SlideShare a Scribd company logo

Adversary Emulation - DerpCon

•
•
Jorge Orchilles
Jorge Orchilles

Adversary Emulation is a type of Red Team Exercise where the Red Team emulates how an adversary operates, following the same tactics, techniques, and procedures (TTPs), with a specific objective (similar to those of realistic threats or adversaries). Adversary emulations are performed using a structured approach, which can be based on a kill chain or attack flow. Methodologies and Frameworks for Adversary Emulations are covered. Adversary Emulations are end-to-end attacks against a target organization to obtain a holistic view of the organization’s preparedness for a real, sophisticated attack.

Technology
1 of 31
Adversary Emulation JORGE ORCHILLES
DERP.TXT • Security appliance from major vendor you may know • Shrink wrap/product penetration test before putting in production (also before we pay them) • Did not want to provide us access to CLI – boooooo • Gave us restricted shell and said we would have to break out if we wanted access – challenge accepted! • Assigned the top restricted shell escaper I know@JORGEORCHILLES
> help https://www.sans.org/blog/escaping-restricted-linux-shells/
@JORGEORCHILLES
@JORGEORCHILLES DERP.TXT
DERP.TXT @JORGEORCHILLES
@JORGEORCHILLES
@JORGEORCHILLES FOUND THE MAGIC WORD AND SO MUCH MORE
#WHOAMILed offensive security team at large financial for past 10 years Published industry contributions include: ⑊ Founding member MITRE Engenuity Center ⑊ Co-Author GFMA Threat-led Penetration Testing & Red Team Framework ⑊ SANS Instructor and author of Red Team course: SEC564 ⑊ NSI Technologist Fellow; ISSA Fellow ⑊ Common Vulnerability Scoring System (CVSSv3.1) ⑊ Author of Windows 7 Administrators reference (Syngress) @JORGEORCHILLES
11 VULNERABILITY SCANNING VULNERABILITY ASSESSMENT PENETRATION TESTING RED TEAM IN PERSON PURPLE TEAM CONTINOUS PURPLE TEAM ADVERSARY EMULATION Definition: A type of Red Team exercise where the Red Team emulates how an adversary operates, following the same tactics, techniques, and procedures (TTPs), with a specific objective like those of realistic adversary. Goal: Emulate an end-to-end attack against a target organization. Obtain a holistic view of the organization’s preparedness for a real, sophisticated attack. @JORGEORCHILLES
12 An end to end assessment of the entire organization ⑊ Main differentiator from penetration testing - Tests the defenders not the defenses (detection vs. prevention) - People, Process, and Technology - Not a limited scope test targeting just a particular product, infrastructure, network, application, URL, or domain ⑊ Full Cyber Kill Chain from Recon to Objective ⑊ Often blind, unannounced exercise ⑊ Determine what TTPs would work, undetected if a true attack occurred and action plan to remediate @JORGEORCHILLES
13 Measuring the effectiveness of People, Process, and Technology Documented metrics and timeline of entire exercise ⑊ Time and TTPs to obtain initial access ⑊ TTPs that allowed moving laterally ⑊ Identify TTPs not prevented or detected ⑊ Process and time to escalate events into an incident ⑊ Time to contain; ⑊ Time to eradicate ⑊ Process to engage hunt team, coordinate communications, alert leadership and correlate all events and realize sophisticated, targeted attack @JORGEORCHILLES
14 ASSUMPTIONS That attack won’t work here because… “We applied all patches” “We have outbound DLP” “Our users would never open a macro” “Our applications have MFA” “Our network is segmented and only way out is through proxy” “We have firewalls, AV, and IDS” Trust but verify Can the Iranians breach us? @JORGEORCHILLES
15 Training and improving the Blue Team ⑊ Every Red Team Exercise will result in Blue Team getting better ⑊ As you measure the people, process, and technology you will see improvements ⑊ Lessons will be learned, and processes improved ⑊ The more you train, the more you improve @JORGEORCHILLES
16 FRAMEWORK & METHODOLOGIES ⑊ Cyber Kill Chain – Lockheed Martin ⑊ Unified Cyber Kill Chain – Paul Pols ⑊ ATT&CK – MITRE Regulatory: ⑊ CBEST Intelligence Led Testing – Bank of England ⑊ Threat Intelligence-Based Ethical Red Teaming – TIBER- EU ⑊ Red Team: Adversarial Attack Simulation Exercises – ABS (Association of Banks of Singapore) ⑊ intelligence-led Cyber Attack Simulation Testing (iCAST) – HKMA (Hong Kong Monetary Authority) ⑊ G-7 Fundamental Elements for Threat-Led Penetration Testing (G7FE-TLPT) ⑊ A Framework for the Regulatory Use of Penetration Testing and Red Teaming in the Financial Services Industry – GFMA (Global Financial Markets Association) @JORGEORCHILLES
INITIAL ACCESS EXECUTION PERSISTENCE PRIVILEGE ESCALATION DEFENSIVE EVASION CREDENTIAL ACCESS DISCOVERY LATERAL MOVEMENT COLLECTION COMMAND AND CONTROL EXFILTRATION IMPACT DRIVE- BY COMPROMISE APPLESCRIPT .BASH_PROFULE AND .BASHRC ACCESS TOKEN MANIPULATION ACCESS TOKEN MANIPULATION ACCOUNT MANIPULATION ACCOUNT DISCOVERY APPLESCRIPT AUDIO CAPTURE COMMONLY USED PORT AUTOMATED EXFILTRATION DATA DESTRUCTION EXPLOIT PUBLIC- FACING APPLICATION CMSTP ACCESIBILITY FEATURES ACCESIBILITY FEATURES BITS JOBS BASH HISTORY APPLICATION WINDOW DISCOVERY APPLICATION DEPLOYMENT SOFTWARE AUTOMATED COLLECTION COMMUINICTION THROUGH REMOVABLE DATA DATA COMPRESSED DATA ENCRYPTED FOR IMPACT EXTERNAL REMOTE SERVICES COMMAND-LINE INTERFACE ACCOUNT MANIPULATION APPCERT DLLS DINARY PADDING BRUTE FORCE BROWSER BOOKMARK DISCOVERY DISTRUBETED COMPONENT OBJECT MODEL CLIPBOARD DATA CONNECTION PROXY DATA ENCRYPTED DEFACEMENT HARDWARE ADDITIONS COMPILED HTML FILE APPCERT DLLS APPINIT DLLS ACCOUNT CONTROL BYPASS USER CREDENTIAL DUMPING DOMAIN TRUST DISCOVERY EXPLOITATION OF REMOTE SERVICES DATA STAGE CUSTOM COMMAND AND CONTROL PROTOCOL DATA TRANSFER SIZE LIMIT DISK CONTENT WIPE REPLICATION THROUGH REMOVABLE MEDIA CONTORL PANEL ITEMS APPINIT DLLS APPLICATION SHIMMIMG CMSTP CREDENTIALS IN FILES FILE AND DIRECTORY DISCOVERY LOGON SCRIPT DATA FROM INFORMATION REPOSITORIES CUSTOM CRYPTOGRAPHIC PROTOCOL EXFILTRATION OVER ALTERNATIVE PROTOCOL DISK STRUCTURE WIPE SPEARPHISHING ATTACHMENT DYNAMIC DATA EXCHANGE APPLICATION SHIMMING BYPASS USER ACCOUNT CONTROL CLEAR COMMAND HISTORY CREDENTIALS IN REGISTRY NETWORK SERVICE SCANNING PASS THE HASH DATA FROM LOCAL SYSTEM DATA ENCODING EXFILTRATION OVER COMMAND AND CONTROL CHANNEL ENDPOINT DENIAL OF SERVICE SPEARPHISHING LINK EXECUTION THROUGH API AUTHENTICATIO N PACKAGE DLL SEARCH ORDER HIJACKING CODE SIGNING EXPLOITATION FOR CREDENTIAL ACCESS NETWORK SHARE DISCOVERY PASS THE TICKET DATA FROM NETWORK SHARE DRIVE DATA OBFUSCATION EXFILTRATION OVER OTHER NETWORK MEDIUM FIRMWARE CORRUPTION MITRE has developed the ATT&CK Matrix as a central repository for adversary TTPs. It is used by both red and blue teams. It is rapidly gaining @JORGEORCHILLES
FRAMEWORK Most organizations will take a hybrid approach based on the frameworks and methodologies just introduced ⑊ Threat Intelligence ⑊ Planning ⑊ Testing ⑊ Closure @JORGEORCHILLES
T1086 – PowerShell T1068 – Exploitation for Privilege Escalation T1003 – Credential Dumping S0194 – PowerSploit S0192 – Pupy S0002 – Mimikatz S0129 – AutoIT Hash Value IP Address TACTICS | TECHNIQUES | PROCEDURES https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html @JORGEORCHILLES
ATT&CK Navigator
21 TRUSTED AGENTS RULES OF ENGAGEMENT ATTACK INFRASTRUCTURE o Limited number of people with knowledge of the exercise o When players find out about exercise their behavior changes o Individuals whose daily roles and responsibilities put them in a position to contribute to reducing the risk of causing unintended impact to production systems and/or inaccurate senior or external escalation Establish the responsibility, relationship, and guidelines between Trusted Agents and Players o Rules for Blue Team o Carry out all activity as any other incident o Trusted Agents will report what incidents are being investigated o Do not report exercise related items to regulators o Rules for Red Team o Do not bring down any business process or operation o Communicate all actions during daily brief Red Team is responsible for setting up infrastructure to emulate TTPs o Choose and procure external hosting service providers o Purchase domain names o Generate domain certificates o Setup mail servers o Setup phishing and credential theft sites o Confirm reputation and categorization of all domain and IPs o Setup Short and Long Haul C2 infrastructure o Configure custom C2 tooling o Test external C2 communication PLANNING @JORGEORCHILLES White Team or White Cell
22 Matrix of command and control frameworks for Red Teamers ⑊ Google doc of most C2 frameworks: www.thec2matrix.com ⑊ Documents various capabilities of each framework ⑊ There is no right or wrong, better or worse framework ⑊ Find ideal C2 for your current objective ⑊ Wizard like UI to select which one: ask.thec2matrix.com ⑊ How-To Site for using C2s: howto.thec2matrix.com ⑊ SANS Slingshot C2 Matrix Edition @JORGEORCHILLES
25 Initial Foothold Compromised System Network Propagation Internal Network Action on Objectives Critical Asset Access ⑊ Reconnaissance ⑊ Weaponization ⑊ Delivery ⑊ Social engineering ⑊ Exploitation ⑊ Persistence ⑊ Defense evasion ⑊ Command & Control ⑊ Discovery ⑊ Privilege escalation ⑊ Execution ⑊ Credential access ⑊ Lateral movement ⑊ Collection ⑊ Exfiltration ⑊ Target manipulation ⑊ Objectives PIVOTING ACCESS The Unified Kill Chain – Paul Pols The Unified Kill Chain is a good answer to some of the Cyber Kill Chain limitations! @JORGEORCHILLES
26 ⑊ What TTPs were prevented? Why? Document these too! ⑊ What was detected? How long did it take? - Time to contain - Time to eradicate ⑊ Where processes followed? - Process and time to escalate events into an incident - Process to engage hunt team - Process to coordinate communications & alert leadership - Process to corelate all events and realize sophisticated, targeted attack CLOSURE @JORGEORCHILLES
27
28
29
Automated Emulation https://medium.com/@jorgeorchilles/purple-team-exercise-tools-a85187ce341 ⑊ Red Team will be asked to repeat TTPs ⑊ Don’t waste Red Team Operator time re-doing the same TTP while engineers, operations, and SOC get detection working
Thank you! 31 Q & A?@JorgeOrchilles @C2_Matrix https://www.thec2matrix.com/ https://www.sans.org/course/red-team-exercises-adversary-emulation

