Hey everyone, welcome to my talk, Guerrilla Red Team, Decentralize the Adversary.
It's a project I've been working on for the past few months.
I decided to write a white paper on it, it's published actually today.
And the more and more I worked on the project, the more I realized
that it meant a lot to the people that were involved, so I decided to talk about it.
So without further ado, let's get in.
This is a brief overview of what this talk is going to cover.
This is a journey that we're going to take together.
It's divided into two parts, Phase 1 and Phase 2.
I'm going to walk through Phase 1 first, obviously.
Phase 2 is going to come a little bit later when I talk about
the so what of the program.
The yes, we did this thing, so what.
That's going to be Phase 2.
So, who am I?
My name is Chris Cottrell. I usually go by iSpareFriends.
Chances are, if you see a picture of iSpare, it could be me.
There's a couple others out there, but iSpareFriends is usually where I go.
I'm on Twitter, GitHub, I have a few ScriptKitty things on GitHub and LinkedIn.
I'm open, just hit me up.
I have been in the Red Team Offensive Security field since 2012.
I'm currently leading my own team right now. It's pretty fun.
We kind of get nasty around then.
I took my OSCP a few years ago, passed that.
Fun fact about that test is I actually consumed over a gram of caffeine
the whole time I was doing the test and writing the report.
That made me very sick later on.
And I hope I never have to do that test or anything like it ever again.
And I've also started to delve into the cloud security components of everything.
Mainly because me personally, I see a lot of security trends going that route.
And I want to try to get ahead of that as much as I can.
Not only to build my own automated Red Team infrastructure,
but just to pen test various things in the cloud.
Pretty much if you learn one, you can kind of understand the other three,
or the big three.
So with my company, we focus on AWS, so that's where I'm starting.
Hopefully I'll have my solutions architect soon.
Who is this talk for? That is a great question.
This talk is aimed at anybody that is trying to get into the Red Team field.
Anybody that runs a Red Team and is looking for friends.
Or anybody that is looking to expand or do anything out of the box for their Red Team.
And I will get into what the out of the box aspects are for the guerrilla portion.
But mainly it's for people that are managers.
You're looking for somebody, you're looking for friends, you're looking for more people on the Red Team.
People that are trying to get into the Red Team, you're looking for a way in.
You're in a company, you're in a help desk or something,
and you're trying to break into the InfoSec field,
or maybe you're trying to get into the OffSec component.
And you don't know where to start.
This is a program that's going to take you there.
So, just some learning expectations.
Like I mentioned, we're going to walk through two phases.
Phase 1 is going to be all about upscaling the assets.
Phase 2 is going to be about unleashing those assets.
Together, those things make up the Guerrilla Red Team.
However, this project first started under the moniker of the Red Team Development Program.
That's originally what it was called. It was only one phase.
And it was Red Team Dev Program, RDTP.
Why did I make this program?
First and foremost, because this was me for about a year and a half.
Just lonely, isolated, by myself, trying to make magic happen by doing ops.
Our security team is pretty small, so I was the Red Team component.
I was setting up my own program, infrastructure, all that stuff.
And it was lonely.
I wasn't able to interface with a lot of the teams because they were the ones that I was testing.
So, at its core, the Red Team Dev Program was there because I was just lonely.
And I was either going to build friends, or I was going to go find them.
So, since I couldn't really become friends' friends with a lot of the people that I was testing,
I decided to just build my own.
And that's where the Red Team Dev Program came into place.
It turned into something else, though.
And I'll get into that a little bit later on in the talk.
But it turned into something magical, in my opinion.
And not magical for me, but magical for the people involved.
And that is why I'm here having this talk right now.
So, at its core, the Red Team Dev Program was going to be, like I said, a way for me to make friends.
And it was almost like a pyramid scheme.
The Red Team was going to be at the top.
And me and my partner that are on the Red Team, we were going to be at the top.
And we were going to have all these little people that we could talk to and get ideas from
and help with idea generation, campaign generation.
If we needed assets to test a certain component of the business,
we would have those assets kind of spread throughout the organization.
So, not really a pyramid scheme, but kind of took on a similar aspect of it.
So, I came up with this idea. We were going to post on our cybersecurity channel on our Slack
that we were running this Red Team Dev Program.
It was a pilot program, and I only posted it in one channel, and I posted it once.
And I told everybody you had to fill out this form that had an open-ended question on it.
The only question on the form was, tell me about something cool.
And the results that we got from that question were super varied.
And from those varied results, it was very obvious who was ready for the program and who was not.
And we got over a dozen applications, and I would say over half of those didn't even come from this channel.
So, there was definitely some word of mouth that happened with it.
So, when you click that link, it led to this form.
And just like the form I had mentioned, I was trying to dress it up a little bit, make people excited.
And it had that one question, just tell me something cool.
From that question, we were able to take five applications.
We accepted five people with one alternate, in case somebody wasn't there.
I created these templates for their managers.
And I would go through and I would say, hey, so-and-so was accepted into the program.
