1
00:00:01,800 --> 00:00:04,400
Hello, hello everyone.

2
00:00:04,400 --> 00:00:05,640
This is Erdener.

3
00:00:05,640 --> 00:00:08,800
I'm here with my colleague Gökberk.

4
00:00:08,880 --> 00:00:10,240
Hi.

5
00:00:11,640 --> 00:00:14,240
Thanks for joining our session.

6
00:00:14,240 --> 00:00:18,320
We are very excited to be part of the Red Team Village this year.

7
00:00:18,720 --> 00:00:25,320
The title of our session is Executing Red Team Scenarios with Built-in Scenario Plays.

8
00:00:27,040 --> 00:00:31,500
First of all, let's start with introducing ourselves a little bit.

9
00:00:32,700 --> 00:00:34,540
Hi everyone.

10
00:00:34,540 --> 00:00:35,900
I am Gökberk.

11
00:00:35,900 --> 00:00:40,300
I am a Penetration Tester and Red Team Operator.

12
00:00:40,300 --> 00:00:47,740
I have worked across a variety of industries, including financial service and government service.

13
00:00:47,820 --> 00:00:54,720
Currently, I am working as an Offensive Security Engineer at an industry-leading bank.

14
00:00:54,720 --> 00:01:01,860
I plan and conduct full-scope Red Team engagements that simulate realistic and targeted attacks.

15
00:01:02,660 --> 00:01:17,040
Also, I am responsible for performing host infrastructure penetration testing, web and mobile application testing, social engineering engagements, source code reviews, and wireless penetration tests.

16
00:01:17,040 --> 00:01:28,000
In the past, I have given several presentations on malware analysis, Red Team operations, exploit development, and IoT security.

17
00:01:29,560 --> 00:01:31,460
Thank you Gökberk.

18
00:01:31,460 --> 00:01:33,980
And my name is Erdener.

19
00:01:33,980 --> 00:01:39,060
I have about 10 years of experience in IT and information security.

20
00:01:39,060 --> 00:01:46,780
During this time, I had a chance to work at research institutes, a Fortune 100 company, and a bug bounty company.

21
00:01:47,040 --> 00:02:01,240
I took roles in development teams in security operations and application security teams that are focused on security tool development, penetration testing, and vulnerability assessments.

22
00:02:01,340 --> 00:02:05,300
Currently, I am working as an Application Security Engineer.

23
00:02:06,400 --> 00:02:17,400
Today, we are going to talk about our tool called Red Team Built-in Scenario Place, also called Manticore platform.

24
00:02:17,500 --> 00:02:24,880
We are going to demonstrate how to execute some adversary emulation scenarios like ransomware attack with this tool.

25
00:02:24,880 --> 00:02:42,220
We'll start the discussion with a brief introduction to what MITRE ATT&CK framework is, then we'll discuss the challenges concerning adversary emulation and its relation tools to show a little bit about why we needed to build, why we wanted to build such a tool,

26
00:02:42,220 --> 00:02:47,040
and later we'll talk about the features of this open source scenario place.

27
00:02:48,520 --> 00:03:08,180
Through the end, we'll demo the tool, and we are going to show the user interface, some scenario cards on it, and we'll execute some sample scenarios like APT29, LOL beans, and a simplified ransomware scenario using the command line client.

28
00:03:08,180 --> 00:03:10,980
Finally, we'll finish with the feature work.

29
00:03:12,220 --> 00:03:14,140
All right, let's start.

30
00:03:14,780 --> 00:03:24,180
So, as we all know, Red Team activities are one of the fastest developing solutions against today's cyber attacks.

31
00:03:24,180 --> 00:03:30,380
And recently, the number of tools that propose to help Red Teams is increasing quite rapidly.

32
00:03:30,520 --> 00:03:37,360
And following this trend, we have also created an adversarial emulation tool for Red Teams.

33
00:03:37,360 --> 00:03:45,420
This is an open source tool, and its aim is to aid a Red Team to execute several types of attack scenarios.