Recommended

Adversary Emulation - Red Team Village - Mayhem 2020
Adversary Emulation - Red Team Village - Mayhem 2020Adversary Emulation - Red Team Village - Mayhem 2020
Adversary Emulation - Red Team Village - Mayhem 2020Jorge Orchilles
 
Adversary Emulation using CALDERA
Adversary Emulation using CALDERAAdversary Emulation using CALDERA
Adversary Emulation using CALDERAErik Van Buggenhout
 
Adversary Emulation and Its Importance for Improving Security Posture in Orga...
Adversary Emulation and Its Importance for Improving Security Posture in Orga...Adversary Emulation and Its Importance for Improving Security Posture in Orga...
Adversary Emulation and Its Importance for Improving Security Posture in Orga...Digit Oktavianto
 
Adversary Emulation and Red Team Exercises - EDUCAUSE
Adversary Emulation and Red Team Exercises - EDUCAUSEAdversary Emulation and Red Team Exercises - EDUCAUSE
Adversary Emulation and Red Team Exercises - EDUCAUSEJorge Orchilles
 
Adversary Emulation and the C2 Matrix
Adversary Emulation and the C2 MatrixAdversary Emulation and the C2 Matrix
Adversary Emulation and the C2 MatrixJorge Orchilles
 
Purple Team Exercises - GRIMMCon
Purple Team Exercises - GRIMMConPurple Team Exercises - GRIMMCon
Purple Team Exercises - GRIMMConJorge Orchilles
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceDhruv Majumdar
 
Threat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKThreat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKKatie Nickels
 

Recommended

Adversary Emulation - Red Team Village - Mayhem 2020
Adversary Emulation - Red Team Village - Mayhem 2020Adversary Emulation - Red Team Village - Mayhem 2020
Adversary Emulation - Red Team Village - Mayhem 2020Jorge Orchilles
 
Adversary Emulation using CALDERA
Adversary Emulation using CALDERAAdversary Emulation using CALDERA
Adversary Emulation using CALDERAErik Van Buggenhout
 
Adversary Emulation and Its Importance for Improving Security Posture in Orga...
Adversary Emulation and Its Importance for Improving Security Posture in Orga...Adversary Emulation and Its Importance for Improving Security Posture in Orga...
Adversary Emulation and Its Importance for Improving Security Posture in Orga...Digit Oktavianto
 
Adversary Emulation and Red Team Exercises - EDUCAUSE
Adversary Emulation and Red Team Exercises - EDUCAUSEAdversary Emulation and Red Team Exercises - EDUCAUSE
Adversary Emulation and Red Team Exercises - EDUCAUSEJorge Orchilles
 
Adversary Emulation and the C2 Matrix
Adversary Emulation and the C2 MatrixAdversary Emulation and the C2 Matrix
Adversary Emulation and the C2 MatrixJorge Orchilles
 
