hi everybody welcome to my devcon 29
adversary village
talk it's called exploiting blue team
opsec failures with red elk my name is
marksmates
and hope you like the presentation i
will be available in the
discord room or you can ask me questions
anytime later after talk you can hit me
up via twitter or some other
way that you can can find me so let's
dive into the talk
exploiting blue team object figures with
red dog a lot to the
dive in two a little bit about
me for who doesn't know who i am my name
is mark smith
um hobby wise i'm from infosec class of
1998 professionally since 2006
and i have a very big background in
system network engineering
and from 2006 i started doing pen
testing
in 2016 i co-founded a company called
outflank which you might know or might
not know
my core roles in there are red team
operations
as well as building some tools and doing
some of the trainings that we have
created within outflank
mainly on the offensive side mainly on
the red side i also have a
little bit of experience on the blue
team side
some of our clients where i had some
threatening experience which is
actually pretty fun to do so that's me
the company outflank we are a boutique
firm and we specialize in red teaming as
well as trainings
mainly aimed for blue although nowadays
we also have a red
aimed training and we have tooling
since the beginning since 2016 we have
created lots of tools given lots of
presentations
and the majority of our tools are
available on our github
although during the time we have become
aware of the fact that some tools are
simply too
powerful to be shared publicly online
and that's why we have created just a
few months ago our
outflank security tooling service which
is basically our private toolset of all
the tools that we use during our
engagements that are too powerful to be
used during operations adds up
those tools also integrate into what is
red elk
and that's where this is the topic of
today so
we're busting gluten object flavors with
red elk reduce the tooling and i want to
dive through
well the whole concept of redrock what
it is why we have created it and
how you can use it and then of course
there is the whole blue team side
and the blue team makes mistakes as well
object mistakes the same as red team
does so those are the main two topics
for today but
before we dive into that product
since we need to discuss how we
and with me we i mean outflank as well
as myself
how we see red teaming if there's one
thing that i would like you to take away
from this
talk is that we believe the red
exists solely to improve blue
um yes we do simulated attacks
uh but it's not a wrecking ball approach
it's not that we
come by smash everything apart
uh knock down the blue team walk away
loot the gold and start laughing no
no far from we see it as a sparring
match we see it as a training for blue
which
means that it's fundamentally a
different goal
we try to try to train the weaknesses of
the blue team
and try to improve them for actually
when the real deal
happens with the real attackers yes our
simulations our red team engagements
contain real punches real movements
it actually may hurt both sides
but it's always better to have a
practice hit on your face than a real
hit on your face
so we exist to train blue
no wrecking ball when we are talking
about our
boxing ring if you like just a quick
overview of how a modern
offensive infrastructure would look like
most likely yours
looks about the same conceptually wise
although there are many different
technical
bits and pieces going from right
to left we first have our own attacking
infrastructure while we have a commander
control service
multiple most likely we have our
delivery services web service where we
do tracking
we have all kinds of decoy things we
might have social media profiles all on
the true
infrastructure that is on your own span
of control
on the complete left side there is the
victim network or the target network
where you
eventually have your implant running
that calls back via http or or dns or
some other spooky
protocol that you have as well as
internally within that 50 network
you've got your things running your
implants connected things like that
in the middle there is what we roughly
call reader characters or
deflecting ways it's in the
modern nature of the modern times with
uh
cloud enabled infrastructure it's very
easy to have lots of
flexible disposable resilient systems in
there that
is just simply a layer in between
to obfuscate some of your own true
attacking infrastructure
as well as making some smart decisions
in the
indigo nothing near here i hope
but there is a reason that i'm telling
you this because this concept
can become quite big if you count the
amount of components that you have
for your offensive infrastructure during
operations so let's talk about
a single engagement which might have
several scenarios
for example if you use a tiebreaker
based approach for a head team you will
have multiple scenarios
within the same operation which also
means that you will have multiple c2
servers
typical engagement for us around five
different c2 servers we
also have multiple heat effectors
reverse proxies and things like that
they want the main fronting cdn type of
players multiple
you'll be creating multiple fake id
entities to do well
the whole social networking thing you
might create a website one or two
tracking pixels everywhere we track
everything both in emails as in delivery
as an ultimate multiple different
aspects tracking pixels tracking pixel
tracking pixels
you need to be catching them you need to
be setting them up
it's things to manage and i know a whole
delivery side we got multiple web
