Red Team Methodologie

Cyber Sec Rom Approach on Red Team Engagements

About

Red Team engagements are an all-out attack on the organization with the aim of compromising critical data assets in company’s network by any means possible. Leveraging the vast threat landscape that a true attacker would have available to them, we imitate the real-world attacks that can hit the organization and perform all the necessary techniques that attackers would employ. By assuming the role of a highly motivated attacker, we demonstrate all the ways that your information security is at risk. General techniques used in a Red Team engagement vary from standard phishing attempts aimed at employees and social engineering to impersonating staff members, to compromising the physical security and implanting Command and Control devices within company’s network. The demonstrated impact from a Red Team engagement paints a much larger picture that will aid the organization in the planning, development, and prioritization of future information security initiatives.

There are a handful of people inside the organization that are aware of the engagement. A C-suite executive or a high-ranking manager of the company should be in constant communication with the Red Team. Any issues or alert should be immediately addressed.

The rules of engagement are predefined before the start of the engagement.

Frameworks

Red Team Engagements follow the best practices and methodologies from industry standards:

  • MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK)

  • Penetration Testing Execution Standard (PTES)

  • The Open-Source Security Testing Methodology Manual (OSSTMM)

  • Open Web Application Security Project (OWASP)

Phases

Red Team engagements follow a methodology that consists of two phases

  • Breaching the perimeter

  • Reconnaissance & Exploitation

  • Phishing

  • Assume Breach

  • Reconnaissance & Local Privilege Escalation & Lateral Movement & Data Exfiltration

Breaching the perimeter

This phase can be split into three different stages:

Reconnaissance

In this phase we are using passive and active methods to retrieve as much information as possible about the Company. We are mapping the internet exposure of the target.

  • Subdomains that are known to belong to the company

  • Newly merges and acquisitions

  • Technologies used by the company (Microsoft, Google, AWS, Salesforce, etc)

  • Running services and technologies

  • Internet exposed web applications (off-the-shelf, custom-build)

  • Usernames and email addresses from publicly available sources (LinkedIn, Social media)

  • Leveraging Threat Intelligence to gather information from online sources, data dumps, password leaks from the Dark Web.

Exploitation

We will try to exploit any vulnerabilities that we find. The main goal is to get access to the internal organization and/or access the internal network. Among the actions performed in this phase:

  • Validating credentials gathered in the Reconnaissance phase

  • Password spraying and brute forcing attacks against the accounts discovered and validated. These attacks are performed against, and not limited to SSH, RDP, VPN, VDI, OWA

  • Web application testing

    • Identify and exploit vulnerabilities that can be used in client-side attacks

    • Identify and exploit vulnerabilities that can lead to remote code execution on the server

  • Service Exploitation

    • Identify and exploit any service that is running on one of the subdomains or domains of the company. Among the activities performed:

    • Testing for known credentials

    • Brute-forcing/password spraying against login forms

    • Identify and exploit vulnerable services

Phishing

The main goal of this phase is to obtain user’s credentials and get access to the employee’s workstations. Possible phishing scenarios that can be performed:

  • Malicious Macro – In this scenario a malicious document will be carefully chosen and obfuscated to bypass security solutions such as Antivirus and EDR solutions. The payload’s purpose is to connect back to the red team’s command and control server (C2) and to obtain a reverse shell.

  • Password Gathering - In this scenario a email is sent to the employee which contains a link to a page with a login form. The user should enter his/her credentials to access the information mentioned in the email. Once the username and password are entered the user is redirected to a predefined page. The credentials are meantime captured by the Red Team.

This scenario is also valid for companies which employ multi factor authentication. * Some limitation can apply on types of MFA Implementation

  • Drive-By-Download – In this scenario an email is sent to the employee. The email contains a link to website that once accessed will force a download file on the employee’s computer. The file contains a malicious link that eventually will lead to a reverse shell.

NOTE: Phishing scenarios require pre-planning.

  1. In order to bypass some of the spam and security measures implemented by the targeted company, domain should be purchased before starting the engagement. These should have a good reputation and be known by the top security product vendors.

  2. Email templates can mimic company’s emails, a partner, known vendor solutions or outside companies. The email can be personalized depending on the pretext and scope of the campaign

Assume Breach – Post Compromise

The scope of this assessment is to perform actions inside the company network without being detected. The end goal can differ for each engagement: get domain administrator privileges (full network compromise), move laterally, exfiltrate data.

Having access to the internal network, it may be possible to perform the following actions:

Reconnaissance

  • Identify critical servers such as file servers, domain controllers, etc.

  • Identify applications that the compromised user has (email, internal applications)

Local Privilege escalation

  • Starting with a low-privileged user, exploit misconfigurations or vulnerabilities and escalate the privileges to administrator or SYSTEM

  • Attempt to Bypass AV

  • Attempt to Bypass EDR

Lateral movement

  • Network level

  • Dump credentials found on the workstation and move laterally to other machines

  • Social Engineering level

  • Send emails from the compromised user to other key accounts employees inside the organization. The email contains a malicious document or a link to a capture credentials website.

  • Engage users on internal communication channels (zoom, Slack, Teams, etc.), the end goal being to compromise their accounts.

Data exfiltration

  • In this phase, files and documents are encrypted and send outside the company. Different Exfiltration channels can be used and performed via DNS queries, HTTP traffic, ICMP, etc.

  • Possible exfiltrated data:

    • Customer PII and credit card information

    • Source Code repositories

    • Stock market analytics

    • Other information that might seem valuable to the company

Advantages

Red Team engagement offer a wide array of advantages for both external and internal approaches:

External

  • Assess the responsiveness of the SOC in place

  • Verifying Security measures implemented by the organization for the external assets

  • Assess internet facing web applications

  • Assess employee awareness on phishing emails

  • Assess email protection employed by the company

Internal

  • Assess the responsiveness of the SOC in place

  • Verify EDR and AV protection

  • Assess AD policy implementation and configuration

  • Test for open share and sensitive files on the servers

  • Test employee awareness on internal attacks and social engineering

  • Assess mitigation in place against data exfiltration

Reporting

At the end of the assessment a report will be handed to the company representative describing:

  • Detailed and timestamp walkthrough of the Red Teaming Engagement

  • Relevant information gathered about the company in the External Reconnaissance phase

  • List with compromised accounts or leaks relevant to the company

  • List of vulnerabilities existent on the internet exposed services and web applications

  • Relevant information collected in the internal reconnaissance phase

  • All the steps performed inside the organization

  • Data that was exfiltrated as a POC (Proof of Concept)

  • Path to Domain Admin

Last updated