34
00:03:45,420 --> 00:03:59,300
It also gives more visibility to the Blue Teams to see what's being executed on their endpoints, or what malicious traffic is going through their network during a Red Team exercise.

35
00:03:59,300 --> 00:04:06,590
So the initial version of this tool was presented at the previous Red Team Village event back in May.

36
00:04:07,040 --> 00:04:12,630
And since then, it has been improved with scenarios, and it has been published on GitHub.

37
00:04:13,700 --> 00:04:23,420
Basically, we have categories of scenarios as network-based, endpoint-based, and APT group-based.

38
00:04:23,420 --> 00:04:31,580
And there is also a section for Blue Team techniques, showing some hardening controls related to executed scenarios.

39
00:04:32,360 --> 00:04:38,220
You can find the GitHub repository link on the slide here.

40
00:04:38,220 --> 00:04:49,740
All the scenarios inside the repo that we are releasing are mapped to the MyTrace attack framework.

41
00:04:49,740 --> 00:04:55,260
And the techniques and the tactics can be found in this framework.

42
00:04:55,260 --> 00:04:58,060
I will talk about the framework in a minute.

43
00:04:58,280 --> 00:05:13,400
You will see the reference numbers, the attack IDs of the scenarios, of the techniques, inside the configuration files for each scenario if you go to the GitHub repository.

44
00:05:13,400 --> 00:05:16,100
But we will go into detail about this.

45
00:05:17,300 --> 00:05:21,620
So, what is MyTrace attack framework?

46
00:05:21,620 --> 00:05:26,960
For those of you who see this for the first time, let me briefly explain it.

47
00:05:27,180 --> 00:05:38,180
When you visit this website, attack.mytr.org, you see a matrix of items called attack matrix of enterprise.

48
00:05:39,660 --> 00:05:42,840
The columns of this matrix are tactics.

49
00:05:42,840 --> 00:05:47,220
And tactics are mainly the objective of the attack attempt.

50
00:05:47,420 --> 00:05:51,060
The goal that an attacker tries to achieve.

51
00:05:51,060 --> 00:05:56,100
So you can see 12 columns here.

52
00:05:56,100 --> 00:06:00,200
Each of them represents an attack goal.

53
00:06:01,140 --> 00:06:05,320
And under each attack goal, there are techniques.

54
00:06:05,320 --> 00:06:09,420
And each of these techniques has an attack ID with it.

55
00:06:09,420 --> 00:06:13,740
So in total there are 12 tactics listed in MyTrace.

56
00:06:13,740 --> 00:06:19,760
And these tactics have around 250 different techniques.

57
00:06:19,940 --> 00:06:32,280
This framework is a great knowledge base classifying these adversary tactics and techniques that are used to attack targets in real life.

58
00:06:32,280 --> 00:06:42,420
Of course, this framework is not only beneficial for red teamers, but also organizations are also benefiting from it to learn about the attack methods.

59
00:06:43,440 --> 00:06:48,720
And the framework is open to any person and organization for use at no charge.

60
00:06:49,020 --> 00:07:05,340
And just like how OWASP's top 10 framework is being embedded in most application security tools, a great resource like this one is becoming a fundamental reference of red teams and adversarial emulation tools.

61
00:07:06,500 --> 00:07:11,080
So our open source tool is no exception for this.

62
00:07:11,660 --> 00:07:24,380
And as I said, there are 12 tactics almost chronologically starting with the initial access and going to the impact goal of an attack.

63
00:07:24,380 --> 00:07:30,380
So in the initial access part, the attacker is trying to penetrate the targets.

64
00:07:30,880 --> 00:07:37,200
And then comes the execution, when the attacker is simply trying to run a malicious code.

65
00:07:38,360 --> 00:07:43,160
And the list goes on actually, I'm not going to details a lot.

66
00:07:43,600 --> 00:07:50,400
Just to see some examples for techniques, let's take the execution tactic.

67
00:07:50,400 --> 00:07:57,700
So for the execution tactic, there are 10 techniques listed underneath it.