servers multiple email boxes maybe some
file sharing services messaging
platforms whatever
all the new hot stuff there there is but
there's multiple aspects that you need
to manage
that's all front facing on your
backhand side you will have generic
backhand components let's talk about
communication channels that you have
internally with your team or also with
the right team you will have your own
test labs you will have all kinds of log
aggregation
and log aggregation is where red elf
actually comes in
the reason i'm telling you this is that
it
this is our boxing ring this is what we
need to use
and it's becoming quite big per
operation and even if you have
multiple operations at the same time
which many writing firms actually do to
keep
track of that infrastructure is actually
becoming
challenging it's not something that
cannot be solved but it's becoming
challenging
so when we look at our offensive
infrastructure we have
two main typical challenges one being
oversight the other one being inside
with oversight i mean just keeping track
of
where your infrastructure is what the
state of it is it up is it running is it
is it okay
is it in some way you are
hurting your own infrastructure multiple
components multiple different things
multiple engagements all together a lot
of data components to keep
track of insight is more oriented on the
fact well besides if it's up and running
is there data in there that can help us
to do a better operation
do we have a proper insight over
infrastructure
looking at other fields we see quite a
resemblance if you look on how
those challenges are being solved
[Music]
so if we look at cowboys i just said the
name
of the term herding to some extent
we need to hurt our own infrastructure
and cowboys have the same
way of hurting their cattle and
use dogs to keep everything in control
and that gives them some way to
manage the hurt in that sense um
if you look at the inside i'd like to
refer back to
mr edmund lokar which was actually the
true shirley bones it was a french
the french shell of holmes and he was
the one who put forensic science into
the field of forensics he was the one
first to start measuring things having
forensic approaches to having a
academic approaches to to forensic
science scientific approaches
early 20th century and why do i
uh bring in this guy into the talk
because his most family known for his
is on the low-cost exchange principle
which means every
contact leaves a trace and this is
actually very much
true for our own operation as you know
every offensive action that we do it
will leave a trace on the system
it's up to blue to digest to see
and digest and inspect the trace
but it's impossible to touch a system to
perform an action to
remotely do something without leaving a
trace
but now it's the fun thing it also goes
the other way around
it's impossible for blue to do things
without leaving a trace
so if you know where you need to look
for both blue side as well as red sides
you can see
actions of the other ones going and if
you're looking if you're talking about
traces by adversaries by red teams
it's quite common to have a thing like a
scene or have
a security operation center or cyber
defense center or
anyway a team of people investigating
traces and
seeing things the other way around
well during operations
we were in need of such a thing so
looking at the tools that we had at wait
so there is
ways of hurting your infrastructure and
we needed a way to actually do some
investigation on our infrastructure
we started looking in the open source
world and we didn't find anything and
that is what actually red dock came
about red elk is a tool ready to be used
open sourced it's available on our
github and you can use it for
keeping oversight of your infrastructure
as well as having insight into what is
happening in the operation
and it's important to understand both
aspects of this um
and red elk is during operation by us
and by the other ones we use it most
often used
uh you've got your live hacking console
of your c2 infrastructure
uh your c2 server your construct client
for example
you do your live hacky hacky hacky
commands and then there is a
second window open where you have the
red dog interface
web interface rather available and it
helps you with just having
well the oversight of the operation
inside and you will see traffic data
coming in operation data coming in etc
etc
like i said it's available on a github
and i've written a few blog posts
explaining why we need it
getting you up and running and achieving
operational oversight and in the next
few months there will be some more
blocks
probably coming out um
red elk the name of course comes from
red being offensively oriented
and elk being elasticsearch lobster
kibana the technical
stack that we choose for actually making
this
this tool so
diving into red oak looking at your
infrastructure again
a slightly different approach to this
on the most left you have the target
network
you've got your implant running so
there's attack and c2 traffic
going first to your three defectors or
your first line infra
and from there on it's being filtered
and is being put on to your c2 service
that you have in your
in your back end nothing new here how
does red dot fit into this whole process
well here you've got a red hook it's in
your
local infrastructure we have it on-prem
you could be running it in cloud we
prefer to have it
on-prem but there are connectors
installed
both on your d-detectors as well as on
your c2 servers
data connectors data feeds we use file
beats a lot
and from there on it is put into
a log stack filtering and it's put into
an elastic
nosql database and kibana is the
