start	end	text
0	3200	And welcome to DEF CON Red Team Village.
3200	5040	My name is Giorgio Chies,
5040	6420	and this talk is titled
6420	11900	Deep Dive into Adversary Emulation, Ransomware Edition.
11900	14580	And what we're going to look at is an attack
14580	17280	that we saw in July, 2020,
17280	20460	against the Garmin organization.
20460	24240	It brought all their services down, asking to pay a ransom.
24240	27460	The particular adversary that was attributed to this attack
28280	33440	is EvoCorp, and they used a ransomware called WastedLocker.
33440	36260	So we're going to talk about how we can emulate
37280	39500	a ransomware attack against an organization
39500	40980	in a professional manner,
40980	45000	so that we can test our detective and preventive controls
45000	49500	and answer the question that most CISOs want to know.
49500	51840	Can this happen to us?
51840	53280	I hope you enjoy,
53280	56160	and I'm available to answer any questions.
56500	59300	As mentioned, my name is Giorgio Chies.
59300	62620	I'm the Chief Technology Officer at SITE.
62620	66500	I'm also the author of the Purple Team Exercise Framework
66500	68780	that we recently released and made available
68780	71780	to everyone for free on our website.
71780	77100	I co-created the C2 matrix with Bryson Bort and Adam Mash,
77500	80740	and it is a framework of various different
80740	81960	command and control frameworks
81960	85320	with their capabilities and their features.
85320	88300	We'll cover that a little bit in this deck.
88720	90320	Before joining SITE,
90320	92940	I worked at Citigroup for 10 years
92940	94880	running the offensive security team.
94880	97680	I started as a vulnerability assessment analyst,
97680	100040	then introduced penetration testing,
100040	103220	and eventually created the Red Team about five years ago.
103220	105300	We then created a Purple Team function
105300	109620	and began doing adversary emulations across the globe
109620	112040	and working with various regulators,
112040	115480	which led to the creation of a global framework
115480	117840	with the Global Financial Markets Association
117840	121400	titled Threat-Led Penetration Testing.
121460	123800	So we'll cover a lot of that here as well.
123800	125400	That's also a free framework.
125400	126620	I teach for SANS.
126620	129340	I've taught for SANS for the past 10 years,
129340	131020	mostly the pen test curriculum
131020	133060	and also some of the cloud courses.
133060	137780	But if you've ever taken or have the GCIH or the GPEN,
137780	138840	shout out to you.
138840	142040	I also have a two-day Red Team exercise
142040	144460	and adversary emulation course.
144460	148260	While at Citi, I was part of the CVSS working group
148260	149360	and I was a voting member
149360	152720	where we released version 3 and 3.1.
152840	154060	Version 4 is in the works
154060	157100	and I'm also working on another working group now
157100	159500	as I'm no longer a voting member of CVSS
160120	164420	on what's called the Exploit Predictability Scoring System.
164420	167120	We're trying to identify what vulnerabilities
167120	170320	will be exploited versus ones that will not,
170320	172780	even if they have similar CVSS scores.
172780	174740	It's a very interesting project.
174740	176660	And if you'd like to join,
176660	179780	it is a working group as part of FIRST as well.
179940	183440	I really believe in ISSA and giving back to the community.
183440	186380	ISSA is the Information Systems Security Association.
186380	188940	They might have a chapter in your location.
188940	189920	Definitely go out.
189920	193900	I actually found two of my jobs before working at Citi.
193900	197080	I worked at Terramark in a security operations center,
197080	201420	found that job through there as well as my job at Citi.
201420	205020	So definitely network and give back to the community.
205020	209000	Long, long ago, I wrote a book on Windows 7.
209000	210920	So I am a published author.
211200	213940	Hopefully no one's using that operating system.
214220	216640	So here's our agenda for today.
216640	218300	We're going to cover some definitions
218300	220980	because as any red team talk,
220980	223580	we have to argue about definitions
224060	227640	and really want to use the same language in the industry
227640	230180	and hopefully help the industry use the same language.
230180	232360	So we're going to cover things like red teaming,
232360	234440	purple teaming, and adversary emulation.
234440	236960	Then we're going to talk about ransomware.
237040	240100	And ransomware is something that we've all heard about.
240100	244080	And while many of us find this annoying and not sophisticated,
244080	247160	we're actually seeing an uptick in the sophistication level
247160	250040	where it isn't just about gaining initial access
250040	252940	and impacting the target systems,
252940	254820	but it also involves moving laterally
254820	259420	and exfiltrating information prior to requesting a ransom.
259740	262220	So we're going to cover our usual steps
262220	264740	when we talk about adversary emulation,
264740	266600	starting with cyber threat intelligence.
266600	268820	We want to learn about various attacks.
268820	272180	In this case, we're going to talk about Garmin and Evil Corp
272180	277060	using a piece of malware called Wasted Locker.
277060	280060	It's the attack that affected Garmin in July 2020.
280060	281820	We're going to understand that attack.
281820	285000	We're going to create an adversary emulation plan around it.
285000	288040	Then we're going to perform it. So it should be a lot of fun.
288040	291380	Then, of course, we're going to talk about defending against ransomware.
291380	294500	Now, the first thing I want to cover is definitions.
294500	297640	And we published this ethical hacking maturity model
297640	301740	to kind of show a blueprint of how many organizations
302180	304960	are maturing in their offensive security.
304960	308440	Now, this doesn't mean that every organization is the same.
