WEBVTT 00:00.000 --> 00:03.200 And welcome to DEF CON Red Team Village. 00:03.200 --> 00:11.900 My name is Giorgio Chies, and this talk is titled Deep Dive into Adversary Emulation, Ransomware Edition. 00:11.900 --> 00:20.460 And what we're going to look at is an attack that we saw in July, 2020, against the Garmin organization. 00:20.460 --> 00:24.240 It brought all their services down, asking to pay a ransom. 00:24.240 --> 00:33.440 The particular adversary that was attributed to this attack is EvoCorp, and they used a ransomware called WastedLocker. 00:33.440 --> 00:49.500 So we're going to talk about how we can emulate a ransomware attack against an organization in a professional manner, so that we can test our detective and preventive controls and answer the question that most CISOs want to know. 00:49.500 --> 00:51.840 Can this happen to us? 00:51.840 --> 00:56.160 I hope you enjoy, and I'm available to answer any questions. 00:56.500 --> 00:59.300 As mentioned, my name is Giorgio Chies. 00:59.300 --> 01:02.620 I'm the Chief Technology Officer at SITE. 01:02.620 --> 01:11.780 I'm also the author of the Purple Team Exercise Framework that we recently released and made available to everyone for free on our website. 01:11.780 --> 01:25.320 I co-created the C2 matrix with Bryson Bort and Adam Mash, and it is a framework of various different command and control frameworks with their capabilities and their features. 01:25.320 --> 01:28.300 We'll cover that a little bit in this deck. 01:28.720 --> 01:34.880 Before joining SITE, I worked at Citigroup for 10 years running the offensive security team. 01:34.880 --> 01:43.220 I started as a vulnerability assessment analyst, then introduced penetration testing, and eventually created the Red Team about five years ago. 01:43.220 --> 02:01.400 We then created a Purple Team function and began doing adversary emulations across the globe and working with various regulators, which led to the creation of a global framework with the Global Financial Markets Association titled Threat-Led Penetration Testing. 02:01.460 --> 02:03.800 So we'll cover a lot of that here as well. 02:03.800 --> 02:05.400 That's also a free framework. 02:05.400 --> 02:06.620 I teach for SANS. 02:06.620 --> 02:13.060 I've taught for SANS for the past 10 years, mostly the pen test curriculum and also some of the cloud courses. 02:13.060 --> 02:18.840 But if you've ever taken or have the GCIH or the GPEN, shout out to you. 02:18.840 --> 02:24.460 I also have a two-day Red Team exercise and adversary emulation course. 02:24.460 --> 02:32.720 While at Citi, I was part of the CVSS working group and I was a voting member where we released version 3 and 3.1. 02:32.840 --> 02:44.420 Version 4 is in the works and I'm also working on another working group now as I'm no longer a voting member of CVSS on what's called the Exploit Predictability Scoring System. 02:44.420 --> 02:52.780 We're trying to identify what vulnerabilities will be exploited versus ones that will not, even if they have similar CVSS scores. 02:52.780 --> 02:54.740 It's a very interesting project. 02:54.740 --> 02:59.780 And if you'd like to join, it is a working group as part of FIRST as well. 02:59.940 --> 03:03.440 I really believe in ISSA and giving back to the community. 03:03.440 --> 03:06.380 ISSA is the Information Systems Security Association. 03:06.380 --> 03:08.940 They might have a chapter in your location. 03:08.940 --> 03:09.920 Definitely go out. 03:09.920 --> 03:13.900 I actually found two of my jobs before working at Citi. 03:13.900 --> 03:21.420 I worked at Terramark in a security operations center, found that job through there as well as my job at Citi. 03:21.420 --> 03:25.020 So definitely network and give back to the community. 03:25.020 --> 03:29.000 Long, long ago, I wrote a book on Windows 7. 03:29.000 --> 03:30.920 So I am a published author. 03:31.200 --> 03:33.940 Hopefully no one's using that operating system. 03:34.220 --> 03:36.640 So here's our agenda for today. 03:36.640 --> 03:50.180 We're going to cover some definitions because as any red team talk, we have to argue about definitions and really want to use the same language in the industry and hopefully help the industry use the same language. 03:50.180 --> 03:54.440 So we're going to cover things like red teaming, purple teaming, and adversary emulation. 03:54.440 --> 03:56.960 Then we're going to talk about ransomware. 03:57.040 --> 04:00.100 And ransomware is something that we've all heard about. 04:00.100 --> 04:19.420 And while many of us find this annoying and not sophisticated, we're actually seeing an uptick in the sophistication level where it isn't just about gaining initial access and impacting the target systems, but it also involves moving laterally and exfiltrating information prior to requesting a ransom. 04:19.740 --> 04:26.600 So we're going to cover our usual steps when we talk about adversary emulation, starting with cyber threat intelligence. 04:26.600 --> 04:28.820 We want to learn about various attacks. 04:28.820 --> 04:37.060 In this case, we're going to talk about Garmin and Evil Corp using a piece of malware called Wasted Locker. 04:37.060 --> 04:40.060 It's the attack that affected Garmin in July 2020. 04:40.060 --> 04:41.820 We're going to understand that attack. 04:41.820 --> 04:45.000 We're going to create an adversary emulation plan around it. 04:45.000 --> 04:46.560 Then we're going to perform it. 04:46.560 --> 04:48.040 So it should be a lot of fun. 04:48.040 --> 04:51.380 Then, of course, we're going to talk about defending against ransomware. 04:51.380 --> 04:54.500 Now, the first thing I want to cover is definitions. 04:54.500 --> 05:04.960 And we published this ethical hacking maturity model to kind of show a blueprint of how many organizations are maturing in their offensive security. 05:04.960 --> 05:08.440 Now, this doesn't mean that every organization is the same. 05:08.440 --> 05:20.480 This is really based on my experiences and on experiences of organizations I've talked to, whether they're SANS students or other people in the industry that have asked about this particular subject. 05:20.520 --> 05:25.280 So most organizations start over on the left side with vulnerability scanning. 05:25.280 --> 05:34.640 Here's where you run a scan against an IP or a web app, and you get back a list of vulnerabilities based on signatures. 