68
00:07:57,700 --> 00:08:01,580
Some of these have some subcategories as well.

69
00:08:02,020 --> 00:08:16,320
The techniques listed here are about the methods that an attacker can use to run code, basically execute a code on a local or remote system to reach their main objective.

70
00:08:16,320 --> 00:08:23,940
This execution tactic is also often interconnected with other tactics.

71
00:08:23,940 --> 00:08:41,680
For example, as a red teamer, your execution technique of using command and scripting interpreter could be running a PowerShell script to perform a file download from a remote server that will be used for the discovery goal.

72
00:08:41,680 --> 00:08:47,980
So it would be related to the discovery goal in that sense.

73
00:08:47,980 --> 00:09:01,980
You can check out the market's website for more details, and we have seen that there are many great talks in the program about this framework, and we suggest that you check them for getting more insights about it.

74
00:09:01,980 --> 00:09:10,960
We just tried to mention the technique and tactic idea here, how we mapped it in our tool.

75
00:09:11,680 --> 00:09:25,080
Next, the offensive teams have some common exercises like vulnerability assessments, penetration testing, and adversary emulation.

76
00:09:25,080 --> 00:09:42,600
Skipping the first two, the last one, adversary emulation is what we focus actually right now, and it's an activity where red teamers, as the name refers, try to emulate or imitate how an adversary performs during a real-life attack.

77
00:09:42,760 --> 00:09:51,960
The platform we'll demo here is focused on adversary emulation, as I've said, performed inside the network of an organization.

78
00:09:51,960 --> 00:09:59,900
So in a way, you can think that initial access tactic has been achieved, and we are moving on to the other tactics.

79
00:09:59,900 --> 00:10:07,580
Therefore, we can say that this tool will be most useful for internal red teams or purple teams.

80
00:10:08,280 --> 00:10:18,780
Now let's discuss some issues faced with adversary emulation, and what we want to see with this tool.

81
00:10:19,300 --> 00:10:30,500
So, it's not going to be an answer to all these problems, the tool is not going to be an answer to all these problems, but we think it's a step to solve some of them at least.

82
00:10:30,520 --> 00:10:39,780
First of all, emulating adversarial behavior is costly, because their techniques are complex and requires time.

83
00:10:39,780 --> 00:10:45,840
And it's not common to see the tools created or used by malicious actors in the wild.

84
00:10:45,840 --> 00:10:50,520
That's why adversary emulation is an expensive exercise.

85
00:10:51,000 --> 00:10:54,160
Next thing is the scenario transparency.

86
00:10:54,160 --> 00:11:00,160
We have seen that adversarial emulation tools do not provide transparency in their scenarios.

87
00:11:00,220 --> 00:11:02,720
That's what we wanted to avoid by this tool.

88
00:11:02,720 --> 00:11:14,220
In our experience, we saw that there is a need for collaboration between red and blue teams, especially for internal security teams of big organizations.

89
00:11:14,560 --> 00:11:22,560
Blue teams cannot easily see the adversarial emulation behavior due to black box nature of the red team's attacks.

90
00:11:22,560 --> 00:11:29,540
This causes a problem in terms of improving their incident response capabilities efficiently.

91
00:11:29,540 --> 00:11:32,700
Another problem is tool availability.

92
00:11:34,300 --> 00:11:40,640
While emulating adversaries, tool availability is another issue.

93
00:11:41,340 --> 00:11:49,000
Red teams cannot easily find the tools used by the malicious actors, just like we mentioned in the cost challenge.

94
00:11:49,000 --> 00:11:56,320
Therefore, bringing all publicly available scenarios together, we think it will be the best option for red teams.

95
00:11:58,200 --> 00:12:01,800
Repeatability is another issue in adversary emulation.

96
00:12:02,380 --> 00:12:02,700
Why?

97
00:12:02,700 --> 00:12:07,340
Because sometimes during the red team engagement, a test may fail.

98
00:12:07,640 --> 00:12:16,060
But the device configuration may be changed at a later point by someone or by some service account.