We were requesting up to four hours of their workday per week to take part in this program.
Are you okay with that? If not, then let me know what you are okay with.
And I made this sales pitch and everything to go with it, so they kind of get an idea of what the program was.
And if their manager is accepted, then I would send this to them and say, hey, guess what? You're part of that cohort.
I need you to fill out this pre-fine checklist. I'll get into that in a second.
And also, we're going to provide you with some swag.
And my thought process on this was I wanted people to join the Red Team Dev program because they wanted to be there.
And I wanted them to be excited to be there, because if they're excited, they're going to really put forth a lot of effort.
And what that turns into is I get a lot of really good assets later on.
So the way that we did this was we paid for a Hackabox VIP subscription for the duration of the program.
We paid for three books that they could have, and they could kind of follow along with some extended learning.
And this came directly out of the cybersecurity budget.
So all they had to do was show up, and we would pay for everything else.
And I walked them through how to do this, how to submit expense reports for it and everything.
I'm sure it could be streamlined, but that's for the next step.
And I also let them take a look at the sales picture that I sent to the manager.
And because I like to make it fun and exciting, I went with a Pokemon theme.
These are laptop stickers that we have.
This is Absol Cohort for Q2 2020.
The idea behind this is every cohort would, you know, every quarter, every half, they would get their own Pokemon.
And if you do well in the cohort, you get to stay on as a fellow.
And the longer you stayed in, you got to collect them all.
So you could collect all the Pokemon.
I thought it was fun.
So now that I got some branding attached to it, we're going to go through and we're going to say,
I need you to fill out this pre-fide checklist.
This is an example of it.
But really, like, here's the meat and potatoes.
This is how the students answered this question.
And it seemed like most of the people came from the help desk field in this cohort.
There was a couple that came from other technical disciplines, but a bulk of them came from help desk.
And the comfort was kind of all over the place with what you would expect.
One person said that they knew how to do an SMB relay.
But most of the time, I try to gauge how they thought they were, like, what their technical skills were.
So for example, Windows networking.
I mean, to me, watching YouTube is a good way to get started.
You at least know what you're trying to watch.
But if you can mount a file share, maybe understand SMB a little bit more.
Same thing with Linux.
Seems like quite a few people knew what SSH was.
A couple of them knew how to use SSH with keys, or at least understood what that meant.
And just general ideas of what the people wanted to get out of this.
For the bulk of it, it was everybody just wanted to learn about red teaming.
A couple people wanted to take it a step further and say, like, I want to turn this into a career.
I made it very clear that this was not what the program was, but that's fine.
And I wanted to teach these students.
I wanted to teach them how to fish, not necessarily how to be an operator, but how to get to a point where they know, OK, I have X problem in front of me.
I'm going to go with Y solution.
Whereas at the start of this program, they may not even know what X problem was or even how to search for Y solution.
The program here was to help with them to get to a point where they could ask that question and start doing research on their own.
So, like I mentioned, we primarily use Hack the Box for a lot of the practical application portions.
And we did that by, you know, providing a VIP subscription.
The reason we went in VIP is because some of the lessons that were being taught, we needed the actual walkthroughs.
And if you have a VIP subscription, you can, you know, you can download the walkthroughs for retired machines.
So it wasn't so much about, you know, getting points and everything, but it was about learning.
And the best way to do that is just to say, try it for a few days.
And if you can't figure it out, let's talk about it.
And then if you still can't figure it out, just download the walkthrough, because I at least want to incorporate some sort of learning.
I want to push the whole cohort forward at the same time, not just like one person, onesies, twosies.
These are the three books that we picked.
Slight caveat warning, my name is actually in the one on the left.
I knew what was in the book because I helped do some technical review for it.
And I knew that it would be a good resource to have for students later on.
Waging Cyber War was there to kind of expose the students to what not just a red team is,
but how do you take a red team to the next level of like, for real, not just exercises and wargaming.
And then the Red Team Development and Operations book that Joe Vest and James Humberville released just this year, which is super awesome.
If you are a red team manager, I highly suggest you read the first half of that book.
If you're a red team operator, I highly suggest you read the second half of that book.
If you just want to read the whole thing, go for it because it's awesome all the way around.
So phase one, red team dev program started.
So I had selected all the applications. We selected five people for our cohort.
We got buy-in from their managers to come in for four hours a week on Fridays.
The whole cohort met together and we would start going to town.
So I made the syllabus for the program and it was broken up into two parts.
There was the we're going to learn how to do this phase, which was the first five weeks.
And then there was the live ops phase, which is the second, like the last four weeks.
First five weeks are all going to be broken down into things like, here's Windows, here's Linux,
here's how you do a Windows prev ask, here's how you do a Linux prev ask, here's how you do password cracking.
And we would meet once a week to discuss those things and go over, you know, learning and everything that we needed.
And just trying to impart as much knowledge as we could so that they could go out and try to research this.
There was also a we incorporated in addition to the books, we did the podcast, Darknet Diaries.
I tried to sync up whatever the lessons that we were trying to teach that week.