05:34.640 --> 05:49.860 Vulnerability assessment is when you look at the output of that vulnerability scan and you give it a real risk rating, where you actually calculate if the risk is there, you verify the vulnerability, and you prioritize what needs to get fixed. 05:50.360 --> 05:55.120 Penetration testing then involves the exploitation of vulnerabilities. 05:55.120 --> 06:08.260 And this can involve finding vulnerabilities that the vendor didn't know about, where we call those ODAs, or it could also mean gaining access to a target system and learning and really calculating that business risk. 06:08.320 --> 06:12.240 Unfortunately, in the industry, pen testing got very scoped down. 06:12.240 --> 06:15.300 We weren't allowed to move laterally to other hosts. 06:15.300 --> 06:19.020 We weren't allowed to do social engineering and things like that. 06:19.020 --> 06:21.300 And that's where the red team came in. 06:21.320 --> 06:24.820 The red team started testing people, process, and technology. 06:25.260 --> 06:29.980 Purple teaming is where we work together, the red team with the blue team. 06:29.980 --> 06:37.680 And adversary emulation is a cyber threat intelligence-led assessment, generally carried out by the red team. 06:37.680 --> 06:44.400 And it can be a full knowledge or zero knowledge assessment, in which case it would be a purple team or a red team engagement. 06:44.400 --> 06:51.780 Now, as I mentioned, these don't necessarily mean that it's the steps you must take to get to where you want to go. 06:51.780 --> 06:58.680 This is just an example that you can use with your senior management to explain to them how your organization has matured. 06:58.680 --> 07:04.100 There is an arrow there at the end, which means that I'm sure this will continue to evolve. 07:04.160 --> 07:06.060 Every organization is different. 07:06.340 --> 07:08.700 And of course, don't stop doing the previous step. 07:08.700 --> 07:14.780 Just because you're doing red team and purple team engagements doesn't mean you're not doing vulnerability scanning anymore. 07:14.780 --> 07:18.060 There's an entire article on this if you'd like to read more about it. 07:18.080 --> 07:21.380 The reason we're here is to talk about adversary emulation. 07:21.380 --> 07:25.040 And that can be defined as a type of red team exercise. 07:25.040 --> 07:27.500 There's many different types of red team engagements. 07:27.500 --> 07:29.460 This is one of those types. 07:29.460 --> 07:37.100 And in this type, we are going to emulate adversary tactics, techniques, and procedures or adversary behavior. 07:37.100 --> 07:41.520 We understand those behaviors by leveraging cyber threat intelligence. 07:41.520 --> 07:49.900 And just like the malicious actors, we're going to have an objective, which would be very similar to objective of that actor. 07:49.940 --> 07:57.900 So in this case, we are putting TTPs together in an attack chain for testing of these various scenarios. 07:57.900 --> 08:05.100 And it's really going to answer the question if the target organization is ready for a real sophisticated attack. 08:05.100 --> 08:07.680 Most of the time, the effort here is manual. 08:07.680 --> 08:08.800 There are a number of tools. 08:08.800 --> 08:12.720 There's some automation that you can build around doing TTPs. 08:12.720 --> 08:14.560 My company site does some of this. 08:14.560 --> 08:16.520 So we'll cover that a little later. 08:16.800 --> 08:21.820 But it's mostly manual because you can't really automate an entire red team, right? 08:21.820 --> 08:24.920 You actually need people, which is very important. 08:25.040 --> 08:29.100 So as I mentioned, adversary manipulation is a type of red team exercise. 08:29.100 --> 08:30.700 There's different types. 08:30.700 --> 08:40.120 And a red team can be defined as the practice of looking at a problem or situation from the perspective of an adversary, which means that you can do a lot with that. 08:40.120 --> 08:41.560 It could be physical pen testing. 08:41.560 --> 08:49.980 It could be doing phishing simulations for awareness training, or it could be testing one or creating a new TTP. 08:49.980 --> 08:57.040 In this case, we're going to talk about adversary manipulation, but we want to differentiate the whole red team from pen testing. 08:57.040 --> 09:06.100 For example, in a pen test, you're generally finding and attacking preventive controls, the lack of patching, or maybe you found a vulnerability that the vendor doesn't know about. 09:06.100 --> 09:08.700 In red teaming, our goals are different. 09:08.700 --> 09:18.720 Our goals are to make the blue team better, to train, to test and measure people, process, and technology, and to test assumptions. 09:18.720 --> 09:21.520 The effort here, as I mentioned, is pretty manual. 09:21.520 --> 09:25.580 There's a lot of tools, so we'll cover some of those in the C2 matrix and this talk. 09:25.580 --> 09:28.820 And the frequency is really based on intelligence. 09:28.820 --> 09:39.620 I'm sure many of you this week heard about Black Hat and DEF CON and saw some new techniques, so we might want to be testing those out as soon as we're back at the office. 09:39.640 --> 09:41.760 The frequency really depends. 09:41.760 --> 09:47.600 We are seeing red team engagements being required by various regulators, and the customer here is the blue team. 09:47.600 --> 09:50.560 We want to work with the blue team. 09:50.960 --> 09:55.080 Now, there is a difference between internal and external teams. 09:55.080 --> 10:07.700 Internal red teams will do an engagement, and then they might have to repeat that engagement multiple times to ensure that the operations teams and the blue teams are trained and have the right detections in place. 10:07.960 --> 10:10.420 That means that they have to do a lot of retesting. 10:10.420 --> 10:12.040 They might not like that. 10:12.040 --> 10:13.520 They're also privileged. 10:13.520 --> 10:14.820 They're insiders. 10:14.820 --> 10:16.320 They have information. 10:16.320 --> 10:22.400 They've probably done other red team engagements and exercises, so they know what works and what doesn't work. 10:22.400 --> 10:27.420 So really, internal red teams should be seen more as a sparring partner to the blue team. 10:27.420 --> 10:30.060 They should have collaboration and get along. 10:30.120 --> 10:32.260 External teams are a little different. 10:32.260 --> 10:34.340 They offer a different perspective. 10:34.340 --> 10:37.900 Since they're coming from the outside, they don't have that insider knowledge. 