99
00:12:16,060 --> 00:12:20,220
So, the same test may pass on another try.

100
00:12:20,260 --> 00:12:28,040
Therefore, it would be great to have some parts of adversary emulation engagements automated, continuous, and repeatable.

101
00:12:28,040 --> 00:12:36,290
It's nice to have a system where the security teams are able to schedule these tests to run at frequent intervals.

102
00:12:37,350 --> 00:12:48,350
Another issue is that adversary emulation exercises has some malicious softwares used by the red teams.

103
00:12:48,350 --> 00:12:56,730
So, these malicious software can cause unexpected situations on corporate devices and networks.

104
00:12:57,190 --> 00:13:04,510
It's also a great idea to have visibility on which software will be used during the engagement.

105
00:13:06,490 --> 00:13:14,710
What's more, there are also some challenges with regards to other tools used by the red teams.

106
00:13:15,070 --> 00:13:25,310
Like for the on-premise installation of simulation tools, updated attacks cannot easily be imported into the infrastructure, into the platforms.

107
00:13:25,310 --> 00:13:32,730
With this tool, the security engineer has the chance to point to a URI, to a repo, where everything is up to date.

108
00:13:33,770 --> 00:13:44,470
Investigating different commercial or open-source tools, we could get the general idea of how many scenarios are available for a security team.

109
00:13:44,690 --> 00:13:52,690
So, we saw that there are about 2000 scenarios in the wild, and all of them cannot be reached from a single place.

110
00:13:54,050 --> 00:14:01,990
Most of the tools used for emulation also do not take advantage of the open-source technology.

111
00:14:01,990 --> 00:14:08,210
Having a place of scenarios enriched by the red team community would be valuable to everyone.

112
00:14:08,570 --> 00:14:14,830
Reporting, on the other hand, is also another issue for the simulation tools.

113
00:14:14,930 --> 00:14:21,430
These tools do not provide enough information for understanding the attack surface and attack vectors.

114
00:14:22,210 --> 00:14:29,230
And finally, simulation tools are too complex for creating and updating scenarios.

115
00:14:29,230 --> 00:14:34,030
They don't have a general structure, like a standard model for scenarios.

116
00:14:34,030 --> 00:14:41,450
We tried to standardize this by a scenario model in the JSON format, that you can see in the slide.

117
00:14:42,210 --> 00:15:00,610
So, we have the ID specific to the scenario, with the initials of the tactic used there, and the tactic names, the description and name of the scenario, and the mapping to the MITRE ATT&CK framework.

118
00:15:00,610 --> 00:15:07,710
We also have the type of the scenario, like is it an endpoint scenario, is it a network or an APT.

119
00:15:07,710 --> 00:15:13,770
And also describing the platform, the operating system that it targets.

120
00:15:18,110 --> 00:15:27,430
So, overall, the MantCore platform, as we call it, this built-in scenario place, has the following features.

121
00:15:27,430 --> 00:15:35,350
First of all, the tool and the methodology we use in emulating adversarial attacks with this tool is open source.

122
00:15:35,350 --> 00:15:39,770
And therefore, this is very cost effective compared to commercial tools.

123
00:15:40,310 --> 00:15:46,210
We prepared a scenario environment that makes it faster and less complicated for red teamers.

124
00:15:46,210 --> 00:15:53,210
They can easily apply the tests from different open sources, like Atomic Red Team or Red Canary.

125
00:15:54,070 --> 00:16:03,790
It gives red teamers the access to the scenarios according to specific attack types, as divided in MITRE categories.

126
00:16:03,790 --> 00:16:11,590
And what's more important, the blue teamers will be able to see these attacks within a transparent process.

127
00:16:11,690 --> 00:16:20,270
The config files clearly show the sources of threat scenarios and the payloads used within it.

128
00:16:21,130 --> 00:16:29,950
Of course, organizations may still prefer to perform the blind engagement, blind red team engagement, depending on their security maturity.