Purple Team Exercises - GRIMMCon
Purple Team Exercises - GRIMMConPurple Team Exercises - GRIMMCon
Purple Team Exercises - GRIMMConJorge Orchilles
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceDhruv Majumdar
 
Threat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKThreat-Based Adversary Emulation with MITRE ATT&CK
Threat-Based Adversary Emulation with MITRE ATT&CKKatie Nickels
 
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE - ATT&CKcon
 
Adversary Emulation using CALDERA
Adversary Emulation using CALDERAAdversary Emulation using CALDERA
Adversary Emulation using CALDERAErik Van Buggenhout
 
How MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsHow MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsSergey Soldatov
 
Leveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common LanguageLeveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common LanguageErik Van Buggenhout
 
So you want to be a red teamer
So you want to be a red teamerSo you want to be a red teamer
So you want to be a red teamerJorge Orchilles
 
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...Jorge Orchilles
 
Threat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonThreat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonBen Boyd
 
Purple Team Exercise Framework Workshop #PTEF
Purple Team Exercise Framework Workshop #PTEFPurple Team Exercise Framework Workshop #PTEF
Purple Team Exercise Framework Workshop #PTEFJorge Orchilles
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopDigit Oktavianto
 
Purple Teaming with ATT&CK - x33fcon 2018
Purple Teaming with ATT&CK - x33fcon 2018Purple Teaming with ATT&CK - x33fcon 2018
Purple Teaming with ATT&CK - x33fcon 2018Christopher Korban
 
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation PlansEvolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation PlansChristopher Korban
 
Cyber threat intelligence ppt
Cyber threat intelligence pptCyber threat intelligence ppt
Cyber threat intelligence pptKumar Gaurav
 
Threat hunting and achieving security maturity
Threat hunting and achieving security maturityThreat hunting and achieving security maturity
Threat hunting and achieving security maturityDNIF
 
Red teaming probably isn't for you
Red teaming probably isn't for youRed teaming probably isn't for you
Red teaming probably isn't for youToby Kohlenberg
 
Introduction to MITRE ATT&CK
Introduction to MITRE ATT&CKIntroduction to MITRE ATT&CK
Introduction to MITRE ATT&CKArpan Raval
 
Building an InfoSec RedTeam
Building an InfoSec RedTeamBuilding an InfoSec RedTeam
Building an InfoSec RedTeamDan Vasile
 
Purple Team - Work it out: Organizing Effective Adversary Emulation Exercises
Purple Team - Work it out: Organizing Effective Adversary Emulation ExercisesPurple Team - Work it out: Organizing Effective Adversary Emulation Exercises
Purple Team - Work it out: Organizing Effective Adversary Emulation ExercisesJorge Orchilles
 
Threat hunting for Beginners
Threat hunting for BeginnersThreat hunting for Beginners
Threat hunting for BeginnersSKMohamedKasim
 
Using IOCs to Design and Control Threat Activities During a Red Team Engagement
Using IOCs to Design and Control Threat Activities During a Red Team EngagementUsing IOCs to Design and Control Threat Activities During a Red Team Engagement
Using IOCs to Design and Control Threat Activities During a Red Team EngagementJoe Vest
 
Cyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down IntrudersCyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down IntrudersInfosec
 
Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...
Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...
Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...Adam Pennington
 
INTERNSHIPREVIEW-ISHAQ (1) [Recovered].pptx
INTERNSHIPREVIEW-ISHAQ (1) [Recovered].pptxINTERNSHIPREVIEW-ISHAQ (1) [Recovered].pptx
INTERNSHIPREVIEW-ISHAQ (1) [Recovered].pptxSuhailShaik16
 

More Related Content

What's hot

MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE - ATT&CKcon
 
Adversary Emulation using CALDERA
Adversary Emulation using CALDERAAdversary Emulation using CALDERA
Adversary Emulation using CALDERAErik Van Buggenhout
 
How MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsHow MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsSergey Soldatov
 
Leveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common LanguageLeveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common LanguageErik Van Buggenhout
 
So you want to be a red teamer
So you want to be a red teamerSo you want to be a red teamer
So you want to be a red teamerJorge Orchilles
 
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...Jorge Orchilles
 
Threat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonThreat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonBen Boyd
 
Purple Team Exercise Framework Workshop #PTEF
Purple Team Exercise Framework Workshop #PTEFPurple Team Exercise Framework Workshop #PTEF
Purple Team Exercise Framework Workshop #PTEFJorge Orchilles
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopDigit Oktavianto
 
Purple Teaming with ATT&CK - x33fcon 2018
Purple Teaming with ATT&CK - x33fcon 2018Purple Teaming with ATT&CK - x33fcon 2018
Purple Teaming with ATT&CK - x33fcon 2018Christopher Korban
 
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation PlansEvolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation PlansChristopher Korban
 
Cyber threat intelligence ppt
Cyber threat intelligence pptCyber threat intelligence ppt
Cyber threat intelligence pptKumar Gaurav
 
Threat hunting and achieving security maturity
Threat hunting and achieving security maturityThreat hunting and achieving security maturity
Threat hunting and achieving security maturityDNIF
 
Red teaming probably isn't for you
Red teaming probably isn't for youRed teaming probably isn't for you
Red teaming probably isn't for youToby Kohlenberg
 
Introduction to MITRE ATT&CK
Introduction to MITRE ATT&CKIntroduction to MITRE ATT&CK
Introduction to MITRE ATT&CKArpan Raval
 
Building an InfoSec RedTeam
Building an InfoSec RedTeamBuilding an InfoSec RedTeam
Building an InfoSec RedTeamDan Vasile
 
Purple Team - Work it out: Organizing Effective Adversary Emulation Exercises
Purple Team - Work it out: Organizing Effective Adversary Emulation ExercisesPurple Team - Work it out: Organizing Effective Adversary Emulation Exercises
Purple Team - Work it out: Organizing Effective Adversary Emulation ExercisesJorge Orchilles
 
Threat hunting for Beginners
Threat hunting for BeginnersThreat hunting for Beginners
Threat hunting for BeginnersSKMohamedKasim
 
Using IOCs to Design and Control Threat Activities During a Red Team Engagement
Using IOCs to Design and Control Threat Activities During a Red Team EngagementUsing IOCs to Design and Control Threat Activities During a Red Team Engagement
Using IOCs to Design and Control Threat Activities During a Red Team EngagementJoe Vest
 
Cyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down IntrudersCyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down IntrudersInfosec
 

What's hot (20)

MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
MITRE ATT&CKcon 2018: Hunters ATT&CKing with the Data, Roberto Rodriguez, Spe...
 
Adversary Emulation using CALDERA
Adversary Emulation using CALDERAAdversary Emulation using CALDERA
Adversary Emulation using CALDERA
 
How MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operationsHow MITRE ATT&CK helps security operations
How MITRE ATT&CK helps security operations
 
Leveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common LanguageLeveraging MITRE ATT&CK - Speaking the Common Language
Leveraging MITRE ATT&CK - Speaking the Common Language
 
So you want to be a red teamer
So you want to be a red teamerSo you want to be a red teamer
So you want to be a red teamer
 
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
Managing & Showing Value during Red Team Engagements & Purple Team Exercises ...
 
