start	end	text
1100	5860	Welcome back. And thank you, Corey and Matt, for supporting us,
5860	9440	supporting the Red Team Village, supporting DEF CON and the community.
9620	12000	And without any further ado, take it away. You're live.
12220	13060	Thank you.
13060	18660	Thanks, Omar. So this talk is called Breaking the Attack Chain,
18660	22260	Unexpected Wins and Fails from Two Stimulated Adversaries.
24320	27560	So here's the agenda. We'll start with who we are,
27560	29860	and then we're going to cover some wins and some fails
30440	35360	across a broad variety of different categories of Red Team topics.
35480	38080	And then we'll finish off with some of our just notes,
38080	40580	and also we'll open up the floor for questions.
41540	44640	So who we are. Matt, you want to say who you are?
44640	47420	Sure. So I'm Matthew Edelberg.
47420	50320	I'm a Principal Security Consultant at Optiv.
50480	54480	I also help lead the Adversary Simulation Team.
54480	57280	That's pretty much our fancy way of calling what we do
57280	61020	for our red, purple, and physical-based,
61020	64380	real-world scenario-based-driven operations.
64420	69300	Also authored and developed several open-source tools and frameworks,
69300	74660	mainly focusing around EDR, evasion, and bypassing security controls
74660	76320	and remaining low underneath the radar.
76320	78260	That's really where my passion is.
78360	80900	I did do, for a while in the beginning of my career,
80900	82660	focus a lot on wireless.
82660	87160	So kind of that whole spectrum, sort of one area, a different area.
87160	89960	Also, I've spoken at numerous different conventions,
89960	93680	you know, DerbyCon, B-Sides Las Vegas, HackFest URCON.
93680	96020	Really just passionate about red teaming operations
96020	98820	and the nuances and always improving that concept of
98820	101280	sharpening that spear, staying low to the ground.
101620	102780	I'm going to turn it over now to Corey
102780	105200	to kind of give a brief introduction as well.
105200	108960	So I'm also a Principal Security Consultant at Optiv,
108960	111480	specializing in Adversary Sim, or red teaming,
111480	114760	or whatever you want to call it, depending on the buzzwords of the day.
114760	117320	I've participated in some open source tool development,
117320	120640	and then my passions really center around data aggregation
120640	126900	and building lab environments for the red teams, basically.
128340	132380	So before we begin, I wanted to basically caveat this.
132920	137020	Red teaming is a different thing to different people.
137020	139640	This presentation is based on our experience
139640	143420	during our engagements, real-world scenarios.
143420	145440	These are not made-up scenarios.
145440	148560	A lot of them include real screenshots from real engagements.
149860	151640	Everyone does this differently, right?
151640	155560	So some people's definition of a red team is just an app testing team.
155560	158660	Some people's definition of a red team is a full-blown,
158660	162200	zero-knowledge assessment every year or every two years or whatever.
163820	167040	So everything in this presentation is also situational.
167040	169380	So we're not going to cover the client's demands.
169380	172500	We're not going to cover that it was raining that day
172500	174740	or whatever reason we have for each scenario.
174740	176440	So there might be a little bit of background information
176440	180480	that we're going to gloss over, but it should be fun.
180760	184300	This talk is going to kind of be a briefing style,
184300	186980	so it's kind of almost like if we're talking to you,
186980	190020	it could be if we're a red team or if you're a blue team,
190020	193460	it's sort of covering our debrief of a lot of these scenarios
193460	195420	that we've encountered on different assessments.
197920	203000	So kicking off the first topic here, we'll be met with some OSINT stuff.
203240	205800	Yep. So we all know what OSINT is.
205800	209220	It's one of the most, I always believe it's one of the most vital things
209220	211480	when you're starting off an engagement.
211820	214520	You know, we're basically just professional Googlers.
215280	217760	Well, one of the things that differentiates, you know,
217760	219760	just quickly Googling, seeing what you can get
219760	225340	and like a deep methodical approach is honestly the level of detail,
225340	228660	whether you have proper API keys, you're scraping the right data.
229820	232780	And as I kind of say this, all those different things we know,
232780	235500	they can be sometimes an endless rabbit hole where you go down
236080	238720	and you never know if it's going to yield you stuff.
238720	241540	You could be starting to pull down, you know, employees,
241540	245800	Instagram posts, Facebook, you know, all those types of social media things,
245800	248320	pulling out, trying to see if there's maybe a picture or something
248320	250560	or some kind of metadata that you can scrape.
250620	253180	And you can be doing that for thousands of pictures
253180	254980	and it may yield nothing.
255020	258260	But oftentimes, it's still a very vital role
258260	261820	and can lead to a lot of unexpected wins and successes,
261820	263280	which we're going to talk about.
263700	268280	And you can kind of see with this great example, a bit of background.
268540	274320	We like to call this, you know, hashtag Mondays might delete later.
274320	275640	I see no problem.
275780	278560	A bit of the background on this is we were looking at a client,
278560	280600	we were doing a remote breach simulation,
280600	283400	which is our terminology for Red Team Ops.
284000	287380	And we did that typical, started building the profile,
287380	289060	looking at who the employees were,
289060	291480	trying to get an understanding of what information was out there
291480	296460	until we stumbled across the company's Instagram account.
296460	299640	And this picture was originally taken by another employee
299640	304740	that the company's Instagram account kind of liked and retweeted.
304740	308740	It was basically just, which we have blurred out,
308920	312200	a bunch of PII information, which included, you know,
312200	316000	date of birth, home address, credit card, bank transactions,
316140	318120	a lot of other very sensitive stuff.
318920	321920	But there was a lot of these types of pictures just sitting on Instagram.
321920	324600	So one of the things we always like to drive is sometimes
324600	327800	we don't even need to get inside the network, get domain admin,
327800	331700	do all those cool lead hacks to get that crown jewel vital data.
331700	333180	They provide it to us.
333260	336680	And I would say that this is not just that one unique time.
336680	338960	This is something that's constantly out there.
339100	341360	As a lot of companies, they train their users,
341360	343560	they don't click on phishing links, don't click on this,
343560	346840	but they don't teach them, don't post this or this is bad,
346840	348440	this is something sensitive,
348440	350380	especially when it comes down to certain departments.
350380	351780	When you look at a marketing team,
351780	354620	they're not given the same level of training that maybe someone
354620	357380	that actually handles sensitive, like, you know, credit card data
357380	359300	in the sense that those two different things,
359300	362420	the awareness there is there are huge gaps.
366540	370480	And that leads us to our next sort of major one that we love to look at
370480	371560	are paste sites.
372160	375520	You know, there's many different ones, Pastebin, anything like that.
376340	378760	I mean, scraping these are just...
378760	380820	you can yield a plethora of data.
380820	382020	I mean, it's not a lot of money.
382020	383320	I mean, correct me if I'm wrong,
383320	386740	but I believe now for a pro license for Pastebin,
386740	389920	you can, for $50, you can scrape to your heart's content.
389920	394540	You put that in, say, like a Caldana instance, like Elk,
394540	396040	and it just endless scrapes.
396040	398180	You can kind of just make a search thing like search client name
398180	400980	and look at every single thing that references this.
401220	404640	And that's honestly something so simple, so unique and so fast
404640	407920	that you can yield things like usernames, credentials, APIs,
407920	410200	hell, even credit cards and other sensitive PII.
410200	411660	As you can kind of see,
411660	414920	we've been able to pull out actual credit card information
415440	420320	going right down to the user's security questions,
420320	422740	where they live, their phone number,
422740	424060	all that information.
424060	426360	With all that information, we were able to actually,
426360	429340	because the client was a bank, provide an impact scenario
429340	431800	where we could actually bypass all the security controls
431800	435500	and start doing some financial banking on behalf of this individual.
435620	437240	Because all their controls were like,
437240	440340	what's your bank account number?
440480	442360	What's your security answer for this?
442360	443860	What's your secondary one?
444000	445340	And do you still live at this address?
445340	446600	What's the last four digits of your phone number?
446600	451820	All those typical security controls to prevent fraudulence are all out there.
451820	455160	Great plate hackers constantly are dumping data there.
455600	460020	And in the top example, we actually can still find valid credentials.
460100	464520	We found two-year-old valid credentials to a third-party portal,
464520	468940	which led us to have access to a setup site.
468940	470740	And from there, we were able to get enough information
470740	474620	that allowed us to establish a foothold into their internal network.
474620	477080	So something like that can sit there for years
477080	479160	before it's even discovered by the client.