308440	310380	This is really based on my experiences
310380	314160	and on experiences of organizations I've talked to,
314160	317040	whether they're SANS students or other people in the industry
317040	320480	that have asked about this particular subject.
320520	325280	So most organizations start over on the left side with vulnerability scanning.
325280	329920	Here's where you run a scan against an IP or a web app,
329920	334640	and you get back a list of vulnerabilities based on signatures.
334640	338820	Vulnerability assessment is when you look at the output of that vulnerability scan
338820	341580	and you give it a real risk rating,
341580	344620	where you actually calculate if the risk is there,
344620	346620	you verify the vulnerability,
346620	349860	and you prioritize what needs to get fixed.
350360	355120	Penetration testing then involves the exploitation of vulnerabilities.
355120	356640	And this can involve finding vulnerabilities
357060	360720	that the vendor didn't know about, where we call those ODAs,
360720	363560	or it could also mean gaining access to a target system
363560	368260	and learning and really calculating that business risk.
368320	372240	Unfortunately, in the industry, pen testing got very scoped down.
372240	375300	We weren't allowed to move laterally to other hosts.
375300	379020	We weren't allowed to do social engineering and things like that.
379020	381300	And that's where the red team came in.
381320	384820	The red team started testing people, process, and technology.
385260	389980	Purple teaming is where we work together, the red team with the blue team.
389980	395920	And adversary emulation is a cyber threat intelligence-led assessment,
395920	397680	generally carried out by the red team.
397680	401300	And it can be a full knowledge or zero knowledge assessment,
401300	404400	in which case it would be a purple team or a red team engagement.
404400	407820	Now, as I mentioned, these don't necessarily mean
407820	411780	that it's the steps you must take to get to where you want to go.
411780	415320	This is just an example that you can use with your senior management
415320	418680	to explain to them how your organization has matured.
418680	424100	There is an arrow there at the end, which means that I'm sure this will continue to evolve.
424160	426060	Every organization is different.
426340	428700	And of course, don't stop doing the previous step.
428700	431180	Just because you're doing red team and purple team engagements
431180	434780	doesn't mean you're not doing vulnerability scanning anymore.
434780	438060	There's an entire article on this if you'd like to read more about it.
438080	441380	The reason we're here is to talk about adversary emulation.
441380	445040	And that can be defined as a type of red team exercise.
445040	447500	There's many different types of red team engagements.
447500	449460	This is one of those types.
449460	454200	And in this type, we are going to emulate adversary tactics,
454200	457100	techniques, and procedures or adversary behavior.
457100	461520	We understand those behaviors by leveraging cyber threat intelligence.
461520	465260	And just like the malicious actors, we're going to have an objective,
465620	469900	which would be very similar to objective of that actor.
469940	474500	So in this case, we are putting TTPs together in an attack chain
475060	477900	for testing of these various scenarios.
477900	481480	And it's really going to answer the question if the target organization
481480	485100	is ready for a real sophisticated attack.
485100	487680	Most of the time, the effort here is manual.
487680	488800	There are a number of tools.
488800	492720	There's some automation that you can build around doing TTPs.
492720	494560	My company site does some of this.
494560	496520	So we'll cover that a little later.
496800	501820	But it's mostly manual because you can't really automate an entire red team, right?
501820	504920	You actually need people, which is very important.
505040	509100	So as I mentioned, adversary manipulation is a type of red team exercise.
509100	510700	There's different types.
510700	515640	And a red team can be defined as the practice of looking at a problem or situation
515640	520120	from the perspective of an adversary, which means that you can do a lot with that.
520120	521560	It could be physical pen testing.
521560	526220	It could be doing phishing simulations for awareness training,
526220	529980	or it could be testing one or creating a new TTP.
529980	533500	In this case, we're going to talk about adversary manipulation,
533500	537040	but we want to differentiate the whole red team from pen testing.
537040	541760	For example, in a pen test, you're generally finding and attacking preventive controls,
541760	546100	the lack of patching, or maybe you found a vulnerability that the vendor doesn't know about.
546100	548700	In red teaming, our goals are different.
548700	552600	Our goals are to make the blue team better, to train,
552600	558720	to test and measure people, process, and technology, and to test assumptions.
558720	561520	The effort here, as I mentioned, is pretty manual.
561520	565580	There's a lot of tools, so we'll cover some of those in the C2 matrix and this talk.
565580	568820	And the frequency is really based on intelligence.
568820	574660	I'm sure many of you this week heard about Black Hat and DEF CON and saw some new techniques,
574660	579620	so we might want to be testing those out as soon as we're back at the office.
579640	581760	The frequency really depends.
581760	585160	We are seeing red team engagements being required by various regulators,
585160	587600	and the customer here is the blue team.
587600	590560	We want to work with the blue team.
590960	595080	Now, there is a difference between internal and external teams.
595080	597820	Internal red teams will do an engagement,
597820	601100	and then they might have to repeat that engagement multiple times
601100	604600	to ensure that the operations teams and the blue teams are trained
604600	607700	and have the right detections in place.
607960	610420	That means that they have to do a lot of retesting.
610420	612040	They might not like that.
612040	613520	They're also privileged.
613520	614820	They're insiders.
614820	616320	They have information.
616320	619620	They've probably done other red team engagements and exercises,
619620	622400	so they know what works and what doesn't work.
622400	627420	So really, internal red teams should be seen more as a sparring partner to the blue team.
