start	end	text
1500	5860	Hey everyone, welcome to my talk, Guerrilla Red Team, Decentralize the Adversary.
6000	8620	It's a project I've been working on for the past few months.
8620	12380	I decided to write a white paper on it, it's published actually today.
12780	15660	And the more and more I worked on the project, the more I realized
15660	20280	that it meant a lot to the people that were involved, so I decided to talk about it.
20280	22240	So without further ado, let's get in.
23220	27260	This is a brief overview of what this talk is going to cover.
27260	30960	This is a journey that we're going to take together.
30960	33600	It's divided into two parts, Phase 1 and Phase 2.
33600	36100	I'm going to walk through Phase 1 first, obviously.
36220	38900	Phase 2 is going to come a little bit later when I talk about
39800	42120	the so what of the program.
42240	45460	The yes, we did this thing, so what.
45460	46940	That's going to be Phase 2.
48540	49980	So, who am I?
50340	54200	My name is Chris Cottrell. I usually go by iSpareFriends.
54200	58660	Chances are, if you see a picture of iSpare, it could be me.
58660	62320	There's a couple others out there, but iSpareFriends is usually where I go.
62320	67700	I'm on Twitter, GitHub, I have a few ScriptKitty things on GitHub and LinkedIn.
68300	70480	I'm open, just hit me up.
72800	78360	I have been in the Red Team Offensive Security field since 2012.
79520	83300	I'm currently leading my own team right now. It's pretty fun.
83300	85820	We kind of get nasty around then.
86600	90260	I took my OSCP a few years ago, passed that.
90260	94260	Fun fact about that test is I actually consumed over a gram of caffeine
94260	97380	the whole time I was doing the test and writing the report.
97780	100200	That made me very sick later on.
100200	104160	And I hope I never have to do that test or anything like it ever again.
105360	110980	And I've also started to delve into the cloud security components of everything.
110980	115880	Mainly because me personally, I see a lot of security trends going that route.
115880	119600	And I want to try to get ahead of that as much as I can.
119600	122720	Not only to build my own automated Red Team infrastructure,
122720	126420	but just to pen test various things in the cloud.
126420	130140	Pretty much if you learn one, you can kind of understand the other three,
131060	132480	or the big three.
133100	137420	So with my company, we focus on AWS, so that's where I'm starting.
137420	140520	Hopefully I'll have my solutions architect soon.
141920	145720	Who is this talk for? That is a great question.
146080	152260	This talk is aimed at anybody that is trying to get into the Red Team field.
152280	155720	Anybody that runs a Red Team and is looking for friends.
155720	163680	Or anybody that is looking to expand or do anything out of the box for their Red Team.
163680	168380	And I will get into what the out of the box aspects are for the guerrilla portion.
169120	172380	But mainly it's for people that are managers.
172400	176260	You're looking for somebody, you're looking for friends, you're looking for more people on the Red Team.
176340	179540	People that are trying to get into the Red Team, you're looking for a way in.
179740	182520	You're in a company, you're in a help desk or something,
182520	185060	and you're trying to break into the InfoSec field,
185060	189860	or maybe you're trying to get into the OffSec component.
190520	192100	And you don't know where to start.
192100	194940	This is a program that's going to take you there.
196360	199100	So, just some learning expectations.
199120	201540	Like I mentioned, we're going to walk through two phases.
202220	205680	Phase 1 is going to be all about upscaling the assets.
205800	208680	Phase 2 is going to be about unleashing those assets.
208700	212080	Together, those things make up the Guerrilla Red Team.
212080	220000	However, this project first started under the moniker of the Red Team Development Program.
220000	223060	That's originally what it was called. It was only one phase.
223100	227040	And it was Red Team Dev Program, RDTP.
227680	229560	Why did I make this program?
229560	234500	First and foremost, because this was me for about a year and a half.
234500	242460	Just lonely, isolated, by myself, trying to make magic happen by doing ops.
242680	247040	Our security team is pretty small, so I was the Red Team component.
247040	250340	I was setting up my own program, infrastructure, all that stuff.
250340	251500	And it was lonely.
252980	257220	I wasn't able to interface with a lot of the teams because they were the ones that I was testing.
257380	262960	So, at its core, the Red Team Dev Program was there because I was just lonely.
262960	266900	And I was either going to build friends, or I was going to go find them.
266940	271760	So, since I couldn't really become friends' friends with a lot of the people that I was testing,
271760	273500	I decided to just build my own.
273500	275640	And that's where the Red Team Dev Program came into place.
277740	280080	It turned into something else, though.
280180	282000	And I'll get into that a little bit later on in the talk.
282000	285060	But it turned into something magical, in my opinion.
285360	290060	And not magical for me, but magical for the people involved.
290280	294640	And that is why I'm here having this talk right now.
295560	300060	So, at its core, the Red Team Dev Program was going to be, like I said, a way for me to make friends.
300120	302240	And it was almost like a pyramid scheme.
302560	304720	The Red Team was going to be at the top.
304720	309540	And me and my partner that are on the Red Team, we were going to be at the top.
309540	314640	And we were going to have all these little people that we could talk to and get ideas from
314640	318060	and help with idea generation, campaign generation.
318200	322020	If we needed assets to test a certain component of the business,
322020	326360	we would have those assets kind of spread throughout the organization.
326820	332860	So, not really a pyramid scheme, but kind of took on a similar aspect of it.
333260	337400	So, I came up with this idea. We were going to post on our cybersecurity channel on our Slack
338020	340660	that we were running this Red Team Dev Program.
340660	346560	It was a pilot program, and I only posted it in one channel, and I posted it once.
346900	352300	And I told everybody you had to fill out this form that had an open-ended question on it.
352300	356240	The only question on the form was, tell me about something cool.
356600	361740	And the results that we got from that question were super varied.
361740	368420	And from those varied results, it was very obvious who was ready for the program and who was not.
368500	373760	And we got over a dozen applications, and I would say over half of those didn't even come from this channel.
373760	376800	So, there was definitely some word of mouth that happened with it.
380700	383780	So, when you click that link, it led to this form.
383840	388180	And just like the form I had mentioned, I was trying to dress it up a little bit, make people excited.
388180	393020	And it had that one question, just tell me something cool.
393800	399040	From that question, we were able to take five applications.
399040	402680	We accepted five people with one alternate, in case somebody wasn't there.
403100	406480	I created these templates for their managers.
406840	413120	And I would go through and I would say, hey, so-and-so was accepted into the program.
