A Red Team not only tests the defenses of the organization during the engagement; however, a well-executed Red Team will also expose:
1. The gaps in the monitoring of an organization’s environment (unmonitored actions of a Red Team)
2. Indicate pathways of attack that a Security Analyst may miss
3. Demonstrate how security tools and processes perform in a realistic environment
The most effective use of the findings from a Red Team engagement occur after the engagement, and this is through analysis of the attack.
Translating Red Team Observations Into Detection
Pattern 1: Living-Off-the-Land Techniques
Most Red Teams will not drop custom malware to attack Organization; they will typically:
1. Utilize PowerShell, WMI and Windows Sysinternals
2. Abuse cloud Command Line Interfaces (CLIs)
3. Utilize Scheduled Tasks and System Services
Hunting Implications
1. Establish a baseline of normal use of these tools
2. Identify anomalies in process trees or execution contexts
3. Keep a record of script invocations that exhibit associated network activity.
Tools
1. Sysmon for enhanced detail of process logs
2. Procmon for in-depth process analysis
3. PowerShell logging (Get-EventLog -LogName Microsoft-Windows-PowerShell/Operational)
Example Detection Command
Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" | Where-Object {$_.Message -match "Invoke-Command"}
Pattern 2: Credential Abuse
Most Red Teams first compromise Account credentials and employ them in a stealthy manner:
1. Utilizing Token Reuse for lateral movement
2. Abusing Local Administrator accounts without being detected
3. Utilizing Cached Credentials
Hunting Tools
1. BloodHound (Mapping of Active Directory)
2. Mimikatz in lab environments
3. Log entries indicating unusual logon attempts (4624 = successful logon, 4625 = failed logon)
Example Detecting Unusual Admin Logins
Get-EventLog -LogName Security -InstanceId 4624 | Where-Object {$_.Message -match "AdminUser"} | Select TimeGenerated, Message
Pattern 3: Network and Protocol Abuse
This means that the red teams mimic how attackers interact with the systems through the use of:
1. Using DNS tunneling to exfiltrate data
2. Establishing command-and-control communication via HTTP(S)
3. Utilizing SMB/LDAP for lateral movement throughout your network.
Some tools available to assist in this type of testing include:
1. Monitoring protocol activity with Zeek
2. IDS operations provided by Suricata
3. Packet capture and analysis with Wireshark.
Example of an Anomaly Hunt that will reveal DNS Activity:
zeek -r traffic.pcap dns.log
grep -E "([a-z0-9]{20,}\.)+" dns.log
DNS may indicate tunneling/exfiltration when long, random-looking subdomains are found.
Pattern 4: Persistence Misuse
Most Red Team Testing does not require persistence as a major factor, but when Red Teams do test for it, they typically look for the following:
1. WMI Event Subscription
2. Scheduled Tasks with Non-Threatening Names
3. Registry Run Keys
To locate persistence misuse on Windows, the following utilities can be used:
1. Autoruns for Windows.
2. Listing all WMI Events via Querying with PowerShell.
Example: WMI Event Review
Get-WmiObject -Namespace root\subscription -Class __EventFilter
Unexpected filters or active consumers indicate suspicious persistence.
Turning Red Team Findings Into Hunting Playbooks
1. All of the techniques that were observed during the engagement should be logged, especially those which did not generate alerts.
2. All of the attacks should be mapped to the relevant data sources, so that correlations can be identified between the attack behavior and the event logs, network data and memory captures.
3. Simulate the alerting scenarios, including all of the thresholds and correlation rules that were created during the engagement.
4. Validate all of your findings against real incidents, by searching for the same type of patterns in your historical logs.
5. Repeat the above process on a regular basis, as the attack behaviors are always evolving and therefore your hunting strategies will also need to evolve.
Real-World Examples
1. During one of the Red Team engagement scenarios, the Red Team used an internal PowerShell script to query the organization's databases. As a result of the hunting activity, dozens of historical unauthorized database queries were discovered that had previously gone unnoticed.
2. During another engagement scenario, the use of token replay within the lab environment caused the development of anomaly detection capabilities for long-lived sessions.
3. For the third engagement scenario, scheduled task persistence was utilized to conceal lateral movement. This finding led us to establish a baseline for alerts for unusual task names across all endpoints. Each of the above examples converted a blind spot that we as defenders were unaware of into detection alerts.
Key Takeaways
1. Red Teams uncover hidden weaknesses in the organization's defenses that defenders cannot detect on their own
2. Utilizing tools such as Sysmon, Zeek, BloodHound and PowerShell logs will help to connect the dots between Red Team engagements and the organization's existing hunting capabilities
3. Patterns of behavior are a much greater indicator of a breach than the actual payload
4. Hunting playbooks should evolve as new findings emerge from Red Team engagements
5. Replicating the above-mentioned techniques in a controlled environment will allow for an enhanced ability to detect real-world breaches
