start	end	text
860	3420	I don't like when they play it, but whatever.
6860	9060	Okay, we are live.
11730	21290	Hi everyone, thanks for coming to Indicators of Emulation Extra Spicy Adversary Emulation.
21510	25170	And we will just get started and go at it.
25170	28110	And really quick, next slide please.
31100	34980	Before I say anything, I have to do this for the lawyers.
34980	40320	And say that any opinions and anything that I say or do is just me.
40320	43680	And I'm not representing my company at all.
43780	46240	It's in an individual capacity.
46500	52480	And not the views of my employer, not the views of his employer, period.
52740	54180	Yeah, that goes for me as well.
54700	58320	Yeah, we both have our lawyer disclaimers.
58760	62260	So I'm going to start with a little bit of story time.
62260	65140	Back at B-Side Chicago.
66420	68020	Okay, there we go.
68020	72840	Back at B-Side Chicago 2019, Matt Kelly did a really great talk.
72840	78600	And it was called Threat Emulation Adversary Focused Red Teams.
78620	84720	And in it, he got me thinking about how CTI can benefit RED.
84720	88940	All things RED. Adversary Emulation, Perp Team, all of that.
88940	93400	And so, you know, I'm working on a doctorate at Marymount University.
93400	99020	And I decided to incorporate the thing that I'm curious about into my research.
99100	103620	And conducting, you know, reading tons of articles and all of that.
103620	109880	I came to the kind of conclusion that there's really minimal information out there.
109880	114360	As far as like the practice of CTI applied towards RED teaming.
114360	118120	It seems more focused on BLUE team stuff.
118120	125820	Like extracting indicators of compromise, IOCs, and helping defenders defend the organization.
125820	128920	And so, of course, there's Atomic RED team and all of that.
128920	132420	I'm talking specifically about the trade practice CTI.
132420	136240	Traditionally, it's for BLUE and not necessarily RED.
136400	138800	So, fast forward a little bit.
138800	143820	And I got curious about Bryson Bort and Sai's marketplace.
143820	154220	And in it, basically, they are putting together something where people can build out capabilities for threat actors for organizations to use.
154220	156920	And I thought, oh, my God, that sounds like so much fun.
156920	158720	I kind of want to do it.
158720	162260	And so, Bryson got me in touch with Adam Maschini.
162260	172100	And Adam pointed out that basically, if you look at the threat Intel reports, they have commands and very, very detailed for Linux.
172100	175160	But Windows, not so much.
175180	179340	And that semester, I happened to be in a malware analysis course.
179340	184760	And I'm like, hmm, maybe I can make this my project for the year.
184780	188380	So, I decided, why not?
188380	190560	Why not explore it a little bit further?
190800	193640	So, I decided to take it on.
193640	196340	And I was like, it will be easy.
196340	204700	All I have to do is just enable command line logging and maybe some PowerShell as an extra, you know, thing.
204880	206800	And it will be really easy.
206800	207820	Not hard at all.
207820	209740	Like, I already know where to get all the samples.
209740	211580	There won't be any problems.
212540	213580	Yeah.
214160	217020	So, I got a VM from Windows.
217020	218260	So, Windows 10.
218260	223380	And then I enabled all the logging for the Windows command line and PowerShell.
223380	228820	I used Michael Gao's, let's see, malware archaeology.
228920	232200	And lots of Googling to make sure I had it all right.
232280	237860	And believe it or not, disabling all of the security on Windows 10, like, holy, holy hell.
237860	242700	Like, it was a lot of work to be able to just execute malware.
243380	248400	With the infection rates, I was expecting it would be easy to just, you know, point and click.
248400	250360	But I was wrong.
250360	253000	So, I just want to do...
254700	256140	Oh, next slide.
256140	257680	A couple next slides.
263280	264320	Back.
265980	267160	Yes, that one.
267160	274680	So, I just want to do a really brief shout out to Windows and Microsoft.
274680	276620	And say, thank you so much.
276620	280860	You've done a really good job at protecting us, everyone.
281560	285220	He made it really hard for me to click and point.
285220	288220	And it required a lot of disabling.
288400	289600	Next slide, please.
290820	292720	So, these are the results.
292720	297820	What I did is I wanted to create a baseline since it was for an actual doctoral class.
297820	302660	So, I had to have some sort of methodology behind it to be able to explain.
302940	307780	So, when you look over the command line logging, it's a little...
307780	311420	It can get a little confusing because stuff goes on.
311420	318420	And before I introduce malware, I wanted to make sure that I understood what the heck was going on first.
318420	323800	So, I wanted to create a control that I knew was not malicious and doing weird stuff.
323800	326840	And before I introduce the craziness.
326920	328880	So, there are three options.
328880	332020	One is issuing the commands yourself, which I did.
332100	335040	The next one was Atomic Red Team.
335040	337840	So, I used Atomic Red Team, installed it.
337840	340760	Shout out to the Atomic Red Team crew.
341040	344460	It was so easy. I just followed the instructions.
344600	351680	And I was able to get it up and running and done and tested in almost no time.
351680	354460	It was ridiculous how easy it was.
354560	357760	And then finally was testing malware.
358000	361840	So, I created a test malware, I call it.
361840	364380	It just pops calc, essentially.
364380	367480	I compiled a C++ binary.