129
00:16:29,950 --> 00:16:37,850
But we think a visible engagement plan can be much more helpful for most of the organizations.

130
00:16:41,690 --> 00:16:52,150
And so, blue teams, we talked about blue team detection and prevention to distribution of scenarios.

131
00:16:52,150 --> 00:17:06,230
While checking the scenarios, we saw that commercial and open source tools mostly have bias towards Windows environments.

132
00:17:06,910 --> 00:17:19,830
And the number of scenarios is distributed like 60% for Windows and 20% for macOS and 20% for Linux environments.

133
00:17:19,830 --> 00:17:26,250
With the community's support, it's possible to increase scenarios on the Mac and Linux side as well.

134
00:17:26,250 --> 00:17:34,150
And therefore, balancing this distribution would be a good product at the end.

135
00:17:35,270 --> 00:17:42,990
With this platform, APT scenarios can also be recreated and visible to both red teams and blue teams.

136
00:17:42,990 --> 00:17:49,630
Since everyone can contribute, red teams will have the chance to add advanced attack scenarios in their toolbox.

137
00:17:49,830 --> 00:17:56,270
And build a community to protect and improve defense against attack and breach scenarios.

138
00:17:57,070 --> 00:18:06,970
Now I will stop sharing the screen and Jörg Berg is going to tell you how we structured this tool, showing the GitHub repository.

139
00:18:06,970 --> 00:18:15,090
And finally, the more exciting part, we will show the demo of the tool and finally talk about our featured work.

140
00:18:19,480 --> 00:18:21,320
Hello again.

141
00:18:21,720 --> 00:18:26,180
Now we will continue with the presentation.

142
00:18:29,580 --> 00:18:33,010
Now we will look at the public threat repository.

143
00:18:33,300 --> 00:18:39,500
For this presentation, we released some complex scenarios on our GitHub account.

144
00:18:39,680 --> 00:18:43,100
We are mapping these scenarios to the Maitre.

145
00:18:43,100 --> 00:18:53,320
So far, we published three complex scenarios named as APT29, LOL beans and ransomware.

146
00:18:53,760 --> 00:18:59,160
In the next, this public repository includes publicly known scenarios.

147
00:18:59,160 --> 00:19:01,980
You can see this on our GitHub repository.

148
00:19:01,980 --> 00:19:05,460
Later we will go deeply into it.

149
00:19:06,900 --> 00:19:13,080
In the next slides, we will look at public threat scenarios, public scenario repository.

150
00:19:13,100 --> 00:19:17,740
We released threat scenarios on our GitHub account.

151
00:19:17,740 --> 00:19:22,800
All scenarios are again prepared with regards to Maitre.

152
00:19:22,800 --> 00:19:27,780
From these scenarios, complex scenario groups are generated.

153
00:19:27,780 --> 00:19:32,040
For example, if you look at ransomware emulation.

154
00:19:32,040 --> 00:19:37,880
Ransomware emulation includes two scenarios included in public scenario repository.

155
00:19:37,880 --> 00:19:41,740
It has two JSON files with their IDs.

156
00:19:41,740 --> 00:19:46,240
These include attack type, attack payloads and platform information.

157
00:19:46,240 --> 00:19:48,640
I will show you later that.

158
00:19:51,150 --> 00:19:59,690
For ransomware emulation, in this section, we will look at ransomware emulation scenarios for generating public scenarios.

159
00:20:00,170 --> 00:20:05,330
We have two different implementations for ransomware emulation.

160
00:20:05,330 --> 00:20:08,190
One of them is written by Go.

161
00:20:08,190 --> 00:20:11,410
The other one is PowerShell based.

162
00:20:11,410 --> 00:20:19,330
This released implementation is not covering all steps of real ransomware attack, but this is on purpose.

163
00:20:19,370 --> 00:20:24,910
Because we wanted to release a simplified implementation of this scenario.

164
00:20:24,910 --> 00:20:30,410
There is no CC or server communication or encrypting all files.

165
00:20:30,410 --> 00:20:37,430
We are encrypting a file that we create on the fly and decrypt it in this file.

