This talk will introduce a relatively new concept in Threat Hunting by explaining how external threat hunters use similar techniques to Red teamers to create a repeatable hunting model through the use of an intermediary payload system to provide insight, awareness, and action. David Maynor, @Dave_Maynor, Black Lotus Labs Analysis Lead, Centurylink Jorge Orchilles, @jorgeorchilles, CTO, SCYTHE

1. @DAVE_MAYNOR
@JORGEORCHILLES
External Threat Hunters are
Red Teamers
@Dave_Maynor
@JorgeOrchilles

2. @DAVE_MAYNOR
@JORGEORCHILLES
TL;DR
● Yes, this is talk is about leveraging red team tradecraft to enable external
hypothesis-based threat hunting
● No, this talk has nothing to do with phishing :P
● Test case in Purple Teaming - how Red learns from Blue and Blue learns
from Red
● Intended audience: skilled practitioners in red and blue team moving to
Purple Teaming ~ natural evolution to Purple Teaming in next 2-3 years
● The takeaway from this talk will be: Understand and use Red Team
tradecraft (like leveraging C2 frameworks) in an external threat hunting
workflow for better insight, repeatability, and refinement
2

3. @DAVE_MAYNOR
@JORGEORCHILLES
$whoami (David Maynor)
● 20 years experience in research, systems, offensive
consulting, and other security related positions in the
private sector
● Leads the Lumens Black Lotus Labs Analysis team
● Recently in news due to TrickBot takedown
● Builds relationships with intel partners, proactively
hunting for adversaries
● Entrepreneur
3

4. @DAVE_MAYNOR
@JORGEORCHILLES
T1033 - User Discovery (Jorge Orchilles)
● Chief Technology Officer - SCYTHE
● 10 years leading offensive team @Citi
● Wrote a book when I was a sys admin
● Started in Vulnerability Assessment
● Pen Test
● Red Team
● Purple Team
4

5. @DAVE_MAYNOR
@JORGEORCHILLES
Agenda
● What is Red Team
● What is External Threat Hunting
● Red Team Tools and Tradecraft
● Attack Infrastructure
● Using C2
● Analysis and Refinement
5

6. @DAVE_MAYNOR
@JORGEORCHILLES
What is Red Team?
● Definition:
○ “The practice of looking at a problem or situation
from the perspective of an adversary”
– Red Team Journal
● Goal:
○ Make Blue Team better
○ Test and measure people, process, and
technology
○ Test assumptions
6
● Effort:
○ Manual
○ Many tools (C2 Matrix)
○ Some automation for attack infra
● Frequency:
○ Intelligence-led (new exploit, tool, or
TTP)
○ Yearly (regulatory)
● Customer:
○ Blue Teams
https://medium.com/@jorgeorchilles/ethical-hacking-definitions-9b9a6dad4988

7. @DAVE_MAYNOR
@JORGEORCHILLES
What is External Threat Hunting?
● Definition:
○ “Proactive identifaction of threats outside of
your perimeter”
– BlueVoyant
● Goal:
○ Make Blue Team better
○ To find an understand actor TTPs in the wild
Blue/Red/Purple teams have more data driven
intelligence for testing
○ Test assumptions
7
● Effort:
○ Manual
○ Many tools (C2 Matrix)
○ Infrastructure acquisition and maintence
○ Cross domain Threat Intelligence
partnerships
● Frequency:
○ Constantly
○ Quarterly refinement of target of
interest
● Customer:
○ Blue/Red/Purple Teams
○ Internal Risk officers

8. @DAVE_MAYNOR
@JORGEORCHILLES
Why External Threat Hunting?
● This may not be ideal for every organization (we get it)
● The workflow is hard to develop correctly without some amount of “gut”
instinct
● Possibility of becoming a boondoggle
● Hard to quantify results and their value to organizational security
● A lot of the same arguments can made about red teaming
● Red Team & External Hunting overlap in more than proving value
problems but the need of the operators also means that there is a lot
ability for reuse of tools and tradecraft between red team/external hunting
8

9. @DAVE_MAYNOR
@JORGEORCHILLES
Needs of Both Teams
● Ability to pivot through infrastructure and keep logs and verifiable evidence
in a central searchable repository
● Document, Document, Document (aka logs of every action)
● A toolset that allows for effective use by team members regardless of the
underlying environment
● Scaling up as team grows – consistency
9