10:37.900 --> 10:50.340 They'll be able to emulate an external malicious actor by performing and doing things like reconnaissance and learning more and seeing what's out there to see if they can breach that perimeter or get internal access. 10:50.340 --> 10:55.400 There's other types, though, where external teams could be brought in in an assumed breach perspective. 10:55.400 --> 10:57.380 We'll talk about that a little bit more. 10:57.380 --> 11:00.460 And these are mostly snapshot engagements, right? 11:00.460 --> 11:02.020 They come in once a year. 11:02.020 --> 11:03.420 They do the test. 11:03.420 --> 11:04.640 They leave a report. 11:04.640 --> 11:07.520 Maybe they do a red team reveal or a replay. 11:07.720 --> 11:10.580 And then they don't come back for at least a year. 11:10.580 --> 11:14.920 So it's very snapshot and point in time oriented. 11:14.920 --> 11:19.700 So why don't we move towards a purple team, especially for those internal teams? 11:19.700 --> 11:26.040 Your job is to make the blue team better, to test and measure and improve people, process and technology. 11:26.040 --> 11:30.200 You don't have to do these zero knowledge engagements all the time. 11:30.200 --> 11:35.320 You might only have to do it maybe every three months or every six months or once a year. 11:35.320 --> 11:41.620 The rest of the time, you can spend it in a purple team fashion, working and collaborating with the blue team. 11:41.620 --> 11:46.540 It is an efficient way of doing a lot of these adversary emulations. 11:46.540 --> 11:48.260 So what is a purple team? 11:48.260 --> 12:05.720 A purple team is a virtual or functional team where various teams actually come together and collaborate to improve the defensive security posture in a method that is more efficient than your standard red team engagement that results in a report. 12:05.720 --> 12:11.220 Here, we use cyber threat intelligence to understand a malicious threat actor. 12:11.220 --> 12:20.900 Generally, this team could be internal, in which case it would have a lot of insider information and really understand the target organization, or it can be an external cyber threat intelligence team. 12:20.900 --> 12:29.400 But the point is that they would provide a threat actor that has the capability, the intent and the opportunity to attack that organization. 12:29.820 --> 12:35.560 Then the red team consumes this information and creates an adversary emulation plan. 12:35.720 --> 12:37.700 You then tabletop this. 12:37.700 --> 12:40.880 You have a discussion with all the parties involved. 12:40.880 --> 12:51.380 The blue team can be the security operations center, a managed security service provider, a hunt team, or an incident response team, digital forensics, right? 12:51.380 --> 12:53.260 All of those are part of the blue team. 12:53.260 --> 13:00.860 You have this tabletop and you say, for these particular TTPs, this is our expected defenses. 13:00.860 --> 13:02.640 And then you emulate that. 13:02.640 --> 13:05.040 Red team shows the blue team what they're doing. 13:05.040 --> 13:05.980 They emulate it. 13:05.980 --> 13:07.800 It's a full knowledge engagement. 13:07.860 --> 13:13.160 The blue team will then go and look for indicators of compromise or indicators of this behavior. 13:13.460 --> 13:23.280 And then both teams work together to say, okay, we believe that this is good enough detection, or we can improve this detection by tuning these various tools. 13:23.720 --> 13:27.520 And then you repeat that over and over for various different TTPs. 13:27.520 --> 13:29.600 You can repeat that to train people. 13:29.600 --> 13:32.060 You can ensure that the processes are working. 13:32.060 --> 13:41.960 A handoff between a security operation center analyst to a level two analyst or to an incident response person all works efficiently. 13:41.960 --> 13:44.940 And of course, you're also tuning your technology. 13:46.180 --> 13:48.260 Did you say purple? 13:48.260 --> 13:50.700 And yes, purple is very hot right now. 13:50.700 --> 13:52.520 And it's because of the efficiencies. 13:52.520 --> 13:56.540 Now, anything we do in offensive is to bring business value. 13:56.540 --> 14:06.080 So regardless of what you're calling this, if it's a red team engagement with no knowledge or a purple team engagement, we always want to bring business value. 14:07.620 --> 14:11.780 So as usual, we start with frameworks and methodologies. 14:11.780 --> 14:22.280 And that's very important for us, because if you're going to sell doing an adversary emulation, especially a ransomware one to your organization, you better have a good plan. 14:22.280 --> 14:26.060 And one of the things that does that is a framework and a methodology. 14:26.060 --> 14:31.560 Now, one of the ones that we recently released through Scythe is the purple team exercise framework. 14:31.560 --> 14:40.780 This covers cyber threat intelligence, covers sponsorships, covers getting the people in the process and getting everything ready for that exercise. 14:40.780 --> 14:43.760 And you can see over here on the right, kind of the life cycle there. 14:43.760 --> 14:51.860 We start with cyber threat intelligence, we do preparation, we execute the exercise, and then we have lessons learned. 14:51.860 --> 14:55.560 There's a number of different methodologies that you can use. 14:55.560 --> 15:03.420 One of the original ones was the Cyber Kill Chain by Lockheed Martin, which was seven steps showing senior management kind of how an attack works. 15:03.420 --> 15:04.760 That has matured. 15:04.760 --> 15:09.060 Paul Poles came out with the Unified Cyber Kill Chain, which goes way more in depth. 15:09.060 --> 15:11.240 Really like that one and shout out to Paul. 15:11.400 --> 15:15.280 And then we have financials that have a number of different regulations. 15:15.280 --> 15:24.620 The Bank of England has CBEST, the European Central Bank, the ECB, has Tiber EU, which is threat intelligence based ethical red teaming. 15:24.620 --> 15:32.280 The Monetary Authority of Singapore and the Association of Banks of Singapore have red team adversarial tax simulation exercises. 15:32.320 --> 15:38.180 Hong Kong Monetary Authority has the intelligence-led cyber attack simulation testing. 15:38.180 --> 15:48.800 And then we all came together and I was a co-author with the Global Financial Markets Association to create a framework for the regulatory use of pen testing in the financial services industry. 