I tried to sync up a podcast with Darknet Diaries for that. And sometimes they matched up very, very well.
Sometimes it was just more of a hey, listen to this episode because it's really good.
So this is just a quick breakdown of the syllabus.
Week 1, Introduction to Red Teaming. We do Legacy. Week 2, Lame. Week 3 was all about password cracking.
Week 4, Windows prev ask, Linux prev ask, LiveOps.
So week 1 is Intro to Red Teaming.
This week focused heavily on talking about what op notes were and how to take them correctly.
And the reason I hark on this was because for me, the op notes are the deliverable that we're required every week.
And if I can't read them and if I can't figure out the narrative that the operator is trying to do, then it's essentially useless.
Because I need to be able to take those op notes, look at their op notes and do replay the op and do exactly the same thing that they did without ever talking to them.
So this was a constant theme throughout the cohort was op notes, op notes, op notes.
It needs to be in a certain narrative. It needs to have certain types of information.
If I want raw logs, I'll go pull the raw logs myself, but I don't want raw logs.
I want to know what you did. So we talked a lot about op notes.
Fortunately, most people had an understanding of what Metasploit was and knew how to use it.
So we could just get kind of straight to, you know, doing this first box, which is Legacy.
I paired that up with the Darknet Diaries episode 57 over MS08067.
And this was just a quick blend. This was like, let's see what your op notes look like. Let's see how you think.
Let's get an idea of what being on target looks like.
All the students completed this.
So here's the episode, talked about it, you know, NetAPI.
Here's the box. It was an easy box.
Almost every boxes, almost all the boxes in this program are easy.
And that's not like some are definitely easier than others in the easy category.
But keep in mind, this is like we were just trying to do learning.
It wasn't we're not trying to be super elite.
We're trying to get these people to a certain level so that they can do things on their own.
For this one, it was super easy. CBE. I think everybody got it pretty quickly.
Week 2 was the other OS. I started talking about Linux here.
And I paired that with just a podcast where you could get an idea of what some professional penetration testers would do.
LAME was the box that we chose.
And at this point, I started trying to profile and categorize everything so that the students weren't so lost all the time.
So it was a Linux OS. I thought you probably have to use Nmap and Metasploit.
And if they completed it, I was like, here's another box you can try.
But like nobody did it. So as I built the syllabus, I was definitely overzealous in trying to make things.
I could have focused on, you know, providing more learning links and less on, hey, if you actually complete this, why don't you try this super hard box.
Just visiting, physical penetration test. LAME, again, pretty easy box.
Most of the ones that I chose are pretty CVE heavy.
And everybody completed this. We still were kind of harping on off limits a little bit.
Some people were doing very well. Some people still needed some course corrections.
It was super interesting to see this like template that I made.
And I tried to show everybody like some students would go one way with it and some would go completely another way with how they structured their off notes.
They were still giving me the information I wanted, but it made sense to them from their perspective.
And it was really interesting to see how they how they chose to start capturing all this information, how their brains started making sense of everything.
They were trying to make sense of it themselves, but they were also trying to make sure that I was happy with them.
Week three, I decided, hey, let's do password cracking because you're going to get on a box.
You're going to like they're not all going to be net APIs or immediately get system.
So you're probably going to have to like crack some creds every now and then.
And this this week is where things started to get interesting.
So those are learning links at the bottom. Those were not there when I originally made the syllabus.
As the week went on and people I started talking to everybody throughout the week because, you know, the other day we were me on Fridays.
But we would also like talk throughout the week as well.
People were running into some issues and I had to go through and research.
And my co and my red team buddy, Steve, he went through there and he like we put all these learning links in there.
And like, as you see at the bottom, there's a Kerberos primer, right?
That's my fault. But it's my fault that I chose this box.
I was looking for password cracking, but I had taken these people that were in helpdesk and I had thrown them into a Kerberos situation.
Now, luckily for me, they all kind of did what they needed to do.
And they talked to each other, which is great because part of the cohort was forming an internal mesh network of trusted ethical hackers.
Not just for me, but for them, too, because it was for me, for the assets, for them.
You may not always want to go to the instructor and say, hey, how do I do this for the fifth time?
Maybe you want to go to your buddy because you're going to be judged a little bit less for that.
So if I could build that trust into the cohort, that's amazing.
And that's exactly what happened this week is they all talk to each other.
And throughout the week, this portion of the syllabus changed and you had those learning links get added in.
You had Kerberos primers popped in.
I think by Wednesday, a couple people had downloaded the walkthrough and at least said, I'm going to get some learning out of this, even if I don't understand it.
But at the end of the week, everybody did.
In fact, paw in the box.
So there's Roku.
I got some... this is the podcast I chose for this week.
And there was actually... I got a lot of really good feedback on that one.
So thank you, Dark Knight Diaries, for having a podcast on Roku because they said it helped a lot with how they were going to attack the box.
Again, Active is the one we chose.
There was a CVE, but then there's some other things you had to do.
I'm not going to spoil it for everybody.
