WEBVTT 00:17.620 --> 00:20.380 Good evening, Red Team Village. 00:20.480 --> 00:26.900 My name is Adam Pennington, and tonight I'm going to be talking about emulating an adversary with imperfect intelligence. 00:28.720 --> 00:34.380 So before I get into content, I wanted to start off with a little bit about who am I. 00:35.160 --> 00:39.000 So I'm the lead of a project called MITRE ATT&CK. 00:39.000 --> 00:41.440 I'm guessing some of you are probably familiar with it. 00:41.440 --> 00:45.000 Several of the other talks in the Red Team Village have been leveraging it. 00:45.280 --> 00:48.480 I've been with MITRE for about 12 years now. 00:48.720 --> 01:03.300 If you're not familiar with MITRE, we're a not-for-profit who primarily runs federally funded research and development centers for the federal government, and does work in the public interest in things similar to ATT&CK that we're putting out there for people to use. 01:03.300 --> 01:19.380 My principal focus is around threat intelligence and deception, but I've been working with adversary emulation teams for years on looking at what sorts of intelligence they're pulling together, and how well the profiles they're building up look like real adversaries. 01:19.740 --> 01:28.700 Most of my time today is spent on MITRE ATT&CK, but I've been an operational defender, as well as a cyber threat intelligence analyst. 01:28.700 --> 01:31.820 I've spent time in multiple security operations centers. 01:32.620 --> 01:38.500 I've been a part of ATT&CK for quite a while, so I've been around since it was a spreadsheet with no ampersand. 01:38.960 --> 01:48.160 ATT&CK originally was an Excel spreadsheet, and I helped gather a lot of the intelligence that we use to create ATT&CK in the first place. 01:48.160 --> 01:52.700 I was at MITRE, I was at Carnegie Mellon for 11 years trying to collect all the degrees. 01:52.800 --> 01:54.980 I'm also a scuba diver. 01:54.980 --> 01:59.100 I'm certified for technical diving, so decompression, rebreather diving. 01:59.460 --> 02:06.400 And I've spent time as a professional live sound engineer, which might explain some of my taste in home audio equipment. 02:06.500 --> 02:08.740 I've been around DEF CON for quite a while. 02:08.740 --> 02:12.260 Obviously, first one through home, like all the rest of you. 02:14.240 --> 02:17.560 Some of the key points I wanted to get to today. 02:17.980 --> 02:23.720 So I'm going to be looking at a very intelligence-focused approach to adversary emulation. 02:23.800 --> 02:29.780 I want to start off by setting the stage in adversary emulation, getting into the definition I'm using. 02:30.100 --> 02:34.900 Now, I'm not expecting that people here haven't heard of adversary emulation. 02:34.940 --> 02:44.780 I really just want to make sure that we're on the same page using the same definition, because adversary emulation is something that I've seen mean different things to different people. 02:44.780 --> 02:51.080 I'm going to talk about gathering and extracting the intelligence necessary to do adversary emulation. 02:51.080 --> 02:52.060 Where do we find it? 02:52.060 --> 02:53.520 How do we pull it together? 02:54.260 --> 02:56.760 And I'm going to talk about some of the flaws in that intel. 02:56.760 --> 02:58.020 So what's wrong with it? 02:58.020 --> 03:00.880 How do we recognize some of those imperfections? 03:01.320 --> 03:02.520 And then how do we deal with it? 03:02.520 --> 03:11.360 How do we find the gaps in our intel, fill them in, and leverage those to create a complete plan that we can use to actually emulate an adversary? 03:13.340 --> 03:16.300 So I said I was going to start with the definition. 03:16.500 --> 03:21.460 This is the definition of adversary emulation that I'm using for the rest of this talk. 03:22.080 --> 03:33.060 Adversary emulation is a type of red team engagement that mimics a known threat to an organization by leveraging threat intelligence to influence what actions and behaviors the red team does. 03:33.060 --> 03:35.060 Pretty straightforward. 03:35.240 --> 03:40.460 Leveraging threat intel, trying to use that to influence what we're going to do. 03:41.640 --> 03:43.120 So what's different? 03:43.900 --> 03:46.920 The big one is that it's driven by threat intelligence. 03:46.920 --> 03:50.360 So it's driven by how the adversary actually looks. 03:51.100 --> 03:56.980 There's a good chance we're going to use that threat intelligence to scope things more than we might in a normal engagement. 03:56.980 --> 03:59.880 So we want things to look like an actual threat. 03:59.880 --> 04:06.520 And so there are things we might not do and take out of our playbooks in order to stick to that. 04:07.500 --> 04:13.820 There's a good chance it follows a constructed scenario in order to stick to what a real adversary looks like. 04:13.820 --> 04:21.780 We might ahead of time create the set of activities, the set of behaviors that we plan to do so that we can keep to that. 04:22.640 --> 04:30.460 And the hope with all of this is that we're getting some idea of how our defenses might fare against a given adversary. 04:30.600 --> 04:32.360 It's still not the real threat. 04:32.360 --> 04:34.240 It's still not going to be the same. 04:34.240 --> 04:38.960 But we're hoping to get close enough to start to get some ideas. 04:40.300 --> 04:44.600 So there's a bunch of new challenges that emulation brings in around intelligence. 04:44.800 --> 04:48.660 And I'm going to be covering several of these in my talk tonight. 04:49.480 --> 04:53.300 The first and most basic one, the need for intelligence in the first place. 04:53.320 --> 04:56.860 So needing to know what an adversary looks like. 04:57.660 --> 05:03.340 We might not have enough intelligence out there on an adversary that's in a form we can use. 05:03.340 --> 05:11.360 It might not describe the sorts of activities that we need as an adversary emulation team to go out and look like the adversary. 05:12.360 --> 05:16.960 The adversary we want to emulate, there may just not be enough intel on. 05:16.960 --> 05:18.680 We may not know about them. 05:18.800 --> 05:23.460 And so we might need to fill in the picture a little bit more to be able to really emulate them. 05:24.260 --> 05:27.280 And finally, you know, we're pulling all this intel. 05:27.300 --> 05:30.780 We need to be able to turn it into a workable scenario. 05:32.320 --> 05:41.300 So my team has an adversary emulation process that we've used in several other places in presentations, as well as documents. 05:41.300 --> 05:48.000 But it originally comes from a presentation a few years ago by then ATT&CK team members, Katie Nichols and Cody Thomas. 05:48.740 --> 05:53.620 And the process we work from is to first gather threat intelligence. 05:53.620 --> 06:02.240 So figure out who your adversaries are and start to pull in all the information you can find on the adversary you picked to emulate. 06:03.840 --> 06:06.120 Extract techniques from that intelligence. 06:06.120 --> 06:14.960 So start to look at what the behaviors are in that intelligence, so that we can pull them together into a plan to be able to look like those behaviors. 06:17.240 --> 06:19.560 Analyze and organize that intelligence. 06:19.900 --> 06:30.540 So taking those behaviors, looking at what's there, what isn't there, filling in any gaps, and then pulling that together into a plan we can actually use. 06:31.320 --> 06:32.920 Develop tools. 06:33.280 --> 06:38.640 So we need malware utilities and other things to be able to operate with. 06:38.980 --> 06:41.940 And then finally, do the emulation. 06:44.590 --> 06:46.890 So I'm a threat intel guy. 06:46.890 --> 06:52.750 I'm going to cover the most threat intel focused pieces of this process. 06:52.750 --> 06:57.530 And so what I'm going to focus on today is the first three steps in this process. 