Speaker 1: Welcome to the deep dive. We're diving into the world
Speaker 1: of red teaming today and our guide is going to
Speaker 1: be hands on red team tactics by Himanshu Sharma and
Speaker 1: heartbreat Singh and these authors.
Speaker 2: You know, they're not just they're not just theorists. Himanshu
Speaker 2: has found vulnerabilities in major companies Apple, Google, Microsoft, Wow,
Speaker 2: even help celebrities get their accounts back after they were hacked.
Speaker 1: That's the kind of experience I want on my side.
Speaker 1: And Hartrey brings years of ethical hacking red teaming expertise,
Speaker 1: working with huge banks, racking up top certifications. So you know,
Speaker 1: the preface of this book really got me thinking, Okay,
Speaker 1: what if you could simulate a real world attack to
Speaker 1: test your company's defenses. Yeah, that's what red teaming is
Speaker 1: all about.
Speaker 2: No, it is about pushing the boundaries, finding those weaknesses
Speaker 2: before the bad guys do. Right. It goes beyond your
Speaker 2: typical security checks, uncovering vulnerabilities that you know might slip
Speaker 2: through the cracks.
Speaker 1: So it's more than just like a basic penetration test. Absolutely,
Speaker 1: it's like really stepping into the shoes of a real attacker,
Speaker 1: trying to think like they do.
Speaker 2: Yeah, it's about understanding their mindset, the tactics they use
Speaker 2: in the real world.
Speaker 1: You know, I used to think that penetration testing and
Speaker 1: red teaming were the same thing, but reading this book,
Speaker 1: I realized there are some key differences.
Speaker 2: You're right. Penetration testing or pen testing, it usually follows
Speaker 2: a more structured process, often guided by industry standards, things like, okay,
Speaker 2: the Penetration Testing Execution Standard PTE, PTEs, GUYSWAPS, STMM, and ISF.
Speaker 1: Okay, so those are like those those are kind of.
Speaker 2: Like the frameworks, right, framework the guidelines for how these
Speaker 2: tests should be conducted.
Speaker 1: All right, So let's break down PTEs a little bit.
Speaker 1: What are the steps involved there?
Speaker 2: So PTEs starts with pre engagement interactions, defining the scope, right, okay,
Speaker 2: making sure everybod he's on the same page. Then there's
Speaker 2: intelligence gathering, rep modeling, vulnerability analysis, and of course the
Speaker 2: actual exploitation phase right right where you try to break in,
Speaker 2: you know, see if you can get through the defenses,
Speaker 2: put it to the test. And finally there's post exploitation
Speaker 2: and reporting. Okay, so documenting what you found, what you
Speaker 2: were able to do, right.
Speaker 1: So it's very thorough, Yeah, It's kind of like a
Speaker 1: scheduled checkup, you know.
Speaker 2: Yeah, you know what to expect when you're going in
Speaker 2: for appentist red teaming. It's all about surprise. Oh okay,
Speaker 2: imagine the organization doesn't even know what's happening, right. That
Speaker 2: element of surprise really helps you see how they would
Speaker 2: react to a real world attack.
Speaker 1: That makes sense. Yeah, this book, it dives into a
Speaker 1: whole bunch of tools that red teams use. Yeah, some
Speaker 1: are familiar, like metasploit and map, but the pin Testing
Speaker 1: twenty eighteen chapter introduce me to some nuance.
Speaker 2: Yeah, like the MSF payload creator okay, MSFPC MSFPC, which
Speaker 2: makes generating payloads, especially for those tricky reverse shell connections,
Speaker 2: so much easier.
Speaker 1: We'll have to get into those verse shells a little
Speaker 1: bit later, definitely. But you also mentioned another tool that
Speaker 1: caught my eye. What's interesting about Kowitic?
Speaker 2: So what's interesting about koatic is okay, it uses Windows
Speaker 2: script hosts to execute its payloads. A lot of anti
Speaker 2: virus programs these days, Yes, they're focused on PowerShell activity,
Speaker 2: and so this can help Koitic fly under the radar
Speaker 2: a little bit, just like.
Speaker 1: A ninja sneaking path to the defenses.
Speaker 2: Yeah, exactly.
Speaker 1: It seems like staying hidden is crucial for red teams.
