دوره SANS SEC565 : عملیات تیم قرمز و شبیه سازی حملات مهاجم سایبری

Overview

During the first section of the course, we will present a common language to discuss adversary tactics and techniques. We will discuss the purpose of the Red Team and highlight the various frameworks and methodologies around this topic. Two critical steps before a successful adversary emulation are to conduct threat intelligence and to plan for the engagement. The section closes by looking at the first few actions during the Red Team engagement.

Exercises

• Environment Orientation
• Deep Dive into MITRE® ATT&CK™
• Consuming Threat Intelligence
• Red Team Planning

Topics

• Adversary Emulation
• Ethical Hacking Maturity Model
• Frameworks and Methodologies
• Understanding Adversaries
• Unified Kill Chain
• MITRE® ATT&CK™
• Threat Intelligence
• Threat Report ATT&CK™ Mapping (TRAM)
• ATT&CK™ Navigator
• End-To-End Testing Model
• Assumed Breach
• Execution Phase
• Building a Red Team - Skill Development
• Reconnaissance
• Open-Source Intelligence (OSINT)
• Password Attacks
• Social Engineering
• Attacks Against MFA - evilnginx2

Overview

The second section of the course will introduce various Red Team tools and command-and-control frameworks, both of which rely on a well-maintained attack infrastructure. We will spend most of the section discussing the important aspects of a resilient attack infrastructure and how the Red Team can create a bit of distance from defenders by utilizing redirectors. Another key aspect of protecting the attack infrastructure that will be discussed is implementing monitoring and operational security.

Exercises

• Setting Up C2 Frameworks
• Setting Up Redirectors
• VECTR
• Covenant
• PowerShell Empire

Topics

• Red Team Tools
• Command and Control (C2)
• C2 Comparison
• Listeners and Communication Channels
• Advanced Infrastructure
• Redirectors
• Third-Party Hosting
• Comparison of Self-Hosted vs. Third-Party
• Operational Security
• Understand IoCs
• Introduction to VECTR
• Covenant

Overview

In the third section of the course, we will prepare our malicious payloads through weaponization. We will discuss various methods of delivery in order to achieve that initial access into the target network. After surveying the initial host and surrounding network, we will stealthily propagate through the network in a cycle of discovery, privilege escalation, credential access, and persistence.

Exercises

• Creating and Testing Payloads
• Test Bypasses
• Initial Access
• Discovery and Privilege Escalation
• Persistence

Topics

• Weaponization
• Custom Executables
• Blending In
• Execution Guardrails
• Initial Access
• Network Propagation
• Discovery
• Operational Security
• Deception Technology
• Local Network Enumeration
• Local Privilege Escalation
• Password Cracking
• Persistence

Overview

The fourth course section dives deep into Microsoft Active Directory (AD), learning and practicing the tactics, techniques, and procedures used to attack and enumerate it. We will use various tools to enumerate, escalate, and pivot through these enterprise networks, including Domain and Forest Trusts, and identify how we can move between them.

Exercises

• Domain Enumeration
• Privilege Hunting and Token Impersonation
• AD Attack Tools
• Bloodhound
• AD Lateral Movement
• Forest Lateral Movement

Topics

• Introduction to Active Directory
• Trees and Forests
• Authentication, Authorization, Access Tokens
• AD Enumerate
• DNS Extraction
• Domain Privilege Escalation
• Access Token Manipulation
• Pass-The-Hash, Pass-The-Ticket
• Kerberoasting
• Silver Ticket, Golden Ticket, Skeleton Key
• AD Certificate Services
• Unconstrained and Constrained Delegation
• Coerced Authentication Using PrinterBug and PetitPotam
• Hopping the Trust
• LLMNR/NBNS/WPAD
• Bloodhound/SharpHound
• AD Explorer
• SMB Pipes, Remote Desktop Protocol, PsExec, Windows Management Instrumentation, dcom
• SMB Relay
• LLMNR/NBT-NS Poisoning and Relay
• Responder
• Setting Up Shadow Credentials
• Domain Privilege Abuse
• DC Sync
• Domain Lateral Movement, Domain Trust Attacks
• Pivoting Between Domains and Forests
• Forest Enumeration, Forest Attacks

Overview

In section five, we will use our newly exploited access to discover critical and sensitive information stored in the environment. We will collect and exfiltrate these data and demonstrate the impact of the Red Teams actions. After the active testing period, the Red Team must analyze the engagement, deliver reporting, and plan for retesting. The section will close with preparations for the immersive Red Team Capture-the-Flag Exercise in the final course section.

Exercises

• Database Attacks
• Action on Objectives
• VECTR
• SCYTHE

Topics

• Action on Objectives
• Database Attacks
• SQL Abuse
• Trust Abuse
• PowerupSQL
• Target Manipulation
• Collection
• Data Staging
• Exfiltration
• Impact
• Emulating Ransomware
• Engagement Closure
• Analysis and Response
• Red Team Reveal
• Measuring People and Processes
• Retesting
• Remediation and Action Plan
• Breach and Attack Simulation
• APTSimulator
• Network Flight Simulator
• Atomic Red Team
• MITRE® CALDERA
• SCYTHE

Overview

In section six, we will conduct a Red Team engagement in a threat representative range depicting a Windows Active Directory enterprise network. Students will each have their own environment consisting of three domains. This story driven environment provides ample opportunity for each student to exercise many of the skills learned throughout the course. The environment is seasoned with rich user stories, target intelligence, and user activity. We will target Windows servers, workstations, and databases along with Active Directory infrastructure. We will also attack Linux servers and databases leveraging the systems maneuver through the segmented network.

Exercises

• Red Team engagement against Windows Active Directory enterprise network

Topics

• Adversary Emulation
• Reconnaissance
• Initial Access
• Persistence and Privilege Escalation
• Credential Access
• Discovery
• Lateral Movement
• Collection
• Command and Control
• Exfiltration
• Impact
• Closure