Week four, we're just getting worse and worse.
I chose all these boxes and I was like, this is going to be great.
They're going to figure out things pretty quickly.
That didn't happen.
More learning links had to get added in.
And this was just a constant iterative process between myself and the students and my buddy Steve.
How are you doing?
How's everything going?
Okay, so there's going to be some issues here.
Let's go ahead and drop a learning link in.
Maybe it'll kind of help speed things along.
Had to do some living off the land stuff.
Again, this week was a little bit interesting, mainly because there was some crazy stuff that happened with this box.
And the constant feedback and connection that we had with the cohort was critical from this point forward.
This point forward, people were starting to get a little upset.
Not upset, but just like frustrated, right?
You're not supposed to be frustrated when you're trying to learn stuff.
And they were being frustrated for the wrong reasons.
They weren't being frustrated because they were being, oh, this is challenging.
They were being frustrated for something that they had no control over, this gap in knowledge that I didn't prepare them for.
So by having that constant feedback and talking to them throughout the week, we were able to kind of overcome some things.
It was a little rough at first.
I mean, this is a pilot program, but the next one will be more streamlined.
And because this was a Windows PrivEsc lesson, I picked Shamoon, a pretty famous attack.
There's a buddy, Optimum.
Some CVEs end with this, but what happened after Optimum was complete for that week, and we started talking about week five.
You know, like we would show up week four, we'd show up, you know, Fridays for a four hour block.
I'd start reviewing off notes and then I'd start trying to talk about what was going to happen for the next week.
What happened was this.
I got a Slack message from one of the students.
And after our lessons had ended, all the students met together and they started talking about feedback and how things could be improved.
Now, I could have taken this one of two ways.
I'm not trying to, like, you know, have an ego about it or anything, but I could have been really offended by it.
But because I was starting to see that the students really, really cared about the program, even though that they were frustrated, they really cared about it.
And basically, this feedback was saying, like, we need help.
We need help. We need we need some better walkthroughs.
We need more direction.
We need you to do a better job.
And they weren't saying it in a way that was, you suck.
It was, we want to make the program better.
And I heard them.
And as a result of that, I decided to implement something else.
I was doing it live.
I was going to do what I call a Sherpa op, right?
Now, a Sherpa op, like I got the term from Destiny, because you have somebody that's really skilled and doing a raid or something.
And they would take, I don't know, five other people through and they would just kind of guide them, right?
People that didn't know what they were doing.
They were just going to guide them through.
So I was like, how can I do that for red teaming?
So I came up with this term called Sherpa ops.
And that's what we did.
So at the start of week five, I was like, guess what, guys?
All of us get on target because this is what we're doing.
I have not done this box.
I will not do this box.
We are going to work together, all five of us.
Myself included as the Sherpa.
And we are going to go through this host together.
And I'm going to try to guide you through without ever touching the keyboard.
And I had done no research on this.
I just thought it was super easy and had a complete total amount of user and root own.
So I figured it was probably good to go.
I didn't know what we were going to do with it.
I didn't know how successful it was.
All I knew was that it was a super easy Windows box.
And at the end of one hour after we had started, everybody in the group had owned that box.
And it was pretty awesome because I was asking them questions and sparking them ideas that they'd scan something.
I'd say like, OK, tell me about this.
Tell me about this.
Tell me about this.
They would scan.
They would come up with their own ideas.
They would give me feedback.
And I'd say, OK, that's great.
I need the information about this.
How would you go find it?
And just constant back and forth.
It was almost like doing an escape room.
Everybody gets their one hero moment in an escape room.
That was pretty much the case for this.
Everybody got their hero moment where they found one piece of the puzzle.
And it was really awesome to help guide them through.
It was a good experience because of what came after.
It was good to do the Sherpa op, but afterwards when I was doing a feedback session on it, I was like,
Hey, what do you guys think?
What do you think of the program even?
Because this is week five right now.
And the feedback that I got is what made me decide to write a white paper about this program.
They reported that their co-workers and colleagues were asking when they could apply for the program because they saw what the gorillas were doing.
The students tried to find other similar programs at other places.
They found nothing.
I know that Ofsec has their academy now, but I was there first.
But this was a straight up grassroots campaign to bring people into the field.
And it started out as a way for the red team to get trusted assets throughout the organization to help fuel ops.
But from this point forward, it turned into something else.
It turned into this was more important to the students than it was for me.
And this was giving them an opportunity to learn some skills, to talk with the red team dude, to ask questions in a non-judgmental environment, to marinate on some of the lessons that were being learned, to struggle and grow together as a group instead of just like one-on-one mentorship.
And I was like, I got to write this up.
And I did.
So the white paper is being released today.
So thank you, Sarvery.
But after that, I was like, you know what, let's do week five.
Let's go.
And originally, the box that I picked was Calamity.
And I did that.
I picked Calamity like the very beginning, not knowing what that was.
And a couple of days into that, I was like, y'all need to stop doing that immediately and go do this other box instead, which was Traceback.