interface the web interface actually
searching through the data and that goes
both for the heat effectors as well for
the c2 server components or you could be
hosting your own uh
website or whatever you can pull the
data and actually put it into
the index of coretta and there's also
data copy um happening on the backside
so there are some rsync scripts
happening to actually copy
downloaded files to have screenshots and
all kinds of other
operational data of your uh data of your
operation
and put it back to your central red dog
server
because well in the end you will have
five six or whatever c2 service for a
single operation
you do not want to be logging into every
specific c2
server to search for that specific
screenshot you want to have it all
centrally
locally in your header instance
reddog does a few things it indexes data
it enriches data that is coming in
it has lots of dashboards in there you
can create your own dashboards and
there's lots of search
well it's it's a search based solution
so that's the core functionality of any
logstash or elastic stack it's based on
open source tools use so you can modify
it yourself and change
dashboards or whatever you can you can
are freely free to do that
for yourself in recent versions we have
also added
a neo4j docker instance as well as a
jupyter notebook docker instance meaning
that the neo4j
is used to import
output from bloodhounds so besides the
elastic stack
you will have also a docker instance
with neo4j and you have a jupyter
notebook for
quick searching through data and this is
really awesome because now you have
operational data of your c2
infrastructure as well as from
traffic data but you also have knowledge
about the active directory environment
of your target
and by using the power of jupyter
notebooks you can make very quick
queries on
pulling data or matching data both
output from the c2 server as well as
data that is within the neo4j instance
for example you could be
searching for usernames that are
or new incoming beacons and pick out the
username and immediately
go through your neo4j instance and see
what if this is a path
going to actually domain admin or any
type of
input that you would like and the
jupyter the notebooks is a way to
actually
quickly make those queries and actually
quick generate quick output
it's really awesome and once you get
used to this really powerful junior
operation
that's the core red elk um with both the
red team and you might as well give the
white team some
access to dashboards and as well as you
on the whole interface
uh right now we mainly use for the red
team
and we use jupiter notebooks to make
data extracts that we can give to the
white team but
hey do your thing you can quickly give
access to your white team
you get the volume access to readout
but looking at the oversight there's
still a target sock or a sock within the
target network
and as analysts do they start analyzing
when they have
a hunch of something that's going bad so
they are doing several things they are
in
analyzing investigating uh your info
so they might be querying your specific
data vectors
or they will put data onto what i call
online security search providers think
spam house firewall
ibm x4 multiple different domain
classifiers
span sandboxes all kinds of different
ways of analyzing pieces of malware as
well as infrastructure
now it's the fun thing that
those security service providers as well
will be
there's these are automated things they
start querying your infrastructure as
well so if you look at the log data of
your reader hectare you will see
you might have the option of actually
having a stock analyst
investigating as well as some online
security server providers they might be
investigating your infrastructure they
might be querying it they might be
looking at your specific ui path of your
implant
with different user agents for example
and now we're getting into the whole
scene part because if you have
a big pile of laws
about your operations t2 servers as well
as
from your reader vectors uh traffic data
you've got a big pile of logs and you
have a whole base
approach of looking for things that
might be suspicious
in your own data as well as querying
online
resources like virustotal to see if an
iuc
of your own implant or your own uploaded
file
is already known at virustotal for
example
well all of a sudden you have a c
type of functionality um
so this is where redderflux fits in into
the bigger picture
if you look at the logs of your video
effect as well as you see two servers
you will see that there's not that much
data in there so we will be needing to
do some attachments
and this is where well the data
enrichment that we have with red dot
comes in
we do multiple things if we talk about
traffic data we map it to guip data we
check if it's a
talk based address we take the ownership
from iana databases we look at reverse
dns
and all that type of data we are putting
into the same record and it's stored
within the
stack within the database we also query
grey noise and for those
who do not know grey noise grey noise is
an excellent tool
for seeing if it's the traffic that hits
you if it's background noise or the
internet yes or no
background noise of the internet is just
the commons cameras
could be google indexing or could be
common uh
type of or c2 bot nets uh or it could be
regular buttons that are just squaring
the internet scanners
things like that it is
created for blue teams but also for red
oriented
aim it's also very interesting because
if an address that
is querying our infrastructure on a very
specific path that matches or is our
implant path and it's not
known by gray noise then most likely you