413120	420980	We were requesting up to four hours of their workday per week to take part in this program.
421080	428240	Are you okay with that? If not, then let me know what you are okay with.
428240	433140	And I made this sales pitch and everything to go with it, so they kind of get an idea of what the program was.
435000	441880	And if their manager is accepted, then I would send this to them and say, hey, guess what? You're part of that cohort.
442360	445720	I need you to fill out this pre-fine checklist. I'll get into that in a second.
445840	449540	And also, we're going to provide you with some swag.
449660	458460	And my thought process on this was I wanted people to join the Red Team Dev program because they wanted to be there.
458460	464300	And I wanted them to be excited to be there, because if they're excited, they're going to really put forth a lot of effort.
464520	468440	And what that turns into is I get a lot of really good assets later on.
468860	475540	So the way that we did this was we paid for a Hackabox VIP subscription for the duration of the program.
475900	482800	We paid for three books that they could have, and they could kind of follow along with some extended learning.
483400	486280	And this came directly out of the cybersecurity budget.
486280	489700	So all they had to do was show up, and we would pay for everything else.
489700	493880	And I walked them through how to do this, how to submit expense reports for it and everything.
493880	496900	I'm sure it could be streamlined, but that's for the next step.
496900	500440	And I also let them take a look at the sales picture that I sent to the manager.
502360	506300	And because I like to make it fun and exciting, I went with a Pokemon theme.
506300	508040	These are laptop stickers that we have.
508040	511960	This is Absol Cohort for Q2 2020.
512260	518380	The idea behind this is every cohort would, you know, every quarter, every half, they would get their own Pokemon.
518460	521480	And if you do well in the cohort, you get to stay on as a fellow.
521800	525040	And the longer you stayed in, you got to collect them all.
525040	526880	So you could collect all the Pokemon.
529120	530400	I thought it was fun.
531760	537680	So now that I got some branding attached to it, we're going to go through and we're going to say,
538120	540240	I need you to fill out this pre-fide checklist.
541640	543200	This is an example of it.
543200	545040	But really, like, here's the meat and potatoes.
545040	548320	This is how the students answered this question.
549860	556060	And it seemed like most of the people came from the help desk field in this cohort.
556060	561820	There was a couple that came from other technical disciplines, but a bulk of them came from help desk.
562280	566540	And the comfort was kind of all over the place with what you would expect.
567980	571040	One person said that they knew how to do an SMB relay.
571040	580880	But most of the time, I try to gauge how they thought they were, like, what their technical skills were.
580880	582820	So for example, Windows networking.
583220	586240	I mean, to me, watching YouTube is a good way to get started.
586240	587780	You at least know what you're trying to watch.
587780	593420	But if you can mount a file share, maybe understand SMB a little bit more.
594680	596200	Same thing with Linux.
596200	598660	Seems like quite a few people knew what SSH was.
598660	602680	A couple of them knew how to use SSH with keys, or at least understood what that meant.
603400	607220	And just general ideas of what the people wanted to get out of this.
609080	612520	For the bulk of it, it was everybody just wanted to learn about red teaming.
612520	616400	A couple people wanted to take it a step further and say, like, I want to turn this into a career.
616640	621500	I made it very clear that this was not what the program was, but that's fine.
621500	624880	And I wanted to teach these students.
624880	633340	I wanted to teach them how to fish, not necessarily how to be an operator, but how to get to a point where they know, OK, I have X problem in front of me.
633340	635280	I'm going to go with Y solution.
635380	642780	Whereas at the start of this program, they may not even know what X problem was or even how to search for Y solution.
642780	650360	The program here was to help with them to get to a point where they could ask that question and start doing research on their own.
651040	657400	So, like I mentioned, we primarily use Hack the Box for a lot of the practical application portions.
657580	661520	And we did that by, you know, providing a VIP subscription.
663800	670660	The reason we went in VIP is because some of the lessons that were being taught, we needed the actual walkthroughs.
670660	676240	And if you have a VIP subscription, you can, you know, you can download the walkthroughs for retired machines.
676460	681360	So it wasn't so much about, you know, getting points and everything, but it was about learning.
681560	685100	And the best way to do that is just to say, try it for a few days.
685100	687980	And if you can't figure it out, let's talk about it.
687980	693560	And then if you still can't figure it out, just download the walkthrough, because I at least want to incorporate some sort of learning.
693560	699400	I want to push the whole cohort forward at the same time, not just like one person, onesies, twosies.
699920	702060	These are the three books that we picked.
702780	706460	Slight caveat warning, my name is actually in the one on the left.
706460	711060	I knew what was in the book because I helped do some technical review for it.
711060	714300	And I knew that it would be a good resource to have for students later on.
714820	721600	Waging Cyber War was there to kind of expose the students to what not just a red team is,
721600	728460	but how do you take a red team to the next level of like, for real, not just exercises and wargaming.
728460	736000	And then the Red Team Development and Operations book that Joe Vest and James Humberville released just this year, which is super awesome.
736380	739860	If you are a red team manager, I highly suggest you read the first half of that book.
739860	743100	If you're a red team operator, I highly suggest you read the second half of that book.
743100	746860	If you just want to read the whole thing, go for it because it's awesome all the way around.
748960	752180	So phase one, red team dev program started.
752180	756180	So I had selected all the applications. We selected five people for our cohort.
756180	761300	We got buy-in from their managers to come in for four hours a week on Fridays.
761300	766800	The whole cohort met together and we would start going to town.
768620	775600	So I made the syllabus for the program and it was broken up into two parts.
775720	780500	There was the we're going to learn how to do this phase, which was the first five weeks.
780500	785220	And then there was the live ops phase, which is the second, like the last four weeks.
785860	790600	First five weeks are all going to be broken down into things like, here's Windows, here's Linux,
790600	794740	here's how you do a Windows prev ask, here's how you do a Linux prev ask, here's how you do password cracking.
796400	803220	And we would meet once a week to discuss those things and go over, you know, learning and everything that we needed.
803540	808700	And just trying to impart as much knowledge as we could so that they could go out and try to research this.
811700	818360	There was also a we incorporated in addition to the books, we did the podcast, Darknet Diaries.
818360	823000	I tried to sync up whatever the lessons that we were trying to teach that week.
823000	828800	I tried to sync up a podcast with Darknet Diaries for that. And sometimes they matched up very, very well.
828800	833120	Sometimes it was just more of a hey, listen to this episode because it's really good.
835910	838190	So this is just a quick breakdown of the syllabus.