479160	480860	And that drives the impact so much more.
486490	487790	So what can you do?
487790	489590	And this will be the style of that debrief,
489590	491110	is how do you break this chain?
491150	493810	In the sense of all these wins, how do you break this?
493810	495470	How do you prevent this from happening?
495490	499850	And it's really hard, especially when data is out of your control,
499850	502070	when you get stuff on those PACE sites,
502070	503930	it's next to impossible to take it down.
504370	506550	So there's no surefire of, oh, this is up there,
506550	509030	we'll bring this down, we'll cease and desist,
509030	510690	and that will be the end of it.
511190	513210	Especially like what I was just describing with PACE sites
513210	515490	and being able to scrape and have that local database.
515490	519010	Once it's there, it's hard to get rid of off every individual who's scraping.
519250	522410	So it really comes down to understanding what's out there.
523010	528450	Find those information sources through profiling or intelligence gathering.
528650	532350	We like to call it public information profiling or data intel.
532450	534590	It's performing that on yourself, your company,
535310	537850	regularly to understand, oh, there's new data coming out there.
537850	539090	Now I have to adjust.
539090	541770	So it might be, hey, we discovered a couple of clients,
541770	543830	there's sensitive data out there, we need to contact them now
543830	546930	and get all that stuff scrubbed.
546930	548850	So that way it's not valid anymore.
548850	551990	And things like that, as well as awareness training,
551990	554570	not just looking at, hey, users, don't click on links,
554570	556470	or if you get a phone call from someone suspicious,
556470	560050	don't follow the instructions, but training them through impact.
560150	564890	Here's a picture of something, and do you think this is sensitive?
564890	566990	Well, here's what an attacker looks at it as,
566990	568550	and this is why it's so impactful.
568550	570870	And just kind of visually explain to them
570870	573910	why this is so detrimental to post.
574130	576970	And that can oftentimes help reduce that gap
576970	579110	from like this big to like this big.
579110	580470	You're always going to still have a little space,
580470	583310	and that's where intelligence sources come into play.
585070	588490	So those were some pretty cool wins you had there, Matt.
588490	591930	But I figured we could cover some failures, right?
591930	595010	So obviously, a lot of successes do happen,
595010	596430	but also failures happen.
596430	599170	And I think maybe blue teams and red teams can learn
599170	601270	from some of our red team failures.
601270	603710	So this is what I like to call the red herring domain.
603710	607870	So basically, the TLDR is that email alias domains
607870	611730	do not make great password guessing or enumeration targets.
611730	616310	So we all remember when Office 365 enum worked perfectly.
616310	620050	Those were the halcyon days of, man, that was a good time.
620050	624250	But basically, the client had clientdomain.com
624250	627090	was their email address. That's what they used publicly.
627090	628970	It was on all over their website and everything.
628970	632670	So we figured this has got to be... this is easy.
633190	634910	That's what their domain is.
635050	636730	We started password guessing,
637250	639450	and we're getting all kinds of weird results.
639470	643130	Valid user, invalid user, bunch of 401s and weird...
643130	644870	like some users have two vectors, some don't.
644870	648490	It was very incongruous with what we're used to seeing.
649550	651450	And basically, we were like, hold on.
651450	653250	Is this really their email domain?
653830	658030	So we actually used reverse DNS, or reverse Whois.
658370	661590	Vue DNS has a very cool reverse Whois tool
661590	664830	where you can basically type in the contact information of a registrant.
664830	668210	So, you know, info at clientdomain.com or whatever.
668210	672090	And then you can view all the other domains that are registered to that email address.
673210	676230	Obviously, it can get a little hairy if you have, you know,
676230	678530	anonymization with the Whois records.
678530	680330	But basically, we used that.
680330	684050	We pulled up a list of all the valid domains that were registered to that client.
684050	689050	And we looked and actually for each one, we went through and checked them against Office 365.
689350	693690	And then eventually, we found the real one, which happened to be myclientdomain.com.
693690	697690	So it was just sort of a weird scenario where we basically burned a few days
697690	701130	on an assumption that this was obviously the domain,
701130	703610	when in reality, the domain was something else.
703730	708130	So I guess the takeaway is to trust your gut.
708190	709930	Check and then double check, right?
709930	713810	If you're getting incongruous results or something that doesn't match up
713810	716930	with what you're expecting when you're executing a tool
716930	720310	or whether you're doing it manually, dig into it.
720310	723190	Figure out what could lead to these different results.
723350	726830	You know, the getUserRealm functionality of Office 365,
726830	731810	you can use to sort of manually inspect each individual element
731810	737290	and see, okay, is this a valid domain in Office 365, etc.
737290	742510	Those sorts of manual checks can keep you from doing these fails.
742670	746910	So Matt's going to cover another funny one about building.
746950	752290	Yes, we thought it'd be fun if we both share our experiences in the fail realm.
752450	755490	So this is the one I like to call wrong building.
755890	759970	So like I kind of said, that rabbit hole, it can lead to so many great results.
759970	762050	It also can bite you.
762070	765950	So in this kind of bit of background here was the situation.
765950	769070	We were hired to do a physical breach assessment
769070	771090	to break in physically into a building.
771570	775170	The building in question was this large commercial high-rise
775170	779590	and we're listed as safe arguments in the story, the seventh floor.
779910	783930	So we did a lot of OSINT and we were able to find some information,
783930	788450	including a page for the building that basically listed out,
788450	790570	you know, who is the property managing company,
790570	794390	like who is the actual person on site, what were the vendors,
794390	795610	even forms to fill out.
795610	798670	Say, for instance, if you were one of the tenants there and say,
798670	802410	you know, telecom went out or pipe burst, paperwork and all that stuff,
802410	804430	you know, who to contact, here's like the, you know,
804430	807850	all this other information to know which building and everything like that.
807850	808450	It was great.
808450	812170	We were so happy because right there we could create a perfect scenario.
813050	813910	And we did.
813910	817010	We kind of decided to come up with a scenario that we were, you know,
817010	818010	coming into the building,
818010	821850	going to be doing some telecom fixing on some of the floors.
822830	824710	We got even so detailed.
824710	827550	We were able to kind of create a fake work order.
827610	832850	We were able to find out uniforms for that vendor and we addressed,
832850	835370	you know, perfectly right down to the level details.
835370	836510	We had called beforehand,
836510	840350	knowing when the office manager for the client was out.
840350	841650	So we left the voicemail.
841650	844610	We left lots of different things just pretending to be the property manager.
844610	847550	Say, Hey, we have some guys coming into the building.
847550	848970	They're doing some work with telecom.
849650	852130	I've been getting a lot of calls throughout the day,
852130	853410	just people verifying them.
853410	856170	I just wanted to let you know that they should be at your floor in the next
856170	857050	20, 30 minutes.
857050	858510	I'm just stepping up for lunch.
858510	861650	So I may not be able to be reachable by phone, but if they do,
861650	864110	have them show the work order and make sure everything like that,
864110	867250	their names are blah and blah and everything like that.
867250	870630	So we really had provided enough information so that way they could go
870630	873190	listen to the voicemail and say, okay,
873190	875210	there has to be a work where we have to check all those things.
875210	877190	So we were kind of creating that self-validation.
877630	880930	So we get up there, talk to the receptionist.
880930	883970	The receptionist goes, okay, I got to go get the office manager.
884090	886050	Point this at the, you know, like the sitting area.
886050	888850	We're sitting there, just sitting there.
889230	892370	And then maybe we kind of realized it's been a while,
892370	894630	but maybe another five, 10 minutes later,
894630	900230	the office manager came out with someone else who was the property manager.
900230	904570	And they were like, so who are you guys?
905970	907790	You're not anyone I've ever worked with.
907790	909410	You don't even work at the company I've never worked with.
909410	913130	I'm like, oh, well, you know, so-and-so that's the property manager contact us.
913130	917010	He probably, he left a call. He was like, yeah, but here's the thing.
917090	920170	He works on the bottom floor in the retail section.
920170	923790	I handle all the commercial high rise and corporate stuff.
923970	927190	So I'm going to ask you again, who are you?
928410	931270	What do you do in that situation? You kind of have egg on your face.
931270	933870	You know, we had done such great OSIN and everything like that.
933870	935110	But the problem was,
935110	938870	we didn't realize that the building was split property managers for retail
938870	940970	and the corporate renting.
941650	945350	And in that moment, like your perfect pretext and everything like that,
945350	946870	just goes out the window.
