchilles
 
Red team Engagement
Red team EngagementRed team Engagement
Red team Engagement
Indranil Banerjee
 
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CKTracking Noisy Behavior and Risk-Based Alerting with ATT&CK
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
MITRE ATT&CK
 
Red teaming probably isn't for you
Red teaming probably isn't for youRed teaming probably isn't for you
Red teaming probably isn't for you
Toby Kohlenberg
 
How MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsHow MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operations
Sergey Soldatov
 
Adversary Emulation - Red Team Village - Mayhem 2020
Adversary Emulation - Red Team Village - Mayhem 2020Adversary Emulation - Red Team Village - Mayhem 2020
Adversary Emulation - Red Team Village - Mayhem 2020
Jorge Orchilles
 
Adversary Emulation and Red Team Exercises - EDUCAUSE
Adversary Emulation and Red Team Exercises - EDUCAUSEAdversary Emulation and Red Team Exercises - EDUCAUSE
Adversary Emulation and Red Team Exercises - EDUCAUSE
Jorge Orchilles
 
Red Team Framework
Red Team FrameworkRed Team Framework
Red Team Framework
👀 Joe Gray
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You ArePutting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Katie Nickels
 
The ATT&CK Latin American APT Playbook
The ATT&CK Latin American APT PlaybookThe ATT&CK Latin American APT Playbook
The ATT&CK Latin American APT Playbook
MITRE ATT&CK
 
Adversary Emulation Workshop
Adversary Emulation WorkshopAdversary Emulation Workshop
Adversary Emulation Workshop
prithaaash
 
Knowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CKKnowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CK
MITRE ATT&CK
 
ATT&CK Updates- ATT&CK's Open Source
ATT&CK Updates- ATT&CK's Open SourceATT&CK Updates- ATT&CK's Open Source
ATT&CK Updates- ATT&CK's Open Source
MITRE ATT&CK
 
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
MITRE ATT&CK
 
Threat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKThreat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CK
Katie Nickels
 
ATT&CK Updates- Campaigns
ATT&CK Updates- CampaignsATT&CK Updates- Campaigns
ATT&CK Updates- Campaigns
MITRE ATT&CK
 
Automating the mundanity of technique IDs with ATT&CK Detections Collector
Automating the mundanity of technique IDs with ATT&CK Detections CollectorAutomating the mundanity of technique IDs with ATT&CK Detections Collector
Automating the mundanity of technique IDs with ATT&CK Detections Collector
MITRE ATT&CK
 
Leveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common LanguageLeveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common Language
Erik Van Buggenhout
 
ATT&CKcon Intro
ATT&CKcon IntroATT&CKcon Intro
ATT&CKcon Intro
MITRE ATT&CK
 
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
Katie Nickels
 
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE - ATT&CKcon
 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE - ATT&CKcon
 
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
MITRE - ATT&CKcon
 
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red TeamWhat is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
MITRE ATT&CK
 
State of the ATT&CK
State of the ATT&CKState of the ATT&CK
State of the ATT&CK
MITRE ATT&CK
 
Purple team is awesome
Purple team is awesomePurple team is awesome
Purple team is awesome
Sumedt Jitpukdebodin
 
Ethical Hacking Definitions Matter - Covering Vulnerability Scanning, Vulnera...
Ethical Hacking Definitions Matter - Covering Vulnerability Scanning, Vulnera...Ethical Hacking Definitions Matter - Covering Vulnerability Scanning, Vulnera...
Ethical Hacking Definitions Matter - Covering Vulnerability Scanning, Vulnera...
Jorge Orchilles
 
Purple Team Exercise Hands-On Workshop #GrayHat
Purple Team Exercise Hands-On Workshop #GrayHatPurple Team Exercise Hands-On Workshop #GrayHat
Purple Team Exercise Hands-On Workshop #GrayHat
Jorge Orchilles
 

Weitere ähnliche Inhalte

Was ist angesagt?