838190	846410	Week 1, Introduction to Red Teaming. We do Legacy. Week 2, Lame. Week 3 was all about password cracking.
846410	850630	Week 4, Windows prev ask, Linux prev ask, LiveOps.
852490	855410	So week 1 is Intro to Red Teaming.
855550	864610	This week focused heavily on talking about what op notes were and how to take them correctly.
864610	871170	And the reason I hark on this was because for me, the op notes are the deliverable that we're required every week.
871170	877830	And if I can't read them and if I can't figure out the narrative that the operator is trying to do, then it's essentially useless.
877830	886770	Because I need to be able to take those op notes, look at their op notes and do replay the op and do exactly the same thing that they did without ever talking to them.
886810	892890	So this was a constant theme throughout the cohort was op notes, op notes, op notes.
892890	897410	It needs to be in a certain narrative. It needs to have certain types of information.
897650	902330	If I want raw logs, I'll go pull the raw logs myself, but I don't want raw logs.
902330	906150	I want to know what you did. So we talked a lot about op notes.
906750	911890	Fortunately, most people had an understanding of what Metasploit was and knew how to use it.
911890	918710	So we could just get kind of straight to, you know, doing this first box, which is Legacy.
918710	924910	I paired that up with the Darknet Diaries episode 57 over MS08067.
925250	930730	And this was just a quick blend. This was like, let's see what your op notes look like. Let's see how you think.
930730	933570	Let's get an idea of what being on target looks like.
933990	935870	All the students completed this.
936690	941550	So here's the episode, talked about it, you know, NetAPI.
942630	944790	Here's the box. It was an easy box.
944790	949750	Almost every boxes, almost all the boxes in this program are easy.
949770	955670	And that's not like some are definitely easier than others in the easy category.
957190	960070	But keep in mind, this is like we were just trying to do learning.
960070	962570	It wasn't we're not trying to be super elite.
962570	967110	We're trying to get these people to a certain level so that they can do things on their own.
967690	972250	For this one, it was super easy. CBE. I think everybody got it pretty quickly.
972990	976690	Week 2 was the other OS. I started talking about Linux here.
976990	985730	And I paired that with just a podcast where you could get an idea of what some professional penetration testers would do.
986290	988610	LAME was the box that we chose.
988910	996250	And at this point, I started trying to profile and categorize everything so that the students weren't so lost all the time.
996250	1001050	So it was a Linux OS. I thought you probably have to use Nmap and Metasploit.
1001350	1004810	And if they completed it, I was like, here's another box you can try.
1004810	1012250	But like nobody did it. So as I built the syllabus, I was definitely overzealous in trying to make things.
1012910	1020390	I could have focused on, you know, providing more learning links and less on, hey, if you actually complete this, why don't you try this super hard box.
1021690	1027910	Just visiting, physical penetration test. LAME, again, pretty easy box.
1028450	1031410	Most of the ones that I chose are pretty CVE heavy.
1031730	1036750	And everybody completed this. We still were kind of harping on off limits a little bit.
1036750	1040290	Some people were doing very well. Some people still needed some course corrections.
1040850	1044490	It was super interesting to see this like template that I made.
1044490	1052790	And I tried to show everybody like some students would go one way with it and some would go completely another way with how they structured their off notes.
1052790	1056570	They were still giving me the information I wanted, but it made sense to them from their perspective.
1056570	1065670	And it was really interesting to see how they how they chose to start capturing all this information, how their brains started making sense of everything.
1065670	1071650	They were trying to make sense of it themselves, but they were also trying to make sure that I was happy with them.
1073730	1079210	Week three, I decided, hey, let's do password cracking because you're going to get on a box.
1079210	1082850	You're going to like they're not all going to be net APIs or immediately get system.
1082850	1086690	So you're probably going to have to like crack some creds every now and then.
1087250	1092130	And this this week is where things started to get interesting.
1092130	1099550	So those are learning links at the bottom. Those were not there when I originally made the syllabus.
1099950	1107410	As the week went on and people I started talking to everybody throughout the week because, you know, the other day we were me on Fridays.
1107410	1110130	But we would also like talk throughout the week as well.
1111610	1116210	People were running into some issues and I had to go through and research.
1116210	1123390	And my co and my red team buddy, Steve, he went through there and he like we put all these learning links in there.
1123870	1127630	And like, as you see at the bottom, there's a Kerberos primer, right?
1127630	1131730	That's my fault. But it's my fault that I chose this box.
1131730	1137970	I was looking for password cracking, but I had taken these people that were in helpdesk and I had thrown them into a Kerberos situation.
1138090	1142350	Now, luckily for me, they all kind of did what they needed to do.
1142410	1152910	And they talked to each other, which is great because part of the cohort was forming an internal mesh network of trusted ethical hackers.
1152930	1157610	Not just for me, but for them, too, because it was for me, for the assets, for them.
1157610	1162190	You may not always want to go to the instructor and say, hey, how do I do this for the fifth time?
1162190	1165890	Maybe you want to go to your buddy because you're going to be judged a little bit less for that.
1165890	1170430	So if I could build that trust into the cohort, that's amazing.
1170430	1174130	And that's exactly what happened this week is they all talk to each other.
1174130	1181010	And throughout the week, this portion of the syllabus changed and you had those learning links get added in.
1181010	1184310	You had Kerberos primers popped in.
1184310	1193790	I think by Wednesday, a couple people had downloaded the walkthrough and at least said, I'm going to get some learning out of this, even if I don't understand it.
1193790	1195590	But at the end of the week, everybody did.
1196050	1199510	In fact, paw in the box.
1199710	1200630	So there's Roku.
1200830	1203810	I got some... this is the podcast I chose for this week.
1204830	1207830	And there was actually... I got a lot of really good feedback on that one.
1207830	1216630	So thank you, Dark Knight Diaries, for having a podcast on Roku because they said it helped a lot with how they were going to attack the box.
1219570	1221310	Again, Active is the one we chose.
1221310	1224170	There was a CVE, but then there's some other things you had to do.
1224170	1225730	I'm not going to spoil it for everybody.
1227670	1230530	Week four, we're just getting worse and worse.
1230530	1233170	I chose all these boxes and I was like, this is going to be great.
1233170	1235470	They're going to figure out things pretty quickly.
1235470	1236210	That didn't happen.
1236210	1238530	More learning links had to get added in.
1238530	1245450	And this was just a constant iterative process between myself and the students and my buddy Steve.
1246150	1247290	How are you doing?
1247290	1248330	How's everything going?