Speaker 2: Absolutely. Yeah, red teams need to operate undetected if they
Speaker 2: really want to accurately assess an organization's security.
Speaker 1: Makes sense, right, speaking of essential tools. Yeah, no, red
Speaker 1: teaming conversation is complete right without talking about the metasploit framework.
Speaker 1: I've messed around with it a little bit myself, Okay,
Speaker 1: but maybe we could do a quick refresher.
Speaker 2: Sure, the book assumes some familiarity, so we don't need
Speaker 2: to go too deep. But think of metasploit like a toolbox, okay,
Speaker 2: filled with modules, little programs designed for specific tasks. There
Speaker 2: are auxiliaries, which are helper tools for things like scanning
Speaker 2: exploits to target vulnerabilities, and payloads, which are the actions
Speaker 2: taken after a successful.
Speaker 1: Exploit, like opening a back door, right.
Speaker 2: Opening a back door, stealing data, stealing beta, things like that,
Speaker 2: And then you have encoders to make those payloads harder
Speaker 2: to detect.
Speaker 1: Right, Yeah. I remember using armitage, yeah, which is that
Speaker 1: graphical interface for metasploity, just to make things a little
Speaker 1: bit easier to manage.
Speaker 2: Armitage is great for streamlining attacks.
Speaker 1: Yeah, you can even automate tasks with Quortana scripting.
Speaker 2: Oh wow. Yeah, speaking of powerful tools, there's another one
Speaker 2: that came up a lot in this book.
Speaker 1: Cooboal Strike Cobalt strikes.
Speaker 2: It sounds like a favorite.
Speaker 1: It is, It's a favorite among Red teamers. Cobalt Strike
Speaker 1: is really about simulating those advanced persistent threats that you
Speaker 1: hear about so much. It's built for those later stages
Speaker 1: of an engagement, and it uses what's called a team
Speaker 1: server as a central hub for controlling those compromise systems.
Speaker 2: So like a command center for the Red Team. Sounds
Speaker 2: like Cobalt Strike is designed to really mimic what those
Speaker 2: really sophisticated attackers do.
Speaker 1: Yeah, the real deal, those nation state actors, APT groups,
Speaker 1: that kind of thing. So to really understand how it's used,
Speaker 1: we need to talk about what's called the Cyber Kill
Speaker 1: Chain the CKC. It's a framework that breaks down and
Speaker 1: attack into stages. Okay, I'm intrigued. What are the stages?
Speaker 2: Think of it like planning a heist, right, Okay, First
Speaker 2: you need to gather information about your target, right, that's reconnaissance. Okay,
Speaker 2: Then you prepare your tools your weapons. That's weaponization makes sense.
Speaker 2: Next comes figuring out how to deliver your attack. Right.
Speaker 2: Then the exploitation phase. You actually break in right, right,
Speaker 2: you know you're through the door.
Speaker 1: Now, okay, So it's not just about getting in, it's.
Speaker 2: About it's about what you do once you're in.
Speaker 1: Okay.
Speaker 2: Right, So after you've exploited a vulnerability, you need to
Speaker 2: install your tools and establish a way to maintain control.
Speaker 1: Right.
Speaker 2: That's installation and command and control. And finally you carry
Speaker 2: out your objective, right, whether it's stealing data, disrupting operations,
Speaker 2: whatever it might be.
Speaker 1: So it's a whole operation, like a multi phase.
Speaker 2: It is a campaign, it's not just a smash and grab,
Speaker 2: you know, gotcha, And Cobalt Strike gives you the tools
Speaker 2: to carry out each of these phases.
Speaker 1: So it's like a comprehensive toolkit. Yeah.
Speaker 2: It helps them simulate that full life cycle of a
Speaker 2: really sophisticated attack from the very beginning to achieving those objectives.
Speaker 1: Now, one technique that keeps popping up is the reverse shell,
Speaker 1: and it sounds like a really clever way to get
Speaker 1: around it is those pesky firewalls, yes, that block incoming connections.
Speaker 2: So a reverse shell allows the attacker to gain control
Speaker 2: of a system by having the target system initiate a
Speaker 2: connection back to the attacker's machine.
Speaker 1: So instead of the attacker trying to force their way in,
Speaker 1: they're tricking the target into reaching out to them exactly.