166
00:20:37,430 --> 00:20:44,490
Adding the few missing points, these implementations can be converted to full ransomware emulation.

167
00:20:44,490 --> 00:20:55,990
Yet, our aim is to test if a defense mechanism could prevent the core function of ransomware, which is encrypting files.

168
00:21:00,200 --> 00:21:06,040
In this section, we will speak about Manticore Adversary Emulation CLI tool.

169
00:21:07,040 --> 00:21:14,880
This tool is working with public threat scenarios, which I showed earlier in another repository.

170
00:21:15,040 --> 00:21:24,380
As we said before, we have seen that adversary emulation tools do not provide transparency in some of their scenarios.

171
00:21:24,380 --> 00:21:34,420
Here, we publish command-line based adversary emulation tool that is fully open source to bring some visibility to how emulation works.

172
00:21:36,040 --> 00:21:41,060
All threats and scenarios are public and configurable.

173
00:21:41,500 --> 00:21:48,900
Red teamers, blue teamers can easily edit this tool according to their aim.

174
00:21:48,900 --> 00:21:57,200
Also, this CLI is developed in Go language for achieving multiplatform execution.

175
00:21:57,200 --> 00:22:07,820
This tool includes single config CLI, which is shown here, public scenarios, payloads, and threats.

176
00:22:07,820 --> 00:22:13,660
With this config CLI, command-line based tool emulates adversary.

177
00:22:15,600 --> 00:22:21,290
Now, we will look at our demo for this presentation.

178
00:22:22,230 --> 00:22:32,710
We have one remote machine and we will run adversary emulation scenarios here.

179
00:22:33,410 --> 00:22:43,560
For looking scenarios, which are used by the CLI tool, here we can see public threat repository.

180
00:22:44,010 --> 00:22:48,170
Here, we can see three different kinds of scenario collection.

181
00:22:48,170 --> 00:22:56,470
There are many scenarios in our backlog and we are importing all of these gradually.

182
00:22:56,470 --> 00:23:00,270
And these scenarios can be easily updated.

183
00:23:01,750 --> 00:23:05,490
All kind of these scenarios is compatible with Maitre.

184
00:23:06,810 --> 00:23:15,270
Firstly, we will look at our built-in scenario place before the demo.

185
00:23:18,130 --> 00:23:20,610
Demo of the CLI tool.

186
00:23:20,710 --> 00:23:28,390
Here, we can see which is shown in our public GitHub repository threat scenarios.

187
00:23:28,390 --> 00:23:30,310
We can see here too.

188
00:23:30,310 --> 00:23:44,230
For example, for PowerShell, one of the example scenarios, execute PowerShell from the CMD executable to collect and compress files of specific extensions.

189
00:23:44,230 --> 00:23:46,510
It is used by the Windows platforms.

190
00:23:47,030 --> 00:23:50,990
It is designed for the Windows platforms.

191
00:23:51,210 --> 00:23:54,510
There, we can see Maitre tags.

192
00:23:54,570 --> 00:23:56,330
Maitre tag name.

193
00:23:56,330 --> 00:23:59,590
Also, we can go into the scenario here.

194
00:23:59,930 --> 00:24:04,190
If we go here, we can see scenario.

195
00:24:05,530 --> 00:24:14,970
If we click on it, we can see there is a simple structure of the JS listed as scenario.

196
00:24:15,270 --> 00:24:22,530
Here, the technique, attack ID, name, type, platform and command and interface.

197
00:24:22,530 --> 00:24:25,750
You can see here, PowerShell is the interface.

198
00:24:25,990 --> 00:24:28,470
Also, you can see here the ID.

199
00:24:29,530 --> 00:24:35,710
Also, we said before too, we have many scenarios in our backlog.

200
00:24:35,870 --> 00:24:39,390
And we will try to import all of these scenarios.

201
00:24:39,390 --> 00:24:46,350
And we will release, we will publish them to Red Teamers, Blue Teamers, Purple Teamers.

