SEC699: Advanced Purple Teaming - Adversary Emulation & Detection Engineering™

Overview

In section one we will lay the foundations for the rest of the week by:

• Leveraging the power of automation to deploy our lab infrastructure.
• Learning how to build a purple team in-house, covering process, approach, and tooling.
• Tracking purple teaming exercises using VECTR
• Showing what an overall detection stack looks like, including a low-level view on how Windows systems generate telemetry (ETW, Kernel Callbacks,...)
• Detection engineering principles (rule-based detection vs anomalies, technique-centric detections vs tool-centric detections...)
• How an adversary emulation stack can be built using freely available tools

Even if it's just the first section, it's heavy hands-on, as students will complete five different exercises.

Exercises

• Exercise: Introduction to VECTR
• Exercise: Preparing our Elastic and SIGMA stack
• Exercise: Preparing our adversary emulation stack
• Exercise: Prelude

Topics

• Introduction
  • Course objectives
  • Building our lab environment
  • Introducing the lab architecture
  • Purple Teaming Organization
• Key Tools
  • Overall detection stack
  • Log Sources & Raw Telemetry
  • Assessing detection coverage
  • Rule-based versus anomaly-based detection
  • Building a stack for adversary emulation
  • Automated emulation using Prelude Operator

Overview

Section two starts with a state-of-the-art overview of current attack strategies and defenses for initial execution. We will zoom in on built-in defenses provided by Microsoft such as the Anti Malware Scanning Interface (AMSI). How does it work, how effective is it, and can it be bypassed? The course section will then move into the following modules:

• Controlling execution on your endpoints using AppLocker. Introduced in Windows 7, Applocker is an application control technique that can be used to prevent execution of malicious payloads. We'll zoom in on its effectiveness and test several bypasses.
• Controlling execution on your endpoints using Attack Surface Reduction (ASR) rules. Introduced in Windows 10, ASR rules are an additional security layer that can be used to prevent execution of malicious payloads. We'll zoom in on their effectiveness and test several bypasses.
• We will look at a number of Endpoint Detection & Response (EDR) bypass strategies, including child-parent process ID spoofing, command line argument spoofing, process injection and hollowing, and direct syscalls. The rise of EDR tools has provided organizations with a means to enable in-depth detection and perform immediate response activities on their endpoints. These tools have changed the security landscape and have forced adversaries to get creative. Careful, it gets quite technical here...

Exercises

• Exercise: VBA Stomping, Purging & AMSI Bypasses
• Exercise: Enabling and bypassing AppLocker
• Exercise: Bypassing Attack Surface Reduction
• Exercise: Child-parent spoofing
• Exercise: Process hollowing
• Exercise: Direct System calls

Topics

• Initial Intrusion Strategies
  • Traditional Attack Strategies & Defenses
• Emulating Adversarial Techniques & Detections
  • Anti-Malware Scanning Interface (AMSI)
  • Office Macro Obfuscation Techniques
  • Application Execution Control
  • ExploitGuard & Attack Surface Reduction Rules
• Avoiding Endpoint Security Products
  • Hiding in Plain Sight - Creating New Processes
  • Do My Bidding - Abusing Existing Processes
  • Endpoint Security / Telemetry Tampering

Overview

The following modules will be covered in section three:

• Enumerating Active Directory (AD) resources and configurations to map the overall attack surface of an AD environment.
• Understanding the Local Security Authority Subsystem Service (LSASS) process. What is its purpose and how is it traditionally attacked? We will go in-depth and explain topics such as Security Support Providers and Authentication Packages. We'll then zoom in on the execution and detection of LSASS dumping attacks using a variety of tools (including Mimikatz, Dumpert, and ProcDump).
• Given the focus of security products on LSASS, we will also investigate other credential dumping techniques. How can adversaries steal credentials without touching LSASS? Key techniques will include Internal Monologue (NTLMv1 downgrade), NTDS.dit stealing, and DCSync.
• Provided with network-level access (or an initial payload on a network-connected device), how can we obtain additional credentials by forcing other Windows systems to connect to us? Topics include the use of Link-Local Multicast Name Resolution (LLMNR), but also IPv6-based man-in-the-middle attacks
• A refresh on Kerberos and traditional attacks such as Kerberoasting, ASReproasting, golden tickets, silver tickets, and the Skeleton Key attack. We'll then focus on advanced attack strategies, primarily delegation attacks, before covering delegation attacks and Active Directory Certificate Service abuse.

Exercises

• Exercise: Analyzing BloodHound attack chains
• Exercise: Stealing credentials from LSASS
• Exercise: Internal Monologue in NTLMv1 downgrades
• Exercise: Creative NTLMv2 Challenge-Response stealing
• Exercise: Abusing unconstrained delegation
• Exercise: Abusing constrained delegation
• Exercise: Abusing Active Directory Certificate Services

Topics

• Active Directory Enumeration
  • Bloodhound Enumeration
• Credential Dumping
  • LSASS Credential Stealing Techniques
  • Stealing credentials without touching LSASS
  • Stealing NTLMv2 Challenge-Response
• Kerberos Attacks
  • Kerberos refresh
  • Unconstrained Delegation Attacks
  • (Resource-based) Constrained Delegation Attacks
• Active Directory Certificate Services

Overview

This section will examine the security boundaries in an Active Directory (AD) environment and how adversaries can possibly pivot between different domains and forests. We'll look at typical persistence strategies used by adversaries as well as typical detection strategies. The course section will also present the following modules:

• Abusing the Component Object Model (COM) to establish a persistent foothold in a target environment. We'll cover attacks including Phantom COM Objects and COM Search Order Hijacking.
• Obtaining persistence through the use of Windows Management Instrumentation (WMI). We will explain WMI Event Filters, Event Consumers, and Event Filter to Consumer bindings
• Establishing persistence through Dynamic Link Libraries (DLLs) such as AppCert, AppInit, and Netshell.
• Leveraging Microsoft Office for persistence, with a focus on template shenanigans and malicious add-ins.
• Abusing the Application Compatibility Toolkit to obtain persistence through application shims.
• Stealth persistence using the AD

Exercises

• Exercise: Pivoting between domains and forests
• Exercise: COM Object Hijacking
• Exercise: WMI Persistence
• Exercise: Implementing Netsh helper DLLs
• Exercise: Office Persistence
• Exercise: Application Shimming
• Exercise: Stealth AD persistence

Topics

• Pivoting between domains and forests
  • Breaking Domain & Forest Trusts
• Persistence Techniques
  • COM Object Hijacking
  • WMI Persistence
  • AppCert, AppInit & Netsh Helper DLLs
  • Office Template & Library tricks
  • Application shimming
  • Stealth AD Persistence
• Conclusion

Overview

In this course section we will build out emulation plans for five specific threat actors: APT-33, EvilCorp, APT-28, APT-34, and Turla. After completing the emulation plans, we will execute them using Caldera, Covenant, and Prelude Operator. After completion of the course, participants will gain access to an epic CTF to infiltrate or defend the corporate environment. Students will leverage all of the tools and techniques they've learned throughout the course for up to 7 days after class ends!

Exercises

• Exercise: APT-33 Emulation Plan
• Exercise: EvilCorp Emulation Plan
• Exercise: APT-28 Emulation Plan
• Exercise: APT-34 Emulation Plan
• Exercise: Turla Emulation Plan

Topics

• Executing Emulation Plans
  • APT-33 Emulation Plan
  • EvilCorp Emulation Plan
  • APT-28 Emulation Plan
  • APT-34 Emulation Plan
  • Turla Emulation Plan