Speaker 2: It's kind of like a judo move. You're using their
Speaker 2: own momentum against them.
Speaker 1: Makes sense, and this.
Speaker 2: Can be really helpful, especially when you have those firewalls
Speaker 2: that are blocking incoming connections but they allow outgoing traffic.
Speaker 2: It's a common configuration and reverse shells take advantage of that.
Speaker 1: It sounds pretty sneaky. It is, it is, but I
Speaker 1: imagine there are different ways to establish.
Speaker 2: There areless way is to use a tool like netcat. Okay,
Speaker 2: but that creates an unencrypted connection, right, which can be
Speaker 2: easily detected if somebody's looking for it. Makes sense, so
Speaker 2: for stealth red teamers use encryption with tools like OpenSSL
Speaker 2: and cat, socat, crypt cat, all sorts of tools out there.
Speaker 1: Can I see that metasploid also has dedicated tayloads. It
Speaker 1: does yeah for this, like reverse CRAP and reverse CPRC four,
Speaker 1: I bet that RC four adds it does.
Speaker 2: RC four is an encryption algorithm. It adds an extra
Speaker 2: layer of encryption to make it even harder to detect.
Speaker 1: So it's all about blending in. It is with that
Speaker 1: normal network.
Speaker 2: Traffic hiding in plane sight, right, that's the name of
Speaker 2: the game.
Speaker 1: And once a red team has that initial foothold, they
Speaker 1: often need to move deeper into the network. And that's
Speaker 1: where pivoting comes in.
Speaker 2: Pivoting exactly.
Speaker 1: Imagine pivoting is like it is using one compromise system
Speaker 1: to hop to another like a stepping stone. Like a
Speaker 1: stepping stone exactly, you.
Speaker 2: Get a foothold on one machine and then you use
Speaker 2: that to reach another one makes sense deeper into the network.
Speaker 1: So the book covers a few it does pivoting techniques.
Speaker 2: One is SSH tunneling, where you use SSH to access
Speaker 2: hidden services on a compromise machine, you know, something like
Speaker 2: V and C. You can tunnel that traffic over SSH.
Speaker 2: And then there's interpreter port forwarding, which creates tunnels through
Speaker 2: an interpreter session to reach other machines.
Speaker 1: And then there's the level pivoting, multi level pivoting, which
Speaker 1: is where it gets really fun. Yeah, that's where you
Speaker 1: chain those pivots together, okay, to access multiple subnets. You're
Speaker 1: expanding that attack surface. You're really going you going deep.
Speaker 1: It's like exploring a maze. You know. Wow, it's amazing
Speaker 1: how Red teams can they can navigate these complex networks.
Speaker 2: They do. It's a skill. Yeah, it takes practice for sure, But.
Speaker 1: I imagine managing all those compromise systems maintaining that access.
Speaker 1: It can be pretty tricky.
Speaker 2: It is. That's where that's where post exploitation frameworks come in.
Speaker 2: Post exploitations frameworks, they're essential for maintaining that control and persistence.
Speaker 1: Okay, So one that stands out in this book is Empire.
Speaker 1: Empire Empire.
Speaker 2: So Empire gives Red teams a centralized platform to manage
Speaker 2: all those compromise systems, execute commands and pivot deeper into
Speaker 2: the network. It's like a remote control for all those
Speaker 2: compromised devices.
Speaker 1: It's like the puppet master. It is pulling the strings
Speaker 1: behind the scenes.
Speaker 2: Yeah, you got it. I'm curious how it works.
Speaker 1: So the core concept and Empire is setting up what's
Speaker 1: called a listener, similar to a handler in metasploitt. The
Speaker 1: listener is just waiting for connections from those compromise systems,
Speaker 1: which are called agents in Empire agents. So those compromises
Speaker 1: they connect back to the Empire server, to the Empire server.
Speaker 2: But how does that happen?
Speaker 1: Through a process called staging. Okay, so Empire generates a
Speaker 1: little piece of code called a stager that gets executed
Speaker 1: on the target system, and that stager reaches out and
Speaker 1: pulls down a larger agent which establishes that connection.
Speaker 2: So it's like a covert channel.
Speaker 1: It is a covert channel for communication.
Speaker 2: And once that connection is made.