want to be
aware of it and most likely an analyst
is actually looking into it
into looking into your operation if it's
just
if it's known by very nice it's most
likely just something like the
background noise of the internet
[Music]
online resources we can check at hybrid
analysis for aristotle the abuse
databases ibm xforce multiple
online resources that we can query and
take data from
and use that for enrichment of the data
within our
stack and if you talk about c2
data uh there is a component within
headache that takes
the locks from the c2 frameworks it
needs to be aware of how
it is locks are being set up and eastern
enriched and that's what we do we have
full support for cobblestrike up to the
latest version
as well as our own custom outflank stage
1 c2
which is also part of our two name
offering
full support in there and we are working
for the other public ones
c2 is let's say halfway basic logs are
being ingested but the
data copying of screenshots and things
like that is not
yet fully done about the same stage for
from ethic
mythic has created an option seam
logging option
that you need to enable if you install
the
the team server from there on if you
install the catalog
component it actually takes away takes
up the logs
ingests them properly um but there's no
data copying happening on screenshots
just yet
working on that on the longer roadmap
we're also working at covenant as well
as
skype and you are free to
make your own connected to your own ic2
infrastructure or
your own c2 tool uh in the end it's just
based on
normal log stage rules it's all open
source and you can
go nuts if you like okay data enrichment
it's a lot about talking about
what we do let's see how it works into
practice let's start with the interface
that you as a veteran operator will see
and from there on we go into
investigation
of our blue team's bluetooth activity
first about
let's see how it works kibana is the web
interface and from here on you just
log in to the interface username
password based and from here on you will
see
that it's a normal kibana interface
and we have several pre-made views for
you
that are most often used meaning that it
has the right columns and red names and
the right
filters already made so i click here on
the heat effect traffic
meaning that it will give you a tabular
view of
in this case the last seven days of
traffic that came in
on anywhere where the data has been
taken from you will see that there is a
time stamp an attack scenario
the back end name of the heat effector
the
traffic source fp source dns and the
extra http
request the attack scenario is an
important one because during an
operation you will
most likely have short haul long haul or
scenario one scenario scenario x if
you're using a tiger so multiple
scenarios during that specific attack
and all the other names actually make
sense if you look at the specific index
that we're talking about so if we talk
about redirected traffic
let's go actually use that so let's
filter
this is just normal kibana interface
stuff let's filter on
only seeing a duck scenario a short haul
you can expand the
the data component or the object and you
will see that there is guip data being
enriched you will see the full log
message as it was provided within the
log and you will see several aspects as
in the actual ip address of the font
address the
the the name that you use that uh the
refresh proxy name so the content name
um the program that was used in this
case was
apache you will also see that it knows
how to digest the different headers
in this case it makes sense because it
was done via a cdn network
and the cdn actually puts in the proper
exported four headers etc that's being
taken up by
spread elk and it replaces two f has the
proper source iphone there lots of
chopping data in there happening
and it presents you an easy incredible
interface if we talk about
c2 logs so no traffic log spots talking
about your own c2 logs then we have
the same approach it's still the same
division between multiple attack
scenarios
you will already see that there isn't a
target username target of the
android ip internet internal ip address
hosting things like that
um that is
the normal log message from cobblestrike
and you will see
that for every action within
a cobblestone being done it has mapped
the data from the top line being the
username
appears etc you can click on the link to
have the full
beacon lock and which most of often can
be pretty big and from here on within
your browser you can just simply control
f to
do quicker viewing sometimes just having
such beacon log in text base is actually
easier to use
than the keyboard interface so from the
kibana interface you have immediately
just clicky
uh you will have the actual beacon log
same goes for the other c2 frameworks
[Music]
now in some cases you have during the
operation you have made multiple
screenshots and
going back you will remember while there
was this one
system where i had the screenshot that
kind of looks like
it had this specific application in
there well kibana or reddock has an
interface with
quick previews as well as full click to
full resolution
screenshots directly available to your
web interface so
because it's pulling from all the
different team servers there's no need
to log into all the different team
servers
[Music]
the same approach goes for keystrokes as
well as downloaded files
another one is a central overview of all
your iocs as you know that copper strike
and your
c2 framework will generate an ioc
indicator that is being adjusted and
from here on you have that view you can
search through it but
with the power of kibana you also have
the option to
