hello everyone and welcome to my
presentation my name is samuel kimmins
and my talk is titled look at me i'm the
adversary now an introduction to
adversary emulation and its place in
security operations
before i jump into the overview i just
wanted to give a big shout out to the
adversary village i'm very excited to
speak to you all and all of you
attending today all right so a quick
overview of what i'm going to cover in
my presentation i'll go through the
typical introduction of the who am i
slide i'll jump into
an introduction to adversary emulation
and the types of emulation and yes i
believe there are more than one types of
one type of emulation
and then i'll jump into
where adversary emulation fits into
security operations and we'll talk about
threat intelligence place in adversary
emulation
we'll talk about emulation for detection
testing and purple teaming
and then emulation as a training tool
and of course i'll finish finish this up
by giving you some resources so that you
can get started with adversary emulation
today
and then we'll cover the conclusion
all right so who am i my name is samuel
kimmins as i mentioned earlier i'm
currently a red teamer at an
organization called cognizant i was
formerly formerly at a company called
recon infosec where i focused 100
percent on adversariation so replicating
ttps malware and c2
i like to consider myself a purple
teamer and absolute emulator at hearts
and before we con infosec i was in the
united states air force started out as a
sysadmin help desk type person moved up
to stock analyst and then on to
pintester and red teaming and advanced
emulation and so where i kind of got
tuned in on adversariation and where it
could fit into security operations was
my time in between sock analyst and red
teaming i started to really kind of dig
into the tcps of how they infected an
environment and what kind of behaviors
we could look for and from the offensive
side of how can i replicate these
behaviors to help my organization
and so you can find me on twitter at
valket underscore k
or on github at falcon
k and the quick disclaimer that everyone
has to throw out uh thoughts and
opinions expressed by me in this talk
are my own and do not represent those of
my employer
okay so let's jump into adversary
emulation and what it actually is so you
might be thinking isn't that just red
teaming well hint it isn't it may be
performed by red teams or
or pin testing teams depending on what
your organization has but i feel like
adversary emulation falls under that
broader umbrella of offensive security
meaning that it has its place but
different teams may conduct those types
of operations and to me the active
is being as true as possible to the
threat intelligence when conducting
offensive operations because without
threat intelligence you don't really
have adversary emulation because at that
point you're doing kind of thrabulation
or your standard adversary simulation
and you're going to hear me throughout
this talk constantly repeat threat until
threat until threat until because it's
very important to this topic
so the two primary types of emulation
that i consider to be important so of
course we have adversary emulation where
we're replicating unknown threat actors
ttps or behaviors and of course this is
based on threat intelligence
and an interesting thing i like to bring
up is something i saw on a blog post
from the former red team lead at walmart
was that we're essentially just copy
cats you know because
we can only emulate a threat actor to a
certain degree
and that's typically because we only
have a certain amount of threat
intelligence on a threat actors
behaviors
and
this isn't uncommon right unless you
have
uh you know a view into an adversary's
entire kill train kill chain you're
probably not going to be able to
replicate it to 100
and to be honest that's okay because as
long as you're getting a benefit out of
the tcps or the behaviors that you're
able to replicate
in your specified scenario
and so the other one threat emulation
this one is kind of one of my favorites
too because you're not really focused on
a particular threat actor you're more
focused on emulating ttp so let's say we
go to miter attack matrix and we select
one we want to select w make for lateral
movement and we want to replicate that
ttp in our environment to you know
determine if our detections are capable
of detecting that or preventing that
type of activity
and so it's cool because it's not tied
to a specific director several threat
actors may use this technique and in
that case you know a cluster of threat
actors may use it but they're not really
important to us
when we talk about advertising and
threat intelligence we're usually doing
that because
this threat actor has been known to
target our organization so we want to be
able to replicate what they can do in
our own environment
so where does it fit into security
operations
so in my mind you know it fits into the
processes and people side of security
ops and typically you would see
sec ops broken down into three pieces
right so processes people and technology
but like i mentioned i'm going to focus
on the processes and the people side
because honestly the technology changes
but the people and the processes not
necessarily remain the same but those
grow and continue to change with time as
well but it should be the methodologies
that are solid from one tool to the
other so from a defensive perspective
regardless of what type of log analysis
tool you're using like a splunk or a
different different scene you should be
able to still look for the same types of
behavior just using different syntax so
the methodologies are there it's just
the tools
change
so on the processes side of security so
processes need
development testing and refining
and you may be thinking where does
adversary emulation fit into this
portion of psychops in my mind it fits
into purple teaming perfectly because
you're able to test those response