Speaker 1: Then the fun begins. The Red team can really start digging.
Speaker 2: In, can really dig in.
Speaker 1: Yeah. Empire has this huge library it does of post exploitation.
Speaker 2: Modules, some massive library.
Speaker 1: Categorized by function. So there are modules for executing code,
Speaker 1: collecting data, stealing credentials, xfiltrating information, basically anything you can
Speaker 1: think of. Ye, pretty much anything that a sophisticated attacker would.
Speaker 2: Do, that a sophisticated attacker would want to do.
Speaker 1: It is a toolbox.
Speaker 2: For all those post exploitation activity post exploitation activities.
Speaker 1: It's like you've gotten in, now what are you going
Speaker 1: to do? Empire gives you the tools to do it.
Speaker 2: And I see that it can target oh yeah, Windows, Linux,
Speaker 2: even macOS.
Speaker 1: It's incredibly versatile. Wow, you can use it in so
Speaker 1: many different situations.
Speaker 2: So it's really valuable for red teams that are operating
Speaker 2: in all these different environments. No, imagine a red team
Speaker 2: gets into an enterprise network. What would be their ultimate goal?
Speaker 1: What do you think if they really want to cause
Speaker 1: some chaos, wouldn't they go for the domain controller?
Speaker 2: You're thinking like a red team or already? The domain
Speaker 2: controller is the heart of the network. It's the keys
Speaker 2: to the kingdom. If you can compromise the domain controller,
Speaker 2: you basically control the whole domain. And the book actually
Speaker 2: details how Empire can be used to target domain controllers, right,
Speaker 2: I'm all yours. First, they need to gain higher privileges
Speaker 2: on a compromised machine, so Empire has modules for that,
Speaker 2: things like bypasswas vnlwright. Then they need to steal credentials.
Speaker 2: Oftentimes they'll use a tool called mimicats to extract passwords
Speaker 2: from memory, and that might include domain user credentials.
Speaker 1: So they escalate privileges. Yeah, grab those credentials.
Speaker 2: Then what then they use those stolen credentials to laterally
Speaker 2: move to the domain controller itself. Once they're on the domain.
Speaker 1: Controller, yeah, they're on the driver's seat, and I.
Speaker 2: Read about this script called death Star. Death Star, Yeah,
Speaker 2: that can actually automate. It can the whole process.
Speaker 1: It can automate a lot of that.
Speaker 2: Yet exploiting active directory to gain domain admin access.
Speaker 1: It could do it in seconds. It's a really powerful tool.
Speaker 1: It just shows you the power of automation.
Speaker 2: So death Star is like the Red Teams.
Speaker 1: He's kind of like they're step secret weapon. Yeah, okay,
Speaker 1: it's a very effective tool.
Speaker 2: We've talked a lot about Empire, but let's circle back
Speaker 2: to Cobalt Strike. The book really emphasizes its usefulness in
Speaker 2: those later stages.
Speaker 1: It's a post exploitation powerhouse. Oh okay, it's designed for
Speaker 1: those later stages of a Red Team engagement. So what
Speaker 1: makes it so, what's fascinating about Cobalt Strike is that
Speaker 1: it goes beyond just the initial exploitation. It gives you
Speaker 1: a whole suite of tools.
Speaker 2: For post exploitation activities.
Speaker 1: So it's really a comprehensive platform. It is.
Speaker 2: It's a platform for Red teaming.
Speaker 1: Tell me more about those advanced capabilities.
Speaker 2: So one of the things that excels at is payload generation.
Speaker 2: It supports all sorts of attack vectors. You know, packages,
Speaker 2: web drive buys, spear phishing.
Speaker 1: Wow.
Speaker 2: And once they're in, Cobalt Strike gives you all sorts
Speaker 2: of post exploitation tools, you know, screen shot capture, keystroke logging,
Speaker 2: process injection, file browsing, you name.
Speaker 1: It sounds like a spy's dream toolkit.
Speaker 2: It's pretty powerful stuff.
Speaker 1: And we can't forget about pivoting. We can't forget pivoting.
Speaker 2: Some kind of pivoting methods.
Speaker 1: So Cobalt Strike gives you several different options. You can
Speaker 1: set up a soocks server, you can create listeners that
Speaker 1: tunnel traffic through compromise systems. You can even deploy VPNs
Speaker 1: wow for covert communication.