And I mean, some of the Linux learning links that we placed on there still apply.
But I kind of led them into the slaughter on that one.
And at this point, we kind of ran out of Darknet Diaries episodes that perfectly lined up with what we needed at the time.
So I was like, hey, just listen to these mini-stories, I guess.
But Traceback was a lot of fun.
Everybody in the cohort pwned it.
This was actually supposed to be the first box of the LiveOps, right?
LiveOps was a shift in mentality, whereas the first five weeks were work together, succeed together, learn how to do these things,
keep doing your op notes, keep learning about Windows, Linux, keep learning about all the offensive tools that are out there,
keep challenging yourself, come to me with questions, come to your cohort with questions, just don't stop.
If you hit a roadblock, don't just sit there at the roadblock, figure it out.
And if all else fails, part of figuring out that roadblock is downloading the walkthrough from HackedBox, which is why we bought the VIP subscriptions in the first place.
Week six through nine, well now week five because of Calamity, that was all about, like I bolded right there, work together, succeed individually.
This is the struggle phase. This is the break me off phase.
This was going to be the phase where people got to see what it was like, just a little taste of being dropped into a live network, and you can't just download the walkthrough.
They're going to have to struggle, they're going to have to figure things out on their own, and it's going to suck.
Some of the students did very, very well. And I'll give you a slight spoiler alert.
I didn't intend to steal people from organizations, but one of these students is now on the red team because of the aptitude that they showed.
And some of them, you know, it's to be expected. They hadn't seen these things before, and they struggled because there were knowledge gaps.
Like, if you ask me to go do quantum theory, I'm not going to know, I can YouTube some stuff, but I'm not going to be able to talk to you because there's this huge gulf of knowledge that I can't overcome.
It's the same thing for some of these students, and you have to recognize when those gulfs hit.
Okay, time to take a step back. And that happened during the last weeks of the live ops. I had to redirect one of the students to do something else.
So the way that we had set it up was you have to do two easy machines, you have to do one of the easy machines before you can move on to the hard ones, or to the medium ones.
For this, it was Traceback and Remote, and because we were doing Traceback instead of Calamity, they already kind of got like a head start.
Remote was pretty fun. All the students pwned that one. There was a CD attached to it, and then the actual ProDesk portion was pretty interesting.
A lot of research went in to the students. And some of these things aged off.
And the reason I chose all the live boxes, like I said, was so that they could get a taste of what it feels like to be in a network and not have any hope.
And to get some points to go along with it. Because if you can get some real points, you can go back and say, like, hey, I'm not a script kid anymore, or like, hey, I'm not a noob.
But anyway, so I was trying to gamify it as much as I could and get some points.
So for the medium boxes, we chose Sauna and Servmon.
Servmon was pretty fun, but it was kind of unstable, and I felt like I had to warn people about that because you don't know what you don't know at that point.
Some of these people are pretty new. They may think that they're doing the right thing, and the boxes... it wasn't working.
So I kind of wanted... I did a little pathfinder thing and went through and just blasted through, like, every easy medium box that I could so that I could kind of guide them and say, like, hey, by the way, on this one Servmon, it's going to be a little bit kind of a pain in the butt.
The person that got chosen to come up to the red team completed both of these boxes.
Almost everybody completed at least one of these, and one student did not complete either.
So that student was pushed to a similar type box, but that had a walkthrough instead.
And that didn't really happen until about week 8 or 9.
So from this point on, like, the cadence for during the live op sections went from, hey, these are learning links to let's talk about what challenges you're running into.
Let me see your op notes, even if they're not finished, like, upload them, let me look at them.
Let's take a look at these things.
So it turned into more of like a red team discussion and not so much as a lecture during the second half.
Nobody made it to any of these, so I don't even know if we'll have the challenge boxes in during the next iteration.
But at the end of 9 weeks, this is one of the op notes from one of the boxes, I forget which one it was.
We went from somebody that had never done red teaming before, never done anything closely related to it.
And at the end of 9 weeks, they were producing op notes like this.
And this is not the person that was chosen to be on the red team.
This is from one of the other operators.
Just from this small snippet, you're able to tell, hey, I understand what the narrative is.
I understand what they tried. I understand what they were thinking.
Most of the op notes look like this by the end of 9 weeks.
And this was a huge pain point that I kept harping on, and that was constant every week.
Let me see your op notes, op notes, op notes.
But these students can take this methodology with them.
I mean, I even made an op note template generator for them.
But the methodology here is now they are in their brain.
If they do op, so they do hack the box, they're going to have their op notes up.
If they try to do OSCP, they're going to be taking op notes now.
They will understand where they've been, what they're trying to do.
And maybe if they're stuck on something, they go back, they read their own narrative.
They say, oh, yeah, I should try that.
And to me, that was the most critical part of this for teaching these junior operators, these guerrilla operators how to fish.
So at the end of the nine weeks, the cohort was over.
I sent out the same exact questions that I had at the start of the cohort just to see where they thought they were.
So on the left is the preflight survey that I had.