procedures
and also train your folks
against specific ttps specific
adversarial ttps and this is great
especially anyone from ranging from tier
one soccer stock analyst all the way up
to your tier three sock engineer or
threat hunter everyone needs that
exposure to these types of ttps and we
can do that through purple teaming
and so i kind of bled into the people's
side of security apps when i was talking
about processes because you know you
don't have the processes without the
people
and so people need ways to improve and
test their skills
and i believe that training through
adversary emulation exercises is one of
the best ways to do this now you may be
thinking what about you know your
traditional red versus blue exercises um
typically those are objective focused
right like the red team has an objective
that they're trying to accomplish and it
may not necessarily be to train the blue
team sure overall it's to make the
security posture of the organization
better but that may not be their primary
objectives and and so when you throw in
the adversary emulation exercise they
become even more natural sparring
partners where they're working in tandem
to improve each other's skill set while
improving the overall security posture
of the organization
so which type of emulation is the right
one uh to me you follow this simple
formula for success
first we'll need to determine if this
will be the for the processes or the
people side of security ops and ask
yourself the following three questions
number one are you trying to detect or
defend against a specific threat actors
ttps or behaviors
and now in my mind this is leaning more
towards adversary emulation because
we're focused on a specific threat actor
their ttps and their behaviors
on to number two
are you simply wanting to improve your
detections against general ttps
now we're more leaning more towards that
threat emulation adversarial simulation
side of
side of offensive security where we're
focused on improving the detections of
our detection and response team
as opposed to
trying to stop or
detect a specific threat actor and these
kind of go back and forth right so we
can apply uh adversarial relation to
this one as to this one as well but
we're more focused on the tcp rather
than
who the threat intel says it's tied to
and number three are you wanting to
train your defenders if so you can apply
a variation of the previous questions to
the scenario
so for example we could say that we want
to emulate a specific threat actor
because we want our defenders to
have exposure to that threat actor
because they're known to target for
example our organization a finance
organization
but we're also testing our detections
against ttps
sure they may not be specific to that
threat actor that we're trying to detect
but by combining these two we can
actually have a pretty great exercise
where we're benefiting both the
processes and the people because we're
testing those response procedures and
we're improving the skills of our
defenders
you may be wondering i keep mentioning
threat intelligence for adversariation
what does it fit into these questions
well when we look at number one without
threat intelligence we don't have
adversary emulation
and even on number two sure we're
talking about
just detecting general ttps but if we
look at something like red canary's
report on the top ttps we can see that
several threat actors
are using these ctps and that's based on
threat intelligence collected
found in the field or in their
organizations they're defending
but where does it fit into adversary
emulation
i mentioned this several times you can't
accurately replicate a threat actor
without threatened intelligence
intelligence allows us to get as true as
possible to an adversary's actions and
remember i said early on in the first
two or three slides that you may not be
able to get one to the 100 mark right
and that's okay
because if we're aiming at replicating a
thread actors
c2 we might be able to do that with open
source tools or custom develop custom
develop tools but if we're talking about
endpoint analytics we can probably
replicate those to generate those types
of logs or events we may not be able to
replicate the exact
uh programming language that a threat
actor uses if we don't have that threat
intelligence and that's okay too
but emulating an adversary who is known
to target your organization is much more
valuable than standard threat emulation
and esco that goes for adversary
simulation as well that your typical red
team would do
and that's okay because they're focusing
on specific objectives they may not be
tying in threat intelligence to their
operations
but they may happen to cover some of
those ttps a threat actor might use
but if it's not tied to one that might
target your organization
that could throw off the importance of
the findings
so let's talk about emulation for
detection testing and purple teaming but
first i'm going to cover kind of my view
on the purple team methodology i'm sure
it's a pretty common one out there so
first we'll start out by selecting a ttp
or an adversary ttp see we can apply
both threat emulation and adversary
emulation to this uh purple team
engagement
formulate a plan of action that means
all parties involved will formulate a
plan of action
they will execute their plan of action
they will validate their findings and
they'll move on to the final step but
it's not a final step because it's a
continuous process so if there's no
detection they will either tune or
create and start again
so let's take a look at a more detailed
version of that purple team methodology
so we'll start out with the ttp
we're going to select lateral movement
via wmic because aptx uses this method
and they just so happen to target our
organization so we want to be able to
detect and possibly prevent that type of
activity
during the development stage
both the offensive and defensive team
will develop their capabilities so the