Speaker 2: It sounds like they thought of everything.
Speaker 1: Yeah, they really did. I read about this aggressor script.
Speaker 1: Aggressor script which lets you automate tasks and customize attacks.
Speaker 2: It's a scripting language.
Speaker 1: Within Cobalt Strike.
Speaker 2: Built right into cobalt strikes.
Speaker 1: Okay, so what can you tell me about that?
Speaker 2: So aggressorscript is really powerful.
Speaker 1: Okay.
Speaker 2: You can define custom behaviors, automate complex sequences of actions. So,
Speaker 2: for example, you could use it to automatically gather information
Speaker 2: about a target network or launch a series of attacks
Speaker 2: against specific systems, can get really creative with it.
Speaker 1: Yeah, it's powerful stuff. It is regardless of what tools
Speaker 1: are being used, command and control or C two.
Speaker 2: C two, it's the heart of it.
Speaker 1: All is crucial for any Red Team operation.
Speaker 2: Could you read more? C two servers are those central
Speaker 2: hubs for communicating with all those compromise systems. They allow
Speaker 2: the Red Team to issue commands, receive data, maintain that
Speaker 2: persistent access.
Speaker 1: Right, and this is where things is where it gets
Speaker 1: get really interesting because the book dives into some really
Speaker 1: ingenious techniques for setting up and disguising those C two servers.
Speaker 2: You have to be creative. You can't just use the
Speaker 2: same old techniques.
Speaker 1: So one that stood out to me was using cloud
Speaker 1: based file sharing services like Dropbox. And one drives two.
Speaker 2: Channels, so you're using drop Box red teaming.
Speaker 1: It's all about blending in with legitimate traffic.
Speaker 2: Okay, how does that work?
Speaker 1: You can set up a listener in Empire that communicates
Speaker 1: through Dropbox, so all that C two traffic just looks
Speaker 1: like normal file uploads and downloads.
Speaker 2: So you're hiding in plane site, you.
Speaker 1: Are, You're hiding in plane sighte wow. And one drive
Speaker 1: can be used in a similar way. But the book
Speaker 1: also talks about C two covert channels, which take things
Speaker 1: to a whole new level. What are covert channels?
Speaker 2: So, covert channels are all about hiding the very existence
Speaker 2: of communication. So it's not just encrypting the data. You're
Speaker 2: using existing protocols like DNA, S, HTTP, ICMP, WebDAV to
Speaker 2: create hidden tunnels for your C two traffic.
Speaker 1: It's like whispering secrets. It is in a crowded room,
Speaker 1: but digitally nobody even knows.
Speaker 2: Nobody even knows the conversation is happening.
Speaker 1: Conversations happening. That's a great analogy.
Speaker 2: I like that one.
Speaker 1: But even with these techniques, yeah, C two servers can
Speaker 1: still be detected, we can and blocked. Right. That's where
Speaker 1: redirectors come. Indirectors, redirectors. Okay, I'm sensing another layer.
Speaker 2: Another layer of obfuscation here, exactly. So a redirector acts
Speaker 2: as a proxy, Okay, it forwards traffic to the actual
Speaker 2: C two server, right, but it masks its true IP address.
Speaker 1: So if the blue team exactly detects the redirector, they're
Speaker 1: not actually.
Speaker 2: Getting getting to the real C two server, to the
Speaker 2: C two server. Right, it's like a decoy, Okay, it
Speaker 2: draws attention away from the real target.
Speaker 1: So the book discusses different types of redirection it does.
Speaker 2: Yeah, from simple forwarding using a tool like socat to
Speaker 2: more sophisticated methods that mimic legitimate traffic. You can even
Speaker 2: use web services like Apache wow, to make it look
Speaker 2: like you're just communicating with a web server. And then
Speaker 2: there's this technique, and then there's domain funding domain fronting,
Speaker 2: which sounds really advanced.
Speaker 1: It's pretty advanced, okay, So what is that Domain fronting
Speaker 1: leverages legitimate services like Google app Engine or cloud flare
Speaker 1: to mask that C two traffic as communication with trusted domains.
Speaker 2: So it's like hiding it is a secret message and
Speaker 2: an official envelope exactly.