quickly just export the data
and present it to your white team so you
go to share you will click on csv
report you will generate the csv file it
will take some time but now the red dot
interface or the redex service is
making the interface the file for you
and it's just a csv based off the
tab that you see right now the same can
be done with jupiter notebooks but from
here on it's just a quick
quick click clicky way of having data in
there
easy to use this is about operation uh
might be already that you think well
this might be useful for your operation
well i hope you do because it actually
is really useful during your
event operations
let's talk about spotting bluetooth
activity
there are multiple ways of multiple
areas and where we could be spotting any
action
of well action of a blue team and where
they leave traces
i'm talking about directly to your
influence or traffic that is directly
hitting our offensive infrastructure
got a few examples in here we of also
got indirect where we are querying
online security service providers
for any bluetooth activity and then
there is a third category where
we talk about internal checks so checks
that your
implant that is already inside the
target network running
it can do some queries and if it's doing
the proper queries you will
might spot some activity of the blue
team
some of these are fully included into
red elk uh
some we are working on and some are for
a longer approach but
first we want to talk about the concept
and then we can talk about
specifics that are implemented in the
catalog as well and if you believe that
we are not quick enough with development
it's an open source project come join us
can help us
we need to discuss how the redirectors
make the decision and how a red arc
feeds into this so when we're talking
about traffic that is already generating
from the actual implant
that's one way the other traffic that
might be hitting a redirector is
non-target related could be scanners
could be just a regular internet
traffic your redirector makes a decision
based on
whatever rule you put in there so this
is just a h.a proxy or apache or any way
that you configure your reverse proxy
and it will make a decision to either
forward that
session to your back end your true c2
backend or
a decoder website or forwarded to a
different website
the logs that are being put out by aj
proxy or apache or nginx or whatever
reverse property that you use
those are being ingested by red elf and
you will you saw them in the interface
but for weather it's important to
have the proper logging so when you do
the installation you actually need to
change the logging of your proxy tooling
but also specific requirements for the
naming of your backhands
if you rather need to be aware of what
is a decoy and what is a c2 backhand so
any type of c2 could be or should be
named with c2
dash whatever any type of decoy or
deflecting
should be starting with decoy dash and
whatever
based on that decision reload will also
help you with alarms
the redirect is making decisions that's
important
okay once you have that up and running
you will see in the interface of radar
that
well an analyst might be connecting to
your
infra could be well eventually being
hooded to a decoy website or
both to or to a c2 back end and
especially traffic going to
euro c2 back and it's interesting and
more than once you will see
at least we have seen and i guess you
will as well that
when a blue team is doing investigation
manual investigation they're using
python or crew or maybe
powershell or and not very
not every time they will be changing the
actual
uh user agent so where you will see
python user agents coming in
and more than once we've seen that they
first tried it from the
breakout point of their sock internet
uplink
but also maybe via a top address so
multiple ways that will be querying your
depending on the actual path and the
backhand that is being chosen by your
lead effector this is interesting to see
well
is there any happening any investigation
going on
another one that once you have the logs
in there
is interesting to see is that if they
are the blue team is
sharing uh the url of
a thing to be investigated some instant
messaging clients
actually tried to preview that specific
uh website so in this
case it's an example of telegram but all
the other ones
are basically the same they will try to
make a preview
and as you type they for every new
character they will be trying to
get a preview of the voice so they will
be connecting
to that host interesting to see
and a clear indicator if well you see
these types of
instant messaging apps with a user agent
come by and querying your c2 backend
infrastructure
that's interesting so that's directly
oriented at your
own infra let's talk about in effect so
far online security service providers
what i'm showing you here is the
interface that a blue team would have in
this case for
a semantic the adr product synthetic atp
and i've highlighted those little checks
or options where it says
submit to sandbox or submit to
virustotal
well you might think that's not smart to
do
because once again virustotal it will
have a hash and we as an
uh red team we know the hashes over our
pieces of malware so we can query
various total well have you got results
for this specific hash and viruses will
tell you
no it's not or if it's there then most
likely as we have not uploaded the
malware piece
ourselves the blue team has and then
there is a big indicator that
you have been compromised but the attack
is compromised
any blue team should know this but it's
made very easy for them to still click
on that button this is semantic
this is microsoft uh the wd
