https://sindadsec.ir/

1. Red Team P2
Adversary
Emulation
‫سینداد‬ ‫ارتباط‬ ‫امن‬ ‫مهندسی‬ ‫شرکت‬
s
i
n
d
a
d
s
e
c
.
i
r

2. Whoami
Soheil Hashemi
Ms.c Network Computers
Penetration Testing | Red Teaming | Purple Teaming
Security Course Instructor
Twitter | Telegram
1 sindadsec.ir

3. MITRE ATTACK
• TACTIC, TECHNIQUE, PROCEDURES [TTP] — APT GROUPs
• Reconnaissance, Resource Development, Initial Access, Execution,
Persistence, Privilege Escalation, Defense Evasion, Credential Access,
Discovery, Lateral Movement, Collection, C2, Exfiltration, Impact
3

4. Adversary Emulation
• After Purple Teaming with Threat Intelligence Report of Organization
Start Emulating Specific APT attack
• Breach and Attack Simulation vs Adversary Emulation Platform
4

5. Reconnaissance (10)
• Attack Surface Management => Framework find Assets and Vulnerabilities
• Techniques (OSINT)
• Active Scanning
• Gather Victim Host Information
• Gather Victim Identity Information
• Gather Victim Network Information
• Gather Victim Org Information
• Phishing for Information
• Search Closed Sources
• Search Open Technical Databases
• Search Open Websites/Domains
• Search Victim-Owned Websites
5

6. Reconnaissance-Tools
• Maltego-CE
• Ammas
• Sn1per
• SET
• Nikto
• Recon-ng
• Shodan
• Spiderfoot
6

7. Reconnaissance-APT Groups
• APT28-> Phishing for Information
• Lazarus-> Gather Victim Org Information -> pretexting Spearphishing
7

8. Resource Development(7)
• Acquire Infrastructure
• Compromise Accounts
• Compromise Infrastructure
• Develop capabilities
• Establish Accounts
• Obtain capabilities
• Stage capabilities
• => Privilege Escalation and client Execution
8

9. Resource Development-APT Groups
• APT28 => Domains, Web Services, Email Accounts,Tool
• Lazarus => Domains, Server,Web Services, Malware, Email Accounts,
Social Media Accounts, Code Signing Certificates, Digital
Certificates,Tool
• APT41 => Tool
9

10. Initial Access(9)
• Drive-by compromise
• Exploit Public-Facing Application
• External Remote Service
• Hardware Additions
• Phishing
• Replication Through Removable Media
• Supply Chain Compromise
• Trusted Relationship
• Valid Accounts
1
0

11. Initial Access-Tools
• Aircrack-ng
• Lunckystrike
• Wifi-pumpkin
• GoPhish
• SQLmap
• King Phisher
• Bash Bunny
1
1

12. Initial Access-APT Groups
• APT28- Drive-by Compromise, Exploit Public-Facing Application,
External Remote Services, Replication Through removal Media,
Trusted Relationship, Valid Accounts, Spearphishing Attachment,
Spearphishing Link, cloud Accounts
• Lazarus- Drive-by Compromise, Valid Accounts, Spearphishing
Attachment, Spearphishing Link, Spearphishing Via services
• APT41- Spearphishing Attachment, compromise software supply
chain
1
2

13. Execution (12)
• Command and Scripting Interpreter
• Container Administration Command
• Deploy Container
• Exploitation for Client Execution
• Native API
• Scheduled Task/Job
• Shared Modules
• Software Deployment Tools
• System Services
• User Execution
• Windows Management Instrumentation
1
3

14. Execution-Tools
• Macro
• Donut
1
4

15. Execution-APT Groups
• APT28=> Powershell, Windows Command Shell, Dynamic Data
Exchange, Malicious File, Malicious Link
• Lazarus=> Powershell, VisualBasic, Windows Command shell,
Schedule Task,Malicious File, Malicious Link
• APT41=> Powershell, Unix Shell, Windows command Shell, Schedule
Task, Service Execution
1
5

16. Persistence (19)
• Account Manipulation
• BITS Jobs
• Boot or Logon Autostart Execution
• Boot or Logon Initialization Scripts
• Browser Extensions
• Compromise Client Software Binary
• Create Account
• Create or Modify System Process
• Event Triggered Execution
• External Remote Services
• Hijack Execution Flow
• Implant InternalImage
• Modify AuthenticationProcess
• Office Application Startup
• Pre-OS Boot
• Scheduled Task/Job
• Server Software Component
• Traffic Signaling
• Valid Accounts
1
6