1248330	1250730	Okay, so there's going to be some issues here.
1250770	1253190	Let's go ahead and drop a learning link in.
1254150	1256810	Maybe it'll kind of help speed things along.
1257990	1260690	Had to do some living off the land stuff.
1260690	1270330	Again, this week was a little bit interesting, mainly because there was some crazy stuff that happened with this box.
1273890	1282950	And the constant feedback and connection that we had with the cohort was critical from this point forward.
1283050	1287270	This point forward, people were starting to get a little upset.
1287270	1289570	Not upset, but just like frustrated, right?
1289570	1292110	You're not supposed to be frustrated when you're trying to learn stuff.
1292110	1294610	And they were being frustrated for the wrong reasons.
1294610	1297770	They weren't being frustrated because they were being, oh, this is challenging.
1297770	1303550	They were being frustrated for something that they had no control over, this gap in knowledge that I didn't prepare them for.
1303550	1309890	So by having that constant feedback and talking to them throughout the week, we were able to kind of overcome some things.
1309890	1311070	It was a little rough at first.
1311070	1315970	I mean, this is a pilot program, but the next one will be more streamlined.
1315970	1324270	And because this was a Windows PrivEsc lesson, I picked Shamoon, a pretty famous attack.
1326090	1328030	There's a buddy, Optimum.
1329010	1338750	Some CVEs end with this, but what happened after Optimum was complete for that week, and we started talking about week five.
1338750	1344770	You know, like we would show up week four, we'd show up, you know, Fridays for a four hour block.
1344770	1350730	I'd start reviewing off notes and then I'd start trying to talk about what was going to happen for the next week.
1351310	1353710	What happened was this.
1354930	1358670	I got a Slack message from one of the students.
1359670	1367030	And after our lessons had ended, all the students met together and they started talking about feedback and how things could be improved.
1367030	1369670	Now, I could have taken this one of two ways.
1369730	1375770	I'm not trying to, like, you know, have an ego about it or anything, but I could have been really offended by it.
1375770	1385670	But because I was starting to see that the students really, really cared about the program, even though that they were frustrated, they really cared about it.
1387510	1390830	And basically, this feedback was saying, like, we need help.
1390830	1394290	We need help. We need we need some better walkthroughs.
1394290	1395930	We need more direction.
1395930	1398170	We need you to do a better job.
1398310	1401650	And they weren't saying it in a way that was, you suck.
1401650	1404330	It was, we want to make the program better.
1404330	1404970	And I heard them.
1405570	1408750	And as a result of that, I decided to implement something else.
1408750	1409830	I was doing it live.
1409830	1413110	I was going to do what I call a Sherpa op, right?
1413190	1420590	Now, a Sherpa op, like I got the term from Destiny, because you have somebody that's really skilled and doing a raid or something.
1420590	1427010	And they would take, I don't know, five other people through and they would just kind of guide them, right?
1427010	1428890	People that didn't know what they were doing.
1428990	1430310	They were just going to guide them through.
1430310	1433690	So I was like, how can I do that for red teaming?
1433690	1435790	So I came up with this term called Sherpa ops.
1435790	1436710	And that's what we did.
1436710	1439970	So at the start of week five, I was like, guess what, guys?
1440270	1442770	All of us get on target because this is what we're doing.
1442810	1444430	I have not done this box.
1444450	1446350	I will not do this box.
1446990	1449590	We are going to work together, all five of us.
1449590	1453130	Myself included as the Sherpa.
1453370	1456650	And we are going to go through this host together.
1456650	1459530	And I'm going to try to guide you through without ever touching the keyboard.
1459910	1461570	And I had done no research on this.
1461570	1468030	I just thought it was super easy and had a complete total amount of user and root own.
1468030	1469950	So I figured it was probably good to go.
1470010	1471450	I didn't know what we were going to do with it.
1471450	1472870	I didn't know how successful it was.
1472870	1475490	All I knew was that it was a super easy Windows box.
1475490	1484150	And at the end of one hour after we had started, everybody in the group had owned that box.
1484510	1492370	And it was pretty awesome because I was asking them questions and sparking them ideas that they'd scan something.
1492370	1495030	I'd say like, OK, tell me about this.
1495030	1495690	Tell me about this.
1495690	1496290	Tell me about this.
1496290	1497210	They would scan.
1497290	1499030	They would come up with their own ideas.
1499030	1499930	They would give me feedback.
1499930	1501610	And I'd say, OK, that's great.
1502070	1504070	I need the information about this.
1504070	1504990	How would you go find it?
1504990	1507750	And just constant back and forth.
1507750	1510130	It was almost like doing an escape room.
1510130	1513310	Everybody gets their one hero moment in an escape room.
1513310	1514670	That was pretty much the case for this.
1514670	1517850	Everybody got their hero moment where they found one piece of the puzzle.
1518030	1521110	And it was really awesome to help guide them through.
1523150	1528370	It was a good experience because of what came after.
1528370	1534410	It was good to do the Sherpa op, but afterwards when I was doing a feedback session on it, I was like,
1534410	1535830	Hey, what do you guys think?
1535850	1537670	What do you think of the program even?
1537670	1539550	Because this is week five right now.
1540410	1545170	And the feedback that I got is what made me decide to write a white paper about this program.
1547310	1558050	They reported that their co-workers and colleagues were asking when they could apply for the program because they saw what the gorillas were doing.
1560490	1564710	The students tried to find other similar programs at other places.
1564710	1565810	They found nothing.
1566750	1571530	I know that Ofsec has their academy now, but I was there first.
1572770	1578650	But this was a straight up grassroots campaign to bring people into the field.
1578650	1584910	And it started out as a way for the red team to get trusted assets throughout the organization to help fuel ops.
1584910	1587770	But from this point forward, it turned into something else.
1587770	1592430	It turned into this was more important to the students than it was for me.
1592910	1611070	And this was giving them an opportunity to learn some skills, to talk with the red team dude, to ask questions in a non-judgmental environment, to marinate on some of the lessons that were being learned, to struggle and grow together as a group instead of just like one-on-one mentorship.
1612150	1614230	And I was like, I got to write this up.
1614390	1615390	And I did.
1615390	1617470	So the white paper is being released today.
1617470	1618790	So thank you, Sarvery.
1620230	1624150	But after that, I was like, you know what, let's do week five.
1624150	1624790	Let's go.
1624790	1627730	And originally, the box that I picked was Calamity.
1627930	1630010	And I did that.
1630010	1634210	I picked Calamity like the very beginning, not knowing what that was.
