Awesome

בס״ד

⫷ HacKingPro ⫸ <br> ⫷ TryHackMe | KoTH ⫸ <br> ⫷ Privilege-Escalation⫸ <br> ⫷ ScanPro | Linfo | Diablo ⫸ <br> ⫷ Offensive-Security | PenTest ⫸ <br> ⫷ Goals | Studies | HacKing | AnyTeam ⫸ <br>

RedTeam

<a href=""><br><img title="Made in ISRAEL" src="https://img.shields.io/badge/MADE%20IN-ISRAEL-blue?style=for-the-badge"></a>

RedTeam - Red Team Tools

RED TEAM DEVELOPMENT CHECKLIST

⫷ MITRE ATT&CK | OST Map | ATT&CK Navigator | Atomic Red Team ⫸

• TTP - Tactics, Techniques and Procedures
• TI - Threat Intelligence
• CTI - Cyber Threat Intelligence
• ISAC - Information and Sharing Analysis Centers

• 1 Reconnaissance:
  • No identified TTPs, use internal team methodology
• 2 Weaponization:
  • Command and Scripting Interpreter
    • PowerShell
    • Python
    • VBA
    • Ruby
    • Bash
    • Shell
  • User executed malicious attachments
• 3 Delivery:
  • Exploit Public-Facing Applications
  • Spearphishing
• 4 Exploitation:
  • Registry modification
  • Scheduled tasks
  • Keylogging
  • Credential dumping
• 5 Installation:
  • Ingress tool transfer
  • Proxy usage
• 6 Command & Control:
  • Web protocols (HTTP/HTTPS)
  • DNS
  • Actions on Objectives
  • Exfiltration over C2

• Determine required knowledge and skills
• Identify and implement alternate methods for bridging knowledge gaps
• Develop roles and responsibilities guide
• Develop red team methodology
• Develop TTP guidance for engagements
• Includes Bag of tricks
• Develop data collection guide and tools
• Develop operational process plan
• Develop communication plan template
• Develop ROE template: Rules of Engagement (RoE)
• Develop technical briefing template
• Develop report template: Diablo

Concept of Operation (CONOPS)

There is not a set standard of a CONOPS document;

Below is an outline of critical components that should be included in a CONOPS

• Client Name
• Service Provider
• Timeframe
• General Objectives/Phases
• Other Training Objectives (Exfiltration)
• High-Level Tools/Techniques planned to be used
• Threat group to emulate (if any)

Resource Plan

• Header
  • Personnel writing
  • Dates
  • Customer
• Engagement Dates
  • Reconnaissance Dates
  • Initial Compromise Dates
  • Post-Exploitation and Persistence Dates
  • Misc. Dates
• Knowledge Required (optional)
  • Reconnaissance
  • Initial Compromise
  • Post-Exploitation
• Resource Requirements
  • Personnel
  • Hardware
  • Cloud
  • Misc.

Mission Plan

• Objectives:
• Operators
• Exploits/Attacks
• Targets
  • Users:
  • Machines:
  • Objectives:
• Execution plan variations

PLANNING - RED TEAM ENGAGEMENT CHECKLIST

• Engagement Planning
  • ROE
    • Event Communication plan
    • Distribute Deconfliction Process
    • Entry point/method
    • Scope
    • Goals/Objectives (should address at least one of the following)
      • Protect
      • Detect
      • Respond
      • Restore
    • Target Restrictions
    • Target Infrastructure / Asset verification / Approvals
  • Scenario Development
  • Operational Impact planning
• Develop threat profiles
  • Network and Host Activity
  • IOC Generation (incl subsequent Analysis) and Management
• Plan threat infrastructure
  • Tier 1
    • IPs
    • Systems
    • Redirectors
    • PPS
  • Tier 2
    • IPs
    • Systems
    • Redirectors
    • PPS
  • Tier 3
  • IPs
  • Systems
  • Redirectors
  • PPS
  • Deploy tools to infrastructure
• Data collection repository

RED TEAM ENGAGEMENT GOAL PLANNING

COMMON GOALS: MEASURE AND OBSERVE ...

• A THREAT’S ABILITY TO ACCESS TO COMMON AND RESTRICTED AREAS (PHYSICAL)

  • What ability does a threat have to access common areas?
  • What ability does a threat have to access restricted areas?
  • Can a threat use access gained to enable cyber capabilities?
  • What impacts can a threat have through gained access?

• A THREAT’S ABILITY TO ACCESS KEY/CRITICAL SYSTEMS

  • Can a threat access key/critical systems?
  • What impacts can a threat have on key/critical systems?

• A THREAT’S ABILITY TO MOVE FREELY THROUGHOUT A NETWORK

  • What ability does a threat have to freely move throughout a network?

• A THREAT’S ABILITY TO GAIN DOMAIN WIDE AND LOCAL ADMINISTRATIVE ACCESS?

  • What ability does a threat have to gain local administrative access?
  • What ability does a threat have to gain domain administrative access?
  • What ability does a threat have to gain elevated access?

• A THREAT’S ABILITY TO ACCESS OR IDENTIFY SENSITIVE INFORMATION

  • What ability does a threat have to access sensitive information?
  • What ability does a threat have to identify sensitive information?

• A THREAT’S ABILITY TO EXFILTRATE DATA OUTSIDE AN ORGANIZATION

  • What ability does a threat have to exfiltrate data outside an organization?
  • How much data must be exfiltrated to impact an organization?

• A THREAT’S ABILITY TO ACT UNDETECTED FOR A GIVEN TIME FRAME

  • How long can a threat go undetected?
  • Can a threat achieve its goals undetected?
  • What must a threat do to stimulate a reaction from an organization?

• A THREAT’S ABILITY TO PERFORM OPERATIONAL IMPACTS

  • What impacts can a threat perform against an organization?
  • How can a threat affect X?

Rules of Engagement (RoE)

• Rules of Engagement
  • Executive Summary
    • Overarching summary of all contents and authorization within RoE document
  • Purpose
    • Defines why the RoE document is used
  • References
    • Any references used throughout the RoE document (HIPAA, ISO, etc.)
  • Scope
    • Statement of the agreement to restrictions and guidelines
  • Definitions
    • Definitions of technical terms used throughout the RoE document
  • Rules of Engagement and Support Agreement
    • Defines obligations of both parties and general technical expectations of engagement conduct
  • Provisions
    • Define exceptions and additional information from the Rules of Engagement
  • Requirements, Restrictions, and Authority
    • Define specific expectations of the red team cell
  • Ground Rules
    • Define limitations of the red team cell's interactions
  • Resolution of Issues/Points of Contact
    • Contains all essential personnel involved in an engagement
  • Authorization
    • Statement of authorization for the engagement
  • Approval
    • Signatures from both parties approving all subsections of the preceding document
  • Appendix
    • Any further information from preceding subsections

Campaign planning

The campaign summary we will be using consists of four different plans varying in-depth and coverage adapted from military operations documents.

Engagement Plan:

Operations Plan:

Mission Plan:

Remediation Plan (optional):

• TryHackMe: Red Team Engagements:
  • Learn the steps and procedures of a red team engagement, including planning, frameworks, and documentation.
• Red Teaming Toolkit

Tools

Shr3dKit Red Team Tool Kit

This tool kit is very much influenced by infosecn1nja's kit. Use this script to grab majority of the repos.

NOTE: hard coded in /opt and made for Kali Linux

• Total Size (so far): 2.5+Gb