Red Team Framework
Red Team FrameworkRed Team Framework
Red Team Framework
👀 Joe Gray
 
The ATT&CK Latin American APT Playbook
The ATT&CK Latin American APT PlaybookThe ATT&CK Latin American APT Playbook
The ATT&CK Latin American APT Playbook
MITRE ATT&CK
 
Knowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CKKnowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CK
MITRE ATT&CK
 
Automating the mundanity of technique IDs with ATT&CK Detections Collector
Automating the mundanity of technique IDs with ATT&CK Detections CollectorAutomating the mundanity of technique IDs with ATT&CK Detections Collector
Automating the mundanity of technique IDs with ATT&CK Detections Collector
MITRE ATT&CK
 
Leveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common LanguageLeveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common Language
Erik Van Buggenhout
 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE - ATT&CKcon
 
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red TeamWhat is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
MITRE ATT&CK
 

Was ist angesagt? (20)

Adversary Emulation and Red Team Exercises - EDUCAUSE
Adversary Emulation and Red Team Exercises - EDUCAUSEAdversary Emulation and Red Team Exercises - EDUCAUSE
Adversary Emulation and Red Team Exercises - EDUCAUSE
 
Red Team Framework
Red Team FrameworkRed Team Framework
Red Team Framework
 
Putting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You ArePutting MITRE ATT&CK into Action with What You Have, Where You Are
Putting MITRE ATT&CK into Action with What You Have, Where You Are
 
The ATT&CK Latin American APT Playbook
The ATT&CK Latin American APT PlaybookThe ATT&CK Latin American APT Playbook
The ATT&CK Latin American APT Playbook
 
Adversary Emulation Workshop
Adversary Emulation WorkshopAdversary Emulation Workshop
Adversary Emulation Workshop
 
Knowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CKKnowledge for the masses: Storytelling with ATT&CK
Knowledge for the masses: Storytelling with ATT&CK
 
ATT&CK Updates- ATT&CK's Open Source
ATT&CK Updates- ATT&CK's Open SourceATT&CK Updates- ATT&CK's Open Source
ATT&CK Updates- ATT&CK's Open Source
 
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
Would you Rather Have Telemetry into 2 Attacks or 20? An Insight Into Highly ...
 
Threat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKThreat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CK
 
ATT&CK Updates- Campaigns
ATT&CK Updates- CampaignsATT&CK Updates- Campaigns
ATT&CK Updates- Campaigns
 
Automating the mundanity of technique IDs with ATT&CK Detections Collector
Automating the mundanity of technique IDs with ATT&CK Detections CollectorAutomating the mundanity of technique IDs with ATT&CK Detections Collector
Automating the mundanity of technique IDs with ATT&CK Detections Collector
 
Leveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common LanguageLeveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common Language
 
ATT&CKcon Intro
ATT&CKcon IntroATT&CKcon Intro
ATT&CKcon Intro
 
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
FIRST CTI Symposium: Turning intelligence into action with MITRE ATT&CK™
 
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
MITRE ATT&CKcon 2.0: Using Threat Intelligence to Focus ATT&CK Activities; Da...
 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
 
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
MITRE ATT&CKcon 2.0: Lessons in Purple Team Testing with MITRE ATT&CK; Daniel...
 
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red TeamWhat is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
 
State of the ATT&CK
State of the ATT&CKState of the ATT&CK
State of the ATT&CK
 
Purple team is awesome
Purple team is awesomePurple team is awesome
Purple team is awesome
 

Ähnlich wie Managing & Showing Value during Red Team Engagements & Purple Team Exercises - VECTR SANS Webcast

Ethical Hacking Definitions Matter - Covering Vulnerability Scanning, Vulnera...
Ethical Hacking Definitions Matter - Covering Vulnerability Scanning, Vulnera...Ethical Hacking Definitions Matter - Covering Vulnerability Scanning, Vulnera...
Ethical Hacking Definitions Matter - Covering Vulnerability Scanning, Vulnera...
Jorge Orchilles
 
Cyber D&D
Cyber D&DCyber D&D
Cyber D&D
Sachin Nandakumar
 
Cyber D&D
Cyber D&DCyber D&D
Cyber D&D
Sachin Nandakumar
 
Using IOCs to Design and Control Threat Activities During a Red Team Engagement
Using IOCs to Design and Control Threat Activities During a Red Team EngagementUsing IOCs to Design and Control Threat Activities During a Red Team Engagement
Using IOCs to Design and Control Threat Activities During a Red Team Engagement
Joe Vest
 
Purple Team Exercise Workshop December 2020
Purple Team Exercise Workshop December 2020Purple Team Exercise Workshop December 2020
Purple Team Exercise Workshop December 2020
Jorge Orchilles
 