Threat hunting - Every day is hunting season
Threat hunting - Every day is hunting seasonThreat hunting - Every day is hunting season
Threat hunting - Every day is hunting season
 
Purple Team Exercise Framework Workshop #PTEF
Purple Team Exercise Framework Workshop #PTEFPurple Team Exercise Framework Workshop #PTEF
Purple Team Exercise Framework Workshop #PTEF
 
Cyber Threat Hunting Workshop
Cyber Threat Hunting WorkshopCyber Threat Hunting Workshop
Cyber Threat Hunting Workshop
 
Purple Teaming with ATT&CK - x33fcon 2018
Purple Teaming with ATT&CK - x33fcon 2018Purple Teaming with ATT&CK - x33fcon 2018
Purple Teaming with ATT&CK - x33fcon 2018
 
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation PlansEvolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
Evolution of Offensive Testing - ATT&CK-based Adversary Emulation Plans
 
Cyber threat intelligence ppt
Cyber threat intelligence pptCyber threat intelligence ppt
Cyber threat intelligence ppt
 
Threat hunting and achieving security maturity
Threat hunting and achieving security maturityThreat hunting and achieving security maturity
Threat hunting and achieving security maturity
 
Red teaming probably isn't for you
Red teaming probably isn't for youRed teaming probably isn't for you
Red teaming probably isn't for you
 
Introduction to MITRE ATT&CK
Introduction to MITRE ATT&CKIntroduction to MITRE ATT&CK
Introduction to MITRE ATT&CK
 
Building an InfoSec RedTeam
Building an InfoSec RedTeamBuilding an InfoSec RedTeam
Building an InfoSec RedTeam
 
Purple Team - Work it out: Organizing Effective Adversary Emulation Exercises
Purple Team - Work it out: Organizing Effective Adversary Emulation ExercisesPurple Team - Work it out: Organizing Effective Adversary Emulation Exercises
Purple Team - Work it out: Organizing Effective Adversary Emulation Exercises
 
Threat hunting for Beginners
Threat hunting for BeginnersThreat hunting for Beginners
Threat hunting for Beginners
 
Using IOCs to Design and Control Threat Activities During a Red Team Engagement
Using IOCs to Design and Control Threat Activities During a Red Team EngagementUsing IOCs to Design and Control Threat Activities During a Red Team Engagement
Using IOCs to Design and Control Threat Activities During a Red Team Engagement
 
Cyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down IntrudersCyber Threat Hunting: Identify and Hunt Down Intruders
Cyber Threat Hunting: Identify and Hunt Down Intruders
 

Similar to Adversary Emulation - DerpCon

Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...
Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...
Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...Adam Pennington
 
INTERNSHIPREVIEW-ISHAQ (1) [Recovered].pptx
INTERNSHIPREVIEW-ISHAQ (1) [Recovered].pptxINTERNSHIPREVIEW-ISHAQ (1) [Recovered].pptx
INTERNSHIPREVIEW-ISHAQ (1) [Recovered].pptxSuhailShaik16
 
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status QuoBSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status QuoKatie Nickels
 
Slideshare.net rh-isac summit 2019 - adam pennington - leveraging mitre at ta...
Slideshare.net rh-isac summit 2019 - adam pennington - leveraging mitre at ta...Slideshare.net rh-isac summit 2019 - adam pennington - leveraging mitre at ta...
Slideshare.net rh-isac summit 2019 - adam pennington - leveraging mitre at ta...Robert Brandel
 
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...Adam Pennington
 
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...Adam Pennington
 
MITRE_ATTACK_Enterprise_11x17.pdf
MITRE_ATTACK_Enterprise_11x17.pdfMITRE_ATTACK_Enterprise_11x17.pdf
MITRE_ATTACK_Enterprise_11x17.pdfAisyiFree
 
C2 Matrix A Comparison of Command and Control Frameworks
C2 Matrix A Comparison of Command and Control FrameworksC2 Matrix A Comparison of Command and Control Frameworks
C2 Matrix A Comparison of Command and Control FrameworksJorge Orchilles
 
Pennington - Defending Against Targeted Ransomware with MITRE ATT&CK
Pennington - Defending Against Targeted Ransomware with MITRE ATT&CKPennington - Defending Against Targeted Ransomware with MITRE ATT&CK
Pennington - Defending Against Targeted Ransomware with MITRE ATT&CKAdam Pennington
 
Cyber Threat hunting workshop
Cyber Threat hunting workshopCyber Threat hunting workshop
Cyber Threat hunting workshopArpan Raval
 
How to get along with HATEOAS without letting the bad guys steal your lunch?
How to get along with HATEOAS without letting the bad guys steal your lunch?How to get along with HATEOAS without letting the bad guys steal your lunch?
How to get along with HATEOAS without letting the bad guys steal your lunch?Graham Charters
 
Splunk Enterprise for InfoSec Hands-On Breakout Session
Splunk Enterprise for InfoSec Hands-On Breakout SessionSplunk Enterprise for InfoSec Hands-On Breakout Session
Splunk Enterprise for InfoSec Hands-On Breakout SessionSplunk
 
2017 Q1 Arcticcon - Meet Up - Adventures in Adversarial Emulation
2017 Q1 Arcticcon - Meet Up - Adventures in Adversarial Emulation2017 Q1 Arcticcon - Meet Up - Adventures in Adversarial Emulation
2017 Q1 Arcticcon - Meet Up - Adventures in Adversarial EmulationScott Sutherland
 
All These Sophisticated Attacks, Can We Really Detect Them - PDF
All These Sophisticated Attacks, Can We Really Detect Them - PDFAll These Sophisticated Attacks, Can We Really Detect Them - PDF
All These Sophisticated Attacks, Can We Really Detect Them - PDFMichael Gough
 
Top 20 certified ethical hacker interview questions and answer
Top 20 certified ethical hacker interview questions and answerTop 20 certified ethical hacker interview questions and answer
Top 20 certified ethical hacker interview questions and answerShivamSharma909
 
For Business's Sake, Let's focus on AppSec
For Business's Sake, Let's focus on AppSecFor Business's Sake, Let's focus on AppSec
For Business's Sake, Let's focus on AppSecLalit Kale
 
Top 10 Ways To Make Hackers Excited: All About The Shortcuts Not Worth Taking
Top 10 Ways To Make Hackers Excited: All About The Shortcuts Not Worth TakingTop 10 Ways To Make Hackers Excited: All About The Shortcuts Not Worth Taking
Top 10 Ways To Make Hackers Excited: All About The Shortcuts Not Worth TakingPaula Januszkiewicz
 
Building an Analytics - Enabled SOC Breakout Session
Building an Analytics - Enabled SOC Breakout Session Building an Analytics - Enabled SOC Breakout Session
Building an Analytics - Enabled SOC Breakout Session Splunk
 
Why Pentesting is Vital to the Modern DoD Workforce
Why Pentesting is Vital to the Modern DoD WorkforceWhy Pentesting is Vital to the Modern DoD Workforce
Why Pentesting is Vital to the Modern DoD WorkforceGlobal Knowledge Training
 

Similar to Adversary Emulation - DerpCon (20)

Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...
Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...
Anomali Detect 19 - Nickels & Pennington - Turning Intelligence into Action w...
 