And then on the left is the exit survey.
So it looks like a pretty good increase with Windows networking.
Great increase, actually, with the Windows networking.
A lot of people really understood SMB a lot more.
Similar situations with the Linux stuff.
Pretty big increases with the Linux operating system.
Comfort with Linux networking was pretty good.
And then just what they thought, what they wanted to get out of the experience on the left.
And then what they kind of felt like they did get out of the experience on the right.
A lot of... I mean, it was pretty Windows heavy.
So that's probably why the majority of the Windows stuff went up.
But on the right, you're going to see a lot of people talk about how the methodologies, the recon,
like the second comment there, putting theoretical knowledge in the test and then applying it,
how to research, things like that.
These are all the core things that I was trying to do.
And at the start of my preflight survey, at the beginning of the thing, or I'm sorry, on my application process,
I said, what this is, it's a chance to hang out with a red teamer and talk shop.
What this isn't is an internship.
So this feedback is actually exactly what I was looking for.
And it could be streamlined a little bit better, 100%.
I'm sure there's other people that if you take this program and you do it, you're going to do it better than I will.
And that's awesome. Please publish that.
But really, it's all about just like upskilling people.
And if you have those upskilled assets throughout the organization, you have your security IQ is also raised as well.
So it doesn't just benefit you, it benefits the whole business.
And I just wanted to put this in here because I'm about to show all these noobs.
I want to show that all six of them have said that, yes, I can use their picture.
So this is the absolute cohort right here. And the biggest noob is up there in the top right.
I was with this group for nine weeks. We still talk discord all the time.
We still talk shop, even though the cohort has been over for about a month and a half now.
It was great. It was an awesome opportunity.
And I feel like some of these people are going to go forward and probably become InfoSec professionals.
Some of these people may choose to go a different route, but they're always going to have that security mindset.
Right. They got to see what an attacker looks like because they were one at some point.
But wait, there's more, because I said that there were two phases to this.
So phase two is the guerrilla red team aspect. Phase two came to me when I was actually writing up the paper for phase one.
Right. I was writing up this paper. Like I said, the original intent was we're going to upskill people.
Security IQ assets are going to be great. It's going to be awesome.
But I was writing up the paper. I was like, we have these low tier trained, trusted adversaries in our network now.
And at the same time, we also have these tools that we spend a lot of money on that say, oh, yeah, like we're going to go after the advanced adversary.
It's going to protect you from the advanced adversary because all these low tier script KDAs are just going to get blasted straight out of the window by all these other tools.
And you're protected. So I was thinking, you know, like, let's test that.
Because I just spent nine weeks training these people. And at their core, like they're low tier actors, right?
There's the script KDAs there. And more than that, they're trusted script KDAs.
And I know that if I give them something to do, they're going to execute on it. They're going to take notes on it.
I'll be able to deconflict with them. I was like, man, let's try it like this.
The idea made so much sense to me. I was like, we just train these people. Let's let's use them.
That's where the two phases came in. We upskill the assets, and now we're going to unleash hell on them.
So I had to come up with this way to sell it because I had to sell it to everybody.
I had to figure out how are we going to decentralize these adversaries?
How are we going to arm these guerrillas?
If the red team is the Green Berets, and these people that we just spent nine weeks training are the local indigenous population that now know how to shoot a gun.
How do I get them a gun? How do I get them a target to attack?
That was my problem to figure out. And I was like, I got to figure this out right now.
And I got to incorporate this into my paper.
So here's the guerrilla red team right here. This is what it is at its core.
And just like I talked about, you have all these EDR platforms that say, oh, we'll protect you from all this stuff.
Advanced sandboxing. EDR is essential.
You have this EDR maturity model. We have AI built in and stuff.
OK, let's see if you can kick off some low tier actors.
So this is the flowchart that I came up with this, and I'm going to walk through it real quick.
This is the guerrilla red team phase two flowchart.
And before I really get into it, I just want to just kind of walk through just a brief how a guerrilla red team works.
You train up, you upskill the guerrillas, right? That's the red team dev program. That's phase one.
Phase two is the red team retains control of these assets.
But to arm them, what does that mean exactly?
Arming means you have to provide them with a way to attack, right?
So that means you have to provide them with a platform to attack from.
And you have to provide them with the ammunition to attack with.
To translate that into cyber is basically you have to provide them an ops box to shoot from.
And you have to give them credentials to shoot with.
Because they may not be able to pop a box, but they can probably exploit a box with credentials.
So now at this point, what do those credentials look like?
Okay, those are probably basically canary credentials.
I'm going to have to form some partnership with Helpdesk now.
Some high-level partnership with the stakeholders so that we can get these certain credentials that are inactive to be used during the op.
By the way, what does that look like?
Let's keep the same cadence, four hours.
Do four hours once a month per guerrilla operator.
Okay, so for four hours once a month, instead of doing hack the box, they're going to do hacker network.
And the red team is going to have to figure out a way to maintain control of that.
So let's walk through how this is.
So I call it an arms delivery, right?