4_25655_SE731_2020_1__2_1_Lecture 1 - Course Outline and Secure SDLC.ppt
4_25655_SE731_2020_1__2_1_Lecture 1 - Course Outline and Secure SDLC.ppt4_25655_SE731_2020_1__2_1_Lecture 1 - Course Outline and Secure SDLC.ppt
4_25655_SE731_2020_1__2_1_Lecture 1 - Course Outline and Secure SDLC.ppt
gealehegn
 
PFCongres - Test Improvement 4 Agile
PFCongres - Test Improvement 4 AgilePFCongres - Test Improvement 4 Agile
PFCongres - Test Improvement 4 Agile
Jeroen Mengerink
 
Cyber Threat Simulation
Cyber Threat SimulationCyber Threat Simulation
Cyber Threat Simulation
Tonex
 

Ähnlich wie Managing & Showing Value during Red Team Engagements & Purple Team Exercises - VECTR SANS Webcast (20)

Ethical Hacking Definitions Matter - Covering Vulnerability Scanning, Vulnera...
Ethical Hacking Definitions Matter - Covering Vulnerability Scanning, Vulnera...Ethical Hacking Definitions Matter - Covering Vulnerability Scanning, Vulnera...
Ethical Hacking Definitions Matter - Covering Vulnerability Scanning, Vulnera...
 
Purple Team Exercise Hands-On Workshop #GrayHat
Purple Team Exercise Hands-On Workshop #GrayHatPurple Team Exercise Hands-On Workshop #GrayHat
Purple Team Exercise Hands-On Workshop #GrayHat
 
2020 11-15 marcin ludwiszewski - purple, red, blue and others - rainbow team...
2020 11-15 marcin ludwiszewski - purple, red, blue and others - rainbow team...2020 11-15 marcin ludwiszewski - purple, red, blue and others - rainbow team...
2020 11-15 marcin ludwiszewski - purple, red, blue and others - rainbow team...
 
Hack Warz® Cyber Attack: A Hands-On Lab for Network Defenders
Hack Warz® Cyber Attack: A Hands-On Lab for Network DefendersHack Warz® Cyber Attack: A Hands-On Lab for Network Defenders
Hack Warz® Cyber Attack: A Hands-On Lab for Network Defenders
 
Cyber D&D
Cyber D&DCyber D&D
Cyber D&D
 
Cyber D&D
Cyber D&DCyber D&D
Cyber D&D
 
FS-ISAC 2019 - Building an Effective Red Team Program 07/08/2019
FS-ISAC 2019 - Building an Effective Red Team Program 07/08/2019FS-ISAC 2019 - Building an Effective Red Team Program 07/08/2019
FS-ISAC 2019 - Building an Effective Red Team Program 07/08/2019
 
Soc
SocSoc
Soc
 
Using IOCs to Design and Control Threat Activities During a Red Team Engagement
Using IOCs to Design and Control Threat Activities During a Red Team EngagementUsing IOCs to Design and Control Threat Activities During a Red Team Engagement
Using IOCs to Design and Control Threat Activities During a Red Team Engagement
 
Red Team Framework
Red Team FrameworkRed Team Framework
Red Team Framework
 
Purple Team Exercise Workshop December 2020
Purple Team Exercise Workshop December 2020Purple Team Exercise Workshop December 2020
Purple Team Exercise Workshop December 2020
 
PPT-Security-for-Management.pptx
PPT-Security-for-Management.pptxPPT-Security-for-Management.pptx
PPT-Security-for-Management.pptx
 
Ethical hacking
Ethical hackingEthical hacking
Ethical hacking
 
4_25655_SE731_2020_1__2_1_Lecture 1 - Course Outline and Secure SDLC.ppt
4_25655_SE731_2020_1__2_1_Lecture 1 - Course Outline and Secure SDLC.ppt4_25655_SE731_2020_1__2_1_Lecture 1 - Course Outline and Secure SDLC.ppt
4_25655_SE731_2020_1__2_1_Lecture 1 - Course Outline and Secure SDLC.ppt
 
PFCongres - Test Improvement 4 Agile
PFCongres - Test Improvement 4 AgilePFCongres - Test Improvement 4 Agile
PFCongres - Test Improvement 4 Agile
 