627420	630060	They should have collaboration and get along.
630120	632260	External teams are a little different.
632260	634340	They offer a different perspective.
634340	637900	Since they're coming from the outside, they don't have that insider knowledge.
637900	641280	They'll be able to emulate an external malicious actor
641280	644240	by performing and doing things like reconnaissance
644240	646600	and learning more and seeing what's out there
646600	650340	to see if they can breach that perimeter or get internal access.
650340	653620	There's other types, though, where external teams could be brought in
653620	655400	in an assumed breach perspective.
655400	657380	We'll talk about that a little bit more.
657380	660460	And these are mostly snapshot engagements, right?
660460	662020	They come in once a year.
662020	663420	They do the test.
663420	664640	They leave a report.
664640	667520	Maybe they do a red team reveal or a replay.
667720	670580	And then they don't come back for at least a year.
670580	674920	So it's very snapshot and point in time oriented.
674920	679700	So why don't we move towards a purple team, especially for those internal teams?
679700	682060	Your job is to make the blue team better,
682060	686040	to test and measure and improve people, process and technology.
686040	690200	You don't have to do these zero knowledge engagements all the time.
690200	692760	You might only have to do it maybe every three months
692760	695320	or every six months or once a year.
695320	698540	The rest of the time, you can spend it in a purple team fashion,
698540	701620	working and collaborating with the blue team.
701620	706540	It is an efficient way of doing a lot of these adversary emulations.
706540	708260	So what is a purple team?
708260	710940	A purple team is a virtual or functional team
710940	713940	where various teams actually come together and collaborate
713940	717980	to improve the defensive security posture in a method
717980	725720	that is more efficient than your standard red team engagement that results in a report.
725720	731220	Here, we use cyber threat intelligence to understand a malicious threat actor.
731220	732960	Generally, this team could be internal,
732960	735840	in which case it would have a lot of insider information
735840	737980	and really understand the target organization,
737980	740900	or it can be an external cyber threat intelligence team.
740900	743340	But the point is that they would provide a threat actor
743340	749400	that has the capability, the intent and the opportunity to attack that organization.
749820	755560	Then the red team consumes this information and creates an adversary emulation plan.
755720	757700	You then tabletop this.
757700	760880	You have a discussion with all the parties involved.
760880	764020	The blue team can be the security operations center,
764180	766040	a managed security service provider,
766260	771380	a hunt team, or an incident response team, digital forensics, right?
771380	773260	All of those are part of the blue team.
773260	774840	You have this tabletop and you say,
774840	780860	for these particular TTPs, this is our expected defenses.
780860	782640	And then you emulate that.
782640	785040	Red team shows the blue team what they're doing.
785040	785980	They emulate it.
785980	787800	It's a full knowledge engagement.
787860	790660	The blue team will then go and look for indicators of compromise
790660	793160	or indicators of this behavior.
793460	795880	And then both teams work together to say,
795880	799020	okay, we believe that this is good enough detection,
799020	803280	or we can improve this detection by tuning these various tools.
803720	807520	And then you repeat that over and over for various different TTPs.
807520	809600	You can repeat that to train people.
809600	812060	You can ensure that the processes are working.
812060	817300	A handoff between a security operation center analyst to a level two analyst
817300	821960	or to an incident response person all works efficiently.
821960	824940	And of course, you're also tuning your technology.
826180	828260	Did you say purple?
828260	830700	And yes, purple is very hot right now.
830700	832520	And it's because of the efficiencies.
832520	836540	Now, anything we do in offensive is to bring business value.
836540	838740	So regardless of what you're calling this,
838740	841260	if it's a red team engagement with no knowledge
841260	846080	or a purple team engagement, we always want to bring business value.
847620	851780	So as usual, we start with frameworks and methodologies.
851780	854020	And that's very important for us,
854020	857340	because if you're going to sell doing an adversary emulation,
857340	860460	especially a ransomware one to your organization,
860460	862280	you better have a good plan.
862280	866060	And one of the things that does that is a framework and a methodology.
866060	868940	Now, one of the ones that we recently released through Scythe
868940	871560	is the purple team exercise framework.
871560	873960	This covers cyber threat intelligence,
873960	875520	covers sponsorships,
875520	880780	covers getting the people in the process and getting everything ready for that exercise.
880780	883760	And you can see over here on the right, kind of the life cycle there.
883760	885500	We start with cyber threat intelligence,
885500	886940	we do preparation,
886940	889600	we execute the exercise,
889600	891860	and then we have lessons learned.
891860	895560	There's a number of different methodologies that you can use.
895560	899040	One of the original ones was the Cyber Kill Chain by Lockheed Martin,
899040	903420	which was seven steps showing senior management kind of how an attack works.
903420	904760	That has matured.
904760	907420	Paul Poles came out with the Unified Cyber Kill Chain,
907420	909060	which goes way more in depth.
909060	911240	Really like that one and shout out to Paul.
911400	915280	And then we have financials that have a number of different regulations.
915280	917500	The Bank of England has CBEST,
917500	919860	the European Central Bank, the ECB,
919860	921300	has Tiber EU,
921300	924620	which is threat intelligence based ethical red teaming.
924620	928920	The Monetary Authority of Singapore and the Association of Banks of Singapore have
928920	932280	red team adversarial tax simulation exercises.
932320	938180	Hong Kong Monetary Authority has the intelligence-led cyber attack simulation testing.