1634410	1643170	And a couple of days into that, I was like, y'all need to stop doing that immediately and go do this other box instead, which was Traceback.
1643170	1649390	And I mean, some of the Linux learning links that we placed on there still apply.
1650710	1653610	But I kind of led them into the slaughter on that one.
1654570	1664650	And at this point, we kind of ran out of Darknet Diaries episodes that perfectly lined up with what we needed at the time.
1664650	1667510	So I was like, hey, just listen to these mini-stories, I guess.
1671530	1673810	But Traceback was a lot of fun.
1673810	1675990	Everybody in the cohort pwned it.
1676370	1683830	This was actually supposed to be the first box of the LiveOps, right?
1684110	1696850	LiveOps was a shift in mentality, whereas the first five weeks were work together, succeed together, learn how to do these things,
1696850	1703050	keep doing your op notes, keep learning about Windows, Linux, keep learning about all the offensive tools that are out there,
1703490	1709430	keep challenging yourself, come to me with questions, come to your cohort with questions, just don't stop.
1709430	1713530	If you hit a roadblock, don't just sit there at the roadblock, figure it out.
1713750	1722730	And if all else fails, part of figuring out that roadblock is downloading the walkthrough from HackedBox, which is why we bought the VIP subscriptions in the first place.
1723530	1733070	Week six through nine, well now week five because of Calamity, that was all about, like I bolded right there, work together, succeed individually.
1733070	1736090	This is the struggle phase. This is the break me off phase.
1736090	1746770	This was going to be the phase where people got to see what it was like, just a little taste of being dropped into a live network, and you can't just download the walkthrough.
1748610	1754390	They're going to have to struggle, they're going to have to figure things out on their own, and it's going to suck.
1754490	1759430	Some of the students did very, very well. And I'll give you a slight spoiler alert.
1759510	1767590	I didn't intend to steal people from organizations, but one of these students is now on the red team because of the aptitude that they showed.
1768350	1774410	And some of them, you know, it's to be expected. They hadn't seen these things before, and they struggled because there were knowledge gaps.
1774410	1784970	Like, if you ask me to go do quantum theory, I'm not going to know, I can YouTube some stuff, but I'm not going to be able to talk to you because there's this huge gulf of knowledge that I can't overcome.
1784970	1791090	It's the same thing for some of these students, and you have to recognize when those gulfs hit.
1791530	1799450	Okay, time to take a step back. And that happened during the last weeks of the live ops. I had to redirect one of the students to do something else.
1801090	1810010	So the way that we had set it up was you have to do two easy machines, you have to do one of the easy machines before you can move on to the hard ones, or to the medium ones.
1810010	1815930	For this, it was Traceback and Remote, and because we were doing Traceback instead of Calamity, they already kind of got like a head start.
1817950	1827430	Remote was pretty fun. All the students pwned that one. There was a CD attached to it, and then the actual ProDesk portion was pretty interesting.
1827590	1833150	A lot of research went in to the students. And some of these things aged off.
1833550	1843790	And the reason I chose all the live boxes, like I said, was so that they could get a taste of what it feels like to be in a network and not have any hope.
1847290	1854070	And to get some points to go along with it. Because if you can get some real points, you can go back and say, like, hey, I'm not a script kid anymore, or like, hey, I'm not a noob.
1855650	1859730	But anyway, so I was trying to gamify it as much as I could and get some points.
1859990	1864930	So for the medium boxes, we chose Sauna and Servmon.
1866510	1873770	Servmon was pretty fun, but it was kind of unstable, and I felt like I had to warn people about that because you don't know what you don't know at that point.
1873770	1879070	Some of these people are pretty new. They may think that they're doing the right thing, and the boxes... it wasn't working.
1879330	1893690	So I kind of wanted... I did a little pathfinder thing and went through and just blasted through, like, every easy medium box that I could so that I could kind of guide them and say, like, hey, by the way, on this one Servmon, it's going to be a little bit kind of a pain in the butt.
1895730	1902690	The person that got chosen to come up to the red team completed both of these boxes.
1903650	1908990	Almost everybody completed at least one of these, and one student did not complete either.
1909070	1916990	So that student was pushed to a similar type box, but that had a walkthrough instead.
1916990	1919590	And that didn't really happen until about week 8 or 9.
1921670	1931230	So from this point on, like, the cadence for during the live op sections went from, hey, these are learning links to let's talk about what challenges you're running into.
1931230	1935330	Let me see your op notes, even if they're not finished, like, upload them, let me look at them.
1935450	1937030	Let's take a look at these things.
1937810	1943370	So it turned into more of like a red team discussion and not so much as a lecture during the second half.
1943390	1948890	Nobody made it to any of these, so I don't even know if we'll have the challenge boxes in during the next iteration.
1950150	1957970	But at the end of 9 weeks, this is one of the op notes from one of the boxes, I forget which one it was.
1958150	1965490	We went from somebody that had never done red teaming before, never done anything closely related to it.
1966450	1969490	And at the end of 9 weeks, they were producing op notes like this.
1969510	1972710	And this is not the person that was chosen to be on the red team.
1972710	1974690	This is from one of the other operators.
1976790	1982210	Just from this small snippet, you're able to tell, hey, I understand what the narrative is.
1982370	1985130	I understand what they tried. I understand what they were thinking.
1985370	1988110	Most of the op notes look like this by the end of 9 weeks.
1988270	1992790	And this was a huge pain point that I kept harping on, and that was constant every week.
1992790	1994510	Let me see your op notes, op notes, op notes.
1994750	1998490	But these students can take this methodology with them.
1998490	2001850	I mean, I even made an op note template generator for them.
2001850	2005990	But the methodology here is now they are in their brain.
2005990	2011030	If they do op, so they do hack the box, they're going to have their op notes up.
2011030	2016110	If they try to do OSCP, they're going to be taking op notes now.
2016190	2019550	They will understand where they've been, what they're trying to do.
2019690	2024170	And maybe if they're stuck on something, they go back, they read their own narrative.
2024170	2025970	They say, oh, yeah, I should try that.
2025970	2032850	And to me, that was the most critical part of this for teaching these junior operators, these guerrilla operators how to fish.
2034010	2036590	So at the end of the nine weeks, the cohort was over.
2036670	2047730	I sent out the same exact questions that I had at the start of the cohort just to see where they thought they were.
2047730	2050670	So on the left is the preflight survey that I had.
2050670	2052730	And then on the left is the exit survey.