CISSP 8 Domains.pdf
CISSP 8 Domains.pdfCISSP 8 Domains.pdf
CISSP 8 Domains.pdf
 
RED-TEAM_Conclave
RED-TEAM_ConclaveRED-TEAM_Conclave
RED-TEAM_Conclave
 
My Keynote from BSidesTampa 2015 (video in description)
My Keynote from BSidesTampa 2015 (video in description)My Keynote from BSidesTampa 2015 (video in description)
My Keynote from BSidesTampa 2015 (video in description)
 
Building a Successful Threat Hunting Program
Building a Successful Threat Hunting ProgramBuilding a Successful Threat Hunting Program
Building a Successful Threat Hunting Program
 
Cyber Threat Simulation
Cyber Threat SimulationCyber Threat Simulation
Cyber Threat Simulation
 

Mehr von Jorge Orchilles

SCYTHE Purple Team Workshop with Tim Schulz
SCYTHE Purple Team Workshop with Tim SchulzSCYTHE Purple Team Workshop with Tim Schulz
SCYTHE Purple Team Workshop with Tim Schulz
Jorge Orchilles
 
C2 Matrix Anniversary - Blackhat EU 2020
C2 Matrix Anniversary - Blackhat EU 2020C2 Matrix Anniversary - Blackhat EU 2020
C2 Matrix Anniversary - Blackhat EU 2020
Jorge Orchilles
 
Blackhat 2020 Arsenal - C2 Matrix
Blackhat 2020 Arsenal - C2 MatrixBlackhat 2020 Arsenal - C2 Matrix
Blackhat 2020 Arsenal - C2 Matrix
Jorge Orchilles
 
Cuddling the Cozy Bear Emulating APT29
Cuddling the Cozy Bear Emulating APT29Cuddling the Cozy Bear Emulating APT29
Cuddling the Cozy Bear Emulating APT29
Jorge Orchilles
 
Adversarial Emulation and the C2 Matrix - Presented at Wild West Hackin Fest ...
Adversarial Emulation and the C2 Matrix - Presented at Wild West Hackin Fest ...Adversarial Emulation and the C2 Matrix - Presented at Wild West Hackin Fest ...
Adversarial Emulation and the C2 Matrix - Presented at Wild West Hackin Fest ...
Jorge Orchilles
 
Adversary Emulation and the C2 Matrix
Adversary Emulation and the C2 MatrixAdversary Emulation and the C2 Matrix
Adversary Emulation and the C2 Matrix
Jorge Orchilles
 
C2 Matrix A Comparison of Command and Control Frameworks
C2 Matrix A Comparison of Command and Control FrameworksC2 Matrix A Comparison of Command and Control Frameworks
C2 Matrix A Comparison of Command and Control Frameworks
Jorge Orchilles
 
Windows Phone 8 Security and Testing WP8 Apps
Windows Phone 8 Security and Testing WP8 AppsWindows Phone 8 Security and Testing WP8 Apps
Windows Phone 8 Security and Testing WP8 Apps
Jorge Orchilles
 

Mehr von Jorge Orchilles (20)

SCYTHE Purple Team Workshop with Tim Schulz
SCYTHE Purple Team Workshop with Tim SchulzSCYTHE Purple Team Workshop with Tim Schulz
SCYTHE Purple Team Workshop with Tim Schulz
 
So you want to be a red teamer
So you want to be a red teamerSo you want to be a red teamer
So you want to be a red teamer
 
Purple Team Use Case - Security Weekly
Purple Team Use Case - Security WeeklyPurple Team Use Case - Security Weekly
Purple Team Use Case - Security Weekly
 
KringleCon 3 Providing Value in Offensive Security
KringleCon 3 Providing Value in Offensive SecurityKringleCon 3 Providing Value in Offensive Security
KringleCon 3 Providing Value in Offensive Security
 
C2 Matrix Anniversary - Blackhat EU 2020
C2 Matrix Anniversary - Blackhat EU 2020C2 Matrix Anniversary - Blackhat EU 2020
C2 Matrix Anniversary - Blackhat EU 2020
 
External Threat Hunters are Red Teamers
External Threat Hunters are Red TeamersExternal Threat Hunters are Red Teamers
External Threat Hunters are Red Teamers
 