06:59.770 --> 07:03.270 So start with the first step, gather threat intelligence. 07:03.870 --> 07:10.250 So we're going to need to choose an adversary and then pull in information that we can find about them. 07:10.590 --> 07:14.870 So before we can start gathering data, we need to identify the adversary. 07:15.350 --> 07:26.950 I'll cover two ways to do this in looking at gaps that we're hoping to assess in our environment and considering who is targeting us in the first place. 07:26.950 --> 07:32.110 I'll then go through a couple of processes for gathering data on that adversary. 07:32.330 --> 07:40.330 So pulling in information on things that they do after they break into environments, that's likely to be most of the space of our engagement. 07:40.830 --> 07:46.590 And beyond behaviors, there are some things to think about beyond just what techniques they do. 07:46.610 --> 07:49.490 So what tools are adversaries using? 07:49.530 --> 07:52.010 What other groups are associated with them? 07:52.010 --> 07:56.690 So what other names might we have that are describing some of the same activity? 07:56.950 --> 08:00.030 As well as an adversary's campaigns. 08:00.250 --> 08:07.830 So a series of intrusions that are happening in a time period that are attributed to the same actor. 08:08.350 --> 08:11.630 And on top of all this, we probably want to think about the timeframe. 08:11.870 --> 08:17.790 Some of the actors we might want to emulate might have been in this business a very long time. 08:17.790 --> 08:24.710 So I'll be using an actor later, who is thought to have been around since at least 2004. 08:24.710 --> 08:30.010 What they looked like in 2004 is probably a little bit different than what they look like today. 08:33.220 --> 08:43.820 So there are a lot of ways that you can find lists of adversaries, you know, information on starting points for who it is you want to emulate. 08:44.320 --> 08:49.520 I've got my biases, I'm going to leverage attack, but you don't have to. 08:49.520 --> 08:55.260 But a decent number of red teams we have seen using it for adversary emulation. 08:55.260 --> 08:58.500 So some other options instead of attack. 08:58.560 --> 09:10.920 If you have an internal threat intelligence team that is tracking on groups that are, you know, hitting your own organization, that might be your best source of threat intelligence. 09:10.920 --> 09:15.340 So they know about the threats that matter most to your organization. 09:15.460 --> 09:21.420 They may have the best picture of the techniques that are really relevant to you. 09:21.420 --> 09:24.260 So that could be a really good place to start. 09:24.260 --> 09:30.580 There are people that might be able to sell this information to you. 09:30.580 --> 09:39.240 So there are commercial threat intelligence providers where, you know, for a fee, you can get information on different adversaries you might be interested in. 09:39.960 --> 09:42.480 Or you can go to the same well that we do. 09:42.480 --> 09:47.500 So everything that we're pulling into attack is coming from open source threat intelligence reporting. 09:47.880 --> 09:51.560 And so you can go out and look at some of the same sorts of reports we do ourselves. 09:52.940 --> 10:02.260 Because I'm going to be using ATT&CK for the rest of this talk, I'm just going to quickly get into a few of the specific aspects of it that I'm going to be leveraging here. 10:02.340 --> 10:07.220 So I'm not going to get into, you know, the defensive use cases, things like that. 10:07.360 --> 10:13.080 Just sort of the basics of the framework structure and then the groups information that we're going to be pulling from it. 10:14.640 --> 10:17.980 So I think probably a lot of you have already heard of ATT&CK. 10:17.980 --> 10:22.230 But at its core, ATT&CK is a knowledge base of adversary behaviors. 10:22.580 --> 10:28.640 It's like an encyclopedia of things that real actors have been seen to do in the wild. 10:28.740 --> 10:36.080 So not just things a red team has done, not just theoretical, but it's actual adversary behaviors. 10:36.300 --> 10:38.120 It's freely available. 10:38.440 --> 10:44.500 Everything I'm going to be talking about today, every resource I'm using is out there for free. 10:44.500 --> 10:47.280 And if it's code is open source. 10:48.140 --> 10:50.440 So let's talk about structural here. 10:50.440 --> 10:53.080 This is the view most people use of ATT&CK. 10:53.080 --> 10:54.980 It's what we call the matrix. 10:56.260 --> 11:01.260 It's a layout of different activities that adversaries do. 11:01.300 --> 11:06.020 The way it's organized is across the top here, we have what we call tactics. 11:06.120 --> 11:08.760 These are the adversary's broad technical goals. 11:08.760 --> 11:11.260 So it's something like initial access. 11:11.640 --> 11:17.140 The adversary is trying to get into my network or exfiltration. 11:17.140 --> 11:20.680 The adversary is sending stuff that they've stolen out of my environment. 11:20.680 --> 11:29.200 Or something a little different like impact, where an adversary is trying to cause destruction or disruption to systems or my environment. 11:30.020 --> 11:34.180 Under each of these tactics, we have what we call techniques. 11:34.280 --> 11:37.860 And those are how the technical goals are achieved. 11:38.400 --> 11:41.260 And these are sort of the basic unit of ATT&CK. 11:41.260 --> 11:43.500 I've seen a bunch of techniques. 11:43.500 --> 11:48.020 So Cirio was just using several technique IDs in her talk. 11:48.280 --> 11:52.320 And so these are getting down to more specific ways. 11:52.320 --> 11:55.200 So instead of initial access, we now have something like phishing. 11:55.200 --> 11:57.960 The adversary is sending a malicious email. 11:58.500 --> 12:08.480 That's kind of an exciting talk for me, because this is the first time I've given a talk in years that I've been able to fit the matrix on a single slide. 12:08.540 --> 12:19.080 So we recently did a fairly big refactoring of ATT&CK and going from just tactics and techniques to tactics, techniques, and sub-techniques. 12:19.080 --> 12:23.720 So there's now another layer of abstraction under a lot of the techniques. 12:24.640 --> 12:27.660 Sub-techniques are just more specific techniques. 12:27.660 --> 12:33.000 So instead of phishing, we have something like spear phishing attachment or spear phishing link. 12:33.000 --> 12:35.600 So it's, again, getting more specific. 12:35.780 --> 12:40.820 These sub-techniques have all the same properties behind them as techniques. 12:40.820 --> 12:44.620 They have all the same mitigations, detections, everything else. 12:44.640 --> 12:48.780 It's just a deeper level of specificity, and they have a parent technique. 12:50.060 --> 12:54.340 Finally, getting all the way down to detail, we've got procedures. 12:54.460 --> 12:59.340 These are specific adversary implementations of techniques and sub-techniques. 12:59.820 --> 13:07.200 So instead of spear phishing attachment, we might have the APT12 that sent emails with malicious office documents and PDFs attached. 13:08.400 --> 13:12.060 Okay, our goal was to find out stuff about groups. 13:12.360 --> 13:19.400 Something else that ATT&CK has is profiles on a number of different threat actors, over 100 of them. 13:20.240 --> 13:22.560 This is what a group page looks like. 13:22.560 --> 13:29.060 We've got a brief text description of the group itself, some metadata associated with it. 13:29.060 --> 13:32.500 We have what we call associated group descriptions. 13:33.340 --> 13:41.760 Different companies, different threat intelligence providers use different names to describe the same or closely related groups. 13:43.040 --> 13:44.220 And this is natural. 