![[HUN][hackersuli] Red Teaming alapok 2024](https://image.slidesharecdn.com/2024redteam-240607054515-93122380/85/HUN-hackersuli-Red-Teaming-alapok-2024-14-320.jpg)
![[HUN][hackersuli] Red Teaming alapok 2024](https://image.slidesharecdn.com/2024redteam-240607054515-93122380/85/HUN-hackersuli-Red-Teaming-alapok-2024-15-320.jpg)
![[HUN][hackersuli] Red Teaming alapok 2024](https://image.slidesharecdn.com/2024redteam-240607054515-93122380/85/HUN-hackersuli-Red-Teaming-alapok-2024-16-320.jpg)
![[HUN][hackersuli] Red Teaming alapok 2024](https://image.slidesharecdn.com/2024redteam-240607054515-93122380/85/HUN-hackersuli-Red-Teaming-alapok-2024-17-320.jpg)
![[HUN][hackersuli] Red Teaming alapok 2024](https://image.slidesharecdn.com/2024redteam-240607054515-93122380/85/HUN-hackersuli-Red-Teaming-alapok-2024-18-320.jpg)
![[HUN][hackersuli] Red Teaming alapok 2024](https://image.slidesharecdn.com/2024redteam-240607054515-93122380/85/HUN-hackersuli-Red-Teaming-alapok-2024-19-320.jpg)
![[HUN][hackersuli] Red Teaming alapok 2024](https://image.slidesharecdn.com/2024redteam-240607054515-93122380/85/HUN-hackersuli-Red-Teaming-alapok-2024-20-320.jpg)
[HUN][hackersuli] Red Teaming alapok 2024
- 2. AGENDA # W H OA M I F O G A L M A K T T P S TO O LO K I N T E R A K T Í V R É S Z
- 3. #WHOAMI
- 4. PÉTER TAMÁS (DJANGO88) PENETRATION TESTER – RED TEAM OPERATOR - DEUTSCHE TELEKOM SYNACK RED TEAM
- 5. RED TEAM Red Team performs Tactics, Techniques, and Procedures (TTPs) to test people, processes, and technology in a target environment. Goal: Make Blue Team better. Train and measure blue teams' detection and response policies, procedures, and technologies are effective. Effort: Manual; lots of tools (see C2 Matrix) Frequency: Intelligence-led (new exploit, tool, or TTP)
- 6. ADVERSARY EMULATION Definition: A type of Red Team exercise where the Red Team emulates how an adversary operates, following the same tactics, techniques, and procedures (TTPs), with a specific objective like those of realistic threats or adversaries. Goal: Emulate an end-to-end attack against a target organization. Obtain a holistic view of the organization’s preparedness for a real, sophisticated attack. Effort: Manual; more setup than a limited scope Penetration Test Frequency: Twice a year or yearly
- 7. RED TEAM PLANNING Red Team Planning Fill any planning gaps Attack Infrastructure/C2 Reconnaissance Social Engineering Weaponization Initial Access/Foothold Network Propagation Action on Objectives
- 8. AN END TO END ASSESMENT OF THE ENTIRE ORGANIZATION Main differentiator from penetration testing Tests the defenders not the defenses (detection vs. prevention) People, Process, and Technology Not a limited scope test targeting just a particular product, infrastructure, network, application, URL, or domain Full Cyber Kill Chain from Recon to Objective Often blind, unannounced exercise Determine what TTPs would work, undetected if a true attack occurred and action plan to remediate
- 9. ASSUMPTIONS That attack won't work here because... “We applied all patches” “We have outbound DLP” “Our users would never open a macro” “Our applications have MFA” “Our network is segmented and only way out is through proxy” “We have firewalls, AV, and IDS”
- 10. BENEFITS Training and improving the Blue Team Every Red Team Exercise will result in Blue Team getting better As you measure the people, process, and technology you will see improvements Lessons will be learned, and processes improved The more you train, the more you improve
- 11. MYTHS Penetration tests are accurate measurements of an organization’s security Penetration testing emulates adversarial behavior Penetration tests serve no purpose in a mature organization’s environment Penetration testing is synonymous with red teaming Black box testing is the most comprehensive method of applied security testing
- 12. Defense SECURE EMAIL GATEWAY • FireEyeMX • Cisco Email Security • Trend Micro for Email • MS Defender for Office365 SECURE WEB GATEWAY • Symantec BlueCoat • Palo Alto Proxy • Zscaler • FireEye NX SECURE DNS • Cisco Umbrella • DNSFilter • Akamai Enterprise Threat Protector AV • McAfee AV • ESET NOD32 • Symantec Endpoint Protection EDR • CrowdStrike Falcon • MS Defender for Endpoint • SentinelOne • Vmware Carbon Black • Elastic Secure DNS AV EDR Endpoint Security Attacker Email Sec Suite + Sandbox Secure Web Gateway Cloud Storage Cloud Redirector
- 13. Typical Initial Access vectors Email with malware attached / linked Spear-phishing / phishing / stealing valid credentials (especially over unusual platforms: LinkedIn, Skype, Telegram, Discord, Slack, Web forms) Reusing stolen credentials against external single-factor VPNs, Citrix Gateways, vulnerable Fortinet VPNs Password Spraying against Office365, Azure, custom login pages, VPN gateways Exposed RDP with weak credentials and lacking controls Unpatched known vulnerable perimeter device, application bugs, default credentials, Proxyshell / Log4j Rarely HID-emulating USB sticks introduced to the company’s premises WIFI Evil Twin -> Rogue WPA2 Enterprise -> NetNTLMv2 hash cracking -> authenticated network access -> Responder Plugging into on-premises LAN -> Lacking 802.1X -> Responder / mitm6 / Ldaprelayx / relaying to LDAP to create backdoor Machine account (RBCD/Whisker) SEO Poisoning – making malicious websites pop up higher in search engine results