Speaker 1: Nobody's going to question that.
Speaker 2: Right, it looks completely legitimate. Wow, Okay, not a clever technique. Yeah,
Speaker 2: rub out my head around that one a little bit more, definitely.
Speaker 2: But let's talk about the end game, all right, Data
Speaker 2: ex filtration, Data ex filtration, getting the goods out right,
Speaker 2: that's the whole point.
Speaker 1: Right yea, So how do red teams actually get that
Speaker 1: data out?
Speaker 2: So there are lots of different methods, each with its
Speaker 2: pros and cons. You know, basic tools like netcat and
Speaker 2: open SSL they lack stealth. Okay, PowerShell can be used
Speaker 2: to exfiltrate data over HTTP. But you got to be
Speaker 2: careful with your scripting. Okay, make sure you're not tripping
Speaker 2: any alarms.
Speaker 1: Right, you know.
Speaker 2: The book also mentions steganography, Yes, steganogaway, which is basically
Speaker 2: hiding data within seemingly innocent files. Right, It's like hiding
Speaker 2: a message in plain sight.
Speaker 1: Yeah, so you could hide sensitive information.
Speaker 2: You could hide it in a recipe, wow, in a
Speaker 2: news article. Anything you can think of.
Speaker 1: That's wild.
Speaker 2: It's a clever technique, okay. And then there's DNS tunneling
Speaker 2: DNS tunneling, which uses DNS requests. DNS tunneling uses DNS
Speaker 2: requests to kind of sneak data out of the network.
Speaker 1: Okay.
Speaker 2: The book mentions a tool called dn.
Speaker 1: Steel dn steel for this purpose.
Speaker 2: And of course Empire has its own yeah, modules for
Speaker 2: data exfiltration.
Speaker 1: Absolutely, Empire has modules for all sorts of things.
Speaker 2: Right, So Empire's modules offer a lot of flexibility control
Speaker 2: over the exfiltration process.
Speaker 1: You got it.
Speaker 2: But you know, the goal of red teaming isn't just
Speaker 2: to steal data.
Speaker 1: It's not just about getting in and grabbing stuff. It's
Speaker 1: about maintaining that access, demonstrating the potential impact of a
Speaker 1: real attack which brings us to which it brings.
Speaker 2: Us to persistence.
Speaker 1: Persistence.
Speaker 2: Yet, that art of staying under the radar and keeping
Speaker 2: that access even if the initial entry points are closed.
Speaker 1: You get a persistence is all about making.
Speaker 2: Sure that the red team can maintain access. Right those
Speaker 2: back doors, Yeah, those back door those implants.
Speaker 1: Yah, those implants they leave behind.
Speaker 2: You've got to have a way to get back in.
Speaker 1: I'm eager to learn about the specifics.
Speaker 2: Yeah. So one common method is manipulating scheduled tasks. Okay,
Speaker 2: you know these are tasks that are set to run
Speaker 2: automatically at certain times. Attackers can hijack these to launch
Speaker 2: their own malicious payloads. So they're blending in hiding their
Speaker 2: activity within legitimate system processes exactly.
Speaker 1: They're making it look like their activity is just normal
Speaker 1: system activity.
Speaker 2: Pretty clever, it is.
Speaker 1: It's a very effective technique. So they might tweak they
Speaker 1: might tweak an existing schedule task, or they might create
Speaker 1: a new one that looks completely harmless but secretly it's
Speaker 1: executing their code in the background.
Speaker 2: Okay, and I bet registry keys are another prime target.
Speaker 1: Oh yeah, Registry keys are a gold mine for.
Speaker 2: Persistence, for persistence. Yeah, the registry is like the control
Speaker 2: center for Windows. Attackers can modify keys that determine which
Speaker 2: programs launch on startup or during certain.
Speaker 1: Events, so they could ensure their payload runs every time
Speaker 1: the computer.
Speaker 2: Starts, every time the computer starts. You got it.
Speaker 1: And I imagine they use.
Speaker 2: Oh, they use all sorts of obfuscation techniques, obfuscation and
Speaker 2: anti forensic technique to.
Speaker 1: Make those modifications harder to spot.
Speaker 2: To make it as difficult as possible for the blue
Speaker 2: team to find them.