15:48.800 --> 15:54.160 So there's many frameworks out there that you can use and leverage that are free and open source. 15:54.160 --> 15:58.960 Pick one and use that one, that way you can show that you are a professional. 15:58.960 --> 16:07.080 And then for testing, of course, we're going to use MITRE ATT&CK, which stands for adversaries, tactics, techniques, and common knowledge. 16:07.080 --> 16:19.160 And it really is a common knowledge or common language that allows the cyber threat intelligence team to work with the blue team, the incident response teams, and the red teams all speaking the same language. 16:19.160 --> 16:32.160 So as something occurs in the wild, something like Garmin hack, which we'll cover right now, the forensics team goes in there, understands what happens, and then they give us cyber threat intelligence. 16:32.160 --> 16:40.040 The cyber threat intelligence team will create these reports, which we will then consume, and then we can map all these back to MITRE ATT&CK. 16:40.040 --> 16:42.700 And of course, everyone's seen the MITRE ATT&CK framework. 16:42.700 --> 16:44.720 On the top, we have our tactics. 16:44.720 --> 16:46.760 Those are the adversary goals. 16:46.760 --> 16:52.240 Under those, we have our techniques, which now have sub-techniques, and also procedures. 16:52.240 --> 16:55.140 And the procedure level is the lowest level you can get. 16:55.140 --> 16:58.100 So it's very good to use frameworks like these. 16:59.720 --> 17:02.300 In this case, we're going to talk about ransomware. 17:02.300 --> 17:09.240 And there is a particular tactic that covers ransomware, and that's called the impact tactic. 17:09.240 --> 17:11.880 It's TA0040. 17:11.920 --> 17:19.380 According to MITRE, that impact is the adversaries trying to manipulate, interpret, or destroy your system and data. 17:19.380 --> 17:27.140 So really, it's trying to disrupt availability or compromise integrity by destroying and tampering your data. 17:27.140 --> 17:32.380 So generally, this is used to achieve that end goal. 17:32.380 --> 17:36.740 And over here on the right, you have an example of just some of the techniques and sub-techniques. 17:36.740 --> 17:38.940 So data manipulation would be the technique. 17:38.940 --> 17:44.960 And then you have stored data manipulation, transmitted data manipulation, and runtime data manipulation as sub-techniques. 17:44.960 --> 17:48.440 You can then click on those and see procedures for different ones. 17:48.440 --> 18:00.420 But this is really one of the main objectives, is to impact the system to then, in ransomware, request money for that particular access back to your systems. 18:01.420 --> 18:04.340 So let's talk about ransomware. 18:04.560 --> 18:15.040 Generally, what we see is threat actors trying to go out and get initial access to a target system or network, and then encrypt files. 18:15.040 --> 18:17.760 And if you want those files back, you have to pay a ransom. 18:17.760 --> 18:24.640 So a lot of this is very opportunist, in that it's a drive-by type of compromise. 18:24.640 --> 18:34.820 Anyone in your organization visits a webpage, whether they clicked on it, or they got there through links or whatnot, and that tries to compromise their system. 18:34.820 --> 18:40.220 From there, the malware will try to run and encrypt files. 18:40.220 --> 18:43.420 Now, we're seeing three different methods of encrypting files. 18:43.420 --> 18:51.740 One is reading the file and create an encrypted version of that file, replacing the original file with the encrypted one. 18:51.740 --> 18:55.480 The other one uses raw disk access for encryption. 18:56.120 --> 19:03.000 And then the third one is open the file and then encrypt the contents of the file, and then save the file itself. 19:03.000 --> 19:05.260 So different ways of doing this. 19:05.260 --> 19:08.960 Sometimes we see organizations stealing those files. 19:08.960 --> 19:10.480 Not all of them steal it. 19:10.480 --> 19:17.260 You get on the target system, you encrypt the files, you steal them, and then you post the ransom note. 19:17.580 --> 19:19.140 So some of those do that. 19:19.140 --> 19:27.560 And then, of course, they download some sort of ransom note saying, now you need to pay if you want access to your files. 19:27.560 --> 19:37.300 And of course, the main actor's goal and objective here is to get paid, get money, generally in some sort of cryptocurrency. 19:38.140 --> 19:40.640 So let's talk about Garmin. 19:40.640 --> 19:46.560 On July 22nd, a lot of folks started posting that they could not connect to Garmin. 19:46.560 --> 19:49.400 Garmin is a company that specializes in GPS. 19:49.940 --> 19:55.860 They also have fitness trackers and a number of other services, as you can see on the screen. 19:55.960 --> 20:01.660 And all that Garmin was saying is that they're currently experiencing an outage. 20:01.660 --> 20:04.940 Now, this outage lasted a number of days. 20:04.940 --> 20:08.400 Rumors started going around that this was ransomware. 20:08.720 --> 20:14.220 And now, by the time you're watching this, we obviously have quite a bit of information about this that we're going to go over. 20:14.220 --> 20:18.300 But you can see here on the right, a lot of services were down. 20:18.300 --> 20:21.840 One that was quite interesting is FlyGarmin. 20:21.840 --> 20:31.680 So a number of planes actually use Garmin devices for their tracking and their GPS, and those planes would not be able to fly because they didn't have tracking. 20:31.680 --> 20:36.000 You can see here, it definitely impacted a lot of people. 20:36.000 --> 20:37.660 It was a global outage. 20:37.660 --> 20:45.120 So given the timeliness of this, this is the malicious organization that we are going to learn from. 20:45.120 --> 20:51.700 We have learned now that the malicious actor is in a threat group called EvilCorp. 20:51.700 --> 20:58.880 And in this particular case, they used a ransomware malware known as WastedLocker. 20:58.880 --> 21:01.660 So let's learn a little bit about this. 21:01.680 --> 21:11.540 So EvilCorp, and in this particular attack, would first get initial access through drive-by sites. 21:11.540 --> 21:22.120 That means they compromised a legitimate website first, and whenever anyone visited this particular website, they would download SockGalish. 21:22.280 --> 21:26.920 And that would trigger a number of different actions. 