367820	377100	And I used Sector 7's Red Team Operator malware dev course to, I guess, learn how to compile C++ binaries.
377100	379720	So, that was fun. It was very benign.
379720	383160	The code is right up there on the left-hand side. It just pops calc.
383160	393140	And the other problem I had, if you can see on the right-hand side, all of the no's for command line arguments.
393140	395900	I'm like, what the heck am I doing wrong?
396300	399800	Why can't I figure this out? Why aren't these executing?
399800	405800	I went to any run, I did hybrid analysis, malware bizarre, I pulled stuff from virus total.
406560	419280	A fun story about that is someone at some place, which I won't name, I asked, hey, I'm having problems executing your samples.
419280	421000	What am I doing wrong?
421060	424700	I know with any run, you change the .bin to .exe.
425660	429980	I even used the file command and checked that it was an executable.
429980	431440	Different things, right?
431900	434980	And they suggested I speak to Bleeping Computer.
434980	437540	Obviously, I'm not going to do that.
438420	442900	So there are multiple repositories for malware, and I decided, you know what?
442940	447560	I'm having such a hard time with this, I'm just going to go direct to the source.
447740	457580	So at URL House, the wonderful thing about that is that when they post fresh samples, they also include the URL.
457580	464380	So with the new ones that they posted, I honestly, I just went to the attacker's domain and pulled the malware myself.
465040	467640	I was safe, don't worry, I was safe.
468420	470160	So next slide, please.
471020	474880	So these are the results of when I pulled the malware myself.
474880	482440	I ended up getting command line arguments, which was great, but there were still over half that I got nothing.
482440	487000	And I'm like, what is going on? Is it me? Is it the malware?
487000	490420	Like, what's wrong with this?
490420	491760	Next slide, please.
493240	496200	So I'm like, oh, there's static analysis, right?
496200	502540	So I'll just download Ghidra and Ida, and I'll just fuss around with it and figure it out.
502540	505720	And it was a little bit harder than that.
506040	514340	I didn't really have the time because it was for a class project too, to sit down and learn all that anti-analysis, anti-VM,
514340	523120	and all of that defensive Asian stuff as far as how to defeat it and step through and do that for multiple samples on scale.
523120	526680	Like, I didn't have that time. I will in the future, possibly.
527360	531260	And also to Joe Slowik, I don't know if you're familiar with him.
531260	533240	He's like the meme master.
533300	538720	He posted something recently where it was a guy drinking out of a cup of water.
538860	542920	And he was like, here, he was like, is this how I drink water?
542920	546700	You know, and like, not actually drinking from it.
546700	551900	And that's how I felt like when I was working with Ghidra and Ida and all that stuff.
551900	556620	So I'm like, whoa, I'm like, I just need to put this down for a second.
556840	558060	Next slide, please.
559640	567240	So at the DFIR Summit in 2020, this year, Mauer Archaeology himself, he was giving a talk,
567240	570320	and I was able to talk to him about some of my problems.
570320	575360	And he suggested that I just use a real computer.
575360	578860	And I'm like, what? That's like crazy.
579080	586940	I would never think to buy a cheap computer and execute it on there to bypass the VM stuff.
586940	589760	So I was like, all right, let's do this.
589760	594200	Like, I will fully commit to this, and I will buy these computers.
594200	597300	So the first one I bought, it was dead on arrival.
597620	599360	It did not work.
599360	601800	And then the second one ended up working.
601800	603320	And next slide, please.
605940	611540	So these are the results of what I did is I grabbed a sample,
611540	616460	and I wanted to get a good idea as far as what the different sandboxes gave me
616460	623860	before I did my actual analysis on a real computer since, you know, whatever.
624300	627560	And so on the left-hand corner, you see VirusTotal.
627560	630600	And then on the upper part, you see Cape Sandbox,
630600	632160	and then the bottom, Joe Sandbox.
632160	635480	Joe Sandbox gave more in this instance.
635480	636820	Next slide, please.
638040	642140	And then this is the actual manual part of it.
642140	649500	And it was about 75 pages worth of stuff that I collected from doing it manually.
649800	651440	This is just some of them here.
651440	652640	Some of them could be helpful.
652640	658400	I also grabbed all the PowerShell command line stuff that came out of executing it.
658400	659700	Next slide, please.
661140	664420	So the funny thing, too, as a threat Intel analyst,
664420	668600	I decided to look at threat reports, and it was a Raccoon Stealer sample.
668600	671280	So I came across a Cyber Reason blog,
671280	675200	because something funny happened while I was executing that one.
675200	679280	It asked me if I wanted to install the .NET framework.
679280	683580	But then in the threat report, it said that one of the biggest complaints
683580	689780	from criminals out there is that the Raccoon Stealer has a very low success rate.
689780	693440	And I'm like, well, gee, now I know why.
693640	698180	Basically, it would require people, at least with the version of Windows 10
698180	702280	that I was using, to install the .NET framework.
702280	708080	So that's a little bit of... that's a lot more work involved.
708080	711060	You know, if they're like, here's an invoice, read it.
711060	714120	It's like, oh, man, I have to install this? Yeah, screw that.
714120	717300	Like, I'm just going to move on with my life, right?
717320	718700	Next slide, please.
719220	720480	Oh, you did it.