INTERNSHIPREVIEW-ISHAQ (1) [Recovered].pptx
INTERNSHIPREVIEW-ISHAQ (1) [Recovered].pptxINTERNSHIPREVIEW-ISHAQ (1) [Recovered].pptx
INTERNSHIPREVIEW-ISHAQ (1) [Recovered].pptx
 
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status QuoBSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo
BSidesLV 2018 - Katie Nickels and John Wunder - ATT&CKing the Status Quo
 
Slideshare.net rh-isac summit 2019 - adam pennington - leveraging mitre at ta...
Slideshare.net rh-isac summit 2019 - adam pennington - leveraging mitre at ta...Slideshare.net rh-isac summit 2019 - adam pennington - leveraging mitre at ta...
Slideshare.net rh-isac summit 2019 - adam pennington - leveraging mitre at ta...
 
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...
 
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...
RH-ISAC Summit 2019 - Adam Pennington - Leveraging MITRE ATT&CK™ for Detectio...
 
MITRE_ATTACK_Enterprise_11x17.pdf
MITRE_ATTACK_Enterprise_11x17.pdfMITRE_ATTACK_Enterprise_11x17.pdf
MITRE_ATTACK_Enterprise_11x17.pdf
 
C2 Matrix A Comparison of Command and Control Frameworks
C2 Matrix A Comparison of Command and Control FrameworksC2 Matrix A Comparison of Command and Control Frameworks
C2 Matrix A Comparison of Command and Control Frameworks
 
Pennington - Defending Against Targeted Ransomware with MITRE ATT&CK
Pennington - Defending Against Targeted Ransomware with MITRE ATT&CKPennington - Defending Against Targeted Ransomware with MITRE ATT&CK
Pennington - Defending Against Targeted Ransomware with MITRE ATT&CK
 
Cyber Threat hunting workshop
Cyber Threat hunting workshopCyber Threat hunting workshop
Cyber Threat hunting workshop
 
How to get along with HATEOAS without letting the bad guys steal your lunch?
How to get along with HATEOAS without letting the bad guys steal your lunch?How to get along with HATEOAS without letting the bad guys steal your lunch?
How to get along with HATEOAS without letting the bad guys steal your lunch?
 
Splunk Enterprise for InfoSec Hands-On Breakout Session
Splunk Enterprise for InfoSec Hands-On Breakout SessionSplunk Enterprise for InfoSec Hands-On Breakout Session
Splunk Enterprise for InfoSec Hands-On Breakout Session
 
2017 Q1 Arcticcon - Meet Up - Adventures in Adversarial Emulation
2017 Q1 Arcticcon - Meet Up - Adventures in Adversarial Emulation2017 Q1 Arcticcon - Meet Up - Adventures in Adversarial Emulation
2017 Q1 Arcticcon - Meet Up - Adventures in Adversarial Emulation
 
All These Sophisticated Attacks, Can We Really Detect Them - PDF
All These Sophisticated Attacks, Can We Really Detect Them - PDFAll These Sophisticated Attacks, Can We Really Detect Them - PDF
All These Sophisticated Attacks, Can We Really Detect Them - PDF
 
Top 20 certified ethical hacker interview questions and answer
Top 20 certified ethical hacker interview questions and answerTop 20 certified ethical hacker interview questions and answer
Top 20 certified ethical hacker interview questions and answer
 
For Business's Sake, Let's focus on AppSec
For Business's Sake, Let's focus on AppSecFor Business's Sake, Let's focus on AppSec
For Business's Sake, Let's focus on AppSec
 
Top 10 Ways To Make Hackers Excited: All About The Shortcuts Not Worth Taking
Top 10 Ways To Make Hackers Excited: All About The Shortcuts Not Worth TakingTop 10 Ways To Make Hackers Excited: All About The Shortcuts Not Worth Taking
Top 10 Ways To Make Hackers Excited: All About The Shortcuts Not Worth Taking
 
Building an Analytics - Enabled SOC Breakout Session
Building an Analytics - Enabled SOC Breakout Session Building an Analytics - Enabled SOC Breakout Session
Building an Analytics - Enabled SOC Breakout Session
 
Why Pentesting is Vital to the Modern DoD Workforce
Why Pentesting is Vital to the Modern DoD WorkforceWhy Pentesting is Vital to the Modern DoD Workforce
Why Pentesting is Vital to the Modern DoD Workforce
 
MITRE ATT&CK Framework
MITRE ATT&CK FrameworkMITRE ATT&CK Framework
MITRE ATT&CK Framework
 

More from Jorge Orchilles

SCYTHE Purple Team Workshop with Tim Schulz
SCYTHE Purple Team Workshop with Tim SchulzSCYTHE Purple Team Workshop with Tim Schulz
SCYTHE Purple Team Workshop with Tim SchulzJorge Orchilles
 
Purple Team Use Case - Security Weekly
Purple Team Use Case - Security WeeklyPurple Team Use Case - Security Weekly
Purple Team Use Case - Security WeeklyJorge Orchilles
 
KringleCon 3 Providing Value in Offensive Security
KringleCon 3 Providing Value in Offensive SecurityKringleCon 3 Providing Value in Offensive Security
KringleCon 3 Providing Value in Offensive SecurityJorge Orchilles
 
C2 Matrix Anniversary - Blackhat EU 2020
C2 Matrix Anniversary - Blackhat EU 2020C2 Matrix Anniversary - Blackhat EU 2020
C2 Matrix Anniversary - Blackhat EU 2020Jorge Orchilles
 
Purple Team Exercise Workshop December 2020
Purple Team Exercise Workshop December 2020Purple Team Exercise Workshop December 2020
Purple Team Exercise Workshop December 2020Jorge Orchilles
 
External Threat Hunters are Red Teamers
External Threat Hunters are Red TeamersExternal Threat Hunters are Red Teamers
External Threat Hunters are Red TeamersJorge Orchilles
 
Evolution of Offensive Assessments - SecureWV Conference
Evolution of Offensive Assessments - SecureWV ConferenceEvolution of Offensive Assessments - SecureWV Conference
Evolution of Offensive Assessments - SecureWV ConferenceJorge Orchilles
 
Purple Team Exercise Hands-On Workshop #GrayHat
Purple Team Exercise Hands-On Workshop #GrayHatPurple Team Exercise Hands-On Workshop #GrayHat
Purple Team Exercise Hands-On Workshop #GrayHatJorge Orchilles
 
Evolution of Offensive Assessments - RootCon
Evolution of Offensive Assessments - RootConEvolution of Offensive Assessments - RootCon
Evolution of Offensive Assessments - RootConJorge Orchilles
 
8.8 Las Vegas - Adversary Emulation con C2 Matrix
8.8 Las Vegas - Adversary Emulation con C2 Matrix8.8 Las Vegas - Adversary Emulation con C2 Matrix
8.8 Las Vegas - Adversary Emulation con C2 MatrixJorge Orchilles
 
DEFCON Safe Mode - Red Team Village - Emulating Evil Corp and WastedLocker
DEFCON Safe Mode - Red Team Village - Emulating Evil Corp and WastedLockerDEFCON Safe Mode - Red Team Village - Emulating Evil Corp and WastedLocker
DEFCON Safe Mode - Red Team Village - Emulating Evil Corp and WastedLockerJorge Orchilles
 
Blackhat 2020 Arsenal - C2 Matrix
Blackhat 2020 Arsenal - C2 MatrixBlackhat 2020 Arsenal - C2 Matrix
Blackhat 2020 Arsenal - C2 MatrixJorge Orchilles
 
Cuddling the Cozy Bear Emulating APT29
Cuddling the Cozy Bear Emulating APT29Cuddling the Cozy Bear Emulating APT29
Cuddling the Cozy Bear Emulating APT29Jorge Orchilles
 