938180	943220	And then we all came together and I was a co-author with the Global Financial Markets Association
943640	948800	to create a framework for the regulatory use of pen testing in the financial services industry.
948800	951920	So there's many frameworks out there that you can use and leverage
951920	954160	that are free and open source.
954160	958960	Pick one and use that one, that way you can show that you are a professional.
958960	962220	And then for testing, of course, we're going to use MITRE ATT&CK,
962220	967080	which stands for adversaries, tactics, techniques, and common knowledge.
967080	969840	And it really is a common knowledge or common language
969840	972240	that allows the cyber threat intelligence team
972240	975880	to work with the blue team, the incident response teams,
975880	979160	and the red teams all speaking the same language.
979160	981400	So as something occurs in the wild,
981400	985600	something like Garmin hack, which we'll cover right now,
985600	989900	the forensics team goes in there, understands what happens,
989900	992160	and then they give us cyber threat intelligence.
992160	995480	The cyber threat intelligence team will create these reports,
995480	1000040	which we will then consume, and then we can map all these back to MITRE ATT&CK.
1000040	1002700	And of course, everyone's seen the MITRE ATT&CK framework.
1002700	1006760	On the top, we have our tactics. Those are the adversary goals.
1006760	1010820	Under those, we have our techniques, which now have sub-techniques,
1010820	1015140	and also procedures. And the procedure level is the lowest level you can get.
1015140	1018100	So it's very good to use frameworks like these.
1019720	1022300	In this case, we're going to talk about ransomware.
1022300	1026940	And there is a particular tactic that covers ransomware,
1026940	1031880	and that's called the impact tactic. It's TA0040.
1031920	1036860	According to MITRE, that impact is the adversaries trying to manipulate,
1036860	1039380	interpret, or destroy your system and data.
1039380	1043620	So really, it's trying to disrupt availability or compromise integrity
1044340	1047140	by destroying and tampering your data.
1047140	1052380	So generally, this is used to achieve that end goal.
1052380	1056740	And over here on the right, you have an example of just some of the techniques and sub-techniques.
1056740	1058940	So data manipulation would be the technique.
1058940	1061020	And then you have stored data manipulation,
1061020	1064960	transmitted data manipulation, and runtime data manipulation as sub-techniques.
1064960	1068440	You can then click on those and see procedures for different ones.
1068440	1071120	But this is really one of the main objectives,
1071120	1076120	is to impact the system to then, in ransomware, request money
1076800	1080420	for that particular access back to your systems.
1081420	1084340	So let's talk about ransomware.
1084560	1090860	Generally, what we see is threat actors trying to go out and get initial access
1090860	1095040	to a target system or network, and then encrypt files.
1095040	1097760	And if you want those files back, you have to pay a ransom.
1097760	1104640	So a lot of this is very opportunist, in that it's a drive-by type of compromise.
1104640	1108760	Anyone in your organization visits a webpage, whether they clicked on it,
1108760	1114820	or they got there through links or whatnot, and that tries to compromise their system.
1114820	1120220	From there, the malware will try to run and encrypt files.
1120220	1123420	Now, we're seeing three different methods of encrypting files.
1123420	1128300	One is reading the file and create an encrypted version of that file,
1128300	1131740	replacing the original file with the encrypted one.
1131740	1135480	The other one uses raw disk access for encryption.
1136120	1140800	And then the third one is open the file and then encrypt the contents of the file,
1140800	1143000	and then save the file itself.
1143000	1145260	So different ways of doing this.
1145260	1148960	Sometimes we see organizations stealing those files.
1148960	1150480	Not all of them steal it.
1150480	1155000	You get on the target system, you encrypt the files, you steal them,
1155000	1157260	and then you post the ransom note.
1157580	1159140	So some of those do that.
1159140	1162620	And then, of course, they download some sort of ransom note saying,
1162620	1167560	now you need to pay if you want access to your files.
1167560	1173700	And of course, the main actor's goal and objective here is to get paid,
1173700	1177300	get money, generally in some sort of cryptocurrency.
1178140	1180640	So let's talk about Garmin.
1180640	1186560	On July 22nd, a lot of folks started posting that they could not connect to Garmin.
1186560	1189400	Garmin is a company that specializes in GPS.
1189940	1195860	They also have fitness trackers and a number of other services, as you can see on the screen.
1195960	1201660	And all that Garmin was saying is that they're currently experiencing an outage.
1201660	1204940	Now, this outage lasted a number of days.
1204940	1208400	Rumors started going around that this was ransomware.
1208720	1210380	And now, by the time you're watching this,
1210380	1214220	we obviously have quite a bit of information about this that we're going to go over.
1214220	1218300	But you can see here on the right, a lot of services were down.
1218300	1221840	One that was quite interesting is FlyGarmin.
1221840	1226800	So a number of planes actually use Garmin devices for their tracking and their GPS,
1226800	1231680	and those planes would not be able to fly because they didn't have tracking.
1231680	1236000	You can see here, it definitely impacted a lot of people.
1236000	1237660	It was a global outage.
1237660	1242760	So given the timeliness of this, this is the malicious organization
1243260	1245120	that we are going to learn from.
1245120	1251700	We have learned now that the malicious actor is in a threat group called EvilCorp.
1251700	1258880	And in this particular case, they used a ransomware malware known as WastedLocker.
1258880	1261660	So let's learn a little bit about this.