720620	726440	So then, let's see, Thursday of this week, I had a friend contact me,
726440	733200	and he was like, hey, I know you're doing a talk at the DEF CON villages,
733200	738660	and if I gave you a blocked, you know, sample from my org
738660	741400	that we don't really care about, that's junk data,
741400	742880	would you be interested?
742880	747340	Would you want to, you know, see what you can do with it, right?
747340	750880	And this was about 24 hours prior to a previous presentation.
750880	751980	I'm like, sure.
752100	755560	I'm like, let's see what I can come up with,
755560	757660	and then I will share it with the world.
758840	761760	So can I do it? Can I not do it? We'll see.
763980	768200	So what I did, I found the sample in VirusTotal,
768760	776640	and then I loaded it to AnyRun, and then I also loaded it to Malware Bazaar.
776640	780280	So the reason why I loaded it to all these different sandboxes
780840	784520	is that Malware Bazaar gives me some really good data.
784820	788360	Joe's Sandbox, I obviously don't have a corporate thing
788360	791660	because, you know, I was doing this as an independent researcher,
791660	795260	and, you know, if you submit it through Malware Bazaar,
795260	797840	you get Joe's Sandbox, you get CAPE,
797840	802800	you get a lot of good stuff to look at and pivot between
802800	805040	when you're building out your reports.
805080	806980	And then, of course, VMRay.
809860	813960	So just as a little side note, the threat Intel brain in me kicked in,
813960	816180	and I'm like, oh, I'm like, I have the sample.
816180	818160	I can make them a custom rule.
818160	822480	So I looked at the callout for the DNS traffic and pivoted,
822480	825580	and it was, of course, a Nigerian-based hosting,
825580	831620	not saying that Nigerian hosting is potentially malicious, whatever,
831620	837620	but I pivoted off of it, and I found four additional samples that were malicious.
837620	843080	So what I did is I created a custom YARA rule using diff and virus total,
843080	845740	and then I passed that along to my contact.
845740	848720	And then the next step was I looked up MITRE ATT&CK,
848720	852740	because I'm like, okay, I know that it is Hawkeye,
852740	858560	and I know that MITRE ATT&CK kind of makes my life easy sometimes
858560	861180	and has stuff already done for me.
861180	863880	And lo and behold, I look at MITRE ATT&CK,
863880	867480	and no, they don't have what it is that I need.
867480	869620	So that means I need to create it from scratch.
869620	871380	But how do I do that?
874380	881760	So then I use a framework, and I use the MITRE ATT&CK tactics to guide my research.
881760	888440	And this is a printout from Joe Sandbox, where they kind of map the different behaviors
888440	893520	and TTPs of the particular malware sample that we have.
894040	895540	Next slide, please.
895860	901160	So for initial access, it was an email with an XE attachment,
901160	904780	and the subject said, invoice attached!
905280	907940	And it can propagate through USB.
908420	911680	As you can see here, on the left-hand side,
911680	915700	you see the raw sample of the email, and it says reverse invoice.
915700	917200	That was really funny.
917620	922220	And I decided to go to the domain in there just to see what was up with it.
922220	925460	And that's the yellow thing on the right-hand side.
925460	928620	And then the sender, the sender down at the bottom,
928620	935400	it was actually a Nigerian company as well that was sending the malicious XE.
936020	939740	So I, of course, passed that along to my contact.
940280	942640	So, next slide.
943260	945400	So now we have execution.
945400	951820	And of course, user execution is required, and that's T1204.002.
951820	954280	And it was execution of a malicious file.
954280	955340	Next slide.
957060	962320	And now we have WMI, T1047.
963900	968140	And so what I wanted to do, since I had a very short amount of time,
968140	970500	and I had a lot of stuff to get through,
970500	976360	so what I did is I created a process in order to parse all of this and get it out.
976720	981140	Basically, I go to the Joe's Sandbox MITRE ATT&CK section,
981140	986940	and then I go to the Joe's Sandbox specific entry in the report,
986940	990720	which you can see down at the bottom, the box thing,
990720	993960	that's the specific entry that I'm talking about.
993960	999420	And then I check Atomic Red Team to see if there's anything that's related to that,
1000140	1004860	such as check if AV antivirus firewall program is installed,
1004860	1007940	and then I Google what isn't there.
1007940	1009420	Next slide, please.
1011580	1018200	So when I first did this for T1047 in Atomic Red Team,
1018200	1022400	I didn't find anything that matched the commands that I needed.
1022440	1027080	And so I decided to Google, and I found something on Stack Overflow,
1027080	1028740	so I threw it up there.
1028740	1032080	And later in the presentation, as I was doing my research,
1032080	1040800	I found the T1518.001, and I came back and added it here.
1040840	1044760	So this is a tip, if you do decide to leverage this,
1044760	1052140	that sometimes things will be under different atomic tests, essentially.
1052140	1053760	Next slide, please.
1053900	1057780	So the next one was Native API.
1059320	1066520	And when I went to go look at the specific section of Joe's Sandbox,
1066520	1072680	I searched and searched and couldn't really find anything beyond just the APIs
1072680	1075100	that were involved with that.
1075100	1079360	So then I went to Atomic Red Team, and they had something that had a command
1079360	1086000	that was similar to v4.0.30319.