13:44.220 --> 13:49.080 These organizations have their own definitions of these groups that may not be quite the same. 13:49.080 --> 13:53.900 That's one of the reasons we call it associated groups instead of what we used to call it, which is aliases. 13:55.440 --> 13:57.620 We keep track of what techniques are used. 13:57.620 --> 14:05.340 So we've taken open source threat intelligence reporting, gone through, and figured out what those reports say that the adversary has been doing. 14:07.700 --> 14:10.980 Similar to our groups pages, we also have software pages. 14:11.220 --> 14:26.840 Those keep track of different pieces of software the adversary is using, everything from utilities to things that they've custom written, as well as all of the techniques that that particular piece of software is able to do. 14:27.460 --> 14:29.600 And finally, there's references for all of it. 14:29.600 --> 14:35.880 You can go back, you can check our work, you can see the original references, and make sure that you believe what we say about it. 14:35.900 --> 14:36.880 People 14:40.170 --> 14:43.130 use ATT&CK for a lot of different things. 14:43.130 --> 14:45.830 I'm only touching on adversary emulation tonight. 14:46.250 --> 14:48.970 It's kind of a good use case for ATT&CK, though. 14:48.970 --> 14:54.970 So it turns out that adversary emulation is what ATT&CK was created for in the first place. 14:56.970 --> 15:16.570 The reason we originally created ATT&CK was that we had a red team who wanted to look like some specific actors, wanted to create playbooks, create plans, operate, and then wanted to be able to compare notes with the blue team and see if they saw the same things that the adversary had done. 15:18.050 --> 15:19.010 Okay. 15:20.570 --> 15:27.070 So if I want to actually start to pick out an actor from all this set, you've got 100 actors. 15:27.150 --> 15:34.950 So we can start by looking at how specific actors align with some of the gaps that we think we might have in our defenses. 15:36.010 --> 15:38.650 So this is coming from APT28. 15:39.850 --> 15:48.890 Everything in blue here is techniques that we've identified from multiple open-source threat intelligence reports. 15:48.890 --> 15:51.330 It's not using any commercial or government reporting. 15:51.330 --> 15:54.010 It's just things that you also have access to. 15:54.230 --> 15:57.430 I'm going to be showing a bunch of diagrams that look like this. 15:57.430 --> 16:02.450 This is basically the same matrix layout I showed in the introduction a second ago. 16:02.450 --> 16:07.510 I do have a number of the sub-techniques expanded out to show a bit more of the detail. 16:08.310 --> 16:13.350 But you're probably not going to be able to read the labels at least over on Twitch or YouTube. 16:14.010 --> 16:19.350 But all these diagrams I'm creating are using ATT&CK Navigator, which is an open-source tool we provided. 16:19.590 --> 16:22.250 That's a URL to actually work with it yourself. 16:22.250 --> 16:28.630 And I'll release the slides for this right after the talk and work on getting the navigator layers out I'm using. 16:29.430 --> 16:39.170 So if we're looking at the techniques that APT28 has used, we can then compare that with our own defenses. 16:39.170 --> 16:48.690 So if we take the same ATT&CK Navigator, we lay out where we think that our defenses can catch or not catch an adversary. 16:48.690 --> 16:53.670 So what's in red here is notional gaps in the defenses for an organization. 16:53.670 --> 16:57.710 So what I think that I can't detect today. 16:58.450 --> 16:59.110 Okay? 16:59.210 --> 17:07.730 So if I take that adversary, I add the gaps to it, I can then create something that looks like this. 17:08.090 --> 17:19.890 So I now have the APT28 in blue, our gaps in red, and the green here is, you know, where we think we might have gaps. 17:20.010 --> 17:25.370 So again, without the slides, probably not going to be able to see which individual techniques are highlighted. 17:25.390 --> 17:29.370 But we can see, you know, maybe APT28 isn't the best match for us. 17:29.370 --> 17:35.010 You know, they've only got maybe 10 techniques that overlap with things that we think are gaps. 17:35.010 --> 17:36.290 So, okay. 17:36.450 --> 17:38.350 What else can we look for? 17:40.250 --> 17:43.490 We can also look at adversaries who are targeting us. 17:43.490 --> 17:56.410 So especially if we've got our own internal threat intelligence team to help us, they may be able to help us prioritize here because hopefully they know who it is who's been coming after us. 17:56.530 --> 18:00.950 And again, there's a couple different ways that we can prioritize based on this. 18:03.310 --> 18:06.570 So we can start with an adversary who targets us regularly. 18:06.890 --> 18:15.390 Now, maybe we've got some actor who the first Monday of every month, like clockwork, sends us a spearfish. 18:16.630 --> 18:18.910 You know, maybe they're not the best. 18:18.910 --> 18:27.650 We don't, you know, maybe that we think that our defenses are pretty good about them, but they may be of a lot of interest to us just because they're trying so regularly. 18:27.650 --> 18:30.470 They're definitely a persistent threat. 18:31.830 --> 18:34.630 We can look at adversaries who have targeted others like us. 18:34.850 --> 18:46.290 If we've got some actor who's tried to break into every other peer in our industry and has succeeded in places, well, we're probably somewhere on their priority list. 18:46.290 --> 18:51.630 We're in their priority intelligence requirements for who they should be breaking into. 18:51.810 --> 18:55.890 So we might want to understand how it is that we might face against them. 18:56.510 --> 19:05.830 Finally, you might want to pick an adversary who doesn't target us very much or we've never actually seen, but they might, but has a high skill level. 19:05.830 --> 19:13.690 You know, the actor who keeps us up at night because we think that if they came after us, they'd probably succeed. 19:13.690 --> 19:15.870 You know, they've got the high skill set. 19:16.930 --> 19:22.650 So the adversary I'm leveraging today for a lot of organizations probably more fits into this last group. 19:23.190 --> 19:25.830 The keep you up at night adversary. 19:27.310 --> 19:31.610 So the adversary I'm going to leverage for the rest of this talk is Turla. 19:32.730 --> 19:37.090 Turla has been attributed to Russian state activity. 19:37.630 --> 19:39.790 They've been around for quite a while. 19:39.790 --> 19:43.010 They've been seen since at least 2004. 19:43.570 --> 19:52.830 I kind of like this group and that they're cross-platform so they don't just stick to Windows systems, but they've been known to go after macOS and Linux. 19:53.190 --> 19:58.050 And they use some interesting techniques that we don't see a lot of actors use. 19:58.530 --> 20:08.810 And so everything in ATT&CK has been seen somewhere by some actor, but there are techniques that there are really only, you know, a certain number of high-end adversaries that are getting into them. 20:10.750 --> 20:12.690 So we've picked our actor. 20:13.190 --> 20:15.650 It's time to start gathering data on them. 20:15.650 --> 20:23.290 So if I'm not using ATT&CK as my data source, I'm going to want to probably go out there and start gathering intel. 20:23.510 --> 20:29.530 And so, you know, I can start looking through open source publicly available threat intelligence reports. 20:29.530 --> 20:32.770 There are quite a lot of them out there these days. 20:32.770 --> 20:40.130 There really weren't that many when ATT&CK started, but we do have quite a wealth out there of reporting now. 20:41.110 --> 20:46.470 Or I can leverage the version of a lot of these techniques that's in ATT&CK. 20:46.590 --> 20:57.450 So we're going through some of these exact same reports, trying to find what behaviors and techniques are in there, and then we're putting out that same information in ATT&CK. 20:57.450 --> 21:02.770 So it's information you already have access to just in a digested form. 21:05.030 --> 21:07.110 So we've got this intel. 