Evolution of Offensive Assessments - SecureWV Conference
Evolution of Offensive Assessments - SecureWV ConferenceEvolution of Offensive Assessments - SecureWV Conference
Evolution of Offensive Assessments - SecureWV Conference
 
Evolution of Offensive Assessments - RootCon
Evolution of Offensive Assessments - RootConEvolution of Offensive Assessments - RootCon
Evolution of Offensive Assessments - RootCon
 
8.8 Las Vegas - Adversary Emulation con C2 Matrix
8.8 Las Vegas - Adversary Emulation con C2 Matrix8.8 Las Vegas - Adversary Emulation con C2 Matrix
8.8 Las Vegas - Adversary Emulation con C2 Matrix
 
DEFCON Safe Mode - Red Team Village - Emulating Evil Corp and WastedLocker
DEFCON Safe Mode - Red Team Village - Emulating Evil Corp and WastedLockerDEFCON Safe Mode - Red Team Village - Emulating Evil Corp and WastedLocker
DEFCON Safe Mode - Red Team Village - Emulating Evil Corp and WastedLocker
 
Blackhat 2020 Arsenal - C2 Matrix
Blackhat 2020 Arsenal - C2 MatrixBlackhat 2020 Arsenal - C2 Matrix
Blackhat 2020 Arsenal - C2 Matrix
 
Cuddling the Cozy Bear Emulating APT29
Cuddling the Cozy Bear Emulating APT29Cuddling the Cozy Bear Emulating APT29
Cuddling the Cozy Bear Emulating APT29
 
Adversary Emulation - DerpCon
Adversary Emulation - DerpConAdversary Emulation - DerpCon
Adversary Emulation - DerpCon
 
Adversarial Emulation with the C2 Matrix - Wild West WebCastin Fest
Adversarial Emulation with the C2 Matrix - Wild West WebCastin FestAdversarial Emulation with the C2 Matrix - Wild West WebCastin Fest
Adversarial Emulation with the C2 Matrix - Wild West WebCastin Fest
 
Adversarial Emulation and the C2 Matrix - Presented at Wild West Hackin Fest ...
Adversarial Emulation and the C2 Matrix - Presented at Wild West Hackin Fest ...Adversarial Emulation and the C2 Matrix - Presented at Wild West Hackin Fest ...
Adversarial Emulation and the C2 Matrix - Presented at Wild West Hackin Fest ...
 
Adversary Emulation and the C2 Matrix
Adversary Emulation and the C2 MatrixAdversary Emulation and the C2 Matrix
Adversary Emulation and the C2 Matrix
 
C2 Matrix A Comparison of Command and Control Frameworks
C2 Matrix A Comparison of Command and Control FrameworksC2 Matrix A Comparison of Command and Control Frameworks
C2 Matrix A Comparison of Command and Control Frameworks
 
Purple Team - Work it out: Organizing Effective Adversary Emulation Exercises
Purple Team - Work it out: Organizing Effective Adversary Emulation ExercisesPurple Team - Work it out: Organizing Effective Adversary Emulation Exercises
Purple Team - Work it out: Organizing Effective Adversary Emulation Exercises
 
Windows Phone 8 Security and Testing WP8 Apps
Windows Phone 8 Security and Testing WP8 AppsWindows Phone 8 Security and Testing WP8 Apps
Windows Phone 8 Security and Testing WP8 Apps
 
Vulnerability Ass... Penetrate What?
Vulnerability Ass... Penetrate What?Vulnerability Ass... Penetrate What?
Vulnerability Ass... Penetrate What?
 

Kürzlich hochgeladen

Ransomware_Q4_2023. The report. [EN].pdf
Ransomware_Q4_2023. The report. [EN].pdfRansomware_Q4_2023. The report. [EN].pdf
Ransomware_Q4_2023. The report. [EN].pdf
Overkill Security
 
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Jeffrey Haguewood
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
sammart93
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc
 

Kürzlich hochgeladen (20)

Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CVReal Time Object Detection Using Open CV
Real Time Object Detection Using Open CV
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
 
Manulife - Insurer Transformation Award 2024
Manulife - Insurer Transformation Award 2024Manulife - Insurer Transformation Award 2024
Manulife - Insurer Transformation Award 2024
 
Artificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyArtificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : Uncertainty
 