21:26.920 --> 21:38.840 So in this case, and we're thinking from a red team perspective, we won't be able to emulate this particular TTP because we're not going to have permission to compromise a third party. 21:38.840 --> 21:47.200 So in this case, we will have to simulate what happens and get that initial access through some other method. 21:47.380 --> 21:55.880 And then once SockGalish ran, it is a zip file with malicious JavaScript that was masquerading as a browser update. 21:55.880 --> 21:58.520 That's another TTP in MITRE ATT&CK. 21:58.520 --> 22:14.820 Then a second JavaScript file would profile the computer to see where it was, gain some situational awareness, and then it used PowerShell to download additional discovery-related PowerShell scripts like PowerView, which we've heard quite a bit about. 22:14.820 --> 22:17.980 It's a free script that you can get straight from GitHub. 22:18.480 --> 22:28.100 Then once the attacker had access to execute PowerShell, they gained network access and would drop a Cobalt strike malware. 22:28.100 --> 22:35.700 Cobalt strike is a command and control framework, which we'll cover here or we'll actually demo it because we're going to emulate all of this. 22:35.700 --> 22:42.320 And unfortunately, Cobalt strike has been used by malicious threat actors before because an early version of it was leaked. 22:42.340 --> 22:53.940 With a Cobalt strike command and control established, then they lived off the land to do some things like steal credentials, escalate privileges, and move laterally. 22:53.940 --> 22:59.360 So there's a more sophisticated threat actor that doesn't just get on one system and drops the ransomware. 22:59.360 --> 23:06.640 It was moving laterally up until the point where it would deploy the WastedLocker ransomware. 23:06.640 --> 23:15.440 So EvilCorp is the adversary and the WastedLocker is the ransomware that would actually encrypt the files and request the ransom. 23:16.040 --> 23:25.740 So PowerShell was used to download and execute a loader from a domain that was publicly reported to be delivering Cobalt strike as part of these attacks. 23:25.740 --> 23:28.260 And then injected a payload. 23:28.380 --> 23:35.020 In this case, Cobalt strike uses its payload, it's called a beacon, and that is used to execute commands. 23:35.020 --> 23:46.280 It injects into other processes, it elevates the privilege, and then it could upload and download other files, in which case it would do that for this particular malware. 23:46.700 --> 23:58.420 The privilege escalation, this particular attack against Garmin seemed to be with the software licensing user interface tool, which is a command line tool that comes with the operating system. 23:58.420 --> 24:02.960 We call these living off the land because it's a tool that's already there. 24:02.960 --> 24:05.820 They would use that to escalate privileges. 24:06.480 --> 24:15.980 Then we've learned as well from the cyber threat intelligence that the attackers would use WMI, which is Windows Management Instrumentation Command Line Utility. 24:15.980 --> 24:18.080 This is also a living off the land tool. 24:18.080 --> 24:26.940 It comes with all versions of Windows to execute commands on remote computers, such as adding new users or executing additional PowerShell. 24:27.340 --> 24:41.860 Then the attackers launched a legitimate command line tool for managing Windows Defender to disable Defender and the scanning of new files in the event that this malware they were using would get caught, they would disable this part. 24:41.860 --> 24:43.980 That's another MITRE ATT&CK TTP. 24:44.720 --> 24:57.740 And then lastly, they would use PSXSEC to move laterally and deploy the WastedLocker ransomware, which begins the encryption process and would also delete the shadow volume. 24:57.740 --> 25:04.080 So all of this is cyber threat intel that we have pulled together for emulation. 25:04.560 --> 25:06.940 This is what WastedLocker look like. 25:06.940 --> 25:11.960 It is interesting because it creates a file. 25:12.000 --> 25:21.740 The encrypted file is called the particular file name and then the extension had the organization name and wasted at the end. 25:21.740 --> 25:30.660 And then it would get a ransomware note that was a text file and then it would be called wasted underscore info. 25:30.660 --> 25:32.760 And here you could see this particular message. 25:32.760 --> 25:37.300 So all of this is important for us as we plan what we're going to do. 25:37.500 --> 25:49.720 Now, none of the cyber threat intelligence I read had MITRE ATT&CK mapping, neither for EvoCorp as a threat actor or a group or WastedLocker as a ransomware. 25:49.720 --> 25:59.300 So I had to manually extract these TTPs from the cyber threat intelligence and then create a MITRE ATT&CK navigation layer. 25:59.300 --> 26:00.100 So I've done that. 26:00.100 --> 26:03.840 And here you can see a screenshot on the right of the impact portion. 26:03.840 --> 26:06.620 This is what the WastedLocker ransomware does. 26:06.620 --> 26:12.500 And there you can see that the JSON layer is available for you to take a look. 26:12.500 --> 26:14.980 So let's take a look at that one right now. 26:14.980 --> 26:18.960 Here is the MITRE ATT&CK layer that I created. 26:19.000 --> 26:24.400 A nice feature of ATT&CK Navigator is that you can give it a JSON file. 26:24.400 --> 26:30.400 So you see up here, this is hosted on GitHub and we give it the URL. 26:30.400 --> 26:35.700 This URL here is the site GitHub where I post community threats. 26:35.700 --> 26:39.040 And in this case, it has this layer, which it renders it here. 26:39.040 --> 26:42.760 So we can see the initial access was drive-by compromise. 26:42.760 --> 26:46.320 We can see execution through PowerShell and JavaScript. 26:46.320 --> 26:52.640 We can see user execution through a malicious file, service execution, as well as WMI. 26:52.640 --> 26:56.380 We can see some privilege escalation, defensivation. 26:56.380 --> 27:17.540 And then we have to scroll over to the right, thanks to all the sub techniques, to see other things such as discovery of local accounts and domain accounts, system owner and user discovery, lateral movements, command and control through HTTPS using asymmetric crypto and a web protocol over HTTPS. 27:17.540 --> 27:25.860 And then over on the right, we see the data destruction, data encryption, store data manipulation, and stopping that service. 