Does the guerrilla operator have an arms delivery?
If the answer is no, they go to the space.
So they're going to submit something that they want, an op plan, which is like this is a singular target that we want to attack.
The red team is going to conduct safety checks on it to see, you know, make sure you're not like trying to pop the CEO's box or something, or you're going to take down some super critical production asset.
They are not there to say yes or no to what the target is.
The red team is there to say yes or no, this is safe.
The red team is not allowed to say yes or no to what the target is because we're decentralizing the adversary.
The red team might not see this particular target as worthwhile, but this guerrilla might.
So if you're going to put all your EDR platforms on something that doesn't seem...
If you're going to put your EDR platforms on something, on all your crown jewels, but you leave this other thing over here just open, maybe the guerrilla goes after that instead because they just want to, right?
So that's part of the decentralization or decentralized process.
Anyway, if it gets approved, we go into the arming phase, right?
The red team will request accounts from the help desk or whoever it is.
If they get approved, they will be held in trust.
Like for our example, we're going to hold them in LastPass, right?
But they'll be inactive.
So you have like 10 accounts with varying sets of permissions, inactive, ready to go, right?
And that requires a relationship.
So if you're on a red team and you want to do this, you better start learning how to talk to people because you should be doing that anyway.
But you're going to have to build a relationship and sell this thing.
Anyway, so your credentials, you're going to build your target package.
So what does that look like?
That's credentials.
You siphon off one of the credentials.
You build them in EC2 instance that has a public IP or that is peered internally.
You generate some SSH keys just for them.
You push your creds and the keys to S3.
It's locked down.
The attack host is like sitting there waiting to go.
All that is required now is for them to schedule their op for their four hours.
So at this point, they've submitted something they want to attack.
And that can come from like the red team can provide that list and say pick one of these 10 things because they're the most vulnerable.
Like if you have a vulnerability management platform and you can pull that list, you can get an idea of whether or not it's going to be super hard or not.
And you can just kind of farm this out through the gorillas.
But you provide like, OK, here's what you're going to attack.
Here's the cred you're going to use to attack it with.
And here's your security mechanisms to get on this host.
So now you need to schedule an arms delivery, which you have done.
So now we go to the second phase of the flowchart.
So, yes, the arms delivery is scheduled.
Now, the day of the op, when it's scheduled, the gorilla is going to give you an IP address.
And you as the red team are going to have to submit this IP address for whitelisting.
You as the red team are going to have to notify helpdesk to make the account active.
And there are automation steps in here all over the place.
The more that you can automate this with Lambda or whatever, the better.
But you know you're going to notify helpdesk, hey, I need you to make this account active in an hour or 30 minutes or something.
They make it active. And then you go to EC2, whitelist that IP in the security groups.
You go to S3, you can either figure out a way to whitelist the IP in S3 or generate a pre-signed URL
and just give that to the gorilla so that they can pull down their target package.
And maybe that pre-signed URL only lasts four hours, which is what we said we were going to do anyway.
So you give it to them. You say, hey, man, it's 10 o'clock. I need you to pull down this and get ready to go.
It's going to have your SSH keys to get into your ops box. Here's your target. Have fun.
So they download the target package from S3. They connect to the host. They conduct their op for four hours.
They're probably going to make a whole hell of a lot of noise. They're going to set off a lot of alarms.
And then at the end of four hours, automation kicks in, security group blacklist or not blacklist,
but their whitelist IP gets removed from the security group and they lose access to the box.
And the op is over. Now, even if they weren't successful, even if the creds worked, but they couldn't get on anything at all,
some random box in the network just got hit with some random account.
And maybe the EDR caught the malware that they were trying to put on. Maybe it didn't.
Maybe they just got on the box and it's like did a bunch of surveys or something.
And by the way, like also the red team would put similar to hack the box.
We would put user.txt and root.txt on the box as well to kind of simulate Sentinel data being stolen.
It still gamifies it a little bit. So if they were able to get their user.txt and their root.txt.
But even if none of that happened and they just set off a whole hell of a lot of alerts,
think about that. Some random box that was just attacked by some random low tier person that's just making all kinds of noise.
What's the blue team going to do with that, right? Are they going to treat it like real?
Because that doesn't really fit the TTPs of the red team, which is typically stealthy.
This is noisy. This is nasty. So it's a good training opportunity for everybody, really.
The gorillas get it. You know, they get to sweat a little bit by like trying not to kick over a production box.
The blue team gets to do some deconfliction. And if the EDR doesn't pick up anything, well, then you need to reevaluate your EDR because some low tier people just like kick down the front door.
And like, that's a problem. And you should know that from a trusted source and not like getting ransomware in your entire network.
But anyway, so after the op is over, the gorilla submits the notes to the red team.
We debrief the gorilla and we store the op notes for deconfliction. I have a whole deconfliction process set up at my red team.
And we just kind of wait for those things to come in. And then here's the fun part.
Once that is done, the ops platform doesn't always have to be a Kali box. It could be a Windows box. It could be anything.