offensive team will develop the ctp
based on threat intelligence the
defensive team will develop a signature
based on threat intelligence if one is
available
in the testing this is key because all
teams need to execute their plan of
actions because
if the offensive team executes their
plan of action and there's no response
from the defensive team we may be in
trouble so we may need to go back to the
beginning of our wheel and re-develop
our plan
and so on the validation stage this is
really important because we it's it goes
several ways so the offensive team will
either determine if they were
successfully able to
execute their task
or was the blue team or the defensive
team able to successfully detect it
those are very important to keep in mind
when doing type when doing purple
teaming with adversary emulation
and so if it was detected we could move
on to the next ttp
but if it wasn't detected we can start
the cycle from the beginning where the
detection team can develop or tune the
signature
and you're probably wondering this this
seems like a lot of work and very
resource and process of intense
intensive and it can be depending on
what you're trying to replicate from a
specific adversary or specific tool set
or a specific piece of malware
and yes it can be automated it will take
a little bit of development or
purchasing a specific tool that allows
you to automate it i won't name any
because there are plenty out there but
using the local resources you have
even the offensive team could add this
payload or add this technique to a
script a powershell script if we're in a
windows environment and then the
defensive team can execute it whenever
they'd like to improve that the
detection technique or the ttp
it and it can go both ways right we can
automate a lot of the defensive piece uh
using a tool like a sore so once the
offensive team develops that ttp
they feed it into the sore so then we
have another method of automating it
so to break down kind of the threat
intelligence piece to developing this
purple team for our adversary emulation
exercise so we're starting out with wmic
four lateral movement and that is
technique t1047 from miter attack matrix
and you can see the link on screen
uh what do you know not petya the
malware happens to use this
so it may not be tied to a specific
threat actor and that's okay
could be we're covering a pretty broad
technique one of the top methods for
lateral movement
and then we see on number three that the
new ransomware variant nedia also
compromises systems worldwide and
happens to use this technique if we look
into the threat intelligence available
on miter attack a blog from talos
intelligence shows us the exact command
that this malware or threat actor uses
to execute commands remotely on another
system
and so this is great this type of
intelligence is great for
adversariation for both the offensive
and defensive side so the offensive side
we already have the command ready to go
we may need to do a little bit of
development so it runs in our specific
specific environment
and then the defensive side is also
ready to go because they can build
signatures around the specific command
line parameters
and there may be some obfuscation that
can take place
but that's why that continuous loop
happens for the purple team engagements
with advocation because we can feed that
back through and build new signatures or
look for those detections
so
when you're first starting out with
doing advertising for purple teaming it
can be tough to keep track of the
signatures or the ttps you want to
signaturize
and honestly a simple spreadsheet like
this
can help you get started
are you documenting the ttp do we have a
signature for it have we tested it is
this a high or low priority is there any
relevant threat intelligence key
adversariation relevant threat
intelligence and do we have a date that
we would like to test this on
and honestly this is
as basic as it gets low resource
intensive and it helps you keep track of
what you need to test
so adversary emulation as a training
tool and this leans more on the people
side of security ops
so i've mentioned this several times
because it's really important getting
getting your defenders getting them
exposure to threat actor ttps and their
behaviors is very important because when
they do in a training situation like you
can with some of these public and
private trainings and then they happen
to see that type of activity
in their own networks that really helps
them clue in on what to pivot on or
okay i'm i'm familiar with what comes
after this ttp normally that a threat
actor would so for example once a threat
actor drops a payload they start
enumerating active directory they might
be looking to move laterally so
if we catch it at that point from a
defensive standpoint we can say okay
let's look for lateral movement
techniques oh what do you know we just
talked about one using wmic so let's
look at that for potential movement
across the network
and so i mentioned there's public and
private private trainings for this a lot
of them are happening at def con and
black hat and other conferences or you
can talk to those companies individually
but on the free side free as in free to
attend but you might have to pay for a
conference to get in cts like open socks
so i'm a little biased because i used to
work at recon and do a lot of
development on the openstack ctf which
is ran at defcon every year
that's one of the best ways to get
exposure to real adversarial emulation
because when i was doing it i had to
actually develop the same exact payloads
and malware that the threat actor might
use and then we move over to boss of the
sock from splunk
obviously the splunk tool is in free but
there is a free-ish version you can get
to use for boss of the stock uh the data
set that's available
um but that threat
threat research team that puts that out
is amazing they put a lot of content out
there to give you the exposure