27:25.880 --> 27:42.860 So I went through all that cyber threat intelligence and I pulled this out, which allows me to create a much better plan for what we are going to try to do here in this red team exercise that emulates EvilCorp and the WastedLocker malware. 27:43.240 --> 27:45.200 So planning is very important, right? 27:45.200 --> 27:56.000 We started with cyber threat intelligence, we learned about the Garmin hack, we learned about EvilCorp, we learned about the WastedLocker malware, and we mapped that automator attack. 27:56.000 --> 27:58.180 Now let's talk about planning. 27:58.180 --> 28:00.120 What are the goals and objectives here? 28:00.120 --> 28:07.580 In this case, we want to determine if an attack like Garmin would work in our target environment. 28:07.660 --> 28:13.200 We also want to decide, are we going to do this as a red team exercise or a purple team exercise? 28:13.240 --> 28:18.220 Given we are in the red team village, we'll do it as a red team exercise. 28:18.220 --> 28:25.120 I'm going to emulate all the steps and then later on, we'll see what the blue team was able to catch or prevent. 28:25.880 --> 28:30.140 It's very important to have an exercise coordinator and a project manager. 28:30.140 --> 28:44.040 That way, even though it is a zero-knowledge engagement, they communicate what is happening to the target organization, to the blue team trusted agents. 28:44.040 --> 28:52.520 Those are folks within the organization that know the exercise is happening, but are not going to tell the players that this is happening. 28:52.520 --> 29:03.480 Because if they know that this is an exercise, their behavior will change, which means your measurement of that particular testing will also change. 29:03.760 --> 29:09.000 Next, we want to do assume breach or a full end-to-end exercise. 29:09.000 --> 29:17.360 In this case, we know through cyber threat intelligence that the initial access was through a compromised third-party site. 29:17.360 --> 29:20.340 So that's not something you're going to be allowed to emulate. 29:20.760 --> 29:23.940 So let's go with an assume breach. 29:23.940 --> 29:31.300 Assume breach is a more efficient way of doing this, especially for mature organizations that know they're going to get breached. 29:31.300 --> 29:39.800 At any given time, there will most likely be some exploits, some vulnerability, or someone inside the target organization is going to click on something. 29:39.860 --> 29:45.760 So for this instance, we're going to go with the assume breach because we want to really get to a ransomware part. 29:45.760 --> 29:50.920 We want to focus on that and not focus on the initial access. 29:50.920 --> 29:53.580 As usual, there's going to be rules of engagement. 29:53.580 --> 29:58.440 So don't encrypt or actually ransom any business data, right? 29:58.440 --> 30:04.860 Create new files, encrypt those, and or exfiltrate them based on this threat actor. 30:04.860 --> 30:10.380 In this particular case, it didn't look like Evil Corp actually exfiltrated the data. 30:10.380 --> 30:26.380 So we're going to create a plan that does exactly that, that creates new files, a lot of new files, encrypts them, downloads a ransom note, and then that way we've emulated in a safe manner so that the target organization, one, approves this exercise, 30:26.380 --> 30:32.520 and two, we will be able to answer the question, can this happen to us without introducing risk? 30:32.600 --> 30:35.820 And then lastly, we have to talk about attack infrastructure. 30:38.640 --> 30:44.420 So for attack infrastructure, the red team needs to determine what tool they're going to use. 30:44.420 --> 30:51.180 Well, this actually was pretty easy because the Cyber Threat Intelligence told us that they use Cobalt Strike. 30:51.620 --> 31:01.580 So what we can do is use the C2 matrix, and it's a Google sheet of a number of different C2s, and it shares all the different capabilities that each of these have. 31:01.580 --> 31:07.660 So if we hadn't heard about Cobalt Strike, we can take a look at that particular one and learn about it here. 31:07.860 --> 31:10.140 You can find the ideal C2. 31:10.140 --> 31:24.360 Now for the malware creation part, we might have to use a different tool to create something that does the same thing that WastedLocker does, because Cobalt Strike doesn't have those particular features. 31:24.580 --> 31:37.300 The C2 matrix also has a Slingshot virtual machine, which allows you to get started and test eight of these C2s without having to install them. 31:37.300 --> 31:40.000 You just download the virtual machine and you can use them. 31:40.000 --> 31:44.880 And there's also a how-to site where you can learn how to use all of these. 31:44.880 --> 31:47.160 So I'll show that shortly. 31:47.680 --> 31:51.340 In this case, we know we need to use Cobalt Strike. 31:51.340 --> 31:55.320 So Cobalt Strike is a commercial command and control framework. 31:55.320 --> 31:57.860 It's available on cobaltstrike.com. 31:58.020 --> 32:00.740 And unfortunately, it was leaked. 32:00.740 --> 32:04.420 And that means that malicious actors have their hands on it. 32:04.420 --> 32:07.040 And it has a MITRE attack page as well. 32:07.040 --> 32:09.420 It's software 0154. 32:09.420 --> 32:13.760 And within there, you can see a number of different malicious actors that have used this. 32:13.760 --> 32:25.120 This here comes from MITRE ATT&CK, which they haven't added EvilCorp as a group , nor have they correlated EvilCorp as having used Cobalt Strike either. 32:25.120 --> 32:27.680 But I'll work with the MITRE team to get that added. 32:27.680 --> 32:35.940 And then on the right, there's a screenshot straight from Cobalt Strike's website as to all the various different features that this particular product has. 32:35.980 --> 32:41.580 So that is our initial access and getting to the point where we can deploy our malware. 32:41.580 --> 32:45.080 Now, for deploying our malware, we're going to use Scythe. 32:45.080 --> 32:58.640 And that's because Scythe specializes in creating custom controlled synthetic malware that will run in a production environment without introducing risk. 32:58.640 --> 33:06.140 It's also a tool that allows you to emulate known threat actors and automate a lot of those TTPs. 33:06.140 --> 33:10.240 Now, obviously, I work at Scythe and I have the cool hoodie, as you can see. 33:10.940 --> 33:16.540 We went with that one to show you how cool and how easy it is to create this particular malware. 