946990	948410	So me and my colleague were sitting there.
948410	950310	We literally had this conversation, just staring at each other,
950310	952890	not to like sweat and everything like that.
953110	955430	You can't just instantly pull up like to get a jail-free card.
955430	957550	Like, ah, this was a scenario and stuff.
957550	959790	You try to always want to deescalate.
959830	960870	So you do your best.
960870	963390	Like, okay, that seems really weird.
963390	964390	You know what, let's just stop.
964390	965230	Let's take a moment.
965510	968770	I called someone who was obviously a co-worker of mine
968770	970490	and pretended like I got the voicemail.
970490	971890	And it's like, hey, there's some issues.
971890	973670	Can I explain the situation on the phone?
974290	976090	We're not going to do any more work.
976310	978370	All this stuff, just trying to really paint it off
978370	979330	that we don't want to do anything
979330	981670	because obviously they're very tense and upset.
982150	984750	So it's really taking those steps to deescalate it.
984750	986630	And it ended up, you know, we're like, okay, well, you know what?
986630	987870	Let's give a business card.
987870	988690	Give us the business card.
988690	989350	We're going to call.
989350	990190	Let's maybe get on there.
990190	991630	We can figure this all out.
991630	992810	But I will tell you,
992810	994790	that was the most awkward elevator ride down
994790	996090	when they came with us in the elevator
996090	997170	and were just sitting there like,
997170	999770	this elevator is going so slow.
1000770	1001890	The moment we got to the ground floor,
1001890	1002890	we shook their hands.
1002890	1005010	I'm pretty sure we had a little bit of sweat on our hands
1005010	1007590	and we're just like bolting right out.
1009270	1011130	So those are the things where, you know,
1011130	1014310	sometimes OSINT can really, you know, bite you in the butt.
1015930	1016590	All right.
1016590	1018470	So taking a left turn here.
1018470	1021610	So a different category than OSINT, initial access.
1021610	1024010	So initial access, you know,
1024010	1025370	we can define it as, you know,
1025370	1028150	that initial point of compromise, right?
1028150	1032470	So nowadays, starting from that perimeter environment,
1032570	1034530	a lot of attack services are heavily limited.
1034530	1037390	Companies have, you know, nothing but 80 and 443.
1037510	1040350	It's pretty much SSO everything,
1040350	1042950	redirect everything through their central auth,
1042950	1044710	and everything's multi-factor, right?
1044710	1048830	So the approach here as an attacker is to prioritize
1048830	1051450	that breadth-first search for that weak point, right?
1051450	1053710	So, you know, if it's Office 365
1053710	1056210	and they have basic auth enabled on AWS
1056210	1057890	or something like that,
1057890	1060130	that would be an example of a weak point.
1060130	1062450	Or, you know, here's some other common techniques.
1062450	1064550	Obviously, we're not going to cover any of these in depth,
1064550	1066490	but password guessing is really common.
1066490	1068930	Web app vulnerabilities, if you can get deserialized
1068930	1071550	or some other, you know, similar, you know,
1071550	1073330	roll your own web app issues.
1073730	1074950	Spear phishing is common.
1074950	1076310	Phone pretexting is common.
1076310	1078770	And then lastly, physical access isn't easy,
1078770	1080570	especially as a backup plan.
1080570	1082190	It works pretty well.
1082190	1086230	So multi-factor spear phishing.
1086270	1088970	So phishing is dead, long live phishing, right?
1089490	1093250	We have seen, especially in the past couple of years,
1093250	1095710	that phishing is really getting a lot of eyeballs
1095710	1097850	as far as tooling solutions
1097850	1100890	and just general alerting and controls.
1101570	1103570	Attachments don't work from the perimeter anymore
1103570	1105290	with an email filter.
1105290	1108630	Email filters have their own URL filtering now.
1108630	1112230	Any email that's sent to more than five people,
1112230	1113690	for example, might just get blocked
1113690	1116230	because they're assuming it's a spear phish.
1116290	1117910	People are good at reporting them.
1117910	1120170	I mean, I guess it's like over the years,
1120170	1122490	we finally started to get better at training people
1122490	1124410	and developing technical solutions
1124410	1126710	so that it's actually not as successful.
1126710	1130210	However, it does still work, even with two factors.
1130210	1135270	So we like to actually focus not necessarily on passwords,
1135270	1136950	but actually on tokens.
1136950	1140930	So there are MFA-compatible phishing tools
1140930	1142610	like Evilginix or Mudlishka
1142610	1145250	that actually let you gather the tokens.
1145250	1147290	So you're actually, with these tools,
1147290	1149990	you're essentially sending a message with the URL in it,
1149990	1151930	the user is browsing to that URL,
1151930	1155430	and then they are basically using you as a proxy
1155430	1157330	to interact with the real site.
1157330	1160230	So if they're using your site as a proxy,
1160230	1162550	you can capture all the authentication tokens,
1162550	1166590	API tokens, whatever it is that that user is sending.
1167330	1169290	And why do we like tokens?
1169430	1171530	Because tokens are harder to track.
1172090	1175330	Lots of people don't have anomaly alerting
1175330	1177310	or anything like that on token usage, right?
1177310	1180430	So if I log in from a new device,
1180430	1182150	it says, whoa, this is a new device,
1182150	1183270	you need to authenticate it.
1183270	1185590	But if I just take the already valid token
1185590	1187510	and replay it onto another device,
1187510	1191590	oftentimes it just works without any sort of double checks
1191590	1192670	or anything like that.
1192670	1194490	The other reason why we like tokens
1194490	1196230	is because they're hard to reset.
1196230	1199670	So a lot of the traditional IR procedures,
1199670	1202630	they focus around Active Directory, right?
1202630	1204550	So you reset your Active Directory password,
1204550	1206270	you lock the Active Directory account.
1206270	1208490	That doesn't necessarily have any triggers
1208490	1210450	to a third-party SSO site.
1210450	1213990	So if it's Okta or another provider,
1213990	1215510	there's no link to Active Directory
1215510	1217590	that necessitates a token refresh
1217590	1219030	or a deletion of all the tokens
1219030	1223590	when a user has an incident and the password is reset.
1223590	1225870	So here's a scenario.
1226770	1230050	Basically, here's a screenshot of Evogenics output.
1230670	1233450	The SID token, this is specific to Okta,
1233450	1237470	but basically, after the user had authenticated
1237470	1239730	to our Evogenics,
1239730	1242290	and then they had pretty much realized,
1242290	1243790	you know, okay, that's not great.
1243790	1247330	But we were actually able to use that token
1247330	1250870	to access their Okta portal, basically,
1250870	1252750	which had access to, you know,
1252750	1255070	not only all their other third-party apps,
1255070	1257890	but also VPN or other similar,
1258850	1261970	you know, higher security context things,
1261970	1264610	which potentially could yield to a foothold.
1267410	1270190	So, you know, before I cover breaking and detaching,
1270190	1271010	last thing I want to mention,
1271010	1272370	just if you're a red teamer,
1272370	1273730	next time you get a token,
1273730	1276670	or if you do phish a user with that,
1276670	1279610	you know, Evogenics or another solution,
1279610	1281230	do what you would do with a credential
1281230	1284330	and actually do stuffing.
1284330	1286490	You know, try to use that API token
1286490	1289550	across as many different applications as you can,
1289550	1291310	and you might be surprised at how easy it is
1291310	1294970	to just put the token in and then go.
1294970	1296670	I mean, with Okta, for example,
1296670	1299470	you literally just put that SID token in your browser,
1299470	1301470	go to the company's Okta site,
1301470	1304390	and at least at the time that this gig was executed,
1304390	1305210	it worked.
1305210	1308710	There was some JavaScript sub-resource integrity stuff
1308710	1309690	that we had to bypass,
1309690	1312490	but it was, you know,
1312490	1314230	API tokens or Vera tokens,
1314230	1316950	it's definitely a good area to focus.
1317550	1319650	So, breaking the attack chain, right?
1319650	1321290	How do you fix this?
1321290	1324310	Because it's really tricky to monitor.
1324330	1326670	Like, Okta doesn't have default alerts
1326670	1329190	for geolocation token usage, right?
1329190	1331710	So, you should generate those alerts, right?
1331710	1334830	So, figure out how within your SIEM or whatever
1334830	1336790	to alert on token usage,
1336790	1338550	not just password usage, right?
