start	end	text
1800	8800	Hello, hello everyone. This is Erdener. I'm here with my colleague Gökberk.
8880	10240	Hi.
11640	18320	Thanks for joining our session. We are very excited to be part of the Red Team Village this year.
18720	25320	The title of our session is Executing Red Team Scenarios with Built-in Scenario Plays.
27040	31500	First of all, let's start with introducing ourselves a little bit.
32700	40300	Hi everyone. I am Gökberk. I am a Penetration Tester and Red Team Operator.
40300	47740	I have worked across a variety of industries, including financial service and government service.
47820	54720	Currently, I am working as an Offensive Security Engineer at an industry-leading bank.
54720	61860	I plan and conduct full-scope Red Team engagements that simulate realistic and targeted attacks.
62660	70940	Also, I am responsible for performing host infrastructure penetration testing, web and mobile application testing,
70940	77040	social engineering engagements, source code reviews, and wireless penetration tests.
77040	88000	In the past, I have given several presentations on malware analysis, Red Team operations, exploit development, and IoT security.
89560	99060	Thank you Gökberk. And my name is Erdener. I have about 10 years of experience in IT and information security.
99060	106780	During this time, I had a chance to work at research institutes, a Fortune 100 company, and a bug bounty company.
107040	113380	I took roles in development teams in security operations and application security teams
113640	121240	that are focused on security tool development, penetration testing, and vulnerability assessments.
121340	125300	Currently, I am working as an Application Security Engineer.
126400	133480	Today, we are going to talk about our tool called Red Team Built-in Scenario Place,
134520	137400	also called Manticore platform.
137500	144880	We are going to demonstrate how to execute some adversary emulation scenarios like ransomware attack with this tool.
144880	150820	We'll start the discussion with a brief introduction to what MITRE ATT&CK framework is,
150820	156240	then we'll discuss the challenges concerning adversary emulation and its relation tools
156240	162220	to show a little bit about why we needed to build, why we wanted to build such a tool,
162220	167040	and later we'll talk about the features of this open source scenario place.
168520	176080	Through the end, we'll demo the tool, and we are going to show the user interface, some scenario cards on it,
176080	183400	and we'll execute some sample scenarios like APT29, LOL beans,
183400	188180	and a simplified ransomware scenario using the command line client.
188180	190980	Finally, we'll finish with the feature work.
192220	194140	All right, let's start.
194780	204180	So, as we all know, Red Team activities are one of the fastest developing solutions against today's cyber attacks.
204180	210380	And recently, the number of tools that propose to help Red Teams is increasing quite rapidly.
210520	217360	And following this trend, we have also created an adversarial emulation tool for Red Teams.
217360	225420	This is an open source tool, and its aim is to aid a Red Team to execute several types of attack scenarios.
225420	232800	It also gives more visibility to the Blue Teams to see what's being executed on their endpoints,
232800	239300	or what malicious traffic is going through their network during a Red Team exercise.
239300	246590	So the initial version of this tool was presented at the previous Red Team Village event back in May.
247040	252630	And since then, it has been improved with scenarios, and it has been published on GitHub.
253700	263420	Basically, we have categories of scenarios as network-based, endpoint-based, and APT group-based.
263420	271580	And there is also a section for Blue Team techniques, showing some hardening controls related to executed scenarios.
272360	278220	You can find the GitHub repository link on the slide here.
278220	289740	All the scenarios inside the repo that we are releasing are mapped to the MyTrace attack framework.
289740	295260	And the techniques and the tactics can be found in this framework.
295260	298060	I will talk about the framework in a minute.
298280	307500	You will see the reference numbers, the attack IDs of the scenarios, of the techniques,
307500	313400	inside the configuration files for each scenario if you go to the GitHub repository.
313400	316100	But we will go into detail about this.
317300	321620	So, what is MyTrace attack framework?
321620	326960	For those of you who see this for the first time, let me briefly explain it.
327180	338180	When you visit this website, attack.mytr.org, you see a matrix of items called attack matrix of enterprise.
339660	342840	The columns of this matrix are tactics.
342840	347220	And tactics are mainly the objective of the attack attempt.
347420	351060	The goal that an attacker tries to achieve.
351060	356100	So you can see 12 columns here.
356100	360200	Each of them represents an attack goal.
361140	365320	And under each attack goal, there are techniques.
365320	369420	And each of these techniques has an attack ID with it.
369420	373740	So in total there are 12 tactics listed in MyTrace.