10. @DAVE_MAYNOR
@JORGEORCHILLES
Planning (Comparison)
10
Planning Red Team External Threat Hunting
Goals and Objectives Yes Yes
Cyber Threat Intelligence Pick Adversary and TTPs to Emulate Formulating a target list
Scope Yes Yes
Exercise Coordinator/PM Yes Yes
Rules of Engagements Don’t bring down infrastructure
Don’t affect business processes
Don’t break laws
Don’t forget the purpose of the
exercise
Don’t get into a knife fight with a
threat actor
Don’t break laws
Don’t forget the purpose of the
exercise
Attack Infrastructure Yes Yes
Lessons Learned Analysis & Response Analysis & Refinement

11. @DAVE_MAYNOR
@JORGEORCHILLES
Formulating a target list
● A list of attacker groups is needed but also a list of attacker capabilities
● Like Cyber Threat Intelligence being used by Red Team in Adversary
Emulation
● Identify adversaries with the opportunity, intent, and capability to attack your
organization
● Understand current capabilities but also possible future capabilities
11

12. @DAVE_MAYNOR
@JORGEORCHILLES
Attack Infrastructure
● Choose and procure external
hosting service providers
● Purchase domain names
● Generate domain certificates
● Set up mail servers
● Set up phishing and credential
theft sites
● Confirm reputation and
categorization of all domain and
IPs
12
● Set up Long and Short Haul
C2 infrastructure
● Configure custom C2 tooling
● Test external C2
communication schemes
● Set up RedELK for central
logging and Blue Team
detection

13. @DAVE_MAYNOR
@JORGEORCHILLES
Operational Security
● Ensure all external systems are locked down so that only Red Team
members can access administrative interfaces
● Ensure all payloads being generated can only be run from target
environment
● Ensure all web properties do not include attributable information
● Ensure all external systems store all operating files using strong
encryption
● Vet payloads and techniques for IoCs to aid blue team in lessons
learned phase and aid in white cell deconfliction periods
● Can you detect the Blue Team investigating you?
13

14. @DAVE_MAYNOR
@JORGEORCHILLES
RedELK
● Goal 1: Ease the work of the RT by aggregating logs and providing central
access to all details of ops. E.g. traffic and C2 logs, IOCs, screenshots, etc
● Goal 2: Red Team’s SIEM that alarms when Blue Team is investigating
● Version 2 (pending late 2020) adds hunting capabilities:
○ Data from bluecheck (implants performing blue team recon)
○ Jupyter notebooks – with tons of ready to use playbooks
○ Neo4J (BloodHound data!)
○ Hunt through all these data points at one time, e.g. has current C2 implant
user (C2 logs) an access path to system X or user Y (BloodHound logs)?
14

15. @DAVE_MAYNOR
@JORGEORCHILLES
Attack Infrastructure Overview
15

16. @DAVE_MAYNOR
@JORGEORCHILLES
16
● Influence an attacker has over a
compromised computer system
that they control
● Communication method attacker
leverages to manipulate target
systems
● Use Heartbeats/Beacons
(callbacks)
● Add Jitter to avoid patterns
● Consistent shell
● Log all operator actions and
responses
Command and Control

17. @DAVE_MAYNOR
@JORGEORCHILLES
Acquiring Infrastructure (External Threat Hunt)
● This topic alone could be the subject of a weeklong class
● Nothing illegal
● Purchasing. Your red team tradecraft may state infrastructure should be
acquired under a deniable identity. This use case requires deniable identities.
● Resource sharing. Threat intel with out their own hunt teams can “loan”
infrastructure to allow you to hunt advertises targeting their org.
○ Docker
○ C2 hosts
○ DNS records
17

18. @DAVE_MAYNOR
@JORGEORCHILLES
DEMO
18

19. @DAVE_MAYNOR
@JORGEORCHILLES
Analysis and Refinement
● What data is being collected, is it valuable?
● Is it collected in a consistent manner?
● Correlating that data
● D.O.P.E – Data On Previous Engagement
● Answer these questions
○ What did we hunt?
○ Did we find them or similar actors behaving in same manner?
○ Have we collected enough data on their activities to map a trajectory of their activities?
○ Have we collected enough data on our activities to determine what fingerprints we left
behind?
○ Are there definable actions for the Blue/Purple/Red Team?
19

20. @DAVE_MAYNOR
@JORGEORCHILLES
References
20
● https://medium.com/@jorgeorchilles/ethical-hacking-definitions-9b9a6dad4988
● https://posts.specterops.io/designing-effective-covert-red-team-attack-infrastructure-
767d4289af43
● https://outflank.nl/blog/2019/02/14/introducing-redelk-part-1-why-we-need-it/
● https://www.thec2matrix.com/
● https://howto.thec2matrix.com/
● https://sans.org/sec564

21. @DAVE_MAYNOR
@JORGEORCHILLES
Thank You!
@Dave_Maynor
@JorgeOrchilles