1338550	1340290	Instead of suspicious login events,
1340290	1342010	maybe look at suspicious token usage
1342010	1345170	or just a session happened to move
1345170	1347510	from this site to this site or whatever,
1347510	1349510	or a different user agent or whatever.
1350530	1352110	And also, build those connectors
1352110	1353990	so that those tokens are automatically reset
1353990	1356130	if the user does change their password.
1356130	1358450	Or, if it's not automatic,
1358450	1359630	build it into a playbook
1359630	1361970	so that your incident response says,
1362090	1362910	a user got phished.
1362910	1365130	Not only do we reset their Active Directory password,
1365130	1367850	but we also reset their Okta tokens
1367850	1370650	or their Office 365 tokens
1370650	1372170	or any kind of tokens.
1372170	1374330	Typically, there are tools within these web portals
1374330	1377750	to actually manually refresh a user's session.
1377810	1379430	So, build that into your IR playbook
1379430	1381950	so that you don't have that token
1381950	1383630	that's been outvalid for 24 hours
1383630	1385630	after the password was changed.
1385870	1388730	And then lastly, here's a little shout-out.
1389150	1390690	Generate IOCs for known tools.
1390690	1392950	So, for example, Evogenics actually has
1393130	1396230	a hard-coded IOC built into it.
1397670	1399530	It's been published on Twitter before.
1399530	1401630	I won't say exactly where it is in the GitHub,
1401630	1403310	but if you're using Evogenics
1403310	1405290	and you haven't forked it and edited it out
1405290	1407510	and removed the IOC from it,
1407510	1411310	it should be easy to be detected, right?
1412690	1414810	Attackers sometimes use off-the-shelf tools
1414810	1418130	like Evogenics, and that's relatively easy
1418130	1420950	as a blue team to download those tools,
1420950	1423810	run them, execute them, and see what that looks like
1423810	1425910	and then generate IOCs based on that.
1427870	1432310	So, after some successes, I'll cover a failure.
1432310	1435890	So, this is what we call the traveling user problem, right?
1435890	1438750	So, we have, on breach engagements,
1438750	1441550	set off alerts with bad IP hygiene.
1441610	1445290	We typically like to use non-attributable IP space, right?
1445290	1449490	So, Amazon, Azure, VPNs, etc.
1449730	1451850	But that's a double-edged sword, right?
1451850	1455890	So, users don't usually use AWS, right?
1455890	1458370	And also, geographically improbable access.
1458490	1461350	So, like, if a user is based out on the East Coast
1461350	1464590	and you're using a US West Amazon instance,
1464590	1467850	that could trigger an alert if you sign in as that user
1467850	1470270	and it says, oh, this user just signed in from here
1470270	1471810	and then they signed in from there.
1472830	1475910	And also, you know, reusing that single cloud...
1476750	1477730	you know, we're lazy, right?
1477810	1480330	We're red teamers, we have so much going on.
1480590	1484090	But sometimes we get lazy, we'll reuse the same IP address
1484090	1486490	that we've obtained for multiple accounts, right?
1486490	1490290	So, you know, maybe we log in on that one instance
1490290	1494170	and then we log in as another user just to test those credentials, right?
1494370	1498410	That's an easy indication that not only is it an AWS IP
1498410	1500930	that's authenticating to our VPN,
1500930	1503370	but also they just authenticated as two valid users
1503370	1506350	and it's not, like, an office location, right?
1507930	1510990	So, for red teamers, how not to fail?
1510990	1512650	Know your IP space, right?
1512650	1515470	Use some of those blue team tools in your red team engagement.
1515470	1517250	So check your ASNs, right?
1517250	1519730	So I put some links at the bottom of different services
1519730	1522790	you could use to check the, like, IP reputation
1522790	1526950	or, you know, sort of the footprint of the IP addresses
1526950	1528170	that you're using.
1528330	1530090	And tell the story as well, right?
1530090	1534490	That's sort of our 2020 breach team slogan is tell the story.
1534490	1539270	But basically, one IP is mapped to one valid account forever.
1539270	1543390	So if we're going to trigger a valid login as a user,
1543390	1546650	if we're going to actually start that pathway of emulating,
1547270	1551790	that's when we'll say, let's go into it.
1551790	1555830	Let's make this IP address this user's IP address
1555830	1560450	and then keep using that for the rest of the engagement, basically.
1560970	1564570	So that is very... it's harder.
1564570	1568330	Obviously, they can still alert on, hey, this is an AWS IP logging in
1568330	1570310	and that shouldn't be the case.
1570310	1574230	But also, they can say, well, they did log in here
1574230	1577370	and they logged in there and maybe they're just using a VPN or whatever.
1577830	1580690	So it can be a powerful thing.
1582390	1586510	Yep. Now we're going to flip over to foothold.
1586550	1588330	And before we kind of go there,
1588330	1590670	let's kind of do a little bit of an explanation.
1590670	1593990	When we talk about, like, initial access versus foothold,
1593990	1597530	we're really kind of differentiating the two kind of concepts
1597530	1602210	of, hey, we were able to get some access through password guessing.
1602210	1604530	It may have given us a small step in,
1604530	1607470	but we're not at the stage where we can, you know,
1607470	1610790	start using our post exploitation frameworks, whatever that is.
1610910	1612590	That's what we call the foothold.
1612590	1614990	We've established the beachhead and we're moving.
1614990	1618370	We begin that privilege escalation and moving laterally.
1619590	1622670	So that's the major definition and difference.
1622670	1625730	So in this example, which we're going to kind of talk about,
1625730	1628470	this is actually a runoff of what Corey was just describing
1628470	1632070	with the Okta and SIDS and Tokens.
1632070	1635770	So we were inside their portals
1635770	1638270	and we were able to get access to several different applications
1639150	1644450	because we sent out a phish and one user clicked it.
1645050	1647910	So we had tons of access, but only through their portals,
1647910	1649890	like the tiles and whatever, you know,
1649890	1652290	substant applications that were exposed to the internet.
1652290	1654070	So as we're going through all these different sites
1654070	1656250	and third-party applications,
1656730	1660290	because we had access to the email account,
1660290	1662570	we saw an email had been triggered.
1662570	1666390	We're like, okay, that's kind of weird because it was an IT ticket.
1667130	1670030	And what basically it outlined, as you can kind of see right here,
1670030	1672610	was, hey, something's gone wrong.
1672610	1675550	And it basically was, I clicked on this.
1676250	1677710	I know it was something bad.
1677710	1679030	I've already changed my password twice,
1679030	1681070	which kind of goes back to what Corey said on how valuable
1682170	1685230	resetting those Okta or, you know, those tokens and SIDs are,
1685230	1687690	because at the end of the day, we didn't need,
1687690	1690610	like the user had changed her password so many times,
1690610	1691910	but we were still in.
1693770	1696730	They had already, they also attached our email.
1696730	1699850	So our Spearfish email, as well as the, you know,
1699850	1703810	security alert of sign-on that we had triggered by logging into an application
1703810	1707730	that we weren't aware of had like that notification prompt built into it.
1707750	1709770	We were just pillaging through the data,
1709770	1713230	trying to get as much information we can to help kind of solidify our next stage
1713230	1714730	of moving into that foothold.
1715370	1720270	So I helped us ticket with our Spearfish and all this stuff.
1720270	1721730	Pretty damaging, right?
1721730	1725350	Hard to kind of back, you know, move around in something.
1725350	1731070	So going back to my initial thing with the story about the building,
1731070	1732510	you have to always deescalate.
1732830	1734210	So what did we do?
1734210	1738890	We removed the attachments and we replied back saying, sorry, my bad.
1738890	1741890	And within a few seconds, because good old help desk,
1741890	1744550	they closed the ticket instantly with a nice little message saying, hey,
1744550	1746770	don't worry about it, I'm glad you were able to be assisted,
1746770	1748130	if you have any other questions.
1748530	1752390	And we also took an additional step by actually adding a mail rule
1752390	1757130	that any type of emails that were related to this help desk ticket
1757130	1760590	would be put into the user's junk bin.
1760590	1762710	So she would never see it.
1762710	1766790	With all of this, we were able to then kind of do a comprehensive
1766790	1768430	internal Spearfish.
1768430	1772450	Starting on a couple of the employees that reported to this user
1773610	1776970	with a typical great macro document.
1776970	1779910	It was an Excel timesheet that they actually had been passing around,
1779910	1781590	all the staff passed around.
1781830	1784270	And we basically just added a few verbiage saying, hey,
1784270	1786930	we're having trouble seeing it, you have to enable macros.