1086000	1091320	So I did a search in the actual Joe's Sandbox, and I found a command
1091940	1096120	on the command line, but there were no specifics tied with it.
1096120	1104520	So this at least gives a beginning of what XE was being used to interface
1104520	1108940	with the APIs, and the APIs specifically included.
1108940	1110420	Next slide, please.
1110720	1112780	So now we have persistence.
1112780	1114000	Next slide.
1114940	1120400	So I looked at the area, the specific area in Joe's Sandbox,
1120400	1122360	and I found wherefault.
1122360	1123840	Wherefault was the culprit.
1123840	1126760	And I had a hash of wherefault.
1126820	1132460	And so I threw that in a various total, and it looks like it's a legitimate service.
1133120	1135020	So this is interesting.
1135020	1138580	It looks like that one is being used for DLL side loading.
1138580	1140880	Next slide.
1140880	1144760	Next we have privilege escalation.
1144760	1147660	So we have... slide after that, please.
1148460	1152120	So now we have DLL side loading again.
1152400	1155100	Next slide as well.
1155700	1158640	And then we also have process injection.
1158720	1162120	And so there is an atomic red team for this,
1162120	1166120	and I put the command line argument there for that.
1166120	1167560	Next slide.
1167560	1173260	There was a ton of defense evasion with this particular sample of Hawkeye.
1173260	1183480	Everything from invalid code signing to software packing to sandbox evasion to obfuscating files.
1183480	1185200	Next slide, please.
1187540	1193420	So what I did is I tried to pick the one... the previous slide, please.
1193420	1203980	I tried to pick stuff out of the defense evasion that I think red teamers and blue and all of that could be able to take advantage of, essentially.
1203980	1206140	And so one of them was masquerading.
1206200	1211280	This sample created files inside the actual user directory.
1211360	1217240	And so I put the location of what was being created and what it was called and all of that.
1217240	1220560	And there are a ton of tests for atomic red teams.
1220560	1224960	So you can just pull the commands out of that that make sense that fit with this.
1224960	1226000	Next slide, please.
1226580	1233100	So the next one is modify registry, and it stores a large binary data to the registry.
1233100	1241340	And I put the registry key that was changed or modified along with what it looked like.
1241340	1248940	I know that there's stuff that could potentially... I'm sure red teamers are like, hmm, I know what that is.
1249820	1252160	Next slide, please.
1253020	1257140	The next one is hidden files and directories.
1257140	1266300	I couldn't find an atomic red team test specifically for this one for changing Windows Explorer.
1266300	1270720	But I did put the key value that was changed.
1270720	1272140	Next slide, please.
1273780	1277900	So this one is my educated guess.
1277900	1287060	So in the detailed part of the sandbox report, it says that it contains functionality to read the PEB.
1287060	1294360	So from a little bit of exploit dev reading, essentially, you know, you can create shellcode.
1294360	1304380	You know this to walk through the PEB, the process environment block in order to find the address of kernel 32 DLL.
1304380	1309640	And so I made an educated guess that that's what the shellcode was about.
1309640	1311340	Next slide.
1311500	1314880	Next one is credentialed access.
1314920	1325320	So I put in here all the different files that were accessed and stolen from this particular sample.
1325440	1327840	And there is an atomic test for it.
1327840	1329200	Next slide.
1329200	1331540	Next one is discovery.
1331800	1335820	And this one queries a list of running processes.
1335820	1342560	And there is an atomic test for it next or atomic commands that you can take out and put into whatever you use.
1342560	1345280	The next one, remote system discovery.
1345480	1348920	There is an atomic test available for this one as well.
1348920	1355540	And it kind of tells you where to go and what's going on, what's reading and stuff like that.
1355540	1357300	The next one, please.
1358100	1359840	System info discovery.
1359840	1368060	I put the key, the registry key that was queried in there for the particular emulation.
1368060	1370320	And there is an atomic test for this.
1370380	1371280	Next slide.
1372540	1374000	Lateral movement.
1374140	1377640	The only thing that I can talk about... previous slide, please.
1377820	1385540	The only thing that I can talk about... the only thing that I can talk about regarding this is that it replicates via USB.
1385540	1386920	Next slide.
1387480	1395160	So, collection... it steals data from the local system, which is T1005.
1395160	1397860	There is also key logging as well with this.
1397860	1403440	And there are atomic red team commands available for this for you to extract.
1403440	1404620	Next slide, please.
1404620	1408940	And it also extracts and archives the collected data.
1408940	1416120	So, my educated guess on this is that it compresses or encrypts the data prior to exfil.
1416120	1419040	So, that is a good behavior to include as well.
1419040	1423560	And there is an atomic red team test with a dependency on PowerShell.
1423560	1425140	Next slide, please.
1425680	1428340	It does grab your clipboard data.
1428340	1430460	And there is an atomic test available.
1430460	1431500	Next slide.
1433540	1435400	Local email collection.
1435400	1440180	It shows all the different files where the information was harvested, essentially.
1440180	1442700	And there is an atomic test for this one.
1442700	1443720	Next slide, please.
1444460	1446520	Okay, C2. Next slide.
1446520	1456320	Here is the various things that were associated with C2 from an encrypted channel and non-application layer protocol.
1456320	1459700	And there are atomic tests available.
1459700	1460780	Next slide.