17. Persistence-Tools
• Empire
• Impact
• Pwncat
1
7

18. Persistence-APT Groups
• APT28=>Additional Email Delegated Permissions, Registry Run
keys/Startup Folder, Logon Script(windows), Component Object
model Hijacking, Office Test, Bootkit, WebShell, Cloud
Accounts,Exploiting Privilege Escalation, Valid Accounts
• Lazarus=> Registry Run keys/Startup Folder, Shortcut Modification,
Windows Service, DLL Side-Loading, KernelCallbackTable, Bootkit,
Scheduled Task, Valid Accounts
• Registry Run keys/Startup Folder, Windows Service, Accessibility
Features,DLL Search Order Hijacking, DLL Side-Loading, Dynamic
Linker Hijacking, Bootkit, Schedule Task, Process Injection, Valid
Accounts
1
8

19. Privilege Escalation (13)
• Abuse Elevation Control Mechanism
• Access Token Manipulation
• Boot or Logon Autostart Execution
• Boot or Logon Initialization Scripts
• Create or Modify System Process
• Domain Policy Modification
• Escape to Host
• Event Triggered Execution
• Exploitation for Privilege Escalation
• Hijack Execution Flow
• Process Injection
• Scheduled Task/Job
• Valid Accounts
1
9

20. Privilege Escalation-Tools
• Rubeus
• UACme
• SharpUP
2
0

21. Privilege Escalation-APT Groups
• APT28=> Token Impersonation Theft, Registry Run keys/folder, Logon
Scripts, Component Object model Hacking, Cloud Accounts,
Deobfuscation/Decode Files and information, Exploitation for Defense
Evasion
• Lazarus=> Create Process with Token, Registry Run Keys/ Startup
Folder, Shortcut Modification, Windows Service, DLL Side-loading,
Kernel Callback Table, DLL Injection, Schedule Task
• APT41=>Registry Run Keys/ Startup Folder, Windows Service,
Accessibility Features, DLL Search Order Hijacking,DLL Side-
Loading,Bits Jobs, Modify Registry, Process Injection, Rootkit
2
1

22. Defense Evasion(42)
• Abuse Elevation Control Mechanism
• Access Token Manipulation
• BITS Jobs
• Build Image on Host
• Debugger Evasion
• Deobfuscate/Decode Files or Information
• Deploy Container
• Direct Volume Access
• Domain Policy Modification
• Execution Guardrails
• Exploitation for Defense Evasion
• File and Directory Permissions Modification
• Hide Artifacts
• Hijack Execution Flow
• Impair Defenses
• Indicator Removal on Host
• Indirect Command Execution
• Masquerading
• Modify Authentication Process
• Modify Cloud Compute Infrastructure
2
2

23. Defense Evasion(42)
• Modify Registry
• Modify System Image
• Network Boundary Bridging
• Obfuscated Files or Information
• Plist File Modification
• Pre-OS Boot
• Process Injection
• Reflective Code Loading
• Rogue Domain Controller
• Rootkit
• Subvert Trust Controls
• System Binary Proxy Execution
• System Script Proxy Execution
• Template Injection
• Traffic Signaling
• Trusted Developer Utilities Proxy Execution
• Unused/Unsupported Cloud Regions
• Use Alternate Authentication Material
• Valid Accounts
• Virtualization/Sandbox Evasion , Weaken Encryption , XSL Script Processing
2
3

24. Defense Evasion-Tools
•Meterpreter
•Proxychains
•Invoke-obfuscation
•Veil
2
4

25. Defense Evasion-APT Groups
•APT28=>
•Lazarus=>
•APT41=>
2
5

26. Credential Access(16)
• Adversary-in-the-Middle
• Brute Force
• Credentials from Password Stores
• Exploitation for Credential Access
• Forced Authentication
• Forge Web Credentials
• Input Capture
• Modify Authentication Process
• Multi-Factor Authentication Interception
• Multi-Factor Authentication Request Generation
• Network Sniffing
• OS Credential Dumping
• Steal Application Access Token
• Steal or Forge Kerberos Tickets
• Steal Web Session Cookie
• Unsecured Credentials
2
6