1786930	1789650	Can someone take a look at this and see if this is right?
1789650	1793850	And we sent that out, and with maybe half an hour, an hour,
1793850	1796970	we received our good trusty beacon.
1797630	1799690	We love to see those come in.
1799830	1803450	So that was a great example of how just because something happens,
1803610	1808050	a ripple in the whole environment is kind of created,
1808050	1809770	they can't always be a wave.
1809770	1811790	And if you know how to handle and deescalate,
1811790	1814170	you can take that ripple and make it invisible.
1814370	1816070	If you don't, you leave it there too long,
1816070	1817350	or you don't handle it properly,
1817350	1820090	you can definitely make that ripple into a giant wave.
1820310	1823330	And now instant responders are investigating,
1823330	1824690	and your whole office burned.
1824690	1828510	So small things can really take time just to deescalate it.
1828510	1832070	And it's nothing technical, it's just using soft skills and communicativeness.
1835070	1838450	So how do you stop against this?
1838930	1842290	One of the biggest things we've seen, and you can kind of take from the story,
1842290	1844450	is that training.
1844450	1847830	It actually turned out after when we did a debrief with the client,
1847830	1851770	that the client actually had a separate portal for incidences.
1851770	1853750	So helpdesk handled the day-to-day issues,
1853750	1856910	I can't log in, my password, those types of issues.
1856910	1858990	But there was a whole separate portal for like,
1858990	1862390	hey, I think I've been spearfished, something's weird, I'm seeing something.
1862750	1865930	And because they put that ticket in the helpdesk,
1865930	1868030	there was different responses and everything like that.
1868110	1872190	Helpdesk, they weren't trained or aware that maybe this is something weird.
1872190	1875670	This user provided a lot of data, and then all of a sudden, deleted, deleted,
1875670	1876830	and saying, my bad.
1876890	1878950	If you read that thing, it kind of looked like this person
1878950	1880630	was two different people talking.
1880790	1882910	But their SLAs and everything like that,
1882910	1886830	they were just trained to not spot weird or anomalous behavior.
1886830	1888030	And that's the key word.
1888090	1890750	We always talk about indicators of compromise,
1890750	1892710	but there's indicators of anomalous.
1892910	1896510	And if you can stay and live in those indicators of anomalous,
1896510	1899930	you're going to have a higher chance of success, as kind of described.
1899930	1904810	So really teaching your users how to properly handle those incidents.
1904810	1908270	Don't just call the helpdesk. Helpdesk is not security, so to speak.
1908570	1912290	And then kind of really focusing on when you get those types of events,
1912290	1915130	like prioritizing a real-time communication.
1915130	1917550	Don't wait for an automated message, don't do anything.
1917550	1921850	And that's both on the user's front and on your IT and security team.
1921950	1925670	In this example, you saw all of them were message-based.
1927270	1930030	Putting in a ticket is great, you have all the evidence there,
1930030	1931350	but following up with a phone call saying,
1931350	1933910	hey, I'm really worried something happened.
1933970	1936310	You have someone on the phone now, you're talking to someone,
1936310	1939750	or you go in the office, you can find them.
1939850	1942570	Talking, being in person, it changes the level of severity
1942570	1944790	and forces people to react faster.
1944830	1948070	A ticket, most of the time, may not come in at the same urgency.
1948650	1952130	And that really can change the amount of time we have as an attacker
1952130	1953730	to be successful.
1953730	1956290	And just by de-escalating, we had enough time to figure out
1956410	1959810	a good, convincing internal spearfish, which we love to do,
1959810	1963030	because you're bypassing all those mail filter controls.
1963030	1966190	We looked at them and saw, oh, all the users are passing
1966190	1969390	this Excel document around, we can put a macro payload in it.
1969390	1974430	And that just adds to the legitimacy of the attack and the story.
1976650	1980370	All right, those successes were great, but let's cover some failures.
1981670	1985130	All Red Teamers should probably know this, but putting all your eggs
1985130	1988510	in one basket is bad.
1989370	1992210	Sometimes, even the best tools are buggy.
1992210	1996730	We use Cobalt Strike. It's a great tool, it's very powerful,
1996730	1998870	but obviously, it's not perfect.
1998990	2003130	This was at a time when, basically, this was right before
2003130	2008330	the Cobalt Strike 4.0 release, and there was a bug in execute assembly
2008330	2013650	at one point, where if you executed anything in execute assembly,
2013650	2015090	it would crash the beacon.
2016210	2019270	So, you know, the little screenshot's kind of funny,
2019270	2023110	but I'm sitting there, and I run, you know, I had worked really hard,
2023110	2027150	and I had done all my Red Team things, and I finally got this beacon.
2027650	2030230	And I was like, all right, I've been working really hard,
2030230	2033810	I should use this, I should take this opportunity, seize the moment,
2033810	2037130	and really go and do all my, you know, do my reconnaissance,
2037130	2040550	do my situational awareness, and try to move laterally, etc.
2042690	2048870	So the downside of that is I didn't really think about, you know,
2048870	2052890	the presence of that bug, and also how much I was relying
2052890	2055990	on that single beacon. So luckily, I did set up persistence
2055990	2059270	before I executed that, so it came back the next day
2059270	2063430	when that user logged in, but it was a long 24-hour period
2063430	2066870	of basically waiting and saying, I shouldn't have done that,
2066870	2069930	I shouldn't have executed that, you know, it was kind of a kick yourself
2069930	2072990	moment when you just potentially burned a couple weeks of work
2072990	2076830	just because you got excited when that beacon came in.
2076950	2081330	So I guess the takeaway here is, if you are, you know,
2081330	2085610	once you finally land that shell or that foothold,
2085610	2088810	don't necessarily go and use it immediately.
2088810	2091750	Maybe take some time, just exist in the environment,
2091750	2094710	gather some information, listen passively, etc.
2095310	2099250	And then maybe establish a backup C2 or another foothold
2099250	2102430	before you start executing higher impact actions, right?
2102430	2105370	So start out as low and slow as you possibly can, and then
2105370	2108710	ramp it up as time goes on instead of having your automation
2108710	2112010	and everything ready to go for that initial beacon to go.
2112010	2116470	Maybe let it persist and just sort of blend in
2116470	2118810	for a little bit before you go all the way.
2120990	2123130	So now we're going to cover lateral movement.
2123130	2125250	So we didn't put a lateral movement overview slide
2125250	2127650	because, you know, it would have been like 20 slides
2127650	2129710	of what lateral movement is, right?
2130250	2133010	It's something different to everyone else,
2133010	2139810	but basically lateral movement is establishing more pieces
2140330	2143390	of the attack chain within the internal environment, right?
2143390	2146770	So, or compromising users, or etc.
2147550	2150370	Basically, this scenario is what we like to call
2150370	2151770	acts like you belong, right?
2151770	2155930	So blue teams know publicly available tools, right?
2155930	2158090	They can go out and they know about GitHub, guys.
2158090	2160790	Like, it's a public site.
2160790	2164470	Anyone can go on there and download whatever tools.
2164470	2165690	You know, they can download ImpactKit.
2165690	2168490	They can download anything that's on there.
2168490	2171470	They know about it, and they can use it, right?
2171670	2174310	Tools can stand out from the baseline, right?
2174310	2176830	So, you know, user agents, for example,
2176830	2179250	if you are using PowerShell and the environment
2179250	2182230	doesn't use any PowerShell, it's a classic example, right?
2182270	2184630	If they don't use PowerShell and you do,
2184630	2186710	then now you're standing out from the baseline.
2187950	2191010	And typically, you know, this has been, you know,
2191010	2193810	there's wall bins and etc., but living off the land
2193810	2196850	or blending in is probably the best way to go
2196850	2198210	if you're red teaming, right?
2198210	2201490	It's harder to catch someone who's using the same tools
2201490	2203750	as every other user in the environment.
2204950	2207530	So this is a scenario where, basically,
2207530	2211630	we had a limited foothold, so we had that C2 access.
2212030	2215010	We had credentials, so we had plain text credentials
2215010	2216150	for this user.
2216910	2220330	Basically, we, you know, enumerated our access.
2220330	2221410	This is net user output.
2221410	2223290	Of course, we didn't actually run net user.
2223290	2224910	That would be way too loud.
2224910	2226950	We generated this from LDAP.
2227130	2229810	But, you know, we looked at our group memberships,
2229810	2233210	and we saw one of those group memberships is Citrix, right?