202
00:24:49,500 --> 00:24:58,020
For now, we will execute the scenarios with our CLI tool instead of using UI interface.

203
00:24:59,880 --> 00:25:07,580
Next, we will look at our CLI tool, which is published on GitHub repository again.

204
00:25:07,580 --> 00:25:12,540
Here, we can see our Adversary Emulation Client CLI tool.

205
00:25:12,840 --> 00:25:18,460
You can easily compile this on your own infrastructure.

206
00:25:18,460 --> 00:25:22,180
Also, for ease of use, we published a release.

207
00:25:22,180 --> 00:25:27,080
Here, you can go into the release and you can download config.ini file.

208
00:25:27,080 --> 00:25:31,120
And you can download Manticore CLI executable.

209
00:25:31,120 --> 00:25:38,620
You can run this executable with the config.ini file within same directory.

210
00:25:40,820 --> 00:25:45,080
config.ini file includes three components.

211
00:25:45,080 --> 00:25:51,200
One of them is public direct group URL, which is used for complex scenario collection.

212
00:25:52,420 --> 00:25:56,540
Other one is public threat scenarios URL section.

213
00:25:57,760 --> 00:26:01,180
It shows threat scenario repository.

214
00:26:01,180 --> 00:26:07,140
Last one is the payload location, which is used for scenario payloads.

215
00:26:07,220 --> 00:26:16,360
For execution, as we told before, you simply compile or download executable and config.ini file.

216
00:26:16,360 --> 00:26:20,700
You cite necessary URLs for parsing repository on the platform.

217
00:26:21,200 --> 00:26:29,560
In the threat groups URL, you can give multiple URLs for emulation, as it accepts an array of URLs.

218
00:26:29,780 --> 00:26:40,480
Now, we will firstly will emulate LOLbins emulation for Dove landing a file from a remote server.

219
00:26:40,980 --> 00:26:46,700
As we can see here, we give threat group URL.

220
00:26:47,200 --> 00:26:49,980
We are coming our tool.

221
00:26:49,980 --> 00:26:56,300
Here, our config.ini file and multi-core CLI executable.

222
00:26:56,300 --> 00:27:02,400
When we run it, emulation is starting.

223
00:27:28,500 --> 00:27:34,380
We have some connection problems here.

224
00:27:34,660 --> 00:27:37,320
I will connect again.

225
00:28:02,440 --> 00:28:08,740
If we can see here, you can see LOLbin emulation.

226
00:28:09,280 --> 00:28:12,620
There are two binaries for Dove landing malicious executable.

227
00:28:12,740 --> 00:28:19,300
One of them is using certutil for Dove landing a file from a remote server.

228
00:28:20,060 --> 00:28:27,740
In the description, we can see this steps Dove landing a file from a remote web server to host using certutil.

229
00:28:27,760 --> 00:28:38,540
Also, we have a different second scenario uses bitsadmin.executable to Dove landing a file from a remote server.

230
00:28:39,280 --> 00:28:41,380
That can be seen here.

231
00:28:46,900 --> 00:28:55,320
Next, we will emulate ransomware which is published on the multi-core GitHub repository.

232
00:28:58,140 --> 00:29:02,410
If we go there, clearly we can see.

233
00:29:03,680 --> 00:29:06,380
It includes two phases.

234
00:29:07,300 --> 00:29:15,380
For generating this scenarios, we used ransomware emulation repository.

235
00:29:16,240 --> 00:29:19,060
First one is Go-based ransomware emulation.

236
00:29:19,060 --> 00:29:22,960
Second one is PowerShell-based ransomware emulation.

237
00:29:23,060 --> 00:29:29,180
If we edit our thread group URL,

238
00:29:36,300 --> 00:29:41,400
then we are running our CLI again.

239
00:29:46,910 --> 00:29:55,190
Firstly, Go-based multi-platform ransomware emulation is simulated.

240
00:29:55,190 --> 00:30:00,440
Also, secondly, PowerShell-based ransomware emulation is simulated.