1461720	1468300	And the thing that I would recommend when you are building this out and looking at the C2 is the C2 matrix.
1468560	1474980	So, you can see right here the various functionalities that all of these different C2s...
1475300	1477620	I think they said that they were at 53 now.
1477620	1478680	There is a ton.
1478680	1480560	And there is a Black Hat talk on it.
1481000	1483320	Black Hat Arsenal talk on it.
1483360	1485800	And Jorge Artiles talks on it a lot.
1485800	1490080	So, he can definitely give you a ton of information about it.
1490720	1492400	C2matrix.com.
1492480	1496640	And use that to pick your C2 that matches with the capabilities.
1496640	1497600	Next slide.
1498840	1500540	So, exfiltration.
1500540	1505980	I just took that the data is compressed or encrypted.
1505980	1507080	Next slide.
1508140	1509120	So, impact.
1509120	1514240	There really doesn't seem to be a crazy amount of impact like there would be with ransomware.
1514740	1516180	You know, they steal creds.
1516180	1516940	Use them later.
1516940	1517820	Sell them.
1517820	1520700	Who knows what this particular actor is doing.
1521100	1523660	So, now I'm going to add some extra context.
1523740	1524760	Next slide, please.
1524760	1528340	So, I looked at the Yara rule specifically in Malware Bazaar.
1528340	1531220	And I saw that it was kind of... it was really active.
1531220	1533480	Like, it was still getting a lot of samples.
1533480	1534760	So, not stale.
1534760	1535980	Next slide, please.
1537760	1538860	And you'll see...
1539440	1541140	So, I went to Malware Bazaar.
1541140	1542220	And then I pivoted out.
1542220	1543700	Looked at the Yara rule.
1543700	1547780	And then I looked at the Joe Sandbox command line.
1547780	1552800	And I saw that this particular Yara rule that was still alerting was from 2015.
1552800	1557640	And they were still using the same string in the command line.
1557640	1563100	So, I'm like, oh, that would be really great to include in adversary emulation exercises.
1563300	1566920	Since it's been pretty consistent for about five years.
1567000	1568200	Next slide, please.
1570300	1574180	So, with this, the HTTP traffic doesn't have a header.
1574180	1583160	And then I put where files, some files that were written, and the process tree for additional context.
1583160	1584360	Next slide, please.
1584360	1586880	It also dropped 11 files.
1586880	1590600	And I put all the different files that were dropped in the different folders.
1590600	1592040	Next slide, please.
1592980	1594660	Other characteristics.
1594800	1598860	Queries connects over DNS, over HTTPS.
1599160	1604040	The thing that was interesting to me is that it used port 0 for listening.
1604890	1610300	And then, you know, injection with create remote thread.
1610300	1617160	So, that sounds like something red team would be interested in knowing that this particular thing does.
1617380	1619240	So, next slide, please.
1619340	1627800	So, basically, I mean, I got someone's throwaway malware sample that they didn't really care about.
1627800	1629200	That was blocked.
1629200	1632060	And I was able to extract all that information.
1632060	1650340	Find out, you know, it was, it used a Nigerian infrastructure from a Nigerian, I'm assuming, compromised company to send, you know, invoices to the particular organization.
1650340	1658900	And built out a thing that they could use to test their defenses regarding adversary emulation exercises.
1658900	1666580	And this was all just from pivoting between multiple sandbox reports and some of my own analysis as well.
1666580	1668460	Not all of it was from Joe's sandbox.
1668460	1671960	I also included some from Kate's sandbox as well.
1671960	1676300	And then, me just looking over the sandbox results as well.
1676300	1677640	Next slide, please.
1678980	1686200	Finally, so what you can do if you decide you want to move forward with this is the purple team exercise framework.
1686200	1689440	Jorge Archiles talks about this.
1689440	1691360	He just released it through Scythe.
1691360	1693880	It's free and available to the community.
1694140	1706760	And it gives you a really good framework in order to be able to process this and to move forward with a purple team exercise.
1706760	1708040	Next slide, please.
1710140	1717040	And CyberWardog, he did a blog post about tracking the hunt team.
1717380	1722320	And so, what I was thinking is that you could do the same thing for purple.
1722320	1734300	And essentially, like track over time and present to your manager or upper management or whomever, like the various TTPs that you've been testing over time.
1734420	1737000	And your coverage with it.
1737000	1744320	Or, you know, for just throwing out random ideas, right?
1744320	1754280	So, you can also use it to track the kind of activity that you're getting from the various malicious items that are being sent to your organization.
1754280	1762080	So, for Nigerian infrastructure, you know, you're like, huh, okay, so they're using these general TTPs.
1762100	1764100	And here's our coverage for it.
1764100	1765740	Here's what we've tested.
1765740	1770820	And basically, the manager can just sit there over time and look at the colors change.
1771440	1773940	So, that would be helpful.
1774720	1779740	But as a CTI analyst, like, I'm not a red teamer.
1779740	1788620	Like, I honestly don't know the commands, whether or not they're right or not, without testing all of them and how to go forward with this.
1788620	1791360	So, this is where the easy button comes in.
1791360	1795760	And I'm going to hand off the presentation to my co-speaker.
1796560	1797600	Hi, everyone.
1797600	1798880	My name's Hayden.