2052730	2057850	So it looks like a pretty good increase with Windows networking.
2059590	2063630	Great increase, actually, with the Windows networking.
2063630	2066570	A lot of people really understood SMB a lot more.
2069610	2072690	Similar situations with the Linux stuff.
2072690	2076270	Pretty big increases with the Linux operating system.
2076270	2080110	Comfort with Linux networking was pretty good.
2080730	2086870	And then just what they thought, what they wanted to get out of the experience on the left.
2086870	2091050	And then what they kind of felt like they did get out of the experience on the right.
2092970	2095850	A lot of... I mean, it was pretty Windows heavy.
2095850	2099950	So that's probably why the majority of the Windows stuff went up.
2101330	2109050	But on the right, you're going to see a lot of people talk about how the methodologies, the recon,
2109050	2115190	like the second comment there, putting theoretical knowledge in the test and then applying it,
2116310	2118030	how to research, things like that.
2118030	2121310	These are all the core things that I was trying to do.
2121390	2127790	And at the start of my preflight survey, at the beginning of the thing, or I'm sorry, on my application process,
2127790	2132070	I said, what this is, it's a chance to hang out with a red teamer and talk shop.
2132070	2133910	What this isn't is an internship.
2133910	2138990	So this feedback is actually exactly what I was looking for.
2138990	2141570	And it could be streamlined a little bit better, 100%.
2141570	2145610	I'm sure there's other people that if you take this program and you do it, you're going to do it better than I will.
2145610	2147810	And that's awesome. Please publish that.
2147850	2150570	But really, it's all about just like upskilling people.
2151390	2158770	And if you have those upskilled assets throughout the organization, you have your security IQ is also raised as well.
2158890	2162850	So it doesn't just benefit you, it benefits the whole business.
2162850	2166750	And I just wanted to put this in here because I'm about to show all these noobs.
2167030	2171610	I want to show that all six of them have said that, yes, I can use their picture.
2172090	2177950	So this is the absolute cohort right here. And the biggest noob is up there in the top right.
2179170	2184350	I was with this group for nine weeks. We still talk discord all the time.
2184350	2189610	We still talk shop, even though the cohort has been over for about a month and a half now.
2189610	2193810	It was great. It was an awesome opportunity.
2193950	2200870	And I feel like some of these people are going to go forward and probably become InfoSec professionals.
2200930	2205950	Some of these people may choose to go a different route, but they're always going to have that security mindset.
2206270	2210490	Right. They got to see what an attacker looks like because they were one at some point.
2211970	2216410	But wait, there's more, because I said that there were two phases to this.
2216410	2226190	So phase two is the guerrilla red team aspect. Phase two came to me when I was actually writing up the paper for phase one.
2226370	2232150	Right. I was writing up this paper. Like I said, the original intent was we're going to upskill people.
2232190	2236050	Security IQ assets are going to be great. It's going to be awesome.
2236050	2244730	But I was writing up the paper. I was like, we have these low tier trained, trusted adversaries in our network now.
2245830	2254270	And at the same time, we also have these tools that we spend a lot of money on that say, oh, yeah, like we're going to go after the advanced adversary.
2254270	2262070	It's going to protect you from the advanced adversary because all these low tier script KDAs are just going to get blasted straight out of the window by all these other tools.
2262070	2267570	And you're protected. So I was thinking, you know, like, let's test that.
2269250	2276210	Because I just spent nine weeks training these people. And at their core, like they're low tier actors, right?
2276210	2280590	There's the script KDAs there. And more than that, they're trusted script KDAs.
2280950	2287190	And I know that if I give them something to do, they're going to execute on it. They're going to take notes on it.
2287190	2291470	I'll be able to deconflict with them. I was like, man, let's try it like this.
2291470	2295750	The idea made so much sense to me. I was like, we just train these people. Let's let's use them.
2295750	2300710	That's where the two phases came in. We upskill the assets, and now we're going to unleash hell on them.
2300710	2303650	So I had to come up with this way to sell it because I had to sell it to everybody.
2303650	2308130	I had to figure out how are we going to decentralize these adversaries?
2308430	2310890	How are we going to arm these guerrillas?
2312030	2320710	If the red team is the Green Berets, and these people that we just spent nine weeks training are the local indigenous population that now know how to shoot a gun.
2321270	2324650	How do I get them a gun? How do I get them a target to attack?
2324650	2328590	That was my problem to figure out. And I was like, I got to figure this out right now.
2329130	2331310	And I got to incorporate this into my paper.
2332970	2336870	So here's the guerrilla red team right here. This is what it is at its core.
2337770	2344890	And just like I talked about, you have all these EDR platforms that say, oh, we'll protect you from all this stuff.
2344890	2348370	Advanced sandboxing. EDR is essential.
2348370	2355870	You have this EDR maturity model. We have AI built in and stuff.
2355870	2360250	OK, let's see if you can kick off some low tier actors.
2361870	2365590	So this is the flowchart that I came up with this, and I'm going to walk through it real quick.
2365590	2368510	This is the guerrilla red team phase two flowchart.
2370230	2377190	And before I really get into it, I just want to just kind of walk through just a brief how a guerrilla red team works.
2377190	2382350	You train up, you upskill the guerrillas, right? That's the red team dev program. That's phase one.
2382470	2386630	Phase two is the red team retains control of these assets.
2386930	2389390	But to arm them, what does that mean exactly?
2389390	2393970	Arming means you have to provide them with a way to attack, right?
2394210	2398010	So that means you have to provide them with a platform to attack from.
2398010	2401470	And you have to provide them with the ammunition to attack with.
2401470	2407550	To translate that into cyber is basically you have to provide them an ops box to shoot from.
2407650	2411670	And you have to give them credentials to shoot with.
2411670	2422590	Because they may not be able to pop a box, but they can probably exploit a box with credentials.
2422610	2427510	So now at this point, what do those credentials look like?
2427510	2430890	Okay, those are probably basically canary credentials.
2431950	2434970	I'm going to have to form some partnership with Helpdesk now.
2435230	2445170	Some high-level partnership with the stakeholders so that we can get these certain credentials that are inactive to be used during the op.
2445970	2447870	By the way, what does that look like?
2447870	2450630	Let's keep the same cadence, four hours.
2450630	2453730	Do four hours once a month per guerrilla operator.
2453730	2459850	Okay, so for four hours once a month, instead of doing hack the box, they're going to do hacker network.
2460450	2463450	And the red team is going to have to figure out a way to maintain control of that.