to real world ttps and while it may be
focused on using their tool set
like i mentioned before it's the
methodologies that are key and not the
tools so you can take those same
concepts and bring them over to gray log
or another tool
and then we have something like net wars
from sans uh cost a little bit to try it
out
but it is a great exposure to
a general amount of ttps not really
specifically tied to a threat actor but
it's great if you're first starting out
and you want to kind of get exposure to
those or you want to try out some of
those offensive ttp's yourself and then
there are hundreds of cts that go on
every year check out ctftime.org
there's probably one going on every
single weekend this year
and while a lot of them are focused on
you know just hacking specifically into
a crazy puzzle it's a great way to get
you familiar with the tool sets and the
methodologies of
conducting exploitation or moving
laterally and then you can take those
and apply those to your actual offensive
engagements
where necessary or where where possible
so my favorite slide in the talk is
because this is where i give you the
resources so you can get started so
let's talk about labs
so
the labs can be a controversial
controversial thing because it's either
you
have a lot of resources to build one or
you have very minimal resources and so
try to choose a a good range of things
that can be done on multiple types of
systems with resources limitations in
mind so detection lab that one's more on
the higher resources then because it'll
pull down several images a dc
i believe they even put in a
sql server on there recently
within the last year
i think i think the developers even
trying to work on the print nightmare
one as well putting that exploit in
there so you could actually exploit and
test and see what it looks like and
that's cool thing about detection lab is
it allows you to spin up that
environment
look at the logs do some detection
engineering or getting familiar with
different attacks in that environment
keep in mind that it's download several
images uh iso files that take quite a
while depending on your internet
connection so keep that in mind
and your hard drive space
and then we move on to splunk's attack
range the splunk team does an amazing
job of developing different ttps they
have a way of incorporating
atomic red team from red canary it's a
great way to get exposure to new new
techniques that are out there or you
want to help build your own detections
if your company happens to use splunk
but as i mentioned before
using splunk isn't you know the end-all
be-all because those same methodologies
we'll move over to a different analysis
tool or a different data analysis tool
and then
the best place to start if you're just
getting started or you want to simply
test something
before you run an operation is a few
virtual me for a few virtual machines
and a log analysis tool so
a windows 10 box uh set up a uh help
server from cyberwardog very minimal i
think there's a four gig configuration
you can run
to feed those logs into
an elk stack so you can actually analyze
what your activity is doing in an
environment and that's like the most
basic way i think you can get away with
maybe like eight gigs of memory uh
across those potentially two or three
os's running at the same time
so keep that in mind when you're
building out a server or a system so
that you can do this type of testing on
your own this type of adversary
emulation testing
so let's talk more about the tools to
help you feed into those labs or that
custom lab you happen to build
so we mentioned atomic red team from red
canary
the developers on that are super active
and they're all amazing i suggest go
check out their slack channel and of
course their github repo and they're all
they seem to be always adding new ttps
to their tool set um and i really
suggest you want to take that throw it
in your lab get familiar with different
ttps different miter attack techniques
and especially if you're on the
defensive or the detection engineering
side this is a great way to get exposure
without having to worry about getting
your hands on the latest and greatest c2
tool or latest and grades
malware right because when it comes down
to it they're just replicating specific
ttps and you can do that with atomic red
team
if you want to get a little more
adventurous you can look at something
called caldera from mitre
recently they started putting in more
development time to it it's becoming a
great tool
it's kind of like a pseudo red team tool
it allows you to build a payload a
binary payload throw it on a target host
execute commands through that payload
just like you would with c2 tools like
cobalt strike or powershell empire those
kind of things or mythic is one another
one and then the other option is custom
development so i mentioned that in an
earlier slide where i was talking about
you know can this be automated
yes using custom development we can have
our offensive team
even if it's your pin testing team and
you don't have a red team you can have
the pin testing team or the offensive
team develop custom tools or custom
scripts to run these adversary emulation
exercises in your lab right or in your
production environment obviously be
smart about what you're doing but you
can run them in your detection
environment so that you can build
detections or help refine those
processes using that purple team
methodology we talked about and so on my
github i actually put a script on there
that will help you automate a lot of the
stuff if you're going for that simple
few virtual me you few virtual machines
set up like a windows 10
an ubuntu server for logging and maybe a
cali for an attack host this script will
basically download
sysmon
winlogbeat it'll help you set up
forwarding all the logs and then also
download atomic red team so you're good
to go all you have to do is type in the
atomic red team invoke atomic red team
run the uh the ttp you want to run and