ICT role in 21st century education and its challenges
ICT role in 21st century education and its challengesICT role in 21st century education and its challenges
ICT role in 21st century education and its challenges
 
DBX First Quarter 2024 Investor Presentation
DBX First Quarter 2024 Investor PresentationDBX First Quarter 2024 Investor Presentation
DBX First Quarter 2024 Investor Presentation
 
Ransomware_Q4_2023. The report. [EN].pdf
Ransomware_Q4_2023. The report. [EN].pdfRansomware_Q4_2023. The report. [EN].pdf
Ransomware_Q4_2023. The report. [EN].pdf
 
Navi Mumbai Call Girls 🥰 8617370543 Service Offer VIP Hot Model
Navi Mumbai Call Girls 🥰 8617370543 Service Offer VIP Hot ModelNavi Mumbai Call Girls 🥰 8617370543 Service Offer VIP Hot Model
Navi Mumbai Call Girls 🥰 8617370543 Service Offer VIP Hot Model
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
 
GenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdfGenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdf
 
A Beginners Guide to Building a RAG App Using Open Source Milvus
A Beginners Guide to Building a RAG App Using Open Source MilvusA Beginners Guide to Building a RAG App Using Open Source Milvus
A Beginners Guide to Building a RAG App Using Open Source Milvus
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
 
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, AdobeApidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
 
Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
 
Apidays Singapore 2024 - Modernizing Securities Finance by Madhu Subbu
Apidays Singapore 2024 - Modernizing Securities Finance by Madhu SubbuApidays Singapore 2024 - Modernizing Securities Finance by Madhu Subbu
Apidays Singapore 2024 - Modernizing Securities Finance by Madhu Subbu
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
 
FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
 

Managing & Showing Value during Red Team Engagements & Purple Team Exercises - VECTR SANS Webcast