1261680	1265880	So EvilCorp, and in this particular attack,
1265880	1271540	would first get initial access through drive-by sites.
1271540	1275300	That means they compromised a legitimate website first,
1275300	1279660	and whenever anyone visited this particular website,
1279660	1282120	they would download SockGalish.
1282280	1286920	And that would trigger a number of different actions.
1286920	1290160	So in this case, and we're thinking from a red team perspective,
1290160	1294500	we won't be able to emulate this particular TTP
1294500	1298840	because we're not going to have permission to compromise a third party.
1298840	1302120	So in this case, we will have to simulate what happens
1302120	1307200	and get that initial access through some other method.
1307380	1312440	And then once SockGalish ran, it is a zip file with malicious JavaScript
1312440	1315880	that was masquerading as a browser update.
1315880	1318520	That's another TTP in MITRE ATT&CK.
1318520	1322840	Then a second JavaScript file would profile the computer
1322840	1325860	to see where it was, gain some situational awareness,
1325860	1329280	and then it used PowerShell to download additional
1329280	1332820	discovery-related PowerShell scripts like PowerView,
1332820	1334820	which we've heard quite a bit about.
1334820	1337980	It's a free script that you can get straight from GitHub.
1338480	1342900	Then once the attacker had access to execute PowerShell,
1342900	1348100	they gained network access and would drop a Cobalt strike malware.
1348100	1350900	Cobalt strike is a command and control framework,
1350900	1353340	which we'll cover here or we'll actually demo it
1353340	1355700	because we're going to emulate all of this.
1355700	1359320	And unfortunately, Cobalt strike has been used by malicious threat actors before
1359320	1362320	because an early version of it was leaked.
1362340	1365580	With a Cobalt strike command and control established,
1365580	1371000	then they lived off the land to do some things like steal credentials,
1371000	1373940	escalate privileges, and move laterally.
1373940	1377660	So there's a more sophisticated threat actor that doesn't just get on one system
1377660	1379360	and drops the ransomware.
1379360	1386640	It was moving laterally up until the point where it would deploy the WastedLocker ransomware.
1386640	1391560	So EvilCorp is the adversary and the WastedLocker is the ransomware
1391560	1395440	that would actually encrypt the files and request the ransom.
1396040	1400300	So PowerShell was used to download and execute a loader from a domain
1400300	1405740	that was publicly reported to be delivering Cobalt strike as part of these attacks.
1405740	1408260	And then injected a payload.
1408380	1412700	In this case, Cobalt strike uses its payload, it's called a beacon,
1412700	1415020	and that is used to execute commands.
1415020	1418980	It injects into other processes, it elevates the privilege,
1418980	1421860	and then it could upload and download other files,
1421860	1426280	in which case it would do that for this particular malware.
1426700	1430920	The privilege escalation, this particular attack against Garmin
1430920	1434700	seemed to be with the software licensing user interface tool,
1434700	1438420	which is a command line tool that comes with the operating system.
1438420	1442960	We call these living off the land because it's a tool that's already there.
1442960	1445820	They would use that to escalate privileges.
1446480	1449820	Then we've learned as well from the cyber threat intelligence
1449820	1452180	that the attackers would use WMI,
1452180	1455980	which is Windows Management Instrumentation Command Line Utility.
1455980	1458080	This is also a living off the land tool.
1458080	1462200	It comes with all versions of Windows to execute commands on remote computers,
1462200	1466940	such as adding new users or executing additional PowerShell.
1467340	1470400	Then the attackers launched a legitimate command line tool
1470400	1473820	for managing Windows Defender to disable Defender
1473820	1476120	and the scanning of new files
1476120	1479520	in the event that this malware they were using would get caught,
1479520	1481860	they would disable this part.
1481860	1483980	That's another MITRE ATT&CK TTP.
1484720	1488840	And then lastly, they would use PSXSEC to move laterally
1488840	1492760	and deploy the WastedLocker ransomware,
1492760	1497740	which begins the encryption process and would also delete the shadow volume.
1497740	1504080	So all of this is cyber threat intel that we have pulled together for emulation.
1504560	1506940	This is what WastedLocker look like.
1506940	1511960	It is interesting because it creates a file.
1512000	1516860	The encrypted file is called the particular file name
1516860	1521740	and then the extension had the organization name and wasted at the end.
1521740	1526820	And then it would get a ransomware note that was a text file
1526820	1530660	and then it would be called wasted underscore info.
1530660	1532760	And here you could see this particular message.
1532760	1537300	So all of this is important for us as we plan what we're going to do.
1537500	1543760	Now, none of the cyber threat intelligence I read had MITRE ATT&CK mapping,
1543760	1549720	neither for EvoCorp as a threat actor or a group or WastedLocker as a ransomware.
1549720	1554460	So I had to manually extract these TTPs from the cyber threat intelligence
1555160	1559300	and then create a MITRE ATT&CK navigation layer.
1559300	1560100	So I've done that.
1560100	1563840	And here you can see a screenshot on the right of the impact portion.
1563840	1566620	This is what the WastedLocker ransomware does.
1566620	1572500	And there you can see that the JSON layer is available for you to take a look.
1572500	1574980	So let's take a look at that one right now.
1574980	1578960	Here is the MITRE ATT&CK layer that I created.
1579000	1584400	A nice feature of ATT&CK Navigator is that you can give it a JSON file.
1584400	1590400	So you see up here, this is hosted on GitHub and we give it the URL.