2233210	2235950	So instead of, you know, oh, let's move LIDAR,
2235950	2238670	let's run ImpactKit, or let's run CME or Bloodhound
2238670	2242150	or whatever, you know, let's just log in to Citrix
2242150	2243310	and see what's in there, right?
2243310	2245870	Not only is there potential footholds there if they have access
2245870	2249030	to Citrix desktops, but also, you know,
2249030	2250270	you never know what you might find.
2250270	2254370	So on the right here is a screenshot of that Citrix portal.
2254370	2258350	So we logged in, and essentially this, you know,
2258350	2260930	everything's censored because it's client stuff,
2260930	2263010	but basically this was a SCADA environment
2263010	2266290	that we basically had direct access to monitor
2267010	2269650	a lot of their high-sensitivity SCADA applications
2269650	2272170	and devices within the environment.
2272170	2275030	Without, you know, we didn't use any real tools to do this.
2275030	2277170	All we did was proxy our traffic through our beacon
2277170	2278790	and then just log in.
2279310	2282050	So that's... and that's... they didn't detect it
2282050	2284690	because that's very difficult to detect a normal user
2284690	2287970	logging into their normal thing that they normally do, right?
2289830	2294130	So now Matt's going to cover a lateral movement fail.
2294630	2298830	Yes. So this was an engagement where we were dwelling
2298830	2301550	in the client's network for three weeks.
2301550	2304070	They had no visibility into what we were doing.
2304070	2306590	As you can kind of see from our maps,
2306590	2308290	we had a lot of access.
2308290	2310710	We had basically been able to move through,
2310710	2312230	basically compromise.
2312230	2314430	In fact, at one point we became the security team,
2314430	2316870	which was a key part of this story.
2316870	2319730	So as we're moving laterally through the environment,
2319730	2322330	there were lots of TOIs, targets of interest,
2322330	2324870	that the client had set up for us to compromise.
2325390	2328470	Kind of, hey, once you're in, it's not just,
2328470	2330950	hey, get domain admin, that's like the easy, cool thing,
2330950	2333150	but show that impact, that value.
2333410	2335890	That'd be like, you know, decrypt credit cards,
2335890	2339130	access our secret sauce that's stored on this network,
2339130	2341790	you know, access data, all the sorts of things
2341790	2344490	that can really show like, oh my God, we have been hacked
2344490	2346830	and our data, our business critical stuff
2347370	2349670	has been compromised, like that integrity.
2351370	2353610	So how we actually managed to establish
2354190	2357650	our initial foothold was on a box where there was a domain admin.
2357650	2359370	So yay, we had access.
2359370	2360710	We hadn't really used this account yet,
2360710	2362190	because for most of the port as we're moving,
2362190	2364510	we were able to simulate using different users,
2364510	2366330	jumping to various jump boxes,
2366330	2368990	or getting to different systems, kind of blending in.
2368990	2374430	And one of the goals was to get access to shipping manifest
2374430	2377790	and all this type of very powerful information
2377790	2380350	related to SKUs and all that stuff.
2380750	2385590	So, unfortunately, we couldn't get onto any of the user's machines
2385590	2387270	because they were in a different environment.
2387270	2388630	They were in like a subdomain,
2388630	2392310	but the domain admin account actually had privileges,
2392310	2395690	and it was actually still an administrative privilege level set,
2395690	2398130	high integrity on those boxes.
2398130	2402090	So we were able to authenticate as this domain administrator
2402090	2405630	on one of the warehouse's computers.
2406090	2408130	Well, that was where it was kind of getting weird,
2408130	2413550	because the account was designed as a backup account for TVs and stuff.
2413830	2415310	And eventually, like I kind of said,
2415310	2418290	we were in the security IT guy's chat room.
2418290	2421570	That's actually the Malware War Room Council,
2421570	2422710	that's what they called it.
2422710	2425570	We were seeing like, why is this account logging in here?
2425570	2427450	And then they were starting to see tidbits.
2427450	2430950	So as they were going back through and knocking down our beacons,
2430950	2433790	we were kind of going around in a different direction.
2433790	2437050	But we eventually lost all but one or two hosts.
2437190	2439150	We still had access in the environment,
2439150	2441590	but we had to start all the way back from square one.
2441590	2443710	And why this is one we like to talk about,
2443710	2447110	especially when we're kind of going through any type of our debriefs
2447110	2450050	internally and stuff is, you know, DA is cool and stuff,
2450050	2453170	but oftentimes companies and stuff, they're going to look for that.
2454550	2457030	Are their DA accounts logged into random places?
2457030	2459470	I know most of the time that's where everyone goes first.
2459470	2460810	They have a lot of controls around,
2460810	2463690	but you can do a lot with like other types of accounts.
2463690	2467210	Like I kind of said, IT security guys, admins,
2467210	2470970	they have a lot of the same access that a domain administrator.
2471510	2473670	And oftentimes when we look at this,
2473670	2475670	like these types of goals and end results,
2475670	2478010	like maybe compromise an application,
2478010	2479970	get access to the database behind it,
2479970	2482530	where like all the credit card or juicy information is.
2483090	2485030	Domain admin doesn't really play into the fact.
2485030	2487450	Domain admin just gives you administrative rights on the box.
2487450	2490330	It doesn't give you, you know, admin rights into an application.
2490710	2492450	So that's something where you always want to keep in mind.
2492450	2496470	So we always kind of look at it like, who are you logging with?
2496470	2500170	Is there value to it? Like, you know, it might be an easy skeleton key,
2500170	2504170	but are you going to create more waves than it's worth?
2504370	2506010	And this is a great example of that.
2506010	2508910	We pretty much, we were in over 50 boxes
2508910	2510550	moving through different environments
2510930	2513290	and we had to go all the way back to square one.
2515850	2520290	So breaking this chain, it really comes down to baselining
2520290	2522870	and understanding your environment.
2523110	2525950	There's a great term called least frequency.
2525950	2528210	If you're not familiar with it, the concept is that
2528710	2531030	if you're baselining to the point where you know your environment,
2531030	2533370	you know, like what user agents everyone uses,
2533370	2535810	you know, your Google Chrome or a Firefox shop,
2535810	2537990	all those types of things, that's your baseline.
2537990	2541610	Everything's going to be the same until you see some differences,
2541610	2545050	like Internet Explorer user agent stuff.
2545050	2548150	And those are the least frequent objects or events
2548150	2550730	that now you can drill into, well, why did that happen?
2550730	2553650	If everything else is standard operating procedure,
2553650	2556490	you've seen this for day in, day out for like three or four years,
2556490	2558630	and then you see this one event for the first time,
2558630	2561230	you kind of can shuffle all that stuff off to the side
2561230	2564230	and focus in on those few unique new events.
2564230	2567650	May not be malicious right away, but you can start digging
2567650	2570830	and that's how you can make this large cloud of noise,
2570830	2574430	something smaller and easier for your team to handle and manage.
2575250	2576810	But when it comes down to lateral movement,
2576810	2580790	the great tips we often recommend are, you know, auditing your ACLs,
2580790	2583930	making sure that, you know, users don't have unnecessary privileges.
2583950	2586850	That's often the easiest pitfall for lateral movement.
2587550	2591050	To go back to what Corey said about, you know, the Citrix and stuff.
2591350	2593690	One of the issues was there were so many unnecessary privileges
2593690	2595930	that gave us hops, skips, and jumps in the environment
2595930	2597710	that just made us so much more successful.
2598890	2600730	There are other great tools.
2600730	2604630	I'm really surprised this one is not talked about a lot or used.
2604630	2605970	It's called Net Cease.
2605970	2608150	There's a link right down there that we provided.
2608650	2614270	Essentially, what it does is it prevents the remote call to net session in Noom,
2614270	2617190	which if anyone's familiar with, that's how most great tools
2617190	2622250	that are out there on GitHub or in the hacker space get all that,
2622250	2624050	you know, who's currently logged in.
2624230	2626310	It doesn't disable or hamper it.
2626310	2629030	What it does is it changes who can call it remotely.
2629030	2630930	If you're on the box, you can call it.
2630930	2634730	It doesn't matter your privileges, but if you're remote to a box,
2634730	2637650	it can only be certain ones rather than what's default,
2637650	2639810	which is anyone that's in the domain user group.
2639810	2643370	It kind of changes it to be power users, administrators, or another group.
2643630	2647430	And with that patch and that little registry change,
2647430	2649230	which can be pushed out through group policy,
2649230	2651610	it really does hamper your ability to see,
2651610	2653990	oh, I need to be user X and I'm user Y,
2653990	2655890	and I need to figure out now where user X is.