Ethical Hacking Definitions Matter - Covering Vulnerability Scanning, Vulnera...
Ethical Hacking Definitions Matter - Covering Vulnerability Scanning, Vulnera...Ethical Hacking Definitions Matter - Covering Vulnerability Scanning, Vulnera...
Ethical Hacking Definitions Matter - Covering Vulnerability Scanning, Vulnera...Jorge Orchilles
 
Adversarial Emulation with the C2 Matrix - Wild West WebCastin Fest
Adversarial Emulation with the C2 Matrix - Wild West WebCastin FestAdversarial Emulation with the C2 Matrix - Wild West WebCastin Fest
Adversarial Emulation with the C2 Matrix - Wild West WebCastin FestJorge Orchilles
 
Adversarial Emulation and the C2 Matrix - Presented at Wild West Hackin Fest ...
Adversarial Emulation and the C2 Matrix - Presented at Wild West Hackin Fest ...Adversarial Emulation and the C2 Matrix - Presented at Wild West Hackin Fest ...
Adversarial Emulation and the C2 Matrix - Presented at Wild West Hackin Fest ...Jorge Orchilles
 
Windows Phone 8 Security and Testing WP8 Apps
Windows Phone 8 Security and Testing WP8 AppsWindows Phone 8 Security and Testing WP8 Apps
Windows Phone 8 Security and Testing WP8 AppsJorge Orchilles
 
Vulnerability Ass... Penetrate What?
Vulnerability Ass... Penetrate What?Vulnerability Ass... Penetrate What?
Vulnerability Ass... Penetrate What?Jorge Orchilles
 
BackTrack 4 R2 - SFISSA Presentation
BackTrack 4 R2 - SFISSA PresentationBackTrack 4 R2 - SFISSA Presentation
BackTrack 4 R2 - SFISSA PresentationJorge Orchilles
 
Emerging Threats to Infrastructure
Emerging Threats to InfrastructureEmerging Threats to Infrastructure
Emerging Threats to InfrastructureJorge Orchilles
 

More from Jorge Orchilles (20)

SCYTHE Purple Team Workshop with Tim Schulz
SCYTHE Purple Team Workshop with Tim SchulzSCYTHE Purple Team Workshop with Tim Schulz
SCYTHE Purple Team Workshop with Tim Schulz
 
Purple Team Use Case - Security Weekly
Purple Team Use Case - Security WeeklyPurple Team Use Case - Security Weekly
Purple Team Use Case - Security Weekly
 
KringleCon 3 Providing Value in Offensive Security
KringleCon 3 Providing Value in Offensive SecurityKringleCon 3 Providing Value in Offensive Security
KringleCon 3 Providing Value in Offensive Security
 
C2 Matrix Anniversary - Blackhat EU 2020
C2 Matrix Anniversary - Blackhat EU 2020C2 Matrix Anniversary - Blackhat EU 2020
C2 Matrix Anniversary - Blackhat EU 2020
 
Purple Team Exercise Workshop December 2020
Purple Team Exercise Workshop December 2020Purple Team Exercise Workshop December 2020
Purple Team Exercise Workshop December 2020
 
External Threat Hunters are Red Teamers
External Threat Hunters are Red TeamersExternal Threat Hunters are Red Teamers
External Threat Hunters are Red Teamers
 
Evolution of Offensive Assessments - SecureWV Conference
Evolution of Offensive Assessments - SecureWV ConferenceEvolution of Offensive Assessments - SecureWV Conference
Evolution of Offensive Assessments - SecureWV Conference
 
Purple Team Exercise Hands-On Workshop #GrayHat
Purple Team Exercise Hands-On Workshop #GrayHatPurple Team Exercise Hands-On Workshop #GrayHat
Purple Team Exercise Hands-On Workshop #GrayHat
 
Evolution of Offensive Assessments - RootCon
Evolution of Offensive Assessments - RootConEvolution of Offensive Assessments - RootCon
Evolution of Offensive Assessments - RootCon
 
8.8 Las Vegas - Adversary Emulation con C2 Matrix
8.8 Las Vegas - Adversary Emulation con C2 Matrix8.8 Las Vegas - Adversary Emulation con C2 Matrix
8.8 Las Vegas - Adversary Emulation con C2 Matrix
 
DEFCON Safe Mode - Red Team Village - Emulating Evil Corp and WastedLocker
DEFCON Safe Mode - Red Team Village - Emulating Evil Corp and WastedLockerDEFCON Safe Mode - Red Team Village - Emulating Evil Corp and WastedLocker
DEFCON Safe Mode - Red Team Village - Emulating Evil Corp and WastedLocker
 
Blackhat 2020 Arsenal - C2 Matrix
Blackhat 2020 Arsenal - C2 MatrixBlackhat 2020 Arsenal - C2 Matrix
Blackhat 2020 Arsenal - C2 Matrix
 
Cuddling the Cozy Bear Emulating APT29
Cuddling the Cozy Bear Emulating APT29Cuddling the Cozy Bear Emulating APT29
Cuddling the Cozy Bear Emulating APT29
 
Ethical Hacking Definitions Matter - Covering Vulnerability Scanning, Vulnera...
Ethical Hacking Definitions Matter - Covering Vulnerability Scanning, Vulnera...Ethical Hacking Definitions Matter - Covering Vulnerability Scanning, Vulnera...
Ethical Hacking Definitions Matter - Covering Vulnerability Scanning, Vulnera...
 
Adversarial Emulation with the C2 Matrix - Wild West WebCastin Fest
Adversarial Emulation with the C2 Matrix - Wild West WebCastin FestAdversarial Emulation with the C2 Matrix - Wild West WebCastin Fest
Adversarial Emulation with the C2 Matrix - Wild West WebCastin Fest
 
Adversarial Emulation and the C2 Matrix - Presented at Wild West Hackin Fest ...
Adversarial Emulation and the C2 Matrix - Presented at Wild West Hackin Fest ...Adversarial Emulation and the C2 Matrix - Presented at Wild West Hackin Fest ...
Adversarial Emulation and the C2 Matrix - Presented at Wild West Hackin Fest ...
 
Windows Phone 8 Security and Testing WP8 Apps
Windows Phone 8 Security and Testing WP8 AppsWindows Phone 8 Security and Testing WP8 Apps
Windows Phone 8 Security and Testing WP8 Apps
 
Vulnerability Ass... Penetrate What?
Vulnerability Ass... Penetrate What?Vulnerability Ass... Penetrate What?
Vulnerability Ass... Penetrate What?
 