373740	379760	And these tactics have around 250 different techniques.
379940	386960	This framework is a great knowledge base classifying these adversary tactics and techniques
386960	392280	that are used to attack targets in real life.
392280	396680	Of course, this framework is not only beneficial for red teamers,
396680	402420	but also organizations are also benefiting from it to learn about the attack methods.
403440	408720	And the framework is open to any person and organization for use at no charge.
409020	416120	And just like how OWASP's top 10 framework is being embedded in most application security tools,
416440	425340	a great resource like this one is becoming a fundamental reference of red teams and adversarial emulation tools.
426500	431080	So our open source tool is no exception for this.
431660	439240	And as I said, there are 12 tactics almost chronologically starting with the initial access
440060	444380	and going to the impact goal of an attack.
444380	450380	So in the initial access part, the attacker is trying to penetrate the targets.
450880	457200	And then comes the execution, when the attacker is simply trying to run a malicious code.
458360	463160	And the list goes on actually, I'm not going to details a lot.
463600	470400	Just to see some examples for techniques, let's take the execution tactic.
470400	477700	So for the execution tactic, there are 10 techniques listed underneath it.
477700	481580	Some of these have some subcategories as well.
482020	489600	The techniques listed here are about the methods that an attacker can use to run code,
489600	496320	basically execute a code on a local or remote system to reach their main objective.
496320	503940	This execution tactic is also often interconnected with other tactics.
503940	510600	For example, as a red teamer, your execution technique of using command and scripting interpreter
510900	517860	could be running a PowerShell script to perform a file download from a remote server
517860	521680	that will be used for the discovery goal.
521680	527980	So it would be related to the discovery goal in that sense.
527980	531460	You can check out the market's website for more details,
531460	536720	and we have seen that there are many great talks in the program about this framework,
536720	541980	and we suggest that you check them for getting more insights about it.
541980	548740	We just tried to mention the technique and tactic idea here,
548740	550960	how we mapped it in our tool.
551680	561600	Next, the offensive teams have some common exercises like vulnerability assessments,
561600	565080	penetration testing, and adversary emulation.
565080	571420	Skipping the first two, the last one, adversary emulation is what we focus actually right now,
571420	575680	and it's an activity where red teamers, as the name refers,
575680	582600	try to emulate or imitate how an adversary performs during a real-life attack.
582760	588380	The platform we'll demo here is focused on adversary emulation, as I've said,
588380	591960	performed inside the network of an organization.
591960	596820	So in a way, you can think that initial access tactic has been achieved,
596820	599900	and we are moving on to the other tactics.
599900	607580	Therefore, we can say that this tool will be most useful for internal red teams or purple teams.
608280	614540	Now let's discuss some issues faced with adversary emulation,
614540	618780	and what we want to see with this tool.
619300	623400	So, it's not going to be an answer to all these problems,
623400	626260	the tool is not going to be an answer to all these problems,
626260	630500	but we think it's a step to solve some of them at least.
630520	635160	First of all, emulating adversarial behavior is costly,
635160	639780	because their techniques are complex and requires time.
639780	645840	And it's not common to see the tools created or used by malicious actors in the wild.
645840	650520	That's why adversary emulation is an expensive exercise.
651000	654160	Next thing is the scenario transparency.
654160	660160	We have seen that adversarial emulation tools do not provide transparency in their scenarios.
660220	662720	That's what we wanted to avoid by this tool.
662720	669720	In our experience, we saw that there is a need for collaboration between red and blue teams,
669720	674220	especially for internal security teams of big organizations.
674560	682560	Blue teams cannot easily see the adversarial emulation behavior due to black box nature of the red team's attacks.
682560	689540	This causes a problem in terms of improving their incident response capabilities efficiently.
689540	692700	Another problem is tool availability.
694300	700640	While emulating adversaries, tool availability is another issue.
701340	709000	Red teams cannot easily find the tools used by the malicious actors, just like we mentioned in the cost challenge.
709000	716320	Therefore, bringing all publicly available scenarios together, we think it will be the best option for red teams.
718200	721800	Repeatability is another issue in adversary emulation.
722380	727340	Why? Because sometimes during the red team engagement, a test may fail.
727640	736060	But the device configuration may be changed at a later point by someone or by some service account.
736060	740220	So, the same test may pass on another try.
740260	748040	Therefore, it would be great to have some parts of adversary emulation engagements automated, continuous, and repeatable.
748040	756290	It's nice to have a system where the security teams are able to schedule these tests to run at frequent intervals.