27. Credential Access-Tools
• Mimikatz
• Hashcat
• Responder
• Cain & Able
• John the Ripper
• THC Hydra
• LaZagne
2
7

28. Credential Access-APT Groups
• APT28=>
• Lazarus=>
• APT41=>
2
8

29. Discovery(30)
• Account Discovery
• Application Window Discovery
• Browser Bookmark Discovery
• Cloud Infrastructure Discovery
• Cloud Service Dashboard
• Cloud Service Discovery
• Cloud Storage Object Discovery
• Container and Resource Discovery
• Debugger Evasion
• Domain Trust Discovery
• File and Directory Discovery
• Group Policy Discovery
• Network Service Discovery
• Network Share Discovery
• Network Sniffing
• Password Policy Discovery
• Peripheral Device Discovery
• Permission Groups Discovery
• Process Discovery
• Query Registry
2
9

30. Discovery(30)
• Remote System Discovery
• Software Discovery
• System Information Discovery
• System Location Discovery
• System Network Configuration Discovery
• System Network Connections Discovery
• System Owner/User Discovery
• System Service Discovery
• System Time Discovery
• Virtualization/Sandbox Evasion
3
0

31. Discovery-Tools
• BloodHound
• SeatBelt
• Kismet
• ADRecon
3
1

32. Discovery-APT Groups
• APT28=>
• Lazarus=>
• APT41=>
3
2

33. Lateral Movement(9)
• Exploitation of Remote Services
• Internal Spearphishing
• Lateral Tool Transfer
• Remote Service Session Hijacking
• Remote Services
• Replication Through Removable Media
• Software Deployment Tools
• Taint Shared Content
• Use Alternate Authentication Material
3
3

34. Lateral Movement-TOOLS
• Mimikatz
• PSexec
• WMIOPS
• CrackMapEXEC
• Infection Monkey
3
4

35. Lateral Movement-APT Groups
• APT28=>
• Lazarus=>
• APT41=>
3
5

36. Collection(17)
• Adversary-in-the-Middle
• Archive Collected Data
• Audio Capture
• Automated Collection
• Browser Session Hijacking
• Clipboard Data
• Data from Cloud Storage Object
• Data from Configuration Repository
• Data from Information Repositories
• Data from Local System
• Data from Network Shared Drive
• Data from Removable Media
• Data Staged
• Email Collection
• Input Capture
• Screen Capture
• Video Capture
3
6

37. Collection-TOOLS
• PowerSploit
• POwerUPSQL
3
7

38. Collection-APT Groups
• APT28=>
• Lazarus=>
• APT41=>
3
8

39. C2(16)
• Application Layer Protocol
• Communication Through Removable Media
• Data Encoding
• Data Obfuscation
• Dynamic Resolution
• Encrypted Channel
• Fallback Channels
• Ingress Tool Transfer
• Multi-Stage Channels
• Non-Application Layer Protocol
• Non-Standard Port
• Protocol Tunneling
• Proxy
• Remote Access Software
• Traffic Signaling
• Web Service
3
9

40. C2-TOOLS
• Covenant
• Pupy
• Empire
• Merlin
• POshC2
4
0

41. C2-APT Groups
• APT28=>
• Lazarus=>
• APT41=>
4
1

42. Exfiltration(9)
• Automated Exfiltration
• Data Transfer Size Limits
• Exfiltration Over Alternative Protocol
• Exfiltration Over C2 Channel
• Exfiltration Over Other Network Medium
• Exfiltration Over Physical Medium
• Exfiltration Over Web Service
• Scheduled Transfer
• Transfer Data to Cloud Account
4
2

43. Exfiltration-Tools
• DNScat2
• ClockifyFactory
• Powershell-RAT
4
3

44. Exfiltration-APT Groups
• APT28=>
• Lazarus=>
• APT41=>
4
4

45. Impacts(13)
• Account Access Removal
• Data Destruction
• Data Encrypted for Impact
• Data Manipulation
• Defacement
• Disk Wipe
• Endpoint Denial of Service
• Firmware Corruption
• Inhibit System Recovery
• Network Denial of Service
• Resource Hijacking
• Service Stop
• System Shutdown/Reboot
4
5

46. Impacts-TOOLS
• Slows
• Low Orbit Lon Cannon(LOIC)
• Ransomware
4
6

47. Impacts-APT Groups
• APT28=>
• Lazarus=>
• APT41=>
4
7

48. Result
• Security Breach
• Damage Ransomware
• Damage Data Leak
• Damage Ics Network
• Damage Denial Of Service
4
8

49. 4
9