But once it's done, you power off the EC2 and you take the hard disk and you image it.
And what you do with that is you give it to the blue team.
And it's up to the blue team to decide whether or not they want to do forensics training on it.
They can do response training as the gorilla is banging around the network.
But if they want to do forensics training, they have this image of a low tier actor with all their tools and stuff on there.
And I'm sure there's... I had thoughts of maybe putting all kinds of logging and everything turned on in the ops box so that they could go find those.
And then the blue team would have to go make the compromised account active.
And if they don't do it within a certain amount of time, then the red team has that relationship with helpdesk already built in.
But really, this whole process accomplishes so many things.
And when I talk about decentralizing the adversary, here's what it accomplishes.
It doesn't mean to decentralize in the physical sense.
Like just because your operator is in Arizona, and they're attacking something in New York.
Yes, that is one type of decentralization, but you're decentralizing TTPs.
You're decentralizing target selection.
You are decentralizing all sorts of things.
And you're doing that by giving it to somebody that maybe writes their op notes a little bit differently.
You tell them one thing, but their brain interprets it as something else.
And they make their own set of op notes, not in any way that you had ever thought to even make them.
People think differently.
And at the end of the day, it is a person that's behind the keyboard.
So if you can get as many variables into your network as possible in a controlled manner, that's just going to make your security program even stronger.
And at the end of the day, you might also spin up some red teamers in the process.
And they're going to come to you, or they're going to bring new life into the community.
And I'll tell you, the only thing that this program really cost to do was time.
It didn't cost thousands of dollars to do this. It cost my time, and it cost the time of the people that were in the program.
So what's next?
Well, unfortunately, I couldn't actually talk about the guerrilla ops that we are doing currently because they're still in progress.
And I wanted to have a little bit more data to say, yes, these work, or no, they don't work, or we had to change these aspects.
Maybe that'll be the 2021 talk, like guerrilla red team year two. I don't know.
But what's next is we're going to continue to try to automate a lot of the build out process for arming the guerrillas.
Trying to maybe automate some of the target generation.
Just more of the processes of what we do with the platform, how we get things to the guerrillas.
That's what we're going to try to do, is just keep testing it, gathering metrics and stuff, all that boring red team manager stuff.
So that we can see how much of a business impact it actually did have.
But at the end of the day, for the capital investment that was required for this, I imagine it's probably going to have significant return on investment.
Because, I mean, it didn't cost anything. It cost like less than $100 per person for nine weeks.
So I want to give a couple shout outs to that. That pretty much is the end of my talk.
Remember phase one was the red team dev program. You upskill the assets. Phase two is in progress.
The guerrilla red team, you let them loose on the network to decentralize as much of that thought and brain power as you can.
Shout outs. I want to thank Cybrary for giving me a platform to write my paper and to work with me on everything.
I had never done a white paper before and they were awesome to work with.
So if you have anything that you want to talk about, they really help you out getting your thoughts on paper and editing and everything else.
I want to thank Mr. Omar also for letting me slide into his DMs and like the last minute to get this talk approved.
Because as I was writing it up, I was like, I really, really, really want to talk about this guerrilla aspect.
Because I think it could change how a red team arms itself.
You have your professionals and then you have these low tier assets that you've trained and they're supposed to be low tier.
Like low tier ain't so bad. Like I said earlier, it's low tier is good if you have the right controls in place.
So thank you Omar for letting me in.
I want to thank the ABSOL cohort for sticking with me through this pilot process.
I definitely should have streamlined it a little bit better.
But because of your feedback, I've I think I've been able to make it a better place for the next cohort.
And all of them have said that they want to decide to stay on as fellows.
So we're going to continue to talk and I look forward to seeing how they grow.
I want to thank Hack the Box for having a platform in which we could host a training platform on our own ad hoc.
And I want to thank Darknet Diaries for being like one of the only hacking podcasts that I could find.
And it was actually it's actually good. It's not just good because it's the like one of the only ones.
It's good because it's good. So thank you for that.
So thank you for walking through this whole process with me.
It's been a lot. Phase one, phase two, a lot of talk.
It's all about how to upscale and unleash assets.
And that is the Guerrilla Red team. So if you have any questions, please feel free to reach out to me on Twitter.
Then I think I'll be in Discord for a little bit to do some Q&A on this if anybody has any questions, but really take this and run with it.
I have an op note generator if you want to steal it on my GitHub.
It uses PyCharm. I'm sorry, it uses Sublime and JSON file.
And you just all you got to do is plug a couple of things in and it crops out like really good op note template for you.
It makes a bunch of folders and stuff, so it's easy to categorize.
But other than that, just please feel free to reach out.
And I hope that somebody takes this and just like makes it awesome, even more so than I made it awesome.
But I really would like to see it spread because getting people into the field outside of the federal pipeline is hard.
And if we could do this at the grassroots level, not only does the red team win, but the people win, which is what's important.
And if the people win, the business wins too. I have to say that, but the people win the most.
And that's what it's all about. So thank you. My name is Chris and take care.