757350	768350	Another issue is that adversary emulation exercises has some malicious softwares used by the red teams.
768350	776730	So, these malicious software can cause unexpected situations on corporate devices and networks.
777190	784510	It's also a great idea to have visibility on which software will be used during the engagement.
786490	794710	What's more, there are also some challenges with regards to other tools used by the red teams.
795070	805310	Like for the on-premise installation of simulation tools, updated attacks cannot easily be imported into the infrastructure, into the platforms.
805310	812730	With this tool, the security engineer has the chance to point to a URI, to a repo, where everything is up to date.
813770	824470	Investigating different commercial or open-source tools, we could get the general idea of how many scenarios are available for a security team.
824690	832690	So, we saw that there are about 2000 scenarios in the wild, and all of them cannot be reached from a single place.
834050	841990	Most of the tools used for emulation also do not take advantage of the open-source technology.
841990	848210	Having a place of scenarios enriched by the red team community would be valuable to everyone.
848570	854830	Reporting, on the other hand, is also another issue for the simulation tools.
854930	861430	These tools do not provide enough information for understanding the attack surface and attack vectors.
862210	869230	And finally, simulation tools are too complex for creating and updating scenarios.
869230	874030	They don't have a general structure, like a standard model for scenarios.
874030	881450	We tried to standardize this by a scenario model in the JSON format, that you can see in the slide.
882210	892030	So, we have the ID specific to the scenario, with the initials of the tactic used there,
892030	900610	and the tactic names, the description and name of the scenario, and the mapping to the MITRE ATT&CK framework.
900610	907710	We also have the type of the scenario, like is it an endpoint scenario, is it a network or an APT.
907710	913770	And also describing the platform, the operating system that it targets.
918110	927430	So, overall, the MantCore platform, as we call it, this built-in scenario place, has the following features.
927430	935350	First of all, the tool and the methodology we use in emulating adversarial attacks with this tool is open source.
935350	939770	And therefore, this is very cost effective compared to commercial tools.
940310	946210	We prepared a scenario environment that makes it faster and less complicated for red teamers.
946210	953210	They can easily apply the tests from different open sources, like Atomic Red Team or Red Canary.
954070	963790	It gives red teamers the access to the scenarios according to specific attack types, as divided in MITRE categories.
963790	971590	And what's more important, the blue teamers will be able to see these attacks within a transparent process.
971690	980270	The config files clearly show the sources of threat scenarios and the payloads used within it.
981130	989950	Of course, organizations may still prefer to perform the blind engagement, blind red team engagement, depending on their security maturity.
989950	997850	But we think a visible engagement plan can be much more helpful for most of the organizations.
1001690	1012150	And so, blue teams, we talked about blue team detection and prevention to distribution of scenarios.
1012150	1026230	While checking the scenarios, we saw that commercial and open source tools mostly have bias towards Windows environments.
1026910	1039830	And the number of scenarios is distributed like 60% for Windows and 20% for macOS and 20% for Linux environments.
1039830	1046250	With the community's support, it's possible to increase scenarios on the Mac and Linux side as well.
1046250	1054150	And therefore, balancing this distribution would be a good product at the end.
1055270	1062990	With this platform, APT scenarios can also be recreated and visible to both red teams and blue teams.
1062990	1069630	Since everyone can contribute, red teams will have the chance to add advanced attack scenarios in their toolbox.
1069830	1076270	And build a community to protect and improve defense against attack and breach scenarios.
1077070	1086970	Now I will stop sharing the screen and Jörg Berg is going to tell you how we structured this tool, showing the GitHub repository.
1086970	1095090	And finally, the more exciting part, we will show the demo of the tool and finally talk about our featured work.
1099480	1106180	Hello again. Now we will continue with the presentation.
1109580	1113010	Now we will look at the public threat repository.
1113300	1119500	For this presentation, we released some complex scenarios on our GitHub account.
1119680	1123100	We are mapping these scenarios to the Maitre.
1123100	1133320	So far, we published three complex scenarios named as APT29, LOL beans and ransomware.
1133760	1139160	In the next, this public repository includes publicly known scenarios.
1139160	1145460	You can see this on our GitHub repository. Later we will go deeply into it.
1146900	1153080	In the next slides, we will look at public threat scenarios, public scenario repository.
1153100	1157740	We released threat scenarios on our GitHub account.
1157740	1162800	All scenarios are again prepared with regards to Maitre.
1162800	1167780	From these scenarios, complex scenario groups are generated.