33:16.560 --> 33:22.860 Also, I couldn't figure out how to create something like ransomware so easily with any of the other C2s. 33:22.860 --> 33:27.560 But if you have any C2s that you think do this, definitely let me know. 33:28.000 --> 33:31.360 So Scythe is also a command and control framework. 33:31.360 --> 33:32.840 It's a pretty easy installer. 33:32.840 --> 33:34.040 It installs on Windows. 33:34.040 --> 33:36.880 It allows multiple channels for command and control. 33:36.880 --> 33:40.360 In this case, we know we have to use HTTPS, which it has. 33:40.360 --> 33:43.140 And then it builds automation. 33:43.140 --> 33:50.280 So not only do we want to drop this synthetic malware that does what WastedLocker does, we want to automate that, right? 33:50.280 --> 33:51.660 It's going to create files. 33:51.660 --> 33:53.000 It's going to encrypt files. 33:53.000 --> 33:54.560 It's going to download a ransom note. 33:54.560 --> 33:57.680 All of that needs to be done all in one. 33:57.880 --> 34:00.120 So it really allows us to do that. 34:00.120 --> 34:14.620 And it has a variety of integrations with a number of different tools like Vector for tracking red and purple team, Exercises, PlexTrack if you use that in your corporation, and integration for purple teams with Splunk and really any SIEM. 34:14.620 --> 34:21.320 So it's really a great tool for doing this particular ransomware malware that we want to do. 34:21.320 --> 34:24.480 Is it even possible to emulate ransomware? 34:24.480 --> 34:28.040 Well, I've hinted at all of this as we get up to this slide. 34:28.040 --> 34:30.160 And the answer is, of course it is. 34:30.160 --> 34:34.980 The secret is to not encrypt or destroy real production data, right? 34:34.980 --> 34:41.960 You have that already in your plan and it will get approved because you're not impacting the target systems. 34:41.960 --> 34:43.820 You're not impacting production. 34:43.820 --> 34:59.780 So instead of encrypting real files, what we're going to do is first create new files and then encrypt them, exfiltrate them if this particular threat actor did, which Evil Corp did not, and then download a ransom note. 34:59.920 --> 35:07.180 So this method will ensure that no data is ever at risk of being encrypted or destroyed or leaked out. 35:07.180 --> 35:09.820 And over on the right, you can see the steps here. 35:09.820 --> 35:12.400 This is the malware that I've created with Scythe. 35:12.400 --> 35:21.080 It's going to load a number of different things into memory, which WastedLocker also did, was it loaded everything into memory so that it wouldn't get caught. 35:21.080 --> 35:25.700 Then we're going to create a directory on our desktop called Evil Corp. 35:25.700 --> 35:29.500 Within there, we're going to create 55 meg files. 35:29.500 --> 35:31.360 So we have a lot of volume there. 35:31.360 --> 35:33.340 And then we're going to encrypt that. 35:33.340 --> 35:38.060 And the password we chose in this case is Evil Corp in LeetSpeak. 35:38.240 --> 35:46.420 And then we're going to download a ransom note from a pastebin that I created that's very similar to the ransom note from WastedLocker. 35:46.420 --> 35:52.600 And we're going to put that in the desktop so that it shows. 35:52.600 --> 35:56.400 And then, of course, we're going to shut down and clean up after ourselves. 35:56.900 --> 35:59.080 So let's take a look. 35:59.080 --> 36:06.240 We're going to start with our SANS Slingshot C2 Matrix Edition virtual machine. 36:06.240 --> 36:12.120 It is running on a separate network with a Windows 10 victim system. 36:12.120 --> 36:20.280 Again, we're going to focus on the actual ransomware payload and not so much on the initial access and lateral movement. 36:20.280 --> 36:25.120 But because it did use Cobalt Strike, let's go ahead and start with that. 36:25.120 --> 36:29.640 In this case, I have Cobalt Strike installed in slash op slash Cobalt Strike. 36:29.640 --> 36:31.740 I'm going to start a team server. 36:31.740 --> 36:33.360 You have to start that with sudo. 36:33.360 --> 36:36.540 And I'm just going to put a basic password in there. 36:36.540 --> 36:40.820 My IP is 192.168.1.166. 36:41.000 --> 36:42.920 So we'll start that up. 36:44.340 --> 36:48.400 And then on another window, I will start the Cobalt Strike client. 36:48.400 --> 36:50.200 You don't need sudo for that. 36:52.060 --> 36:54.300 And here we will connect. 36:56.720 --> 36:58.360 So this is Cobalt Strike. 36:58.360 --> 37:03.440 The first thing we're going to do, like in any other command control framework, is set up a listener. 37:03.980 --> 37:05.560 I'm going to click add. 37:15.100 --> 37:19.360 And we're going to use port 8080 just because we have something else running. 37:19.360 --> 37:21.640 We have Apache running on port 80. 37:24.060 --> 37:27.360 Now that we have the listener, we are going to create an attack. 37:27.360 --> 37:31.220 As the threat intel told us, they use PowerShell for that. 37:31.220 --> 37:33.660 So we'll do exactly that. 37:50.230 --> 37:56.090 So what we're going to do is move over that payload to the system where we will execute it from. 38:06.090 --> 38:10.350 And we copy and paste that into a standard command prompt. 38:14.320 --> 38:17.900 And here we see it has checked in. 38:19.120 --> 38:29.160 Now that we have access on this target system, we can do the things that Evil Corp did, which was escalate privileges and move laterally, etc. 38:29.160 --> 38:33.180 In this case, we want to focus more on impact, which is on the ransomware. 38:33.180 --> 38:39.340 So let's go over and create the WastedLocker synthetic malware. 38:39.400 --> 38:41.300 So I'm over here in Cypher. 38:41.300 --> 38:43.100 I'm going to Threat Catalog. 38:43.100 --> 38:47.620 And I've already imported the WastedLocker campaign. 38:47.620 --> 38:54.600 So here we see that it will do everything that we discussed, which was load, run, file, correct downloader. 38:54.760 --> 38:59.900 It will create a directory in Evil Corp, an Evil Corp directory on the desktop. 38:59.900 --> 39:05.960 It will create five files all with that wasted extension. 39:05.960 --> 39:07.380 Then it will encrypt them. 39:07.380 --> 39:09.700 Then it will download a message. 39:09.700 --> 39:11.040 And then it'll shut down. 39:19.780 --> 39:29.520 Now we will download that 32-bit executable onto our Linux system, so that we then use Cobalt Strike to upload it and execute it. 39:38.940 --> 39:44.520 Now we will upload the file into this cusers.george directory. 