BackTrack 4 R2 - SFISSA Presentation
BackTrack 4 R2 - SFISSA PresentationBackTrack 4 R2 - SFISSA Presentation
BackTrack 4 R2 - SFISSA Presentation
 
Emerging Threats to Infrastructure
Emerging Threats to InfrastructureEmerging Threats to Infrastructure
Emerging Threats to Infrastructure
 

Recently uploaded

A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)Gabriella Davis
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...Martijn de Jong
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfsudhanshuwaghmare1
 
🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘RTylerCroy
 
Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonAnna Loughnan Colquhoun
 
Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)wesley chun
 
Scaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationScaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationRadu Cotescu
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityPrincipled Technologies
 
Manulife - Insurer Innovation Award 2024
Manulife - Insurer Innovation Award 2024Manulife - Insurer Innovation Award 2024
Manulife - Insurer Innovation Award 2024The Digital Insurer
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProduct Anonymous
 
Artificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyArtificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyKhushali Kathiriya
 
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodPolkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodJuan lago vázquez
 
Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024The Digital Insurer
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...DianaGray10
 
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, AdobeApidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobeapidays
 
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?Igalia
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024The Digital Insurer
 
HTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation StrategiesHTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation StrategiesBoston Institute of Analytics
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc
 
Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024The Digital Insurer
 

Recently uploaded (20)

A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)
 
2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...2024: Domino Containers - The Next Step. News from the Domino Container commu...
2024: Domino Containers - The Next Step. News from the Domino Container commu...
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdf
 
🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘
 
Data Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt RobisonData Cloud, More than a CDP by Matt Robison
Data Cloud, More than a CDP by Matt Robison
 
Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)Powerful Google developer tools for immediate impact! (2023-24 C)
Powerful Google developer tools for immediate impact! (2023-24 C)
 
Scaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationScaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organization
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
 
Manulife - Insurer Innovation Award 2024
Manulife - Insurer Innovation Award 2024Manulife - Insurer Innovation Award 2024
Manulife - Insurer Innovation Award 2024
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
 
Artificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyArtificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : Uncertainty
 
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin WoodPolkadot JAM Slides - Token2049 - By Dr. Gavin Wood
Polkadot JAM Slides - Token2049 - By Dr. Gavin Wood
 
Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024Tata AIG General Insurance Company - Insurer Innovation Award 2024
Tata AIG General Insurance Company - Insurer Innovation Award 2024
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, AdobeApidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
 
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?
 
Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024Axa Assurance Maroc - Insurer Innovation Award 2024
Axa Assurance Maroc - Insurer Innovation Award 2024
 
HTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation StrategiesHTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation Strategies
 
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law DevelopmentsTrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
TrustArc Webinar - Stay Ahead of US State Data Privacy Law Developments
 
Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024Partners Life - Insurer Innovation Award 2024
Partners Life - Insurer Innovation Award 2024
 