1798880	1802580	I was just listening to you and thinking it was amazing this talk, Thierry.
1802580	1806140	Thank you for inviting me to co-talk with you.
1806140	1810640	So, Thierry was talking about cyber threat intelligence, adversary emulation, purple teaming.
1810640	1815560	And what's happened is that we both were talking back and forwards.
1815560	1820900	I've been a cyber threat intelligence analyst six months ago or years ago for six months.
1820900	1829220	And what happened was I would use to copy and paste indicators such as IP addresses and domains from a report, throw it through ArcSight.
1829420	1833560	So, Thierry was telling me she wants to make it easier for cyber threat intel analysts.
1833560	1836800	So, I started to was into coding and learning Golang.
1836800	1839440	So, I came up with emulate.go.
1839440	1852240	Now, the problem that we were identifying, well, not a problem, but the concern we had with C2 tools such as PowerShell Empire or many of the others is that they can have a steep learning curve.
1852240	1855260	And you need a really deep technical understanding.
1855340	1857600	They can require a lot of dependencies.
1857760	1864840	And they can require a bit of a setup as well to get your same interpreter payload working or things like that.
1864840	1867840	So, most of them can be extremely complex.
1867840	1878780	And we wanted to abstract that away and focus on cyber threat intelligence of initial access and creating it that way.
1878780	1888680	So, the goal was to lower the bar of entry for adversary emulation, abstract away the technicality, focus on initial access, and help people learn.
1888680	1891880	Adversary emulation in Purple Team can be quite advanced.
1891880	1903260	But ultimately, when you get down to it, it's attempting an attack or building an exercise for attack, executing it, and seeing if you detected it or missed it, and then fine-tuning it.
1903440	1905160	So, that's what we were doing.
1905420	1909360	The solution was a client-server implementation.
1909360	1917120	It doesn't have a command line GUI as advanced as Metasploit or Red Team Atomic Framework or anything like that.
1917120	1919160	It doesn't have any payloads or modules.
1919160	1920500	It doesn't have dependencies.
1920500	1922000	It is written in Go.
1922000	1926000	So, if you want to run the Go file, you obviously have to install Go.
1926060	1927940	I think it's been easy to use.
1927940	1930320	I made some obvious command line arguments.
1930760	1937840	It's limited to two things, running execution manually and a list of commands.
1937840	1939800	So, you can say, who am I?
1939800	1943260	You can do a regedit, but you have to manually do it or put it in a file.
1943460	1946540	And then there's basic logging into JSON format.
1946540	1948620	So, let's continue.
1948620	1957180	The basic C2 infrastructure for command and control is, obviously, the admin sits in the cloud and then it connects to the infected machine.
1957180	1959260	So, I was like, okay, let's do that.
1959260	1973620	But with adversary emulation, I really wanted to allow CTI analysts or people who are learning to also test their environment on lateral movement or if one or more systems are infected.
1973620	1976620	So, the parent proxy mode sits in the middle.
1976700	1979860	It receives the commands and forwards them to the child.
1980220	1982420	And that way, it's sort of like a daisy chain.
1982420	1986980	And it just adds a little bit more complexity or functionality for testing.
1987980	1992700	So, again, the modes as any C2 tool are, is it has an admin interface.
1992700	1998120	It runs in the cloud or it pretends to be an external attacker.
1998240	2003040	The parent mode, obviously, proxies the commands back and forwards, but you don't have to use it.
2003040	2008820	The client mode receives the commands from either the admin or parent and executes them.
2008820	2009900	Pretty simple.
2009900	2018820	So, we tried to abstract away everything and help people or even CTI analysts sort of be more beneficial to an adversary emulation.
2019080	2027400	So, the two types of modes I mentioned before is on the left, the normal one, you type host name, who am I, and you can see my machine hidden local.
2027400	2035480	The list one, you just supply a file with a list of commands and it will just run through them automatically and send the results back.
2035480	2036900	So, nice and easy.
2038180	2049400	And the dash log is just into a JSON format with the timestamp of command execution, the command that was executed or requested, and then the results.
2049400	2060680	So, this just allows you as someone, if you're at home or in your org, that if you have 100 commands or you execute them and try the next day, you have timestamps to correlate in your detection tools.
2062680	2066700	So, with my tool, I wanted to add TLS.
2066700	2072600	The reason being is that when you're emulating an adversary, they probably don't use clear text.
2072740	2076840	And I didn't, I was trying to think of things that would get in the way of testing.
2076840	2088820	And if you have a command control tool reaching outside your network, your IPS or something in the cloud, whichever detection tool you have is going to trigger an alert and most probably block it.
2089000	2093960	So, I added some certificates and I was playing with Go and got it working.
2094160	2099300	And I sort of cheated a bit because the idea is to abstract away some of the complexity.
2099300	2106380	So, I didn't want anyone to have to build their own certificates, the X509, the key, the product key, stuff like that.
2106380	2110320	So, what I did is I included it in the files.
2110380	2113880	And when you build them, they're included in the executable or the binaries.
2114280	2118980	And then I marked it as insecure skip verifier, which means that it skips the verification.
2119020	2121800	Because TLS is meant to be tied to a domain.
2122280	2128760	And obviously, if you're putting on different boxes, you're putting in the cloud, you don't want to have to generate a certificate all the time.