1167780	1172040	For example, if you look at ransomware emulation.
1172040	1177880	Ransomware emulation includes two scenarios included in public scenario repository.
1177880	1181740	It has two JSON files with their IDs.
1181740	1188640	These include attack type, attack payloads and platform information. I will show you later that.
1191150	1199690	For ransomware emulation, in this section, we will look at ransomware emulation scenarios for generating public scenarios.
1200170	1205330	We have two different implementations for ransomware emulation.
1205330	1211410	One of them is written by Go. The other one is PowerShell based.
1211410	1219330	This released implementation is not covering all steps of real ransomware attack, but this is on purpose.
1219370	1224910	Because we wanted to release a simplified implementation of this scenario.
1224910	1230410	There is no CC or server communication or encrypting all files.
1230410	1237430	We are encrypting a file that we create on the fly and decrypt it in this file.
1237430	1244490	Adding the few missing points, these implementations can be converted to full ransomware emulation.
1244490	1255990	Yet, our aim is to test if a defense mechanism could prevent the core function of ransomware, which is encrypting files.
1260200	1266040	In this section, we will speak about Manticore Adversary Emulation CLI tool.
1267040	1274880	This tool is working with public threat scenarios, which I showed earlier in another repository.
1275040	1284380	As we said before, we have seen that adversary emulation tools do not provide transparency in some of their scenarios.
1284380	1294420	Here, we publish command-line based adversary emulation tool that is fully open source to bring some visibility to how emulation works.
1296040	1301060	All threats and scenarios are public and configurable.
1301500	1308900	Red teamers, blue teamers can easily edit this tool according to their aim.
1308900	1317200	Also, this CLI is developed in Go language for achieving multiplatform execution.
1317200	1327820	This tool includes single config CLI, which is shown here, public scenarios, payloads, and threats.
1327820	1333660	With this config CLI, command-line based tool emulates adversary.
1335600	1341290	Now, we will look at our demo for this presentation.
1342230	1352710	We have one remote machine and we will run adversary emulation scenarios here.
1353410	1363560	For looking scenarios, which are used by the CLI tool, here we can see public threat repository.
1364010	1368170	Here, we can see three different kinds of scenario collection.
1368170	1376470	There are many scenarios in our backlog and we are importing all of these gradually.
1376470	1380270	And these scenarios can be easily updated.
1381750	1385490	All kind of these scenarios is compatible with Maitre.
1386810	1395270	Firstly, we will look at our built-in scenario place before the demo.
1398130	1400610	Demo of the CLI tool.
1400710	1408390	Here, we can see which is shown in our public GitHub repository threat scenarios.
1408390	1410310	We can see here too.
1410310	1424230	For example, for PowerShell, one of the example scenarios, execute PowerShell from the CMD executable to collect and compress files of specific extensions.
1424230	1426510	It is used by the Windows platforms.
1427030	1430990	It is designed for the Windows platforms.
1431210	1434510	There, we can see Maitre tags.
1434570	1436330	Maitre tag name.
1436330	1439590	Also, we can go into the scenario here.
1439930	1444190	If we go here, we can see scenario.
1445530	1454970	If we click on it, we can see there is a simple structure of the JS listed as scenario.
1455270	1462530	Here, the technique, attack ID, name, type, platform and command and interface.
1462530	1465750	You can see here, PowerShell is the interface.
1465990	1468470	Also, you can see here the ID.
1469530	1475710	Also, we said before too, we have many scenarios in our backlog.
1475870	1479390	And we will try to import all of these scenarios.
1479390	1486350	And we will release, we will publish them to Red Teamers, Blue Teamers, Purple Teamers.
1489500	1498020	For now, we will execute the scenarios with our CLI tool instead of using UI interface.
1499880	1507580	Next, we will look at our CLI tool, which is published on GitHub repository again.
1507580	1512540	Here, we can see our Adversary Emulation Client CLI tool.
1512840	1518460	You can easily compile this on your own infrastructure.
1518460	1522180	Also, for ease of use, we published a release.
1522180	1527080	Here, you can go into the release and you can download config.ini file.
1527080	1531120	And you can download Manticore CLI executable.
1531120	1538620	You can run this executable with the config.ini file within same directory.
1540820	1545080	config.ini file includes three components.
1545080	1551200	One of them is public direct group URL, which is used for complex scenario collection.
1552420	1556540	Other one is public threat scenarios URL section.
1557760	1561180	It shows threat scenario repository.