2463450	2465430	So let's walk through how this is.
2465550	2467790	So I call it an arms delivery, right?
2467790	2470010	Does the guerrilla operator have an arms delivery?
2470010	2472490	If the answer is no, they go to the space.
2472810	2480170	So they're going to submit something that they want, an op plan, which is like this is a singular target that we want to attack.
2480170	2489750	The red team is going to conduct safety checks on it to see, you know, make sure you're not like trying to pop the CEO's box or something, or you're going to take down some super critical production asset.
2489890	2495350	They are not there to say yes or no to what the target is.
2495350	2499070	The red team is there to say yes or no, this is safe.
2499930	2505990	The red team is not allowed to say yes or no to what the target is because we're decentralizing the adversary.
2505990	2513470	The red team might not see this particular target as worthwhile, but this guerrilla might.
2513810	2517990	So if you're going to put all your EDR platforms on something that doesn't seem...
2518950	2528850	If you're going to put your EDR platforms on something, on all your crown jewels, but you leave this other thing over here just open, maybe the guerrilla goes after that instead because they just want to, right?
2528850	2532790	So that's part of the decentralization or decentralized process.
2532790	2536750	Anyway, if it gets approved, we go into the arming phase, right?
2536750	2541470	The red team will request accounts from the help desk or whoever it is.
2541550	2543890	If they get approved, they will be held in trust.
2543890	2549210	Like for our example, we're going to hold them in LastPass, right?
2549210	2550470	But they'll be inactive.
2550470	2556650	So you have like 10 accounts with varying sets of permissions, inactive, ready to go, right?
2556650	2558150	And that requires a relationship.
2558150	2564330	So if you're on a red team and you want to do this, you better start learning how to talk to people because you should be doing that anyway.
2564370	2568190	But you're going to have to build a relationship and sell this thing.
2568790	2572850	Anyway, so your credentials, you're going to build your target package.
2573070	2574350	So what does that look like?
2574350	2575470	That's credentials.
2575530	2577710	You siphon off one of the credentials.
2577850	2583150	You build them in EC2 instance that has a public IP or that is peered internally.
2583470	2586150	You generate some SSH keys just for them.
2586150	2589730	You push your creds and the keys to S3.
2589750	2591210	It's locked down.
2591270	2594010	The attack host is like sitting there waiting to go.
2594030	2599390	All that is required now is for them to schedule their op for their four hours.
2599510	2602330	So at this point, they've submitted something they want to attack.
2602330	2608690	And that can come from like the red team can provide that list and say pick one of these 10 things because they're the most vulnerable.
2608690	2616410	Like if you have a vulnerability management platform and you can pull that list, you can get an idea of whether or not it's going to be super hard or not.
2616410	2618550	And you can just kind of farm this out through the gorillas.
2620470	2624250	But you provide like, OK, here's what you're going to attack.
2624250	2626390	Here's the cred you're going to use to attack it with.
2627850	2632490	And here's your security mechanisms to get on this host.
2632690	2636950	So now you need to schedule an arms delivery, which you have done.
2636950	2640390	So now we go to the second phase of the flowchart.
2640390	2642470	So, yes, the arms delivery is scheduled.
2643050	2649210	Now, the day of the op, when it's scheduled, the gorilla is going to give you an IP address.
2649550	2654030	And you as the red team are going to have to submit this IP address for whitelisting.
2654450	2658690	You as the red team are going to have to notify helpdesk to make the account active.
2658870	2662050	And there are automation steps in here all over the place.
2662050	2667330	The more that you can automate this with Lambda or whatever, the better.
2668910	2674650	But you know you're going to notify helpdesk, hey, I need you to make this account active in an hour or 30 minutes or something.
2674650	2682310	They make it active. And then you go to EC2, whitelist that IP in the security groups.
2682310	2687890	You go to S3, you can either figure out a way to whitelist the IP in S3 or generate a pre-signed URL
2687890	2694010	and just give that to the gorilla so that they can pull down their target package.
2694210	2702150	And maybe that pre-signed URL only lasts four hours, which is what we said we were going to do anyway.
2702170	2708110	So you give it to them. You say, hey, man, it's 10 o'clock. I need you to pull down this and get ready to go.
2708110	2713990	It's going to have your SSH keys to get into your ops box. Here's your target. Have fun.
2714710	2722090	So they download the target package from S3. They connect to the host. They conduct their op for four hours.
2722090	2727070	They're probably going to make a whole hell of a lot of noise. They're going to set off a lot of alarms.
2727070	2733970	And then at the end of four hours, automation kicks in, security group blacklist or not blacklist,
2733970	2741210	but their whitelist IP gets removed from the security group and they lose access to the box.
2741210	2753550	And the op is over. Now, even if they weren't successful, even if the creds worked, but they couldn't get on anything at all,
2753550	2760050	some random box in the network just got hit with some random account.
2761030	2766430	And maybe the EDR caught the malware that they were trying to put on. Maybe it didn't.
2766430	2771290	Maybe they just got on the box and it's like did a bunch of surveys or something.
2772110	2775650	And by the way, like also the red team would put similar to hack the box.
2775650	2783230	We would put user.txt and root.txt on the box as well to kind of simulate Sentinel data being stolen.
2783990	2789110	It still gamifies it a little bit. So if they were able to get their user.txt and their root.txt.
2789770	2793590	But even if none of that happened and they just set off a whole hell of a lot of alerts,
2793590	2803030	think about that. Some random box that was just attacked by some random low tier person that's just making all kinds of noise.
2803150	2807430	What's the blue team going to do with that, right? Are they going to treat it like real?
2807430	2811330	Because that doesn't really fit the TTPs of the red team, which is typically stealthy.
2811330	2817110	This is noisy. This is nasty. So it's a good training opportunity for everybody, really.
2817450	2822530	The gorillas get it. You know, they get to sweat a little bit by like trying not to kick over a production box.
2822530	2836170	The blue team gets to do some deconfliction. And if the EDR doesn't pick up anything, well, then you need to reevaluate your EDR because some low tier people just like kick down the front door.
2836690	2846470	And like, that's a problem. And you should know that from a trusted source and not like getting ransomware in your entire network.
2846610	2851670	But anyway, so after the op is over, the gorilla submits the notes to the red team.
2851670	2858090	We debrief the gorilla and we store the op notes for deconfliction. I have a whole deconfliction process set up at my red team.
2858690	2863130	And we just kind of wait for those things to come in. And then here's the fun part.