2128760	2130740	So, this was just to help make it easier.
2130740	2137400	So, regarding encryption, if you don't know, the clear text version is on the left.
2137400	2141720	And you can see the command being recorded over the network in clear text.
2141720	2143600	And TLS gobbles it.
2143600	2147180	So, it's version 1.3, which I was lucky with, I guess.
2147520	2155460	And then because the tool prints to the screen in all three different modes, malware wouldn't print to the screen.
2155460	2159320	It's great for learning, but it's not so much great for emulation.
2159320	2164840	And I didn't want people detecting the print to the screen or printing to the terminal.
2165080	2168520	So, I wanted you to be able to silence it, and then it would just go blank.
2168520	2170700	And you wouldn't see anything printed to the screen.
2170700	2172020	So, that was my thinking.
2172920	2175180	I did add a pause function.
2175180	2181460	So, in the bottom left here, you can just see that it shows the options running in clear text or logging as on and off.
2181720	2186000	And I mostly did that to only script kitties, just because, why not?
2186000	2188680	In addition to just letting you see the options.
2188680	2192640	And then if you do the dash skip, you can skip this bit.
2192640	2196800	And it will just run through automatically, so you can run it quickly.
2196940	2199920	So, I recorded some demos of this.
2199920	2205460	I wanted to show all the different modes, list and normal, and then the TLS demonstration.
2205620	2213920	And then I also wanted to show a registry edit with BlueSpawn, which is an open source EDR, and a scheduled task execution.
2214060	2215940	So, let's get to that.
2218090	2219830	I will drag it over here.
2219830	2222430	See, I have them all in my folder recorded, ready to go.
2222430	2225170	So, I didn't have any technical issues.
2225190	2228810	The thing here is that it's just a host name in the cloud called Ubuntu.
2228890	2230790	And then I set up a lab.
2230790	2232630	So, this is a domain controller.
2233110	2238570	So, I have the emulate and the executable on Linux, because I was moving over to the Windows file.
2238690	2241470	But it's just ./.emulate.
2241470	2242830	The mode is admin.
2242950	2245050	And then you choose the listening port.
2245210	2246910	Listening IP address and port.
2246910	2248370	So, it's just 8.8.8.8.
2248370	2249990	The options are on the left.
2249990	2251430	You've got your TLS, none.
2251430	2252490	Logging, none.
2252490	2253470	Pause, none.
2253470	2257670	And then it even tells you where to connect the client to.
2258270	2262390	So, when you run the executable, you actually choose client mode.
2262390	2267310	And then you do client connect with the same IP address and the same ports.
2267390	2269950	And it should just connect nice and easily.
2270030	2275710	And you don't have to worry about making sure you've done it right.
2275710	2276690	Yep.
2276690	2278270	And it just works like that.
2278330	2281070	And then you can enter who am I or a host name.
2281070	2283390	Just a nice demo to show it working.
2283590	2287810	And then it prints to the screen on the client side so that you know it's working correctly.
2287910	2291250	And what results it's giving.
2291950	2294750	And then this is why I put silence in.
2294750	2300450	Just so that when the client executes, it doesn't detect I'm printing to the screen.
2300450	2302170	Because that would be rather embarrassing.
2303470	2306190	So, the admin list works this way.
2306190	2307590	The same way.
2308310	2309870	So, we do dot emulate.
2309870	2311670	The mode is admin list.
2311670	2315090	You supply the port and IP with the dash listen again.
2315710	2318110	And my typing is really slow.
2318170	2321270	And then you just do the dash commands with the file.
2321270	2323170	So, it would be commando dot text.
2323170	2326010	And we're attempting to launch it in admin list mode.
2326870	2329050	So, on the client is the same.
2329050	2330830	But you do client list mode.
2332030	2335470	And then you do the IP address and port.
2336110	2341650	So, what happens is when you run it, it should automatically execute it like that.
2342290	2347070	So, we just ran whoamihostnamepowershell.exe OS.
2347070	2348350	Not advanced commands.
2348350	2349390	It's just a demo.
2349390	2352150	And to help you guys see the tool in motion.
2352630	2354310	So, that's how it works.
2354530	2357970	Let me close Windows Media Player.
2358430	2360450	The parent mode is pretty cool.
2360450	2362070	Or at least I think it's pretty cool.
2362070	2364970	So, here I've got Ubuntu on the left.
2365230	2367830	I've got two Windows PowerShells open.
2368450	2372410	And then I'm just using the admin dash listen mode in port 999.
2372530	2375090	And then I'm just using dash parent mode.
2375090	2377010	And then the flags are pretty simple.
2377010	2378870	So, it's dot parent connect.
2378870	2380510	Where is the parent going to connect to?
2380510	2381870	It's the admin server.
2382010	2386810	And then dash parent listen is what port is it going to listen on?
2386850	2387670	So, it makes sense.
2387670	2388530	Nice and easy.
2388530	2389930	And then emulate dot exe.
2389930	2391150	The mode is client.
2391150	2393970	Client connect connects to the parent.
2394110	2396350	And then it just forwards the commands through.
2396470	2399030	So, when you're in your org or you're learning at home.
2399030	2401230	You can do more than one machine.
2401370	2402710	Which is pretty cool.