2656310	2659290	You can't just start hitting every box and looking at any...
2659290	2661950	using any tools to find that user.
2661950	2663990	It really changes the game.
2664710	2668490	Also, making sure, you know, privilege accounts are protected,
2668490	2670110	you know, there are protected user groups
2670110	2673830	or credential delineations and delegations.
2673830	2675710	Make sure that, you know, you're not...
2675710	2678030	if someone logs in a service account or something like that,
2678030	2679690	they're not just stale, sitting in memory,
2679690	2681130	or they're not just easily available.
2681130	2683590	Really kind of protecting the actual sensitive
2683590	2685790	of credentials or hash credentials.
2688830	2691930	So now we're going to kind of talk about persistence.
2691930	2694950	It's one of those... it's more of an art form, I like to say.
2695530	2697190	There's great techniques or something like that,
2697190	2699490	but whenever you hear about a new one on Twitter
2699490	2701350	or there's an article, most of the time,
2701350	2703230	people pay attention because they really get scared,
2703230	2705410	and that's, like, the focus of patching,
2705410	2707070	so when you find vulnerabilities that allow.
2707230	2709610	So I always like to take the arts form.
2710250	2711890	And it really comes down to, like, you know,
2711890	2714950	you could go that crazy route that they might have it patched,
2714950	2718950	but if, say, your payload or whatever, you know, binary, DLL,
2718950	2721570	whatever you want to have it, can persist on disk,
2721570	2722610	or it stays on disk.
2722610	2726330	It could be somewhere in, like, you know, the user app data,
2726330	2727370	temp folder, something like that,
2727370	2731150	and whatever security appliance is just not alerting on it,
2731150	2734150	if you have, say, you know, a bat file or something
2734150	2739270	where it drops into a start follow of a user and calls it,
2739270	2740730	it's probably not going to get detected
2740730	2743130	if it looks right telling that story again.
2743130	2746530	So in one of the scenarios we did,
2746530	2748310	we were persisting on multiple different machines,
2748310	2751570	and what we ended up doing was just dropping a bat file
2751570	2755610	that would call gpupdate.exe, but our binary,
2755610	2757770	our evil binary was gpupdate.exe,
2757770	2759330	because it was obviously putting app data.
2759530	2762270	So when you looked at it, strictly from the point,
2762270	2765690	oh, the process, you know, the binary gpupdate started up
2765690	2768930	when the user kind of logged in, and it wasn't as suspicious.
2768930	2771330	I mean, if you drilled in, you would have seen,
2771330	2775950	well, why is gpupdate not in C system Windows 32?
2776010	2778770	Why is it in app data?
2779050	2780950	And one of the great things about that is that
2780950	2783850	if they're looking at things like what this file is,
2783850	2785630	there's something else that's already kind of dragged
2785630	2788570	their attention towards it, so you're already kind of burnt.
2788650	2792390	But just staying pretty low, making tiny ripples,
2792390	2794930	you hang around that, you know, indicators of anomalous.
2794930	2797070	If someone looked at it, they probably wouldn't blink twice
2797070	2801010	until they looked at the file path or other attributes of the file.
2803070	2806590	And now it comes down to, I think this is one of our favorite ones
2806590	2809450	to talk about, is conference rooms.
2810750	2814490	So we were on an engagement that was getting close to the end,
2814990	2817630	and it was very late when we had managed to finally get through,
2817630	2818890	and we really wanted to establish persistence
2818890	2820970	because we couldn't afford to lose.
2820970	2824990	We were really coming close to the tight line of the end.
2824990	2828190	So it's very late at night. Okay, perfect.
2828490	2832550	So we decided, okay, we know what their conference room systems are.
2832550	2836890	So we put a beacon with persistence on it, thinking, you know,
2836890	2839730	no one's going to look at them. It's pretty late on a Friday.
2839730	2845030	No one's going to, you know, do anything about this until Monday, if anything.
2845290	2846930	And let's be honest, no one's going to come in over the weekend
2846930	2849010	and use the conference room machines.
2849030	2850890	But it was a pretty solid idea.
2850890	2856110	What actually happened was their SOC was like,
2856610	2860470	why is there traffic coming from the conference rooms at 2 a.m.?
2860470	2863070	Like, what? Is someone using these?
2863350	2868330	And that in itself was actually louder than anything we had done previously
2868330	2872370	to get in because it didn't make sense why these conference rooms
2872370	2876030	every so often would call out to the internet and stuff like that.
2876030	2878530	And that really was kind of like the problem was
2878970	2881830	we thought we were being really stealthy and quiet.
2881830	2885710	And for all purposes, like, you know, there was no artifacts left.
2885910	2889690	There was no, like, alerts from the EDR consoles or dashboards.
2889690	2892430	It was just someone saying, well, this traffic, it looks weird.
2892430	2897010	Our traffic baseline is that, you know, 8 a.m. to 5 p.m. is a lot.
2897010	2900550	And then afterwards, it's a little. And then all of a sudden, there's a big spike.
2900650	2903330	So it's like, OK, what's going on here?
2903350	2905470	And then they dug deeper and deeper.
2905470	2909710	And it's really hard to come back from that because they've done everything right.
2909710	2913730	Like, that's so low of an indicator that there's nothing you can really mask
2913730	2916030	besides maybe figure out a better story.
2918950	2923410	So as I was saying before, this whole persistence, it's really an art form.
2923410	2925650	There's no, like, silver bullet that if you do this,
2925650	2927790	there's no way anyone can persist on your environment.
2928510	2931930	You know, patching and keeping up to date is always a great thing.
2931930	2936590	But kind of like the stories we just kind of described, like, it doesn't matter.
2936590	2940030	It really comes down to how are you monitoring? Do you have a good baseline?
2940030	2945290	Do you understand, like, what processes typically should start up for every different department?
2945710	2951950	Does HR just use Google Chrome and Outlook and all the services related to that?
2951950	2954910	So, OK, there's your baseline for that department.
2954930	2958690	And looking around, like, file locations, you know, the ones that hackers love to use,
2958690	2963270	you know, all those, looking for things that are spawning from there or starting up there,
2963270	2966610	that will give you a huge indication, like, nine times out of ten,
2966610	2971850	there should never be a DLL in temp or app data that's starting up right when a user logs in.
2972210	2976410	And of course, the one that got us burned is the unusual net communications.
2976410	2980190	Looking at those things, if you can drill down that precise,
2980190	2983870	you have a very mature environment and a very mature way of handling instances
2983870	2988030	that's going to make any, like, challenge, red teamers job a lot harder.
2989450	2993450	Also, application whitelisting is your friend. It's not ours.
2993670	2997190	When we're on a box, whatever way, you know, might be in Excel,
2997550	3000690	Word documents that bypass that, but, like, trying to get persistence,
3000690	3004830	it's next to impossible if you have a strong whitelist application going.
3004850	3008690	You know, dropping binaries, like we just described, makes it a whole lot harder.
3008870	3012790	And then making sure whatever we're trying to slingshot through,
3013270	3016830	that's not, you know, being caught in any of those chains to get to the nasty
3016830	3020610	that we call our backup payload, making sure none of that.
3021190	3024150	All of those things are not blocked through application whitelisting.
3024150	3027090	It can just be a nightmare. By the time we get it all figured out,
3027090	3029750	you know, we've persisted too long, not moving.
3030850	3033710	So it's definitely a key thing to definitely keep up monitoring
3033710	3036810	and baselining and getting a good understanding for your environment.
3037370	3039370	So we're now coming to the end.
3039370	3045030	All right. Yeah, so conclusions, or, you know, confessions of an attacker.
3047370	3051030	So here's some of our sort of lifting the curtain a little bit.
3051210	3053210	Attackers use what they know works, right?
3053210	3056830	So, you know, we use Cobalt Strike because we know Cobalt Strike works.
3056830	3060410	We, you know, custom stuff is great. We experiment with it quite a bit.
3060410	3065270	But if it comes down to we have one shot, we have one, you know, DLL or one EXE
3065270	3069130	that we're going to do, which C2 do you want to use, right?
3069130	3072930	We're going to, if it comes down to a choice like that,
3072930	3075390	we're going to make the choice of the most reliable tool, right?
3075390	3079790	So oftentimes that can be easier for blue teams to identify
3079790	3085310	because the tool set is shrinking as you're relying on more well-developed
3085310	3086790	or well-known tools.