21:07.110 --> 21:20.290 If we're going from our own sources, if we're bringing in open source threat intelligence reporting ourselves, we're going to need to go through a process of extracting techniques. 21:20.670 --> 21:23.490 Internally, we tend to call this mapping. 21:23.630 --> 21:32.970 So the quick process that you're going to go through in these reports is something along the lines of first finding the behaviors in the report. 21:32.970 --> 21:41.730 So figuring out what is it that are activities that the adversary did, the things that we're going to want to later be doing ourselves. 21:42.450 --> 21:44.130 Figure out the tactics. 21:44.130 --> 21:49.490 So it takes a little bit of experience in understanding what you're reading with adversary behavior. 21:49.730 --> 21:53.670 But what is the adversary's goal for each of those behaviors? 21:54.650 --> 21:56.150 Move down to more specifics. 21:56.150 --> 21:58.610 Move down those columns of ATT&CK. 21:58.950 --> 22:05.770 Go from the tactic to a technique, or even better, all the way down into a sub-technique. 22:06.630 --> 22:08.530 And I recommend doing this as a team. 22:08.530 --> 22:15.190 You know, everyone has their own biases and preconceptions in how they read intel, something I'll talk about a bit more in a minute. 22:15.410 --> 22:22.030 But comparing notes can be super effective for canceling out different issues you might have. 22:22.550 --> 22:32.970 So I'm only going to be briefly talking about how to do this, but my friend and former ATT&CK teammate Katie Nichols released training earlier this year on how to do this mapping in much more detail. 22:33.430 --> 22:36.010 The URL for it is available in the slides. 22:36.010 --> 22:38.070 Again, I'll release the slides later. 22:38.290 --> 22:39.550 And it's completely free. 22:39.550 --> 22:41.910 The videos for it are up on YouTube. 22:44.980 --> 22:48.700 So this process of mapping ATT&CK techniques. 22:48.760 --> 22:57.640 You know, this little snippet of reporting has quite a few of them in it in the way that we would interpret an open-source threat intelligence report. 22:57.640 --> 23:02.680 So first we're going through, we're identifying each of the behaviors. 23:02.680 --> 23:14.960 There's the highlighted in yellow bits where they're either describing something an adversary did or, you know, they're using a tool where it's relatively clear what the behavior is that they're using it for. 23:15.840 --> 23:20.620 We're going through, we're getting down into tactics and getting down into techniques. 23:20.620 --> 23:28.200 So instead of create batch scripts, we're interpreting that into ATT&CK for our Windows command shell, T10-59-003. 23:28.560 --> 23:33.540 Instead of Windows run key, we now have registry run keys, startup folder. 23:33.540 --> 23:36.340 So T15-74-001. 23:36.440 --> 23:46.200 And we're just going through the entire document, repeating this process over and over again, and pulling out the full set of techniques that we're able to find. 23:49.300 --> 23:54.840 So once you've pulled out all those techniques, you need to structure your intel. 23:54.840 --> 23:58.760 And so I'm, you know, again, using the ATT&CK Navigator. 23:58.920 --> 24:07.580 This is the full set of Turla techniques that I've extracted from ATT&CK, pulled out of their page that's in there. 24:07.660 --> 24:11.560 Again, everything that's here is only based on open source threat intelligence reporting. 24:11.560 --> 24:14.620 So it has the limitations of that. 24:15.440 --> 24:22.980 And so that's, this is the sum total of all of those threat intelligence reports we mapped with Turla. 24:25.780 --> 24:28.860 Okay, so we've got a pile of intel. 24:29.260 --> 24:31.280 What do we actually do with it? 24:31.280 --> 24:32.960 You know, is this any good? 24:32.960 --> 24:35.440 Do we have a picture of the adversary yet? 24:35.700 --> 24:43.320 And so we're going to need to go through some more work to figure out what we've got, you know, what the adversary is trying to do. 24:43.440 --> 24:47.560 And do we even have enough of a picture to be able to make a plan here? 24:48.260 --> 24:53.720 So the first two steps I'm going to work through are establishing the adversary's goal. 24:53.720 --> 24:56.420 So what is it that they're trying to do? 24:56.420 --> 25:04.960 Understand their modus operandi a little bit better in terms of what we're later going to want to operate like. 25:05.080 --> 25:11.440 And an important point to remember is that this goal is probably not technical. 25:11.720 --> 25:18.200 The adversary is probably not focused on getting domain administrator or stealing a particular password. 25:18.200 --> 25:23.480 They're probably interested in fulfilling an intelligence requirement. 25:23.480 --> 25:28.800 You know, they have some piece of information that they want to steal from your environment. 25:30.400 --> 25:41.800 So the goal is likely to be something more like data theft or to stop you from operating than, you know, hack the Gibson or, you know, brick a particular computer. 25:43.220 --> 25:49.900 After you've determined what that goal is, you need to look at what the gaps are between an adversary getting in and reaching that goal. 25:50.420 --> 25:56.140 What is it I don't know about the middle that would let me look like that adversary? 25:57.720 --> 26:02.900 So to go through those first two steps of it, so establishing an adversary goal. 26:03.420 --> 26:07.600 You could take a look at which tactics the adversary is using. 26:07.600 --> 26:12.480 So we can see that TERLA has some stuff in collection and exfiltration. 26:12.480 --> 26:14.300 They've got nothing in impact. 26:14.300 --> 26:17.380 But instead, I'm going to go back to the original reporting. 26:18.260 --> 26:21.920 So this is a Kaspersky report on TERLA. 26:22.120 --> 26:26.540 And so they talk about how TERLA went through, they're searching for emails. 26:26.540 --> 26:30.380 They were specifically looking for emails related to NATO energy dialogue. 26:30.380 --> 26:34.140 And then shortly afterwards, the report talks about them exfiling the information. 26:34.140 --> 26:38.820 So, okay, they're stealing information around particular topics. 26:39.900 --> 26:42.120 Similarly, an ESET report. 26:42.120 --> 26:47.000 They're going through, they're getting into the victim's Microsoft SQL database. 26:47.000 --> 26:52.740 Pulling documents out of it, and again, exfiling, and taking specific information. 26:53.580 --> 27:03.400 So we've got a relatively clear picture, and we can look at other reports and see the same thing, where over and over and over again, TERLA is stealing information. 27:03.400 --> 27:09.200 So it looks like they're focused on theft of information and exfiltration. 27:12.980 --> 27:20.240 So I said that we need to then examine gaps between access and goal. 27:20.760 --> 27:24.740 I'm going to cover for a few minutes first, why are there gaps? 27:24.880 --> 27:29.180 So we've got this intel, it's an attack, it's all out there. 27:29.260 --> 27:33.640 Why isn't that enough for us to be able to work with? 27:34.500 --> 27:40.300 Open source intelligence likely doesn't paint a complete picture of an adversary. 27:40.640 --> 27:44.680 Frankly, commercial and closed intelligence probably doesn't either. 27:44.680 --> 27:54.280 So there are biases in the information, in how it's gathered, and what information is gathered, as well as nobody has perfect visibility. 27:54.420 --> 28:06.260 It's very rare that you have intelligence that tells you everything an adversary does from the point when a victim clicks to the point when they actually are stealing information. 