1561180	1567140	Last one is the payload location, which is used for scenario payloads.
1567220	1576360	For execution, as we told before, you simply compile or download executable and config.ini file.
1576360	1580700	You cite necessary URLs for parsing repository on the platform.
1581200	1589560	In the threat groups URL, you can give multiple URLs for emulation, as it accepts an array of URLs.
1589780	1600480	Now, we will firstly will emulate LOLbins emulation for Dove landing a file from a remote server.
1600980	1606700	As we can see here, we give threat group URL.
1607200	1609980	We are coming our tool.
1609980	1616300	Here, our config.ini file and multi-core CLI executable.
1616300	1622400	When we run it, emulation is starting.
1648500	1654380	We have some connection problems here.
1654660	1657320	I will connect again.
1682440	1688740	If we can see here, you can see LOLbin emulation.
1689280	1692620	There are two binaries for Dove landing malicious executable.
1692740	1699300	One of them is using certutil for Dove landing a file from a remote server.
1700060	1707740	In the description, we can see this steps Dove landing a file from a remote web server to host using certutil.
1707760	1718540	Also, we have a different second scenario uses bitsadmin.executable to Dove landing a file from a remote server.
1719280	1721380	That can be seen here.
1726900	1735320	Next, we will emulate ransomware which is published on the multi-core GitHub repository.
1738140	1742410	If we go there, clearly we can see.
1743680	1746380	It includes two phases.
1747300	1755380	For generating this scenarios, we used ransomware emulation repository.
1756240	1759060	First one is Go-based ransomware emulation.
1759060	1762960	Second one is PowerShell-based ransomware emulation.
1763060	1781400	If we edit our thread group URL, then we are running our CLI again.
1786910	1795190	Firstly, Go-based multi-platform ransomware emulation is simulated.
1795190	1800440	Also, secondly, PowerShell-based ransomware emulation is simulated.
1800870	1804300	For example, if we look at the first scenario.
1804730	1808050	First, ISK is generated.
1808050	1813250	Then, encrypted ISK is generated via public key.
1813250	1818230	Then, decrypted ISK via generated private key.
1818570	1824450	Here, we can see encrypted file content and decrypted file content.
1825190	1828530	And we can finally see scenario result here.
1829670	1835590	If you wonder, for example, ransomware emulation executable here listed.
1835590	1842050	As we said before, it is compiled from this repository.
1842050	1847130	You can easily compile that and you can run in your infrastructure.
1852260	1859320	Finally, we will add APT29 emulation URL in config file.
1859320	1864300	Which does not show all scenarios, but few of them we will try to emulate.
1871510	1879210	For being clear, if we go into APT21 JSON file.
1879210	1882810	There we can see different scenario phases.
1882910	1886350	And you can easily go into it.
1887070	1889250	In our github repository.
1896820	1899020	For example.
1903200	1910620	In one of the examples, screen capture native api calls were used to collect a screenshot.
1910620	1919460	It imports the getScreenshot.ps1 file, publish shell file, then call the function.
1919460	1922680	And we will emulate now this one.
1922680	1924980	We are closing that.
1931150	1944940	I will check config file again.
1949440	1953340	Here we can see scenario execution is continuing.
1988220	1993060	Here we completed partially APT29 emulation.
1993060	1997080	As we told before, it is partial.
1997080	2003300	We have different kind of scenarios. You can clearly go them in our github repository.
2003300	2011680	We are trying to import all available scenarios into our platform.
2011680	2019240	Easily people can reach them and they can generate complex scenarios from them.
2022960	2027000	If we continue our slides.
2030350	2037630	For the future work, we are continuing to add all available scenarios to the repository.
2037630	2044830	We are also working on the feature of running scheduled scenarios throughout the UI.
2045690	2055670	Another plan is to integrate our threat intelligence framework into this scenario tool to contribute to the scenario generation and attack prevention.
2056490	2063590	In the public release, we will add reporting feature that will be added.
2063590	2077590	In the other hand, for achieving purple team, we will add security management software integration into our CLI tool and UI feature user interface.
2077590	2087070	Easily red teamers, blue teamers can query which scenario is detected or prevented.
2087890	2093570	In the next, we are waiting for the community support for this tool.
2095130	2097490	Thanks for listening.
2097870	2103790	If you have any questions, please ask us live in discord.
2103790	2111350	Also, you can reach us if you want from this email address.
2111350	2117370	Also, we are waiting for your support on our github platform.
2117370	2118890	Thank you so much again.