  • 1. SEC564 Demo Managing & Showing Value during Red Team Engagements & Purple Team Exercises Red Team Exercises and Adversary Emulation © 2020 Jorge Orchilles & PhilWainwright | All Rights Reserved
  • 2. SEC564 | RedTeam Exercises and Adversary Emulation T1033 - System Owner/User Discovery – Jorge Orchilles • Chief Technology Officer - SCYTHE • C2 Matrix Co-Creator • Certified SANS Instructor: SEC560, SEC504 • Author SEC564: Red Team Exercises and Adversary Emulation • 10 years @ Citi leading offensive security team • CVSSv3.1 Working Group Voting Member • GFMA: Threat-Led Pen Test Framework • ISSA Fellow; NSI Technologist Fellow
  • 3. SEC564 | RedTeam Exercises and Adversary Emulation T1033 - System Owner/User Discovery – Phil Wainwright • Director at Security Risk Advisors, focus on technical testing and software delivery • InfoSec consultant for 15 years, promoted to “cyber” in recent years • Background in pen testing, appsec/product security, network & cloud security • More recent focus in purple teaming & adversary emulation past ~7 years • Manages team working on the VECTR platform • Black Hat Arsenal 2019 & FS-ISAC speaker
  • 4. SEC564 | RedTeam Exercises and Adversary Emulation About SEC564 Red Team Exercises and Adversary Emulation • Learn the skills needed to perform safe, professional Red Team Exercises and Adversary Emulations • Introduce and follow repeatable frameworks and methodologies • Tips and tricks to save time, enhance quality, and avoid risk • Perform hands-on exercises to reinforce the topics, in a class- long, intelligence led, Adversary Emulation Red Team Exercise 4
  • 5. SEC564 | RedTeam Exercises and Adversary Emulation Agenda • Definitions – because we said Red Team and must debate • Framework and Methodology • Cyber Threat Intelligence • Planning an Adversary Emulation • Emulating an Adversary • Exercise Closure – Showing Value with VECTR • ~70% Live Demos – And screenshots for those that only read slides – Yeah, we know who you are 5
  • 6. SEC564 | RedTeam Exercises and Adversary Emulation RedTeam • Definition: Red Team performs Tactics, Techniques, and Procedures (TTPs) to test people, processes, and technology in a target environment. “The practice of looking at a problem or situation from the perspective of an adversary” – Red Team Journal 1997 • Goal: Make Blue Team better. Train and measure blue teams' detection and response policies, procedures, and technologies are effective. • Effort: Manual; lots of tools (see C2 Matrix) • Frequency: Intelligence-led (new exploit, tool, or TTP) • Customer: Blue Teams 6
  • 7. SEC564 | RedTeam Exercises and Adversary Emulation BlueTeam • Definition: the defenders in an organization entrusted with identifying and remediating attacks. Generally associated with Security Operations Center or Managed Security Service Provider (MSSP), Hunt Team, Incident Response, and Digital Forensics. Really, it is everyone's responsibility! • Goal: identify, report the attack, contain, and eradicate attacks • Effort: Automated and Manual. People are the best defenders • Frequency: Every Day 24/7 • Customer: entire organization 7
  • 8. SEC564 | RedTeam Exercises and Adversary Emulation Adversary Emulation 8 • Definition: A type of Red Team exercise where the Red Team emulates how an adversary operates, following the same tactics, techniques, and procedures (TTPs), with a specific objective like those of realistic threats or adversaries. • Goal: Emulate an end-to-end attack against a target organization. Obtain a holistic view of the organization’s preparedness for a real, sophisticated attack. • Effort: Manual; more setup than a limited scope Penetration Test • Frequency: Twice a year or yearly • Customer: Entire organization
  • 9. SEC564 | RedTeam Exercises and Adversary Emulation PurpleTeam • Definition: A function, or virtual team, where red and blue work together to improve the overall security of the organization. Red Team does not focus on stealth as they normally would. • Goal: Red Team emulates adversary TTPs while blue teams watch and improve detection and response policies, procedures, and technologies in real time. • Effort: Manual • Frequency: Intelligence-led (new exploit, tool, or TTP) • Customer: Red Team & Blue Team 9
  • 10. SEC564 | RedTeam Exercises and Adversary Emulation Framework for SEC564 Like most organizations, this course will take a hybrid approach based on the frameworks and methodologies just introduced 10 • Threat Intelligence • Planning • Testing − Red Team Exercise Execution • Closure − Analysis and Response − Report − Remediation and Action Plan FRAMEWORK
  • 11. SEC564 | RedTeam Exercises and Adversary Emulation Threat Intelligence for RedTeam & PurpleTeam Exercises "Threat intelligence is evidence-based knowledge, including context, mechanisms, indicators, implications and actionable advice about an existing or emerging menace or hazard to assets that can be used to inform decisions regarding the subject's response to that menace or hazard." (Gartner) 11 Understand the Target Org Gather Threat Intelligence Analyze & Organize Emulate the Adversary Identify the Adversary ExtractTTPs Create a Plan
  • 12. SEC564 | RedTeam Exercises and Adversary Emulation MITRE® ATT&CK™ 12
  • 13. SEC564 | RedTeam Exercises and Adversary Emulation Planning The planning phase covers test preparation activities 13 • Triggers • Objectives • Scope • Trusted Agents • Roles and Responsibilities • Rules of Engagement FRAMEWORK