28:07.840 --> 28:11.240 And by putting it into attack, we add our own problems. 28:11.240 --> 28:17.400 So group intelligence in attack is subject to our own biases, and then we're very similar. 28:18.080 --> 28:22.720 And, you know, we're adding on to the biases that are coming from this open source intelligence. 28:22.720 --> 28:28.740 So some of that is from how we map from these intelligence reports and what it is we actually choose to come in. 28:29.680 --> 28:33.960 Now, bias is usually a negative word in the English language. 28:33.960 --> 28:42.560 It sounds bad, you know, sounds like we may not like certain intelligence, but in threat intelligence, we accept that all sources 28:46.160 --> 28:46.720 have certain information. 28:46.720 --> 28:51.660 And so we work to understand those and what they are so that we can account for them. 28:54.220 --> 28:59.000 So some of why we have these biases in our reporting. 29:02.280 --> 29:06.440 Any reporting source is going to have a visibility bias. 29:07.040 --> 29:15.040 There are only certain types of information that a given source is going to have, and they might only have certain types of sensors. 29:15.040 --> 29:22.300 An incident response firm may only have whatever sensors were in the environment at the time. 29:23.000 --> 29:36.660 Whereas things that can only be seen in real time, so maybe decoded command and control traffic or registry monitoring, other things that don't really leave much of a forensic trace, might not be in their visibility. 29:38.300 --> 29:40.640 So there's novelty bias. 29:40.840 --> 29:43.680 So I'm kind of a beer snob. 29:43.680 --> 29:54.640 In normal pre-COVID times, I walk into a good beer bar, I look at the taps that are there, and I see a bunch of stuff I've had before. 29:54.640 --> 30:02.660 It's been on my untapped list for years now, and I see the one tap that was the thing I've wanted to try for a while. 30:03.160 --> 30:05.320 Reporting can be a lot like that. 30:05.320 --> 30:18.100 So I've got my reports, I've got my APT 1-8 report where I've got a new actor, we've never seen him before, they're doing something new, and I've got my APT Elite report. 30:18.100 --> 30:23.860 I'm going to put out the one that's brand new, is more likely to make a headline. 30:24.200 --> 30:29.460 And so our intel is biased by this, where some reports are more likely to come out than others. 30:31.640 --> 30:36.780 As people are creating the intelligence in the first place, they have availability bias. 30:36.980 --> 30:41.080 Availability bias is a classic cognitive bias. 30:41.220 --> 30:48.920 I have some things that I am more familiar with, that I'm more used to seeing, that I'm more likely to recognize. 30:49.140 --> 31:06.220 So somebody who's done a ton of incident response, they've seen PowerShell over and over again, they might be more likely to notice the PowerShell activity and not notice that, say the adversary got into the BIOS over here or something super novel. 31:07.940 --> 31:09.400 Victim bias. 31:09.400 --> 31:15.320 So there are some victims where there is more likely for reporting to come out than others. 31:15.680 --> 31:23.720 So there are only certain firms that can afford some of the companies that are putting out a lot of this threat intelligence reporting. 31:23.960 --> 31:29.660 Some victims are also in industries where they're a lot more likely to allow reports to come out. 31:29.800 --> 31:34.980 There may be issues with regulators if there's any information about them having been hacked. 31:35.400 --> 31:40.200 And so who the victim is, is going to matter a lot for if we ever hear about it. 31:43.800 --> 31:44.400 Victim bias. 31:44.600 --> 31:48.340 So some sources write more reports than others. 31:48.940 --> 32:05.620 If, you know, one company is writing, you know, dozens and dozens of reports that all have active behaviors in them and another company is just putting out a couple, we're going to have more information to work with from another. 32:06.740 --> 32:08.640 And so I said we compound it. 32:08.680 --> 32:12.980 And so we add our own biases to these and the types of sources we select. 32:13.120 --> 32:21.720 And so a lot of the stuff I've been talking about is in terms of information from security vendors and threat intelligence firms. 32:22.200 --> 32:29.980 So 92% of the reports that we have in ATT&CK, as a point when I made this slide, are coming from security vendors. 32:30.060 --> 32:32.260 3% are coming from government reports. 32:32.260 --> 32:37.380 These are things like public indictments and other public available government reports. 32:37.520 --> 32:39.540 And a few are coming from press reports. 32:39.800 --> 32:47.940 Sometimes there's an article in Wired or the Register that describes really good, unique adversary activity. 32:48.860 --> 32:51.500 We have our own availability bias. 32:51.540 --> 33:01.960 So in that mapping process of going through reports, we've reduced the number of techniques in ATT&CK a little bit recently, but there's still over 160 of them. 33:02.240 --> 33:08.140 And so it's hard for us to keep a working set of all of those techniques. 33:08.140 --> 33:12.860 And so we've got the techniques that we remember in there and are at the tip of our tongue. 33:12.860 --> 33:21.080 And then we have the techniques in ATT&CK, like hidden file system that we almost never see in reporting. 33:22.340 --> 33:24.600 We have our own novelty bias. 33:24.600 --> 33:30.560 So we've got, you know, dozens and dozens of reports on FuzzyDeck using PowerShell. 33:30.560 --> 33:37.620 But we've got this one brand new report on APT Elite using transmitted data manipulation, a fairly new technique. 33:38.140 --> 33:41.620 We're probably going to go for the shiny new report. 33:43.940 --> 33:49.280 And so if you're using Intel from ATT&CK, there's a couple of other caveats to realize . 33:50.520 --> 33:58.660 So our reporting that we've got in there on a given group page is from all different time periods combined. 33:59.220 --> 34:02.280 There's some reasons why we do this. 34:02.440 --> 34:05.620 Reporting frequently doesn't say when the activity happened. 34:05.620 --> 34:15.660 So a report, we might have a date on the report itself, not always, and a pox on people that put out threat intelligence reports about dates . 34:15.940 --> 34:19.420 But we don't even know necessarily when the intrusion happened. 34:19.420 --> 34:28.360 And I've seen reporting where I know the intrusion that they were talking about was four or five years old, where it sounded like they were talking about something recent. 34:29.560 --> 34:32.220 Some reports might only talk about a small range of activity. 34:32.220 --> 34:39.800 So some why we end up adding stuff together is so that we can talk enough about a single actor to paint a picture. 34:39.800 --> 34:48.080 So if I only have one report with, you know, ten techniques in it, it's probably not telling me the range of activity that an actor can do. 34:49.740 --> 34:55.460 Our group pages only include behaviors that are directly tied to actor activity. 34:55.540 --> 35:01.720 So our standards for what we're adding into those pages is that the reporting says that the actor did it. 35:02.140 --> 35:05.560 And so that doesn't include behaviors of software that adversaries use. 35:05.560 --> 35:13.620 So if there is a malware analysis report out there that we're putting in attack, that's going on those software pages. 35:13.820 --> 35:17.880 And we're not including that into the activity of the given adversary. 35:17.960 --> 35:21.600 And finally, the reporting we're using doesn't always agree on attribution. 35:21.940 --> 35:27.960 And so we're sometimes left trying to figure out what the heck group we should be even putting this into. 35:27.960 --> 35:30.460 And hopefully in most cases it's accurate. 