Speaker 1: It's like trying to find it is a needle in
Speaker 1: a haystack, exactly.
Speaker 2: It's a very apt analogy. And then they're rogue services.
Speaker 1: Rogue services, yeah.
Speaker 2: Are those essentially make services disguised.
Speaker 1: As disguised as legitimate system processes. Yeah, yep. Attackers can
Speaker 1: create services that run in the background and execute their code.
Speaker 1: They'll often use names that mimic legitimate services.
Speaker 2: To avoid to avoid raising suspicion. If you see a
Speaker 2: service running that looks like a normal system service, Yeah,
Speaker 2: you're not going to think twice about it. This is
Speaker 2: getting into some deep technical.
Speaker 1: Sep technical territory sounds incredibly difficult.
Speaker 2: It is. It's not easy to root out these back doors.
Speaker 2: It requires specialized knowledge and tools, and that's why one
Speaker 2: of the key reasons why red teaming is so valuable.
Speaker 1: Absolutely, it helps.
Speaker 2: Organizations understand these sophisticated.
Speaker 1: Tactics that real world exposure they need and develop to
Speaker 1: develop those countermeasures countermeasures.
Speaker 2: So it's like this never it is game of cat.
Speaker 1: And mouse, Cat and mouse. Yeah, the cybersecurity landscape.
Speaker 2: Attackers is constantly evolving fenders.
Speaker 1: Attackers are always coming up with new methods, and defenders
Speaker 1: have to adapt and stay one step ahead. So given
Speaker 1: all this, what can organizations actually do?
Speaker 2: That's the million dollar question.
Speaker 1: To protect themselves from these.
Speaker 2: They can't just rely threat on traditional security measures anymore.
Speaker 2: You firewalls, anti virus software, those are important, but they're
Speaker 2: not enough. They're enough, not in today's threat landscape.
Speaker 1: Okay, so what else can they do?
Speaker 2: So they need a multi layered approach that combines prevention
Speaker 2: with proactive threat hunting and incident response capabilities.
Speaker 1: So it's not just about.
Speaker 2: It's not just about building walls.
Speaker 1: Building walls.
Speaker 2: It's about having eyes on the inside right actively looking
Speaker 2: for those subtle signs of an attack.
Speaker 1: So you got to operate under the assumption. You have
Speaker 1: to that breaches are inevitable, breaches are going to happen,
Speaker 1: and focus on minimizing the impact exactly.
Speaker 2: You've got to be able to detect them quickly, respond effectively,
Speaker 2: contain the damage, and recover efficiently.
Speaker 1: And that's where and.
Speaker 2: That's where red teaming really shines.
Speaker 1: Red teaming comes in. Yet by simulating those real world attacks,
Speaker 1: simulating organizations can thoroughly test their defenses, pinpoint those weaknesses,
Speaker 1: and improve their overall security posture.
Speaker 2: So it's like a fire drill. Like a fire drill,
Speaker 2: but for your cybersecurity.
Speaker 1: This deep dive has really given me a much deeper appreciation.
Speaker 2: Good. I'm glad to hear that for.
Speaker 1: The complexity of cybersecurity.
Speaker 2: It is complex, Yeah, there's no doubt about that.
Speaker 1: And the challenges that organizations face.
Speaker 2: Yeah, it's a tough job.
Speaker 1: But I gotta admit, yeah, it's a little overwhelming.
Speaker 2: It can be.
Speaker 1: To think about the sheer scale, It is a lot
Speaker 1: to take in and sophistication a.
Speaker 2: Threat landscape is constantly evolving.
Speaker 1: Of these attacks.
Speaker 2: New threats are emerging all the time, so it's a
Speaker 2: lot to keep up with, it is, But the key
Speaker 2: takeaway here is that security is an ongoing journey. It's
Speaker 2: not a destination. You never really arrive.
Speaker 1: Just check a box and you're done, set it and
Speaker 1: forget it.
Speaker 2: Yeah, you can't do that with security.
Speaker 1: It's about continuously improvement and resilience.
Speaker 2: Constant improvement, yeah, okay. And resilience being able to bounce
Speaker 2: back when those attacks inevitably happen.
Speaker 1: Because they will they will. So by staying informed about
Speaker 1: those emerging threats yep, gott to stay up to date,
Speaker 1: adopting those best practices, and regularly testing those defenses.