atp so the modera protection central
portal there is a check for virustotal
and there is
an option of clicking into or submitted
to the
deep analysis which is just a sandbox
it's made very easy for them to click on
those links
talking about sandboxes um
you could be deflecting traffic from
your coming from sandboxes based on
source ip address
uh to a specific b chord backend or your
heat director or you
could just let them come in either way
you could be
check the characteristics of that
av sandbox connection uh and have an
alarm in there
having a clear indicator so
doing some tests during the training
that we did
uh this is just a mapping of i believe
it was over
an eight hour period when on purpose we
actually tried to hit sandbox
connections just have a bigger data set
of how sandbox connections looks like
and this most likely maps back to your
own experience that you might have for
the sandbox connection
the funny thing is that they are not
very creative with the naming so
on the right side you will see the
actual names
of the computers and on the horizontal
bar you will see the different students
that they have tried to create
and the amount of new av beacons that
are
connected so let me just zoom in you
will see the names that you will
probably recognize at npc john pc
tequila boom boom
virtual pc admin dash something when
dash all the typical windows evaluation
images
not very creative so this is a clear
indicator
which of course you already know is that
there is something fishy going on
but we could also generate a launch
based on this even if it's not going
back to
the c2 record another one that i want to
highlight is domain classification
here you will see where log already does
this there is a config file where you
enter domain names and from there on
in this case i entered outflank.now and
it's querying ibm x4s mcafee as well as
blue code
in a periodic way and you will see that
for some reason at ibm exports we have
an error getting reputation but that's
okay we still have two left
and what's interesting here to see or to
look for
is changes in those classifications
and to see if it's actually a bad
reputation so if it's a rogue type of
thing
we went through all the different data
are the different classification groups
that those domain classifiers have we
picked out the
the rogue ones and as soon as there is a
mapping of your domain into one of those
categories
you should be getting
interesting other area where you can do
spoiling using activity is on the
internal so it checks on the internal
wave
coming from your implant on the internal
network and let me
give you just a few examples first of
all
the damn nasty kirby tgt many networks
still have not an automated way of
changing the password of the kv-tg
so if you come into a network and you
will see that in this case even 2010 the
last password set of that specific
contrast 2010
and later on in your operation all of a
sudden is being reset
well chances are big that it was a blue
team initiated
change so the tgt is very specific but
you can use the
the the the same thing for specific
admin accounts or other accounts and
it's hard to judge when a normal
password change would be but if you have
five admin accounts and all of a sudden
they are
changed in the last day it's a clear
indicator that
well if all admins start changing their
passwords they are on to something
so blue check is an uh thing that helps
you with actually
outputting this information it's a uh
it's a calm based thing that
communicates via etsy
um and it outputs in a certain way that
haddock actually is able to ingest
i'm not sure if we have open sourced it
just
yet how about
certificates uh here we do
a sect check for a specific website our
athletic website and this
check gets the data from the certificate
out
it checks to see if it's being ssl
intercepted or if there's a
ssl intercepting a corporate proxy in a
way if this changes during an operation
then the blue team has well enabled as
interceptions
which they might often not always do
from the beginning and it's a clear
indicator that well something has
changed
you need to be aware of
of blue team investigations okay as a
summary if we talk about
direct based types of indicators
invested
investigation or maybe we should call it
indicator of analysis or indicator of
detection
i don't know i don't care uh but if we
look at the directly based things we can
check for analyst traffic so specific
torque ip addresses curl user agents
could that are going straight to your c
to the back end that's a clear indicator
for
analysis deflected traffic
for some reason your redirector logic
has said well we need to deflect this to
our decoy website or some to other thing
we can make alarms based on that blue
code other specific view defenders have
very
specific ways of querying your
infrastructure and
you can have insight into the data and
later on we can have alarms on that
as well it's messaging i show you
a funny thing is if you have if you know
the ip ranges of
blue teams which you might know over
some time
if those ip ranges are connecting to
your infrastructure
and even if they go to a decoy if they
are going to deflected decoy
back end or if they go to your true c2
back end
you want to be aware of any type of
built-in
ip address accessing your infrastructure
because it's immediately
is that suspicious and then there's
generic c2 scanners and av sandboxes
having red dock you will have
proper here insight into what those c2
scanners are doing and where they're
coming from
not directly alarm related but it's very
helpful to have that insight
that's on the direct traffic if we talk
about indirect we're talking about av