35:32.000 --> 35:33.860 So that sounds awful. 35:33.860 --> 35:35.600 You know, so what do we what do we do about it? 35:35.600 --> 35:37.840 I've talked about this as our source of intel. 35:37.840 --> 35:40.580 And now I've talked about all these problems with it. 35:40.800 --> 35:50.480 So the important part is to understand that there are these types of limitations and biases in the intel that we're using to do this emulation. 35:51.280 --> 35:59.340 Once we know that there are these limitations and gaps are there, we can start to determine where the gaps are in our specific intelligence. 35:59.680 --> 36:05.080 And so we don't just throw up our hands and say, well, I don't know anything. 36:05.100 --> 36:08.240 I'm just going back to normal red teaming. 36:08.240 --> 36:14.900 We need to account for these gaps and fill them in as we build our adversary emulation plan. 36:17.320 --> 36:20.100 That was a long aside away from Turla. 36:20.140 --> 36:27.380 But let's start to look at how we might spot gaps in our specific adversary picture. 36:27.740 --> 36:35.360 So taking Turla as an example, how might we see some evidence that our information on Turla isn't perfect? 36:37.060 --> 36:39.320 I can first look for missing dependencies. 36:40.000 --> 36:49.040 So my colleague Amy Applebaum wrote a blog post a couple years back on trying to find related attack techniques. 36:49.200 --> 36:59.160 So both dependencies where in order to do one technique, you might need this other technique first, or techniques that are very often seen together . 37:00.060 --> 37:04.240 And so that can be a useful source for doing this. 37:04.300 --> 37:09.680 But I'm going to zoom in on a couple places in our profile of Turla. 37:09.700 --> 37:11.560 So let's look at initial access. 37:11.560 --> 37:18.560 So we've got some pretty simple techniques here that drive by compromise . 37:18.560 --> 37:22.460 We have fishing, spearfishing attachment, fishing, spearfishing link. 37:22.780 --> 37:24.840 Okay, relatively germane . 37:25.040 --> 37:37.640 But if they're doing each of these things, these successful intrusions, there are actions that need to follow that for the intrusion to have been successful as it was. 37:37.940 --> 37:42.060 So I take a look at our execution for Turla. 37:42.340 --> 37:45.860 And I look at, you know, I've got user execution malicious link. 37:45.860 --> 37:48.540 So they sent a malicious spearfishing link . 37:48.540 --> 37:49.720 We clicked on it. 37:49.720 --> 37:50.720 Okay . 37:51.000 --> 37:53.480 They sent us a spearfishing attachment. 37:54.100 --> 37:57.740 I don't actually have an execution technique for that . 37:57.740 --> 38:00.360 So there's clearly a gap here. 38:00.800 --> 38:02.520 It's something we probably need to fix. 38:02.520 --> 38:15.860 But it, there's, I would expect there to be here either user execution malicious file, or, you know, potentially if they're being really ninja exploitation for client execution. 38:15.860 --> 38:22.340 So, you know, maybe they're, maybe it's a user clicking on the attachment, or maybe they're popping the outlook. 38:22.960 --> 38:25.380 But something is missing here. 38:27.220 --> 38:37.460 We can also look for hints of dependencies, you know, and so we're trying to create something in the style of an adversary, not necessarily exactly what they did. 38:37.680 --> 38:40.760 But so I can look at something like lateral movement. 38:40.760 --> 38:47.580 So, okay, we see them doing lateral tool transfer and Samba Windows admin shares. 38:48.120 --> 38:56.880 Windows admin shares, if they're doing this technique, it's usually something where they're being driven by operating system credentials to get around the network. 38:56.880 --> 39:03.860 So, okay, there's something that should be in here as a credential access so that they've got the creds to do that. 39:04.920 --> 39:11.780 Well, what I've got here is brute force, which they could be using to do OS credentials. 39:11.780 --> 39:18.120 Credentials from password stores is usually other types of credentials rather than operating system. 39:18.460 --> 39:26.920 So I'd really expect there to be something more like OS credential dumping or something with Kerberos tickets. 39:26.920 --> 39:29.340 So domain authentication here. 39:29.380 --> 39:33.580 So a sign that I might have another gap that I need to deal with. 39:36.480 --> 39:44.800 Less dependable, but another way that we might be able to see signs of this is looking for things like unusually sparse tactics. 39:45.980 --> 39:53.620 So in the case of Turla, we've got an adversary who's been around since at least 2004, as I said in the beginning of this. 39:54.300 --> 40:02.040 Most adversaries over time are definitely developing multiple techniques to do a given tactic that's important to them. 40:02.580 --> 40:08.080 And in the case of Turla, all we've got here for exfiltration is exfiltration of cloud storage. 40:08.680 --> 40:19.180 And another reason why that's a little bit suspicious for Turla is that Turla is older than cloud storage, at least in the sense that we would generally mean by it. 40:19.520 --> 40:25.340 And so there's some signs that there might be another gap here in our picture of Turla. 40:27.840 --> 40:45.280 Okay, so if there are gaps and we don't have necessarily everything we need to get from the adversary getting in to achieving their goal, let's look at some ways of filling these in in a logical fashion that sticks to the spirit of the adversary as much as possible. 40:46.160 --> 40:49.560 I'm going to go over four techniques for filling in gaps. 40:49.680 --> 40:54.780 First is adding techniques from the software that the adversary is using. 40:54.860 --> 41:00.520 I'm going to fill in some of those dependencies that I just identified and add those in. 41:00.520 --> 41:02.680 I'm going to take a look at peer adversaries. 41:02.680 --> 41:10.720 So maybe we're still not able to get enough intelligence on stuff that's directly related to the one we've chosen. 41:10.780 --> 41:12.020 Let's look at their peers. 41:12.020 --> 41:15.320 Let's look at people who are operating like them. 41:15.320 --> 41:17.960 And we can borrow from as well. 41:18.200 --> 41:23.440 And finally, if all of that fails, let's look at what lots of adversaries are doing. 41:23.440 --> 41:26.200 It might be something that they're doing as well. 41:28.180 --> 41:35.620 So if I go back to the attack group page, this is all the software that we've associated with Terla. 41:35.760 --> 41:38.720 There's a mix of different types of things in here. 41:39.060 --> 41:42.580 For starters, we have what I'm going to call utilities. 41:43.040 --> 41:49.120 So these are tools that are in every case, but PSExec built into Windows. 41:49.260 --> 41:57.060 PSExec obviously being part of Sys internal, so something that they probably downloaded over the course of the intrusion. 41:57.060 --> 42:00.940 But it's a general purpose tools that anyone's going to have access to it. 42:02.500 --> 42:05.140 Next, we've got public tools. 42:05.140 --> 42:07.780 So our public offensive tools. 42:08.220 --> 42:13.900 Terla, like a lot of actors out there, is a user of MimiCats , as well as Empire . 42:14.380 --> 42:18.020 And so this is something that, you know, it's not just specific to Terla . 42:18.020 --> 42:20.900 We see tons of different adversaries using. 42:22.940 --> 42:27.920 But Terla has a lot of possibly unique software. 42:28.020 --> 42:33.020 So these are pieces of software we have listed for no other adversary but Terla. 42:33.220 --> 42:43.300 We think that maybe they were written for them or written by them, but we at least don't have evidence of them being used elsewhere. 