2402710	2404770	And here I typed netstat incorrectly.
2404770	2407150	That's why it doesn't quite work.
2409840	2411060	And yeah, there you go.
2413320	2417040	So, the basic logging format, again, is in JSON.
2417040	2418540	So, if I skip through.
2418860	2420980	I've just done admin list.
2420980	2423760	The listen with the IP address and port again.
2423840	2424900	The dash command.
2424900	2426960	Because we're going to execute in command.
2427360	2429940	And then dash log with the name emulog.
2429940	2432440	Which will create emulog dot JSON.
2432480	2433680	Simple as that.
2433680	2437040	And then on the client mode, you don't have to do the logging.
2437040	2439600	It's only the admin interface that logs.
2439600	2441000	Which is more realistic.
2441000	2442200	But I guess you could.
2442200	2446040	I could build logging for the client if everyone demands it.
2446040	2446940	Or if it's useful.
2446940	2449540	But I thought just doing it on the admin was fine.
2450660	2456220	And then if I skip through and you get the emulog dot JSON file, it's pretty ugly.
2456220	2457360	It's just there.
2457360	2458960	It's just basic JSON.
2460560	2462680	I think that's it.
2462740	2466440	If you put it in nano, it is actually in a JSON object.
2466440	2470120	So, it's got the time, the command, and the output that it receives.
2470120	2474060	So, that allows you to correlate between the different detection tools.
2475580	2478720	The TLS option is pretty similar.
2478720	2480680	You just add dash TLS.
2480800	2486100	So, as you can see here, it's emulate dash mode admin dash listen.
2486100	2490880	I did port 000 just to show that it can listen multiple interfaces.
2490940	2494140	But dash TLS is really the important key here.
2494400	2498160	And then on the client side, you also need to put dash TLS.
2498160	2499680	Otherwise, the handshake won't work.
2499680	2503400	It will think SSL on one end and non-SSL on the other.
2504240	2505760	And then you run that.
2505760	2509260	And I'm just using Wireshark to show that the encryption actually works.
2509260	2511040	I'm not talking out my ass.
2511320	2513700	But yeah, it does the client hello handshake.
2513700	2515420	And you're off to the races.
2515420	2516840	So, that's pretty cool.
2517900	2520620	And it also works with PowerShell and that stuff.
2522220	2524360	After it executes and runs through.
2529680	2532900	This one is to show just some recon commands.
2533020	2537320	So, Xena Oterio was giving me her research.
2537320	2540780	And there was one that executed multiple recon commands.
2540780	2543380	And one was even the WLAN export profile.
2543380	2547780	But I left it in because I thought it would be funny being in AWS.
2547780	2551060	It doesn't have a Wi-Fi profile.
2551340	2552900	So, that's the file.
2553600	2554780	You add it in.
2554780	2556280	And the log name is advanced.
2556280	2559160	And so, it will become advanced.json.
2559460	2563200	And then I just already have it in the Windows CMD.
2563200	2564520	It clicks through.
2564520	2565620	It runs it.
2565620	2568140	And it all logs to a JSON file.
2568220	2570440	Even though it's quite a lot of output.
2570840	2575840	And then I use jQuery just to see how it's ugly when you cap the file.
2575840	2577000	Because it's JSON.
2577140	2580180	But if you use jQuery, it's a little bit better formatted.
2580580	2582620	You could probably clean it up a lot better.
2582620	2585520	But it was just, I made it larger for the demo.
2585540	2589000	And you can see that it executes CMD slash C.
2589180	2592420	And then it creates the results.
2595440	2596360	Close, close.
2596360	2596680	All right.
2596680	2597460	Cool.
2599220	2606560	So, the research Xena gave me, there was a registry add command with environment CMD start.
2606560	2607480	Things like that.
2607480	2615960	I wanted to show a demo where this registry add can actually be tipped by an open source EDR called bluespawn.
2615960	2624940	So, in an example of doing something real world, or in the effort to do so, we have it set up here.
2624940	2626420	I'm listening on port 44.
2626460	2633240	We're going to execute bluespawn, which is an open source EDR, to see if we can trip it.
2633240	2634660	Or it detects something.
2635080	2638020	So, then we're going to go into client mode with TLS.
2638720	2640480	And then, as you can see, I'm admin one.
2640480	2642700	Because that's the only way I could really execute.
2643160	2644680	And then I copy paste.
2644680	2646460	But I do this in PowerShell.
2646860	2649100	Just because I felt like it.
2653390	2654890	And then it goes through.
2654890	2657810	It's reported as completing successfully.
2658630	2661690	And you can see, even on the client, it shows you.
2661690	2668870	And then when you go to bluespawn, you can see the MITRE technique, T1183, and the registry edit.
2668970	2671330	So, this was actually from some training.
2671430	2675930	I did this regedit, and they did a demo with bluespawn.
2675930	2684050	I thought it would be great to show everyone how the tool can be used in the idea of adversary emulation.
2684910	2691710	Now, the next one we wanted to show was a scheduled task slash job, which is T1053 in the MITRE framework.
2691990	2696390	And this was from Cape Sandbox 32597.
2696690	2699930	So, it's scheduled tasks, and it creates...
2700790	2703250	Scheduled tasks, it executes when someone logs on.
2703250	2704990	So, it's a typical persistence mechanism.