39:51.300 --> 39:54.200 And now we will execute it. 40:00.250 --> 40:03.170 You should see that execution now here. 40:05.530 --> 40:07.450 And there's the check-in. 40:07.450 --> 40:10.510 It's going to go through and load all these modules. 40:10.510 --> 40:28.110 If we observe the directory here on the victim system, we will see it create the folder Evil Corp, create the files, encrypt those files, and then download a ransom note from PasteBit. 40:29.930 --> 40:33.150 There's the Evil Corp folder. 40:34.030 --> 40:45.050 It will now create all these files and then encrypt them, and then download the ransom note. 40:49.700 --> 40:53.010 And here we see the ransom note was downloaded. 40:54.330 --> 40:59.950 And there is the ransom note, very similar to what was used in Garmin. 40:59.950 --> 41:25.550 So as you can see, we use Cobalt Strike to get that initial access with a PowerShell script, and then use Cobalt Strike to dump this executable, which is synthetic malware created with Scythe, to emulate a ransomware attack inside a professional enterprise network without introducing any risk. 41:25.550 --> 41:27.990 How do we defend against ransomware? 41:27.990 --> 41:40.130 Well, before, we just had to worry about that initial access on preventive controls, because ransomware would find its way into any system and then encrypt it, even with user-level privileges. 41:40.130 --> 41:59.210 But now we're seeing these more sophisticated attacks, like Evil Corp on Garmin, where it's getting access, the threat actor gets access to a system, does privilege escalation, moves laterally, does defensivation, executes a number of different ways, and then drops their encryption. 41:59.210 --> 42:09.050 So there's a number of different ways to defend against this, very similar to your other adversary emulations that didn't have the ransomware type impact. 42:09.050 --> 42:11.030 We're now seeing those there. 42:11.070 --> 42:15.370 So there's a number of different ways to defend against this. 42:15.370 --> 42:23.190 I did an excellent interview with Olaf from FalconForce on using things like Sysmon. 42:23.270 --> 42:31.150 Because we are calling all those encryption APIs, you should be able to detect that, especially if a whole bunch of systems do it. 42:31.150 --> 42:36.750 Now, US CERT just recently released these tips, and there's a number of other resources here. 42:37.130 --> 42:42.790 I do want to point out another organization that was recently breached called CWT. 42:42.790 --> 42:52.850 They are an enterprise, a corporate travel organization, and their chats with the malicious actor were leaked. 42:53.030 --> 43:00.270 In this case, they actually paid four million dollars to get access to their files, and the chat was leaked. 43:00.270 --> 43:13.830 The link is there for the entire thread if you want to read it, but here you can see quite a bit of advice that was given to the target organization after the malicious work was done and they got paid. 43:13.830 --> 43:23.270 They gave them some advice as to what to do, which is very similar advice to a lot of the things that we find in our adversary emulations. 43:24.050 --> 43:29.870 So obviously there's a lot more ransomware than just WastedLocker. 43:29.870 --> 43:40.250 These are just a few with their links to MITRE ATT&CK, as well as an interesting service I saw called Shadow Intelligence, which tells you about a number of different ransomware attacks. 43:40.250 --> 43:41.630 So definitely check them out. 43:42.570 --> 43:46.410 Now if this interests you, we have a Threat Thursday. 43:46.410 --> 44:03.610 So every Thursday we choose an adversary, we introduce the adversary, we consume Cyber Threat Intelligence, map it to MITRE ATT&CK, create that navigator layer just like we did here, then we create an adversary emulation plan, we share that plan in our community GitHub, 44:03.610 --> 44:09.090 we emulate the adversary and show it on a video, and we talk about how to defend against this. 44:09.090 --> 44:11.090 So this is all free for the community. 44:11.090 --> 44:16.790 A lot of it is with Scythe, but a lot of the living off the land you'll be able to do without using Scythe. 44:19.210 --> 44:22.010 Another thing I wanted to mention is to save the date. 44:22.010 --> 44:29.830 I know you all like free conferences, so we are hosting a free conference called UNICON, our very own unicorn conference. 44:29.830 --> 44:32.870 Yes, I work at Scythe, where we have unicorns. 44:32.870 --> 44:35.310 And that is going to be on August 20th. 44:35.310 --> 44:41.730 We're doing some very cool stuff and creating an ecosystem for the community. 44:41.730 --> 44:48.210 So we have an SDK that allows you to create your own adversary TTPs. 44:48.210 --> 44:53.970 Think of it of creating a bug bounty, but for TTPs, for Adversary Behaviors. 44:53.970 --> 45:03.630 You can create these modules and put them up in this marketplace, where you can share them for free or sell them and make some money off of them. 45:03.630 --> 45:08.770 So all of that is possible through our marketplace, and we will be releasing that at UNICON. 45:08.850 --> 45:13.690 The way it works is that you use the SDK, which is completely free. 45:13.690 --> 45:30.550 You create a TTP, you add it into the marketplace, and then any Scythe user will be able to grab it or pay you for it, and then run these adversary emulations in their environment and hopefully detect the different behaviors that you've created. 45:30.550 --> 45:33.670 If not, they'll be able to test and hopefully improve it. 45:33.670 --> 45:42.230 So it's an ecosystem of sharing offensive techniques so that organizations can better defend themselves. 45:43.250 --> 45:47.250 I went through a number of different references, so here is the slide. 45:47.250 --> 45:49.410 Obviously, I didn't do all of this on my own. 45:49.410 --> 45:54.790 Big shout out to the folks that did the Cyber Threat Intelligence for Eagle Bull Corp and Wasted Locker. 45:54.790 --> 46:03.870 I did the MITRE Attack Mapping, and as I mentioned, all of that is shared for you, and hopefully you found all of this useful. 46:03.870 --> 46:06.790 So with that, thank you very much for your time. 46:06.790 --> 46:08.250 I really appreciate it. 46:08.250 --> 46:10.970 Hopefully you learned something here today, and I'll see you