1590400	1595700	This URL here is the site GitHub where I post community threats.
1595700	1599040	And in this case, it has this layer, which it renders it here.
1599040	1602760	So we can see the initial access was drive-by compromise.
1602760	1606320	We can see execution through PowerShell and JavaScript.
1606320	1609920	We can see user execution through a malicious file,
1609920	1612640	service execution, as well as WMI.
1612640	1616380	We can see some privilege escalation, defensivation.
1616380	1619180	And then we have to scroll over to the right,
1619180	1622520	thanks to all the sub techniques, to see other things such as discovery
1622520	1627200	of local accounts and domain accounts, system owner and user discovery,
1627200	1634580	lateral movements, command and control through HTTPS using asymmetric crypto
1634580	1637540	and a web protocol over HTTPS.
1637540	1640280	And then over on the right, we see the data destruction,
1640280	1645860	data encryption, store data manipulation, and stopping that service.
1645880	1649600	So I went through all that cyber threat intelligence and I pulled this out,
1649600	1655720	which allows me to create a much better plan for what we are going to try to do
1655720	1662860	here in this red team exercise that emulates EvilCorp and the WastedLocker malware.
1663240	1667140	So planning is very important, right? We started with cyber threat intelligence,
1667140	1670200	we learned about the Garmin hack, we learned about EvilCorp,
1670200	1676000	we learned about the WastedLocker malware, and we mapped that automator attack.
1676000	1680120	Now let's talk about planning. What are the goals and objectives here?
1680120	1684480	In this case, we want to determine if an attack like Garmin
1684480	1689220	would work in our target environment. We also want to decide,
1689220	1693200	are we going to do this as a red team exercise or a purple team exercise?
1693240	1698220	Given we are in the red team village, we'll do it as a red team exercise.
1698220	1701600	I'm going to emulate all the steps and then later on,
1701600	1705120	we'll see what the blue team was able to catch or prevent.
1705880	1710140	It's very important to have an exercise coordinator and a project manager.
1710140	1714860	That way, even though it is a zero-knowledge engagement,
1714860	1724040	they communicate what is happening to the target organization, to the blue team trusted agents.
1724040	1728420	Those are folks within the organization that know the exercise is happening,
1728420	1732520	but are not going to tell the players that this is happening.
1732520	1737420	Because if they know that this is an exercise, their behavior will change,
1737420	1743480	which means your measurement of that particular testing will also change.
1743760	1749000	Next, we want to do assume breach or a full end-to-end exercise.
1749000	1754740	In this case, we know through cyber threat intelligence that the initial access was
1754740	1758760	through a compromised third-party site. So that's not something you're going to
1758760	1763940	be allowed to emulate. So let's go with an assume breach.
1763940	1768960	Assume breach is a more efficient way of doing this, especially for mature organizations
1768960	1774320	that know they're going to get breached. At any given time, there will most likely be some
1774320	1778840	exploits, some vulnerability, or someone inside the target organization is going to click on
1778840	1783840	something. So for this instance, we're going to go with the assume breach because we want to
1783840	1790920	really get to a ransomware part. We want to focus on that and not focus on the initial access.
1790920	1796600	As usual, there's going to be rules of engagement. So don't encrypt or actually
1796600	1803260	ransom any business data, right? Create new files, encrypt those, and or exfiltrate them
1803260	1808300	based on this threat actor. In this particular case, it didn't look like Evil Corp actually
1808300	1814060	exfiltrated the data. So we're going to create a plan that does exactly that, that creates new
1814060	1820400	files, a lot of new files, encrypts them, downloads a ransom note, and then that way we've emulated
1820400	1827780	in a safe manner so that the target organization, one, approves this exercise, and two, we will be
1827780	1833280	able to answer the question, can this happen to us without introducing risk? And then lastly,
1833280	1841940	we have to talk about attack infrastructure. So for attack infrastructure, the red team needs
1841940	1847060	to determine what tool they're going to use. Well, this actually was pretty easy because
1847060	1853780	the Cyber Threat Intelligence told us that they use Cobalt Strike. So what we can do is use the
1853780	1859620	C2 matrix, and it's a Google sheet of a number of different C2s, and it shares all the different
1859620	1864780	capabilities that each of these have. So if we hadn't heard about Cobalt Strike, we can take a
1864780	1871720	look at that particular one and learn about it here. You can find the ideal C2. Now for the
1871720	1875800	malware creation part, we might have to use a different tool to create something
1875800	1882660	that does the same thing that WastedLocker does, because Cobalt Strike doesn't have those
1882660	1890720	particular features. The C2 matrix also has a Slingshot virtual machine, which allows you to
1890720	1897560	get started and test eight of these C2s without having to install them. You just
1897560	1903480	download the virtual machine and you can use them. And there's also a how-to site where you can learn
1903480	1907160	how to use all of these. So I'll show that shortly.
1907680	1914020	In this case, we know we need to use Cobalt Strike. So Cobalt Strike is a commercial command
1914020	1919680	and control framework. It's available on cobaltstrike.com. And unfortunately, it was
1919680	1926520	leaked. And that means that malicious actors have their hands on it. And it has a MITRE attack page
1926520	1932440	as well. It's software 0154. And within there, you can see a number of different malicious actors
1932440	1940540	that have used this. This here comes from MITRE ATT&CK, which they haven't added EvilCorp as a
1940540	1946320	group, nor have they correlated EvilCorp as having used Cobalt Strike either. But I'll work with the
1946320	1950600	MITRE team to get that added. And then on the right, there's a screenshot straight from Cobalt
1950600	1956680	Strike's website as to all the various different features that this particular product has.