  • 14. SEC564 | RedTeam Exercises and Adversary Emulation Assumed Breach Philosophy and understanding one will be breached 14 • Based on assumption an endpoint is already compromised • Answers “what can attacker do with this initial access” – Tests for malicious insider threat as well • Start with a base build of OS and account just like a new hire • Simulate a user being compromised, then emulate an adversary • All other ATT&CK™ Tactics are in play • See Red Siege’s Mike Saunders presentation
  • 15. SEC564 | RedTeam Exercises and Adversary Emulation 15 Role Responsibilities Governance Approve the attack scenario, the final report and remediation action items. Governance agents should also receive status updates throughout the exercise Project Management Coordinate entire Red Team Exercise including threat intelligence gathering; target reconnaissance; Testing Phase communication; and management of timeline and objectives Threat Intelligence Identify cyber threat actor(s) with the sophistication and desire to attack the organization; provide the group’s technical and behavioral profile including TTPs Risk Avoidance Receive daily updates on all Red Team actions and are responsible for avoiding or reducing the material impact of the exercise to business operations Action Item Remediation Owners Own actions related to remediation plan. Owners of Technology related findings will be privy to more briefings and overall action items than those that fall in the Exercise and Process categories as the need to know becomes lower and the risk of knowledge transfer becomes higher
  • 16. SEC564 | RedTeam Exercises and Adversary Emulation RedTeam Planning • Red Team Planning – Fill any planning gaps – Attack Infrastructure/C2 – Reconnaissance – Social Engineering – Weaponization • Initial Access/Foothold • Network Propagation • Action on Objectives 16 FRAMEWORK
  • 17. SEC564 | RedTeam Exercises and Adversary Emulation The C2 Matrix Matrix of command and control frameworks for RedTeamers 17 • Google doc of most C2 frameworks • Documents various capabilities of each framework • There is no right or wrong, better or worse framework • Find ideal C2 for your current objective • Wizard like UI to select which one • www.thec2matrix.com • howto.thec2matrix.com
  • 18. SEC564 | RedTeam Exercises and Adversary Emulation 18
  • 19. SEC564 | RedTeam Exercises and Adversary Emulation ShowValue • Analysis and Response – Red Team Reveal – Replay – Purple Team • Reporting • Remediation and Action Plan – People – Process – Technology 19 FRAMEWORK
  • 20. SEC564 | RedTeam Exercises and Adversary Emulation What isVECTR? • Free platform for planning and tracking red team and purple team assessments • Heavy focus on collaborative testing between red & blue teams with tracking of specific red team activities and defensive outcomes • Designed to promote transparency and education between red team operators, security operations, engineering, threat intel & hunt teams 20
  • 21. SEC564 | RedTeam Exercises and Adversary Emulation Common Use Cases forVECTR • Measure enterprise defenses across the MITRE ATT&CK framework • Structured testing and evaluations for existing and PoC security tools in the environment • Import structured CTI (STIX 2.0 bundles) for adversary emulation planning • Create custom assessments, campaigns, and test case templates for repeatable testing across multiple environments and targets • Report on executive summary level or drill-down into assessment results, visualize with dynamic heat map, historical trending, and detailed reporting views 21
  • 22. SEC564 | RedTeam Exercises and Adversary Emulation Getting Started • Download VECTR at https://github.com/SecurityRiskAdvisors/VECTR • Read the docs: https://docs.vectr.io • Join the community: https://vectr.io • Contact the team at vectr@sra.io with questions & feedback 22
  • 23. SEC564 | RedTeam Exercises and Adversary Emulation VECTR Concepts 23 Testing Scope Assessments Groups of Tests Campaigns Individual Tests Test Cases Organization Unit Databases
  • 24. SEC564 | RedTeam Exercises and Adversary Emulation Data Hierarchy 24 Assessments (Test Scope) Campaigns (Groups of Tests) Test Cases (Individual Tests) Databases (Organization Unit / Function) Purple Team Tracking Nov 2019 Purple Team APT 39 Emulation APT 39 Lateral Movement SSH APT 39 Phishing Word Doc Macros APT 39 Web Shell ASPXSPY
  • 25. SEC564 | RedTeam Exercises and Adversary Emulation Importing AssessmentTemplates 25
  • 26. SEC564 | RedTeam Exercises and Adversary Emulation Importing Content fromThird-party Sources 26 Import latest MITRE ATT&CK enterprise bundle Import latest Red Canary Atomic Red index
  • 27. SEC564 | RedTeam Exercises and Adversary Emulation Importing Custom Assessments (VECTR-to-VECTR sharing) 27
  • 28. SEC564 | RedTeam Exercises and Adversary Emulation Reporting Dashboard 28
  • 29. SEC564 | RedTeam Exercises and Adversary Emulation Dynamic Heat Map 29
  • 30. SEC564 | RedTeam Exercises and Adversary Emulation HistoricalTrending with sub-charts 30
  • 31. SEC564 | RedTeam Exercises and Adversary Emulation Campaign Dashboard 31
  • 32. SEC564 | RedTeam Exercises and Adversary Emulation Test Case Panel 32
  • 33. SEC564 | RedTeam Exercises and Adversary Emulation VECTR: On Deck Features 33 • New auth layer with SSO and MFA support • VECTR Portable Runtime Automation and structured logging format – ATTiRe – Attack Tool Timing and Reporting – Support import of data from SCYTHE • Test Case Panel re-design • Detection Rules re-design • Reporting View updates and more customization • More granular RBAC than current roles • Public API & TAXII Server
  • 34. SEC564 Demo Thank You! Questions? Red Team Exercises and Adversary Emulation © 2020 Jorge Orchilles & PhilWainwright | All Rights Reserved