2865250	2872870	Once that is done, the ops platform doesn't always have to be a Kali box. It could be a Windows box. It could be anything.
2872870	2882190	But once it's done, you power off the EC2 and you take the hard disk and you image it.
2884170	2887030	And what you do with that is you give it to the blue team.
2887310	2891990	And it's up to the blue team to decide whether or not they want to do forensics training on it.
2892290	2895890	They can do response training as the gorilla is banging around the network.
2895890	2901810	But if they want to do forensics training, they have this image of a low tier actor with all their tools and stuff on there.
2901810	2909350	And I'm sure there's... I had thoughts of maybe putting all kinds of logging and everything turned on in the ops box so that they could go find those.
2909710	2912950	And then the blue team would have to go make the compromised account active.
2912950	2918550	And if they don't do it within a certain amount of time, then the red team has that relationship with helpdesk already built in.
2919310	2924270	But really, this whole process accomplishes so many things.
2924350	2928850	And when I talk about decentralizing the adversary, here's what it accomplishes.
2928850	2934530	It doesn't mean to decentralize in the physical sense.
2934650	2938830	Like just because your operator is in Arizona, and they're attacking something in New York.
2938830	2942830	Yes, that is one type of decentralization, but you're decentralizing TTPs.
2942950	2945630	You're decentralizing target selection.
2945750	2948310	You are decentralizing all sorts of things.
2948750	2953650	And you're doing that by giving it to somebody that maybe writes their op notes a little bit differently.
2953650	2957730	You tell them one thing, but their brain interprets it as something else.
2957730	2963610	And they make their own set of op notes, not in any way that you had ever thought to even make them.
2963870	2965390	People think differently.
2965390	2967990	And at the end of the day, it is a person that's behind the keyboard.
2967990	2978530	So if you can get as many variables into your network as possible in a controlled manner, that's just going to make your security program even stronger.
2978770	2983370	And at the end of the day, you might also spin up some red teamers in the process.
2983370	2988990	And they're going to come to you, or they're going to bring new life into the community.
2989150	2993690	And I'll tell you, the only thing that this program really cost to do was time.
2993690	2999830	It didn't cost thousands of dollars to do this. It cost my time, and it cost the time of the people that were in the program.
3001630	3003050	So what's next?
3003050	3010450	Well, unfortunately, I couldn't actually talk about the guerrilla ops that we are doing currently because they're still in progress.
3010450	3017030	And I wanted to have a little bit more data to say, yes, these work, or no, they don't work, or we had to change these aspects.
3017230	3021650	Maybe that'll be the 2021 talk, like guerrilla red team year two. I don't know.
3022290	3028430	But what's next is we're going to continue to try to automate a lot of the build out process for arming the guerrillas.
3029710	3034690	Trying to maybe automate some of the target generation.
3035510	3041810	Just more of the processes of what we do with the platform, how we get things to the guerrillas.
3042450	3050110	That's what we're going to try to do, is just keep testing it, gathering metrics and stuff, all that boring red team manager stuff.
3050610	3053770	So that we can see how much of a business impact it actually did have.
3053770	3062070	But at the end of the day, for the capital investment that was required for this, I imagine it's probably going to have significant return on investment.
3062070	3068090	Because, I mean, it didn't cost anything. It cost like less than $100 per person for nine weeks.
3070250	3074070	So I want to give a couple shout outs to that. That pretty much is the end of my talk.
3075130	3080810	Remember phase one was the red team dev program. You upskill the assets. Phase two is in progress.
3080810	3088090	The guerrilla red team, you let them loose on the network to decentralize as much of that thought and brain power as you can.
3088570	3096770	Shout outs. I want to thank Cybrary for giving me a platform to write my paper and to work with me on everything.
3098050	3101330	I had never done a white paper before and they were awesome to work with.
3101330	3109490	So if you have anything that you want to talk about, they really help you out getting your thoughts on paper and editing and everything else.
3110510	3117350	I want to thank Mr. Omar also for letting me slide into his DMs and like the last minute to get this talk approved.
3117350	3124390	Because as I was writing it up, I was like, I really, really, really want to talk about this guerrilla aspect.
3124450	3129350	Because I think it could change how a red team arms itself.
3129350	3136670	You have your professionals and then you have these low tier assets that you've trained and they're supposed to be low tier.
3136730	3143250	Like low tier ain't so bad. Like I said earlier, it's low tier is good if you have the right controls in place.
3143250	3144870	So thank you Omar for letting me in.
3146210	3150290	I want to thank the ABSOL cohort for sticking with me through this pilot process.
3150770	3154150	I definitely should have streamlined it a little bit better.
3154150	3163330	But because of your feedback, I've I think I've been able to make it a better place for the next cohort.
3164130	3167790	And all of them have said that they want to decide to stay on as fellows.
3167850	3173270	So we're going to continue to talk and I look forward to seeing how they grow.
3173910	3181110	I want to thank Hack the Box for having a platform in which we could host a training platform on our own ad hoc.
3181330	3186210	And I want to thank Darknet Diaries for being like one of the only hacking podcasts that I could find.
3186370	3190550	And it was actually it's actually good. It's not just good because it's the like one of the only ones.
3190550	3192730	It's good because it's good. So thank you for that.
3195390	3199010	So thank you for walking through this whole process with me.
3199010	3202490	It's been a lot. Phase one, phase two, a lot of talk.
3202490	3206050	It's all about how to upscale and unleash assets.
3207730	3214630	And that is the Guerrilla Red team. So if you have any questions, please feel free to reach out to me on Twitter.
3214870	3222830	Then I think I'll be in Discord for a little bit to do some Q&A on this if anybody has any questions, but really take this and run with it.
3222830	3226550	I have an op note generator if you want to steal it on my GitHub.
3226970	3234750	It uses PyCharm. I'm sorry, it uses Sublime and JSON file.
3234750	3240330	And you just all you got to do is plug a couple of things in and it crops out like really good op note template for you.
3240330	3243310	It makes a bunch of folders and stuff, so it's easy to categorize.
3243490	3245550	But other than that, just please feel free to reach out.
3245550	3252430	And I hope that somebody takes this and just like makes it awesome, even more so than I made it awesome.
3252430	3258590	But I really would like to see it spread because getting people into the field outside of the federal pipeline is hard.
3258710	3265670	And if we could do this at the grassroots level, not only does the red team win, but the people win, which is what's important.
3266010	3271970	And if the people win, the business wins too. I have to say that, but the people win the most.
3271970	3276770	And that's what it's all about. So thank you. My name is Chris and take care.