1956680	1961580	So that is our initial access and getting to the point where we can deploy our malware.
1961580	1967360	Now, for deploying our malware, we're going to use Scythe. And that's because Scythe specializes
1967360	1976640	in creating custom controlled synthetic malware that will run in a production environment without
1976640	1983880	introducing risk. It's also a tool that allows you to emulate known threat actors and automate
1984240	1990240	a lot of those TTPs. Now, obviously, I work at Scythe and I have the cool hoodie, as you can see.
1990940	1996540	We went with that one to show you how cool and how easy it is to create this particular malware.
1996560	2001920	Also, I couldn't figure out how to create something like ransomware so easily with any of the other
2001920	2007560	C2s. But if you have any C2s that you think do this, definitely let me know.
2008000	2013360	So Scythe is also a command and control framework. It's a pretty easy installer. It installs on
2013360	2018540	Windows. It allows multiple channels for command and control. In this case, we know we have to use
2018540	2025160	HTTPS, which it has. And then it builds automation. So not only do we want to drop
2025160	2030580	this synthetic malware that does what WastedLocker does, we want to automate that, right? It's going
2030580	2035120	to create files. It's going to encrypt files. It's going to download a ransom note. All of that
2035120	2041940	needs to be done all in one. So it really allows us to do that. And it has a variety of integrations
2041940	2047560	with a number of different tools like Vector for tracking red and purple team, Exercises,
2047560	2052900	PlexTrack if you use that in your corporation, and integration for purple teams with Splunk and
2052900	2060580	really any SIEM. So it's really a great tool for doing this particular ransomware malware that we
2060580	2066320	want to do. Is it even possible to emulate ransomware? Well, I've hinted at all of this
2066320	2072460	as we get up to this slide. And the answer is, of course it is. The secret is to not encrypt or
2072460	2078240	destroy real production data, right? You have that already in your plan and it will get approved
2078240	2085440	because you're not impacting the target systems. You're not impacting production. So instead of
2086380	2092820	encrypting real files, what we're going to do is first create new files and then encrypt them,
2092820	2098340	exfiltrate them if this particular threat actor did, which Evil Corp did not, and then download
2098640	2105100	a ransom note. So this method will ensure that no data is ever at risk of being encrypted or
2105100	2110780	destroyed or leaked out. And over on the right, you can see the steps here. This is the malware
2110780	2115860	that I've created with Scythe. It's going to load a number of different things into memory,
2115860	2120460	which WastedLocker also did, was it loaded everything into memory so that it wouldn't get
2120460	2126400	caught. Then we're going to create a directory on our desktop called Evil Corp. Within there,
2126400	2132480	we're going to create 55 meg files. So we have a lot of volume there. And then we're going to
2132480	2139120	encrypt that. And the password we chose in this case is Evil Corp in LeetSpeak. And then we're
2139120	2144980	going to download a ransom note from a pastebin that I created that's very similar to the ransom
2144980	2152900	note from WastedLocker. And we're going to put that in the desktop so that it shows. And then,
2152900	2159440	of course, we're going to shut down and clean up after ourselves. So let's take a look. We're going
2159440	2168540	to start with our SANS Slingshot C2 Matrix Edition virtual machine. It is running on a separate
2168540	2175300	network with a Windows 10 victim system. Again, we're going to focus on the actual ransomware
2175300	2182040	payload and not so much on the initial access and lateral movement. But because it did use
2182040	2187300	Cobalt Strike, let's go ahead and start with that. In this case, I have Cobalt Strike installed
2187300	2192700	in slash op slash Cobalt Strike. I'm going to start a team server. You have to start that with
2192700	2202000	sudo. And I'm just going to put a basic password in there. My IP is 192.168.1.166. So we'll start
2202000	2209480	that up. And then on another window, I will start the Cobalt Strike client. You don't need sudo for
2209480	2219980	that. And here we will connect. So this is Cobalt Strike. The first thing we're going to do, like in
2219980	2235640	any other command control framework, is set up a listener. I'm going to click add. And we're going
2235640	2241640	to use port 8080 just because we have something else running. We have Apache running on port 80.
2244060	2247360	Now that we have the listener, we are going to create an attack.
2247360	2253660	As the threat intel told us, they use PowerShell for that. So we'll do exactly that.
2270230	2275350	So what we're going to do is move over that payload to the system where we will execute it
2275350	2297900	from. And we copy and paste that into a standard command prompt. And here we see it has checked in.
2299120	2303720	Now that we have access on this target system, we can do the things that
2303720	2310460	Evil Corp did, which was escalate privileges and move laterally, etc. In this case, we want to
2310460	2317760	focus more on impact, which is on the ransomware. So let's go over and create the WastedLocker
2317760	2324060	synthetic malware. So I'm over here in Cypher. I'm going to Threat Catalog. And I've already
2324060	2331640	imported the WastedLocker campaign. So here we see that it will do everything that we discussed,
2331640	2337540	which was load, run, file, correct downloader. It will create a directory in Evil Corp,
2337540	2345960	an Evil Corp directory on the desktop. It will create five files all with that wasted extension.
2345960	2351040	Then it will encrypt them. Then it will download a message. And then it'll shut down.