hash let's check virus total hybrid
analysis but it's also an infra
blacklist so
if you have configured to reduce
if they are if it's aware of the urls
that you use if they are
if your route ip addresses of your
infrastructure specifically
so the the hash of yourself we can check
that data onto
well public lists of known ip bad ip
addresses urls and certificates
and the domain classifiers i already
showed you
looking at the internal side uh we can
check for the password resets the tls
interception another one that we have
already included is the
security tool checks so an unexpected
change of the edl tool is being
installed
that's a clear indicator all of a sudden
they have done something for more
investigation
we are working on checks for look
forwarding security config as well as
accounts login
where we lock forwarding if there is a
change all of a sudden ref is being
enabled or
winlock weed is being enabled things
like that it's a clear indicator that
something has changed that you need to
be aware of and most likely is
related to blue team activity
we can check for six specific security
conflict changes
um this is a very broad topic but it is
a category that needs to be mentioned so
if you have an implant doing some checks
and all of a sudden
well you can check many different
security parameters
local security policies and if those
change why would they be changing during
operation
and then there is an unexpected change
of the
accounts are logging in if you land on
the box and if you go through the
windows event view of the past 10 logins
or the past 100 logins you will
most often see a clear approach of
what accounts are logging into this
machine all of a sudden you see
service accounts logging in or all kinds
of different things it might be aware
it might be an indicator for you that
you're not as stealthy as you
think
how to get started um i need to tell you
a few
things on the planning side a radar
installation is intended per operation
could be having multiple scenarios but
it's for one
client if you like so do not mix clients
do not make a central redux over where
you put into
everything together you want to nuke the
system because again
it contains highly confidential data you
want to nuke the system
after your operation it has three main
components the redox server itself
a connector that you install on your c2
servers and a connector
that you install on your redirectors
there are several imported identifiers
used during the operation and you want
to
make them clear at the beginning of your
installation that is the attack scenario
name that you use as well as the
component name that you use
the component name is interesting or
relevant for the c2 servers and the
reader vectors and the attack scenario
as as well those are also parameters
that you need to put onto the installer
on the c2 server as a retargeter
an important thing to know and i
mentioned it before is that the default
logging of apache or ajay proxy or any
type of other
reverse proxy is not sufficient
we've put on the wiki which is on github
and both on the blog post series we
have told you or we put examples configs
in
the header code as well how you change
the login to be
specifically ready for apache to include
header logging and there's explicit
names of the font in the backend
and things like that it's already in
there but you need to enable it
otherwise well
that dock is blind for traffic data
then you do the installation you get the
latest release from github or you can
just try the master branch whatever you
like
then there is a first step in creating
certificates
and the installation packages for both
the elk server the c2 server as well as
the heat effector you do that with the
initial setup you generate certificates
that are being used for the transport
of the data from those other components
back to the fedex server
it's encrypted t-less encrypted you need
to configure that
and from there on you run the installers
on your readers on your c2 servers as
well on the main headlock server
and very important there are post
installation
configurations that need to be done you
will find that on the elk server
at the specific project you will see
there
there you enable specific alarms and
other kinds of things and it's all
explained into the
documentation that we have both on
github as well in the blog post series
a little bit about the map uh version
one which was 2018 2019 i believe
we focused mainly on oversight and not
very much on the alarms we had support
for cobblestride aj proxy and as well as
effectually detectors
but version 2 where i've been working on
since
it is 19 i believe
it's at it's still a better stage but
almost there
it's a major improvement both on the
setup but most
majority on the types of alarms as well
as the ops data and support attack so
lots of more c2 is supported part c2
but also nginx and their own c2
framework and of course like i mentioned
we have the integrated neo4j and the
jupyter notebooks
it's in constant development more alarms
more improved dashboards and things like
that and we'll
also working on other c2 frameworks and
you're happy to join us if you
like in summary
we believe red teaming is to make blue
teams better
that's why we do proper sparring uh
and we having that insight
of movement of your opponent during a
sparring fight is actually better so
catalog helps you with that specific
case it will help you
to see activities that the blue teams
are
doing and dear blue think if you're
upset
you can make use of radarock you will
find it on a github and you will find
information about this
also on my blog and with that i would
like to
thank you for your time