241
00:30:00,870 --> 00:30:04,300
For example, if we look at the first scenario.

242
00:30:04,730 --> 00:30:08,050
First, ISK is generated.

243
00:30:08,050 --> 00:30:13,250
Then, encrypted ISK is generated via public key.

244
00:30:13,250 --> 00:30:18,230
Then, decrypted ISK via generated private key.

245
00:30:18,570 --> 00:30:24,450
Here, we can see encrypted file content and decrypted file content.

246
00:30:25,190 --> 00:30:28,530
And we can finally see scenario result here.

247
00:30:29,670 --> 00:30:35,590
If you wonder, for example, ransomware emulation executable here listed.

248
00:30:35,590 --> 00:30:42,050
As we said before, it is compiled from this repository.

249
00:30:42,050 --> 00:30:47,130
You can easily compile that and you can run in your infrastructure.

250
00:30:52,260 --> 00:30:59,320
Finally, we will add APT29 emulation URL in config file.

251
00:30:59,320 --> 00:31:04,300
Which does not show all scenarios, but few of them we will try to emulate.

252
00:31:11,510 --> 00:31:19,210
For being clear, if we go into APT21 JSON file.

253
00:31:19,210 --> 00:31:22,810
There we can see different scenario phases.

254
00:31:22,910 --> 00:31:26,350
And you can easily go into it.

255
00:31:27,070 --> 00:31:29,250
In our github repository.

256
00:31:36,820 --> 00:31:39,020
For example.

257
00:31:43,200 --> 00:31:50,620
In one of the examples, screen capture native api calls were used to collect a screenshot.

258
00:31:50,620 --> 00:31:59,460
It imports the getScreenshot.ps1 file, publish shell file, then call the function.

259
00:31:59,460 --> 00:32:02,680
And we will emulate now this one.

260
00:32:02,680 --> 00:32:04,980
We are closing that.

261
00:32:11,150 --> 00:32:15,490
I will check config file again

262
00:32:24,060 --> 00:32:24,940
.

263
00:32:29,440 --> 00:32:33,340
Here we can see scenario execution is continuing.

264
00:33:08,220 --> 00:33:13,060
Here we completed partially APT29 emulation.

265
00:33:13,060 --> 00:33:17,080
As we told before, it is partial.

266
00:33:17,080 --> 00:33:19,000
We have different kind of scenarios.

267
00:33:19,000 --> 00:33:23,300
You can clearly go them in our github repository.

268
00:33:23,300 --> 00:33:31,680
We are trying to import all available scenarios into our platform.

269
00:33:31,680 --> 00:33:39,240
Easily people can reach them and they can generate complex scenarios from them.

270
00:33:42,960 --> 00:33:47,000
If we continue our slides.

271
00:33:50,350 --> 00:33:57,630
For the future work, we are continuing to add all available scenarios to the repository.

272
00:33:57,630 --> 00:34:04,830
We are also working on the feature of running scheduled scenarios throughout the UI.

273
00:34:05,690 --> 00:34:15,670
Another plan is to integrate our threat intelligence framework into this scenario tool to contribute to the scenario generation and attack prevention.

274
00:34:16,490 --> 00:34:23,590
In the public release, we will add reporting feature that will be added.

275
00:34:23,590 --> 00:34:37,590
In the other hand, for achieving purple team, we will add security management software integration into our CLI tool and UI feature user interface.

276
00:34:37,590 --> 00:34:47,070
Easily red teamers, blue teamers can query which scenario is detected or prevented.

277
00:34:47,890 --> 00:34:53,570
In the next, we are waiting for the community support for this tool.

278
00:34:55,130 --> 00:34:57,490
Thanks for listening.

279
00:34:57,870 --> 00:35:03,790
If you have any questions, please ask us live in discord.

280
00:35:03,790 --> 00:35:11,350
Also, you can reach us if you want from this email address.

281
00:35:11,350 --> 00:35:17,370
Also, we are waiting for your support on our github platform.

282
00:35:17,370 --> 00:35:18,890
Thank you so much again.