42:43.820 --> 42:49.500 And so for filling in software, I'm going to start with just this possibly unique to Terla set. 42:49.620 --> 42:53.440 And I've got a couple of reasons I'm going to do that. 42:53.440 --> 43:08.720 So the first is that some of the other tools like Mimi Cats, Empire, or if they've been using something like Cobalt, those tools have a ton of functionality . 43:09.340 --> 43:14.700 Off the top of my head, I think Cobalt , we've got over 65 techniques mapped to . 43:15.100 --> 43:23.220 And so it starts to just color in the entire matrix , not necessarily the pieces that Terla is actually using. 43:24.100 --> 43:31.620 Something I've seen is that adversaries have a tendency to use more of the functionality of their own tools , too, than general purpose they're using . 43:31.620 --> 43:33.420 And that makes a lot of sense. 43:34.140 --> 43:42.180 If you are commissioning these or buying these tools, you're probably not going to ask for a lot of functionality that you never use. 43:42.880 --> 43:52.560 So if I take all of the techniques that are associated with each of these tools, add them together, I get something that looks like this. 43:52.860 --> 43:57.320 And again, I'll release the slides so you can zoom in a bit better. 43:57.320 --> 44:01.160 Right now, I'm just more showing sort of the shape of the coloring. 44:01.280 --> 44:06.280 You can see that this adds in activity across a lot of different tactics . 44:06.640 --> 44:10.540 So we've got a bunch of material here. 44:11.040 --> 44:18.460 And if I go back and add my Turla profile back into that, I've now got quite a bit more there. 44:18.540 --> 44:21.100 So blue was what we already had with Turla. 44:21.100 --> 44:25.060 Red is what we just added in with the software that they're using. 44:25.380 --> 44:26.460 And green is the overlap. 44:26.460 --> 44:28.900 So green is what we already had. 44:29.260 --> 44:33.800 And so I pointed out exfiltration was kind of thin in the original profile. 44:34.620 --> 44:39.420 Well, so adding in the software they're using has helped fill that in a bit. 44:39.420 --> 44:45.940 So we've now got something like not just cloud storage, but also exfiltration of a command and control channel. 44:46.240 --> 44:49.800 And so some more options for us to be able to work with too. 44:52.330 --> 44:57.550 So I've still got some of those missing dependencies though, even with the software added in. 44:57.550 --> 45:01.370 So the next thing I'm going to go through is filling the missing dependencies. 45:01.570 --> 45:09.890 I didn't actually find a lot of those in Turla specifically, but there are definitely actors where there are more of these that you'll find. 45:10.210 --> 45:17.710 And so I'm going to take the fairly simple step with the missing dependencies I'd found to simply fill them in. 45:17.710 --> 45:20.810 So, you know, we're trying to stick in the sphere of the adversary. 45:21.150 --> 45:27.810 They probably did these things in order to accomplish those other techniques or after those other techniques. 45:27.930 --> 45:30.250 So I'm going to bring those into our profile. 45:32.330 --> 45:39.650 So that now gives me a relatively well -fleshed out adversary profile. 45:39.910 --> 45:45.990 So this also isn't coloring in quite as much of the attack matrix as it might appear here. 45:46.430 --> 45:53.030 I have only expanded out sub techniques where there are techniques selected in them. 45:53.110 --> 45:58.030 So again, I'm trying to keep the matrix actually fitting on the slide. 45:58.030 --> 46:02.910 But there are quite a few sub techniques that are still tucked in here. 46:02.910 --> 46:11.930 So this is still keeping us to a scoping that is in the spirit of Turla. 46:12.350 --> 46:14.090 So I think we're good here. 46:14.090 --> 46:21.690 I think for Turla itself, this is probably sufficient for us to work with in any scenario we want to create. 46:21.790 --> 46:25.590 But what if I was working in an actor where I couldn't do that? 46:25.810 --> 46:29.510 So the next thing I can do is start examining peer adversaries. 46:30.670 --> 46:35.790 Turla is attributed to be a Russian state actor who likes to steal information. 46:35.790 --> 46:38.990 So who else in the tech do we have that looks like them? 46:39.090 --> 46:43.190 The ones that jump out are APT28 and 29. 46:43.190 --> 46:49.570 These are the two groups that were attributed by the US government to be behind the DNC hacks a couple years ago. 46:49.570 --> 46:51.750 They have been very prolific. 46:52.110 --> 46:55.090 They do a wide range of their own activities . 46:55.790 --> 47:09.830 I could use them like this where I'm just taking every technique from both mashing them together or maybe I just want to use it as a way of seeing what's popular for them. 47:09.830 --> 47:15.990 So the green techniques are where there's overlap between these two adversaries. 47:18.230 --> 47:26.370 Lastly, you know, so if the peers aren't enough, maybe I can just look at what techniques are common out there. 47:26.450 --> 47:37.410 So a number of companies over the past couple years have started publishing annual reports on what attack techniques that they've seen over the past year. 47:38.170 --> 47:46.050 And so looking at a couple of companies' reports on what techniques they saw in 2019, we can start to use those to fill in gaps. 47:46.750 --> 47:49.550 So the first one I'm going to use is red canary. 47:49.550 --> 47:51.090 So they put out a report. 47:51.090 --> 47:56.270 It's actually got top 20 in it, but you can actually read the text on this one. 47:56.870 --> 48:03.910 So it is going through, and it's in order, but it's important to understand, again, what this means. 48:03.930 --> 48:14.710 This is the top 10 techniques that they saw in the places that they have sensing in and compared with their actual detectors. 48:15.030 --> 48:20.470 So it's not necessarily the 10 most popular techniques, it's the 10 most popular techniques they saw. 48:21.090 --> 48:36.890 Another company who put out top 20 techniques this year, I'm again cutting them down to 10 for the slide, but you'll note that the only overlap between these two lists is process injection. 48:36.950 --> 48:50.630 So we may want to combine a couple of these together in order to see where the overlaps are, add their data, but these are giving us some ideas of things that we know at least have been out there in the wild a bunch in the past year. 48:50.630 --> 49:00.030 So it doesn't tell us that Turla did these, it doesn't tell us that 28 or 29 did these, but a bunch of people did them somewhere. 49:00.470 --> 49:08.230 So adding them into our profile may be still sticking to a realistic APT profile. 49:08.610 --> 49:15.430 And again, I wouldn't do this unless I wasn't able to get it directly from the threat intelligence on the actor. 49:18.410 --> 49:19.950 So we've filled in some gaps. 49:19.950 --> 49:22.430 We've got a lot of things colored in now. 49:22.430 --> 49:24.550 We've got our pretty picture. 49:25.230 --> 49:26.810 So what do we do with it? 49:26.810 --> 49:31.650 How do we actually turn this into more of a profile ? 49:32.130 --> 49:36.050 So I talked about a couple gap techniques that I didn't use . 49:36.070 --> 49:46.050 So going back to my Turla profile that is Turla plus the software that appears to be unique to them plus filling in those dependencies . 49:48.960 --> 49:51.480 So I'm going to want to do something like this . 49:51.520 --> 50:00.820 So I've got my techniques, I've got my tactics, and I'm going to want to start to carve down to the techniques I want to actually use. 50:00.920 --> 50:04.120 And those techniques have a flow to them. 50:04.120 --> 50:09.220 So I've talked a teeny bit about dependencies like where one technique is going to require another. 50:09.260 --> 50:15.260 There are often spaces where one tactic is generally going to require another one too. 50:15.820 --> 50:17.580 Attack is not ordered. 