2359780	2365620	Now we will download that 32-bit executable onto our Linux system,
2365620	2369520	so that we then use Cobalt Strike to upload it and execute it.
2378940	2384520	Now we will upload the file into this cusers.george directory.
2391300	2403170	And now we will execute it. You should see that execution now here.
2405530	2410510	And there's the check-in. It's going to go through and load all these modules.
2410510	2419130	If we observe the directory here on the victim system, we will see it create the folder Evil
2419130	2428110	Corp, create the files, encrypt those files, and then download a ransom note from PasteBit.
2429930	2439150	There's the Evil Corp folder. It will now create all these files and then encrypt them,
2439150	2453010	and then download the ransom note. And here we see the ransom note was downloaded.
2454330	2459950	And there is the ransom note, very similar to what was used in Garmin.
2459950	2466690	So as you can see, we use Cobalt Strike to get that initial access with a PowerShell script,
2466690	2472970	and then use Cobalt Strike to dump this executable, which is synthetic malware
2472970	2482530	created with Scythe, to emulate a ransomware attack inside a professional enterprise network
2482530	2489430	without introducing any risk. How do we defend against ransomware? Well, before,
2489430	2494670	we just had to worry about that initial access on preventive controls, because ransomware
2494670	2500130	would find its way into any system and then encrypt it, even with user-level privileges.
2500130	2505670	But now we're seeing these more sophisticated attacks, like Evil Corp on Garmin, where
2505670	2511390	it's getting access, the threat actor gets access to a system, does privilege escalation,
2511390	2518230	moves laterally, does defensivation, executes a number of different ways, and then drops their
2518230	2524030	encryption. So there's a number of different ways to defend against this, very similar to your other
2524670	2530170	adversary emulations that didn't have the ransomware type impact. We're now seeing those
2530170	2537450	there. So there's a number of different ways to defend against this. I did an excellent interview
2537450	2545370	with Olaf from FalconForce on using things like Sysmon. Because we are calling all those encryption
2546270	2551150	APIs, you should be able to detect that, especially if a whole bunch of systems do it.
2551150	2556750	Now, US CERT just recently released these tips, and there's a number of other resources here.
2557130	2563310	I do want to point out another organization that was recently breached called CWT. They are
2563310	2571810	an enterprise, a corporate travel organization, and their chats with the malicious actor were
2571810	2578810	leaked. In this case, they actually paid four million dollars to get access to their files,
2578810	2582970	and the chat was leaked. The link is there for the entire thread if you want to read it,
2582970	2589930	but here you can see quite a bit of advice that was given to the target organization after the
2589930	2597430	malicious work was done and they got paid. They gave them some advice as to what to do,
2597430	2603270	which is very similar advice to a lot of the things that we find in our adversary emulations.
2604050	2611410	So obviously there's a lot more ransomware than just WastedLocker. These are just a few with
2611410	2617030	their links to MITRE ATT&CK, as well as an interesting service I saw called Shadow Intelligence,
2617030	2621630	which tells you about a number of different ransomware attacks. So definitely check them out.
2622570	2628930	Now if this interests you, we have a Threat Thursday. So every Thursday we choose an adversary,
2628930	2634590	we introduce the adversary, we consume Cyber Threat Intelligence, map it to MITRE ATT&CK,
2634590	2639810	create that navigator layer just like we did here, then we create an adversary emulation plan,
2639810	2646650	we share that plan in our community GitHub, we emulate the adversary and show it on a video,
2646650	2651850	and we talk about how to defend against this. So this is all free for the community. A lot of it is
2651850	2656790	with Scythe, but a lot of the living off the land you'll be able to do without using Scythe.
2659210	2663910	Another thing I wanted to mention is to save the date. I know you all like free conferences,
2663910	2670190	so we are hosting a free conference called UNICON, our very own unicorn conference. Yes,
2670190	2675710	I work at Scythe, where we have unicorns. And that is going to be on August 20th. We're doing
2675710	2684290	some very cool stuff and creating an ecosystem for the community. So we have an SDK that allows
2684290	2692450	you to create your own adversary TTPs. Think of it of creating a bug bounty, but for TTPs,
2692450	2698570	for Adversary Behaviors. You can create these modules and put them up in this marketplace,
2698570	2704570	where you can share them for free or sell them and make some money off of them. So all of that
2704570	2710270	is possible through our marketplace, and we will be releasing that at UNICON. The way it works is
2710270	2717810	that you use the SDK, which is completely free. You create a TTP, you add it into the marketplace,
2717810	2723670	and then any Scythe user will be able to grab it or pay you for it, and then run these adversary
2723670	2730550	emulations in their environment and hopefully detect the different behaviors that you've created.
2730550	2736050	If not, they'll be able to test and hopefully improve it. So it's an ecosystem of sharing
2736050	2742230	offensive techniques so that organizations can better defend themselves.
2743250	2748470	I went through a number of different references, so here is the slide. Obviously, I didn't do all
2748470	2753170	of this on my own. Big shout out to the folks that did the Cyber Threat Intelligence for Eagle Bull
2753170	2759070	Corp and Wasted Locker. I did the MITRE Attack Mapping, and as I mentioned, all of that is shared
2759070	2766190	for you, and hopefully you found all of this useful. So with that, thank you very much for
2766190	2770970	your time. I really appreciate it. Hopefully you learned something here today, and I'll see you