3087870	3091330	Also, one end-to-end attack chain can be easier for us to manage, right?
3091330	3095890	So as, you know, as cool as it is to have four or five different footholds
3095890	3100210	that are totally unrelated, different C2, different initial compromise,
3100210	3102890	different physical locations, that's great.
3102890	3105190	But the reality is we're, you know, we're red teamers,
3105190	3109130	so we're doing this in a condensed timeframe with restrictions
3109130	3110930	on how long we have.
3110930	3114790	So oftentimes we end up with just one end-to-end attack chain.
3114790	3117290	And along the way, all those chain breaks that we described
3117290	3120750	are ways that would just basically send us back to square one
3120750	3124670	where we'd have to start over and say, we did this, this, and this.
3124670	3129330	However, they had this security control or they caught us or whatever,
3129330	3131050	and now we have to start over.
3131050	3134550	So it's actually, you know, it's... the chains are more fragile
3134550	3135910	than they might appear.
3136710	3140150	Users who report incidents are honestly one of the things that comes up
3140150	3144090	more than we'd like it to because there's really nothing we can do
3144090	3145250	to stop it, right?
3145250	3149150	We can't stop users from emailing their security team and saying,
3149150	3150370	hey, this looks weird.
3150930	3155530	Obviously, we showed an example of how we can do anti-evasive maneuvers
3155530	3158590	and say, oh, actually, never mind, my mistake.
3158590	3160570	But if someone's going to pick up the phone and call a user
3160570	3164150	or if the user picks up the phone and calls up security people,
3164150	3165910	we're not a part of that conversation.
3165910	3167970	We can't really work around that.
3167970	3170950	So that's where that security awareness training and just relying
3170950	3174670	and trusting on your users is actually really hard to get around.
3175690	3179350	And then obviously, defense in depth, it really does win in the long run, right?
3179350	3181790	So this works for real attackers, right?
3181790	3185370	Because if you're trying not to get hacked, you're running away from a bear.
3185370	3188650	So as long as you're not the slowest, you probably won't get eaten.
3188710	3191630	But defense in depth makes it harder.
3191690	3196650	Every step along the way gets harder when you have, oh, well, we got a foothold,
3196650	3198970	but now they have all these really strong local firewalls,
3198970	3204150	so we can't move laterally as easily because everything's blocked
3204150	3205150	to everything else, right?
3205150	3206930	That's an example of defense in depth.
3207650	3209590	That's not protecting you from spear phishing,
3209590	3213190	but that is helping if you do get to that breach status.
3213190	3215910	It's going to be restricted in the scope of it.
3216790	3223290	And then Matt has some final conclusions on tools or defensive controls.
3223290	3224730	Yes, defensive controls.
3224730	3226890	We kind of talked a lot about this.
3226890	3232410	We kind of at some point hit small, you know, an inch into this type of topic.
3233410	3237110	You know, tools are great, you know, as we kind of described before.
3237110	3240550	We highly recommend, you know, modern tools, proper configurations,
3240550	3243850	but they're kind of useless if you just buy them in an audit mode.
3244550	3248950	And that's what we kind of see a lot is, is the deployment that they're not,
3248950	3252850	you know, you might have the greatest security stack of 20 different products.
3252850	3256350	You might have 14 different ADR agents on there,
3256350	3260130	but if they're not properly tuned or configured, there's tons of gaps.
3260130	3263450	And that's where hackers and attackers love to live is just in those gaps.
3263450	3264590	It's pretty much where it is.
3264590	3269050	Hey, look, there's a gap or a blind spot in our, in this client's network.
3269050	3270670	That's where we are going to start.
3270670	3274190	We're going to live in this gap and we're going to try to move as much as we can in there
3274190	3276470	because you guys don't have any visibility. We know that.
3276810	3281170	So if we know that, you know, hey, you guys are monitoring PowerShell,
3281170	3286030	but you know, we can use C sharp or hey, we can, you know,
3286030	3289010	you guys have great lockdown for a lot of stuff, but macros are really easy.
3289010	3292570	We could use macros. We can use water hole attacks, you know, set up.
3292570	3296670	In fact, hey guys, you know, your ADR is only set up to detect, you know,
3296670	3299890	process injections or something like that, anything like that.
3300410	3301970	There's tons of little things like that.
3301970	3306090	And that's where really tuning and tightening up can really make a huge difference
3306090	3308270	in the success of your defensive controls.
3308790	3311070	Also that kind of comment I made before about audit.
3311070	3314010	We often see the latest and greatest, you know,
3314010	3317770	oh, this is going to stop every, you know, threat, cyber threat known to mankind.
3317770	3322370	We detect, oh, days before they even thought of tools, but you ran in an audit mode.
3322370	3325690	So someone's not looking at the dashboard. You don't see a blinking light appear.
3326490	3330210	And so we continue on our way through the environment.
3331010	3333710	It's really, it's really hard to do a lot of that stuff.
3333710	3336710	And that's where like hiring, you know, red team sims
3336710	3338750	or doing those types of engagements.
3338750	3342390	So that way you can see what's out there, understand what, you know,
3342390	3344830	people are doing and seeing where those gaps are in your product.
3344830	3348510	That's highly valuable than just, hey, I'm going to buy a product
3348510	3350970	and just, you know, plug a few buttons on it
3350970	3352830	and hope that I got everything right.
3353050	3355950	Really having it go through those trials and stuff
3355950	3359010	in a live fire engagement is going to help you guys more than anything.
3361270	3363910	Also, we know this, and this is probably going to be
3363910	3366110	one of the most frequent questions asked.
3366110	3369290	You know, well, if we do all this stuff, then, you know,
3369290	3371150	it's not usable for my environment.
3371150	3373910	You know, users can't log in as easy or they can't do things
3373910	3376110	that they used to do as quickly and stuff.
3376110	3377690	And now they're going to complain that they're affecting
3377690	3380210	or affecting their ability to do their job.
3380210	3382970	And, you know, it's going to hurt the company's bottom line.
3382970	3385450	But, you know, it's that type, it's a hard conversation
3385450	3387590	you have to have with the business about, you know,
3387590	3390170	you have to change the way you guys have been using stuff
3390170	3391710	to make it more secure.
3391930	3393090	It's very hard.
3393090	3396210	I mean, I don't envy anyone who has to deal with those conversations
3396210	3399450	on a daily basis, but it's necessary to have.
3400010	3402650	And I think if you approach it properly,
3402650	3405150	and with a lot of, you know, information and guidance
3405150	3407930	and recommendations, even from third parties,
3407930	3410390	you can definitely get a lot of value out of that.
3410430	3412330	And the last thing, of course, we've mentioned
3412330	3414170	throughout this whole thing is baselining.
3414350	3415510	Baselining, baselining.
3415510	3417550	Know your environment inside and out.
3417930	3421970	If you do, that's the biggest thing from our red teaming experience
3421970	3424770	that has killed us or stopped us dead in the water
3424770	3429070	is if you can baseline and discern us from the rest
3429070	3431670	of your normal traffic, even if we're logging in through RDP
3431670	3433670	and we're using all the same stuff you're normally using,
3433670	3437510	if you can find out that we're not who we're pretending to be,
3437510	3439850	you're going to have a lot better success right then
3439850	3442290	if you do anything that I just described.
3442290	3443670	Baselining is probably the biggest key,
3443670	3445870	and that's why we left it as the largest bullet point.
3446890	3449010	Really, just least frequency.
3449110	3451230	Get in tune with your environment.
3451230	3453910	Get really in tune. Get very close to it.
3453910	3455790	Get unnecessarily close to it.
3455790	3457730	And with that knowledge, you'll definitely be able
3457730	3459590	to spot the anomalous behavior.
3461170	3464330	All right, so we have a few minutes left.
3464330	3468370	If you guys have questions, put them in the Discord channel.
3468550	3473090	If you guys are in Discord, it's the Briefings Main Talks channel.
3473310	3476950	We're both in there, and we can try to answer some questions
3476950	3479890	in real time before we wrap up.
3479890	3483770	You can hit us up on Keybase or Twitter if you have any questions
3483770	3485350	or just want to chat. We're always available.
3485350	3488510	We love picking other teams or other people's brains
3488510	3492770	in the industry, so definitely hit us up if you ever have a question.
3493710	3495870	Other than that, I just want to say thank you
3495870	3498710	to the Red Team Village for letting us speak today,
3498710	3500730	and thank you guys for showing up for our talk.