now you have logs shipping
to your help or your elk stack depending
on what you decide to set up and keep in
mind the resources can be intensive
depending on what you're trying to do
and some great references to help you
get started with looking at threat
intelligence for adversariation
is first off miter attack metric minor
attack
you'll cure it probably
all day every day at every conference
you go to or every blog post you see but
it's very important right because it's
got a way of breaking down ttps in a
readable manner and they're also great
about including threat intelligence to
back up those ttps and that's a great
point when it comes to threat research
that's your pivot point right so i found
my ttp i found relatable intelligence
i'm going to go keep searching for that
type of intel or these types of threat
actors that might actually use these
ttps or these tools
and so
my favorite one is uh it
it's not really a minor attack matrix
style website but it's called malpedia
right
and uh it's one of my favorite places
for threat intelligence gathering is
because you simply search the
type of malware or
uh c2 or threat actor
that you're interested in right so for
for this one i looked up pepya right and
i came up with the eternal petya they
can show you which types of uh families
it's a part of it'll link different blog
posts different uh
different reports from different vendors
uh the open source ones that you can get
access to without paying for a
subscription
it's an amazing place i don't believe
it's easy to get an account on there but
a lot of the stuff is free you just
simply go to their search page and start
typing away
i used to use it all the time and i
still use it all the time when i'm
interested in finding out how to
replicate a specific threat actor
because a lot of the times when you go
to something like minor attack matrix
they'll have four or five
possible
references at the bottom right but
honestly that's not enough when you're
building out a full campaign or you want
to build on a full purple team operation
using address simulation
or simply when you want to train your
defenders against a multitude of a
threat actors ctps one report from minor
attack matrix might give you one or two
ttps you come over to malpedia and
you'll probably find 10 to 15 different
articles or blog posts about a specific
threat actor
and information surrounding their
objectives and that's something else i
didn't mention is when you're doing
adversary emulation you want to be
objective focused just like you are with
red team engagements because the
adversary has an objective it's you know
it could be to gain access just simply
to sell access or they want to gain
access to
ransomware your data or collect your
data and sell it somewhere else there's
always an objective in mind and it's
most likely financially motivated so
keep that in mind when you're doing your
research
okay so
my favorite part in addition to the
resources slide is how can you get
started so i gave you the resources to
get started on a lab to get started with
some pseudo adversarial activity using
red canary's atomic red team and miters
caldera and then of course custom
development because i always encourage
that that's the best way to learn is to
get your hands on the code and start
writing these ttps yourself even if it's
simply wmic you know process call create
on the target host that's enough to get
started so
there's three steps i like to include
when i'm doing advertising or i'm you
know i'm building out an adversary
emulation scenario is first off threat
intelligence is key i mentioned that
several times because it is key you
don't have
adversariation without threat
intelligence well you don't have
successful
adversary emulation without threat
intelligence so step one we're going to
select our threat actor and our relevant
threat until so we're going to pick aptx
we're going to go to mitre we're going
to look at the specific references they
have what ttps they happen to use we'll
hop over to malpedia look for subsequent
articles or blog posts about
interactions with these types of threat
actors in different environments what
what they do in their environments what
they're do what they do when they're in
the environments what their objectives
are
they'll move on to step two so this is
the most resource intensive part
depending on what you're trying to
replicate if you're trying to replicate
a throat actor specific
malware or c2 depending on the
capabilities of your team this could be
resource intensive so but in this step
we're going to develop and replicate
those ttps if it's a simple command line
action that's easy that's straight from
the threat until we just need to modify
it a little bit if it's an actual
payload that may take some time so keep
that in mind when you're doing this type
of development if you're trying to be
time sensitive
and then step three we're going to
execute our actions and depending on how
we went if we went specifically for a
purple team operation or simply just
giving our defenders exposure to these
actions
this is the final step and so when you
add all three of these together you get
successful adversary emulation and i'm
going to mention it again because it's
very important threat intelligence is
the key to successful adversary
emulation
okay so i just wanted to give another
big shout out to adversary village
all of the people watching today thank
you so much for attending my talk and my
final parting thoughts on adverse
emulation so adversary emulation can
help you improve the overall security
posture of your organization
through testing validating capabilities
or simply improving the people behind
the processes because when it comes down
to security ops or the defensive side of
security and even the offensive side the
people
are the most important and they need to
be able to refine those processes that
help them defend their organizations so
once again thank you so much