Adversary Emulation - DerpCon

  • 2. DERP.TXT • Security appliance from major vendor you may know • Shrink wrap/product penetration test before putting in production (also before we pay them) • Did not want to provide us access to CLI – boooooo • Gave us restricted shell and said we would have to break out if we wanted access – challenge accepted! • Assigned the top restricted shell escaper I know@JORGEORCHILLES
  • 4.
  • 10. #WHOAMILed offensive security team at large financial for past 10 years Published industry contributions include: ⑊ Founding member MITRE Engenuity Center ⑊ Co-Author GFMA Threat-led Penetration Testing & Red Team Framework ⑊ SANS Instructor and author of Red Team course: SEC564 ⑊ NSI Technologist Fellow; ISSA Fellow ⑊ Common Vulnerability Scoring System (CVSSv3.1) ⑊ Author of Windows 7 Administrators reference (Syngress) @JORGEORCHILLES
  • 11. 11 VULNERABILITY SCANNING VULNERABILITY ASSESSMENT PENETRATION TESTING RED TEAM IN PERSON PURPLE TEAM CONTINOUS PURPLE TEAM ADVERSARY EMULATION Definition: A type of Red Team exercise where the Red Team emulates how an adversary operates, following the same tactics, techniques, and procedures (TTPs), with a specific objective like those of realistic adversary. Goal: Emulate an end-to-end attack against a target organization. Obtain a holistic view of the organization’s preparedness for a real, sophisticated attack. @JORGEORCHILLES
  • 12. 12 An end to end assessment of the entire organization ⑊ Main differentiator from penetration testing - Tests the defenders not the defenses (detection vs. prevention) - People, Process, and Technology - Not a limited scope test targeting just a particular product, infrastructure, network, application, URL, or domain ⑊ Full Cyber Kill Chain from Recon to Objective ⑊ Often blind, unannounced exercise ⑊ Determine what TTPs would work, undetected if a true attack occurred and action plan to remediate @JORGEORCHILLES
  • 13. 13 Measuring the effectiveness of People, Process, and Technology Documented metrics and timeline of entire exercise ⑊ Time and TTPs to obtain initial access ⑊ TTPs that allowed moving laterally ⑊ Identify TTPs not prevented or detected ⑊ Process and time to escalate events into an incident ⑊ Time to contain; ⑊ Time to eradicate ⑊ Process to engage hunt team, coordinate communications, alert leadership and correlate all events and realize sophisticated, targeted attack @JORGEORCHILLES
  • 14. 14 ASSUMPTIONS That attack won’t work here because… “We applied all patches” “We have outbound DLP” “Our users would never open a macro” “Our applications have MFA” “Our network is segmented and only way out is through proxy” “We have firewalls, AV, and IDS” Trust but verify Can the Iranians breach us? @JORGEORCHILLES
  • 15. 15 Training and improving the Blue Team ⑊ Every Red Team Exercise will result in Blue Team getting better ⑊ As you measure the people, process, and technology you will see improvements ⑊ Lessons will be learned, and processes improved ⑊ The more you train, the more you improve @JORGEORCHILLES
  • 16. 16 FRAMEWORK & METHODOLOGIES ⑊ Cyber Kill Chain – Lockheed Martin ⑊ Unified Cyber Kill Chain – Paul Pols ⑊ ATT&CK – MITRE Regulatory: ⑊ CBEST Intelligence Led Testing – Bank of England ⑊ Threat Intelligence-Based Ethical Red Teaming – TIBER- EU ⑊ Red Team: Adversarial Attack Simulation Exercises – ABS (Association of Banks of Singapore) ⑊ intelligence-led Cyber Attack Simulation Testing (iCAST) – HKMA (Hong Kong Monetary Authority) ⑊ G-7 Fundamental Elements for Threat-Led Penetration Testing (G7FE-TLPT) ⑊ A Framework for the Regulatory Use of Penetration Testing and Red Teaming in the Financial Services Industry – GFMA (Global Financial Markets Association) @JORGEORCHILLES
  • 17. INITIAL ACCESS EXECUTION PERSISTENCE PRIVILEGE ESCALATION DEFENSIVE EVASION CREDENTIAL ACCESS DISCOVERY LATERAL MOVEMENT COLLECTION COMMAND AND CONTROL EXFILTRATION IMPACT DRIVE- BY COMPROMISE APPLESCRIPT .BASH_PROFULE AND .BASHRC ACCESS TOKEN MANIPULATION ACCESS TOKEN MANIPULATION ACCOUNT MANIPULATION ACCOUNT DISCOVERY APPLESCRIPT AUDIO CAPTURE COMMONLY USED PORT AUTOMATED EXFILTRATION DATA DESTRUCTION EXPLOIT PUBLIC- FACING APPLICATION CMSTP ACCESIBILITY FEATURES ACCESIBILITY FEATURES BITS JOBS BASH HISTORY APPLICATION WINDOW DISCOVERY APPLICATION DEPLOYMENT SOFTWARE AUTOMATED COLLECTION COMMUINICTION THROUGH REMOVABLE DATA DATA COMPRESSED DATA ENCRYPTED FOR IMPACT EXTERNAL REMOTE SERVICES COMMAND-LINE INTERFACE ACCOUNT MANIPULATION APPCERT DLLS DINARY PADDING BRUTE FORCE BROWSER BOOKMARK DISCOVERY DISTRUBETED COMPONENT OBJECT MODEL CLIPBOARD DATA CONNECTION PROXY DATA ENCRYPTED DEFACEMENT HARDWARE ADDITIONS COMPILED HTML FILE APPCERT DLLS APPINIT DLLS ACCOUNT CONTROL BYPASS USER CREDENTIAL DUMPING DOMAIN TRUST DISCOVERY EXPLOITATION OF REMOTE SERVICES DATA STAGE CUSTOM COMMAND AND CONTROL PROTOCOL DATA TRANSFER SIZE LIMIT DISK CONTENT WIPE REPLICATION THROUGH REMOVABLE MEDIA CONTORL PANEL ITEMS APPINIT DLLS APPLICATION SHIMMIMG CMSTP CREDENTIALS IN FILES FILE AND DIRECTORY DISCOVERY LOGON SCRIPT DATA FROM INFORMATION REPOSITORIES CUSTOM CRYPTOGRAPHIC PROTOCOL EXFILTRATION OVER ALTERNATIVE PROTOCOL DISK STRUCTURE WIPE SPEARPHISHING ATTACHMENT DYNAMIC DATA EXCHANGE APPLICATION SHIMMING BYPASS USER ACCOUNT CONTROL CLEAR COMMAND HISTORY CREDENTIALS IN REGISTRY NETWORK SERVICE SCANNING PASS THE HASH DATA FROM LOCAL SYSTEM DATA ENCODING EXFILTRATION OVER COMMAND AND CONTROL CHANNEL ENDPOINT DENIAL OF SERVICE SPEARPHISHING LINK EXECUTION THROUGH API AUTHENTICATIO N PACKAGE DLL SEARCH ORDER HIJACKING CODE SIGNING EXPLOITATION FOR CREDENTIAL ACCESS NETWORK SHARE DISCOVERY PASS THE TICKET DATA FROM NETWORK SHARE DRIVE DATA OBFUSCATION EXFILTRATION OVER OTHER NETWORK MEDIUM FIRMWARE CORRUPTION MITRE has developed the ATT&CK Matrix as a central repository for adversary TTPs. It is used by both red and blue teams. It is rapidly gaining @JORGEORCHILLES
  • 18. FRAMEWORK Most organizations will take a hybrid approach based on the frameworks and methodologies just introduced ⑊ Threat Intelligence ⑊ Planning ⑊ Testing ⑊ Closure @JORGEORCHILLES
  • 19. T1086 – PowerShell T1068 – Exploitation for Privilege Escalation T1003 – Credential Dumping S0194 – PowerSploit S0192 – Pupy S0002 – Mimikatz S0129 – AutoIT Hash Value IP Address TACTICS | TECHNIQUES | PROCEDURES https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html @JORGEORCHILLES
  • 21. 21 TRUSTED AGENTS RULES OF ENGAGEMENT ATTACK INFRASTRUCTURE o Limited number of people with knowledge of the exercise o When players find out about exercise their behavior changes o Individuals whose daily roles and responsibilities put them in a position to contribute to reducing the risk of causing unintended impact to production systems and/or inaccurate senior or external escalation Establish the responsibility, relationship, and guidelines between Trusted Agents and Players o Rules for Blue Team o Carry out all activity as any other incident o Trusted Agents will report what incidents are being investigated o Do not report exercise related items to regulators o Rules for Red Team o Do not bring down any business process or operation o Communicate all actions during daily brief Red Team is responsible for setting up infrastructure to emulate TTPs o Choose and procure external hosting service providers o Purchase domain names o Generate domain certificates o Setup mail servers o Setup phishing and credential theft sites o Confirm reputation and categorization of all domain and IPs o Setup Short and Long Haul C2 infrastructure o Configure custom C2 tooling o Test external C2 communication PLANNING @JORGEORCHILLES White Team or White Cell
  • 22. 22 Matrix of command and control frameworks for Red Teamers ⑊ Google doc of most C2 frameworks: www.thec2matrix.com ⑊ Documents various capabilities of each framework ⑊ There is no right or wrong, better or worse framework ⑊ Find ideal C2 for your current objective ⑊ Wizard like UI to select which one: ask.thec2matrix.com ⑊ How-To Site for using C2s: howto.thec2matrix.com ⑊ SANS Slingshot C2 Matrix Edition @JORGEORCHILLES
  • 23.
  • 24.
  • 25. 25 Initial Foothold Compromised System Network Propagation Internal Network Action on Objectives Critical Asset Access ⑊ Reconnaissance ⑊ Weaponization ⑊ Delivery ⑊ Social engineering ⑊ Exploitation ⑊ Persistence ⑊ Defense evasion ⑊ Command & Control ⑊ Discovery ⑊ Privilege escalation ⑊ Execution ⑊ Credential access ⑊ Lateral movement ⑊ Collection ⑊ Exfiltration ⑊ Target manipulation ⑊ Objectives PIVOTING ACCESS The Unified Kill Chain – Paul Pols The Unified Kill Chain is a good answer to some of the Cyber Kill Chain limitations! @JORGEORCHILLES
  • 26. 26 ⑊ What TTPs were prevented? Why? Document these too! ⑊ What was detected? How long did it take? - Time to contain - Time to eradicate ⑊ Where processes followed? - Process and time to escalate events into an incident - Process to engage hunt team - Process to coordinate communications & alert leadership - Process to corelate all events and realize sophisticated, targeted attack CLOSURE @JORGEORCHILLES
  • 27. 27
  • 28. 28
  • 29. 29
  • 30. Automated Emulation https://medium.com/@jorgeorchilles/purple-team-exercise-tools-a85187ce341 ⑊ Red Team will be asked to repeat TTPs ⑊ Don’t waste Red Team Operator time re-doing the same TTP while engineers, operations, and SOC get detection working
  • 31. Thank you! 31 Q & A?@JorgeOrchilles @C2_Matrix https://www.thec2matrix.com/ https://www.sans.org/course/red-team-exercises-adversary-emulation

Editor's Notes

  1. https://www.youtube.com/watch?v=RfiQYRn7fBg
  2. Escaping the restricted shell. Was written in ruby and some proprietary commands. Bypassctl was one that sent arguments to shell. 1. Create a file in the tmp directory 2. Make the file we created editable and executable 3. Echo our "usermod" command into our executable shell script which would give the current user root privileges 4. The "id" command shows we are a regular user 5. The "sudo -l" command shows we can run "tcpdump" as root with "sudo" privileges 6. Run the "tcpdump" command calling our shell script "-i eth0" binds our packet capture to the ethernet interface "-G 1" rotates the dump files every one second "-w /tmp/lepwn.pcap" writes the command output to a file which is needed for the "-z" option "-z" /tmp/lepwn" runs the shell script lepwn (/usr/sbin/usermod -g adm currentuser) The "usermod" command adds the user running the restricted shell to the "adm" group giving it root privileges 7. Running "sudo -l" again shows we can now run ALL commands as root without a required password 8. Root privileges are confirmed when we can view the contents of the shadow file Vulnerable Ruby Code: The restricted shell was written in Ruby and didn't properly sanitize command line arguments. A few proprietary Linux commands were executed in the Ruby script using "Open3.popen3" which spawns external operating system commands. The ability to join command arguments and include the command line operators (i.e. ; and &&) enabled us to supply a second command to be executed from within the restricted shell.   Developer comments: You find lots of great developer comments when reviewing their code! Reference the Jurassic Park quote...