50:18.020 --> 50:26.860 Obviously, yes, things off to the left in attack often happen before things to the right in attack, but there is no strict ordering to it. 50:26.860 --> 50:28.520 It is not a kill chain. 50:29.240 --> 50:42.660 And so tactics may happen in different orders , they may not appear at all in the intrusion , but we are going to want to force some ordering on them for operation so that we can actually build up a plan. 50:43.180 --> 50:51.460 So here what I've done is I've started with initial access, so I've got the adversary breaking into the environment. 50:51.640 --> 51:00.960 Followed by execution, so the code actually getting run, so that's also got the most file in here that I filled in using dependencies. 51:01.480 --> 51:12.040 From execution, they are going to be doing both discovery and privilege escalation, so I'm going to be able to do a lot of my discovery without needing extra privileges . 51:12.040 --> 51:17.740 At the same time, I'm going to be building up so that I can do my defensivation credential access and persistence . 51:18.780 --> 51:29.680 Some of Turla's defensivation does require privilege escalation, so they do things like hidden file systems, which is a fairly unusual technique. 51:31.580 --> 51:36.080 And then, you know , so from my credential access, I'll then be able to do lateral movement. 51:36.160 --> 51:48.140 I've got my OS credential dumping, which lets me do my Samba, Windows administrative shares, and the arrow is supposed to loop around from one side to the other, back to execution, and start it all over again. 51:50.400 --> 52:02.340 So, in order to bring this even closer to something I can operate with, the final organizational step I'm going to do is organized technique flow into plan phases. 52:03.140 --> 52:06.320 So, everything I've talked about here is started at initial access. 52:06.320 --> 52:10.500 And so, that's using what's in enterprise attack today. 52:10.740 --> 52:19.460 But obviously, there are some steps that an adversary, as well as an adversary emulator, is going to need to do before they get into the environment. 52:19.500 --> 52:21.340 So, that's this phase one. 52:21.980 --> 52:26.880 And so, you might not be familiar with the tactics, reconnaissance, and resource development. 52:27.020 --> 52:29.900 And that's because they won't be in attack for another few months. 52:29.900 --> 52:31.220 But stay tuned. 52:31.420 --> 52:40.780 We actually are extending attack to match the scope of the cyber kill chain and activities that come before you break into an environment. 52:41.680 --> 52:59.520 Phase two, I've got the adversary operating, setting down their footprint, while I've got this particular adversary doing their collection and exfiltration at the end. 52:59.520 --> 53:02.780 So, they've got the footprint and then they steal the information. 53:03.440 --> 53:07.140 And so, I'm putting these in order so that we can use them for operations. 53:07.140 --> 53:13.180 This isn't going to be perfect, but a lot of these techniques and tactics have required ordering to them. 53:15.710 --> 53:24.710 So, the pieces I'm not really going to cover today, but just a few thoughts on making sure that we're applying Intel as we go through the entire process. 53:24.750 --> 53:28.250 So, we're going to want to develop tools to be able to do this. 53:28.810 --> 53:33.330 You know, want to be able to think, can we do this with COTS free open source? 53:33.330 --> 53:35.970 Are those reasonable for the given actor? 53:36.290 --> 53:40.050 So, in some cases, we may have an actor who's using Empire or Cobalt. 53:40.050 --> 53:43.470 So , the answer to that is fairly obvious. 53:43.530 --> 53:54.950 If we have an actor that's doing nothing but bespoke tool development and using techniques that aren't really supported by much that's out there in public, we may need to do some custom work. 53:55.010 --> 54:00.630 But, regardless, trying to keep those payloads inspired by the APT. 54:00.990 --> 54:06.630 So, you're looking at how they're packing and everything else, trying to stick to that intelligence. 54:07.030 --> 54:13.730 And finally, as you actually operate, obviously, you're going to have to set up all the infrastructure, test it out and get it going. 54:13.770 --> 54:19.990 But once you're emulating the adversary, try to think about the modus operandi that we thought about earlier. 54:20.110 --> 54:23.350 Adversary is trying to steal targeted information. 54:23.510 --> 54:29.130 The goal is not to get into the domain controller. 54:29.210 --> 54:32.950 I saw somebody on Discord that I said hacked the Gibson. 54:34.210 --> 54:38.350 Think about your goal throughout this and where is it you're actually trying to get to. 54:38.510 --> 54:39.990 And then think about pacing. 54:39.990 --> 54:43.630 How is it that the adversary actually operates? 54:43.630 --> 54:48.390 Are they somebody that is slow and methodical in how they're spreading out? 54:48.390 --> 54:50.510 Are they doing a smash and grab? 54:52.510 --> 54:55.010 Think about that as much as possible . 54:56.190 --> 55:02.010 In closing, some of the things I hope to take away from this is pick your adversary wisely. 55:02.010 --> 55:08.550 There are a lot of things you can think about to leverage Intel in the selection of an adversary in the first place. 55:08.630 --> 55:11.150 The Intel in your adversary isn't going to be perfect. 55:11.150 --> 55:15.170 It doesn't matter if you're getting it from attack, original sources, or wherever. 55:15.470 --> 55:18.570 But it is not going to be perfect. 55:18.710 --> 55:23.110 But you can still emulate an adversary with imperfect Intel. 55:23.110 --> 55:29.730 So this is something you can pull off even though you're not going to know absolutely everything about an adversary. 55:31.730 --> 55:40.490 I'll post my slides, but some of the links to resources I used in here between ATT&CK Navigator and ATT&CK itself. 55:40.490 --> 55:47.370 We've put out a couple of emulation plans where we've used a lot of this process and how we've actually done it. 55:47.610 --> 55:58.170 And we've got our own Red Team automated tool, Caldera, that we've actually ported the APT29 emulation plan over to. 55:59.950 --> 56:05.770 And I'm reachable in a couple different venues via ATT&CK, via Twitter, whatever. 56:06.950 --> 56:08.490 And that's it for me. 56:08.690 --> 56:17.610 And so I'm going to be answering questions in Discord after this, but a couple I did catch scroll by that I'll take on now. 56:17.610 --> 56:22.710 So I saw somebody saying, am I talking about the pre-ATT&CK stuff? 56:22.830 --> 56:23.830 Yes. 56:23.830 --> 56:28.670 So we're undergoing a merger right now of the information that's in pre-ATT&CK. 56:28.670 --> 56:38.430 We are refactoring it down to just information that is technical, things that some defenders somewhere can see. 56:38.430 --> 56:42.670 So some of the intelligence planning steps are going to be going away. 56:42.670 --> 56:48.130 And we're refactoring that into two new tactics, reconnaissance and resource development. 56:48.130 --> 56:52.230 So that's something you can expect to see in the next release of pre-ATT&CK. 56:52.930 --> 56:57.010 And with that, I will be answering questions in Discord. 56:57.010 --> 56:58.890 And thank you for attending my talk. 56:59.250 --> 57:00.790 Thank you so much, Adam. 57:00.810 --> 57:06.610 And thank you for supporting not only the community and the DEF CON, but the Red Team Village as well. 57:06.610 --> 57:07.730 Amazing talk. 57:08.030 --> 57:19.610 And for those of you that are watching in Twitch, YouTube, that's where you can get access to the Discord server that Adam was mentioning. 57:20.210 --> 57:24.010 We're going to go on a brief break and the next presentation will start in just a moment