Speaker 2: Testing is crucial. Organizations can organizations can really reduce their.
Speaker 1: Risk, significantly reduce their risk.
Speaker 2: Yeah, you can't eliminate risk entirely, but you can manage it.
Speaker 1: Okay. So shifting gears a bit, let's delve a little
Speaker 1: deeper into and kobolts the world of cobalt strike.
Speaker 2: Let's do it.
Speaker 1: You mentioned earlier how versatile it is it is, especially
Speaker 1: in those later stages.
Speaker 2: It's a post exploitation powerhouse.
Speaker 1: Of a Red Team engagement. So it's fascinating.
Speaker 2: So it's fascinating about Cobalt Strike. Is it really enables
Speaker 2: Red teamers to act like those stealthy advanced attackers, you know,
Speaker 2: those apts, those nation state actors.
Speaker 1: Oh, we hear so much about it.
Speaker 2: Yeah, it's designed to mimic their tactics and help organizations
Speaker 2: understand how those threats actually operate in the real world.
Speaker 1: That makes sense. Yeah, so can you walk me through
Speaker 1: sure some of the ways.
Speaker 2: So one of the key aspects of cobolt strike is
Speaker 2: its beaconing behavioral beconing. So instead of constantly communicating with
Speaker 2: the C two server, beacons only check in periodically. So
Speaker 2: it's like it's like a spy sending coded messages, coded
Speaker 2: messages at irregular intervals. Okay, So that low and slow approach,
Speaker 2: right helps Cobalt Strike blend in with all the other
Speaker 2: network activity.
Speaker 1: Makes it harder to detect, much harder to detect. And
Speaker 1: what about those post exploitation capabilities. Oh, yeah, that we
Speaker 1: talked about earlier.
Speaker 2: Cobalt Strike excels in that area as well.
Speaker 1: Okay, it gives you.
Speaker 2: A wide array of tools for lateral movement, privileged escalation,
Speaker 2: credential theft, data expiltration.
Speaker 1: You name it.
Speaker 2: It's like it's like a Swiss army knife, a Swiss
Speaker 2: army knife for post exploitation.
Speaker 1: Or post exploitation activities. Yeah, it sounds incredibly powerful.
Speaker 2: It is. It's very powerful stuff.
Speaker 1: I remember reading about mimicats, which can extract passwords from memory.
Speaker 2: Mimicats is a favorite among attackers.
Speaker 1: Is that something that Cobalt Strike utilizes.
Speaker 2: Oh yeah, Cobalt Strike integrates with mimicats seamlessly. Red teamers
Speaker 2: can use mimic cats okay, to gather credentials a move
Speaker 2: laterally within a network. Wow, just like real attackers would.
Speaker 1: It's fascinating, but also a little scary.
Speaker 2: It is a little bit scary.
Speaker 1: Think about how effect if these tools can be in
Speaker 1: the wrong hands.
Speaker 2: These tools can be.
Speaker 1: Very dangerous in the wrong hands.
Speaker 2: That's why responsible red teaming is so important. It's about
Speaker 2: using these powerful tools ethically responsibly to help organizations improve
Speaker 2: their security.
Speaker 1: Speaking of responsible red teaming, yeah, I'm curious about the
Speaker 1: ethical consideration, absolutely so.
Speaker 2: Ethical red teaming requires transparency, a shared understanding between the
Speaker 2: red team and the organization that's being assessed. So it's
Speaker 2: like a a partnership, partnership where both sides.
Speaker 1: Are both sides are working together, working.
Speaker 2: Together to achieve that common goal of improving security.
Speaker 1: Improving security exactly, clear communication, well defined scope, a strong
Speaker 1: focus on ethical considerations. Okay, these are all essential for
Speaker 1: those for successful.
Speaker 2: Successful red team engagement. Red team engagements, you got it now,
Speaker 2: Before we move on, I want to circle back, okay
Speaker 2: to data X filtrate right, and.
Speaker 1: Discuss some techniques earlier, But I'm curious to learn more
Speaker 1: about how red teams choose.
Speaker 2: So choosing the right exfiltration method depends on a lot
Speaker 2: of different factors. You know, how much data are you
Speaker 2: trying to get out, how sensitive is that data, what's
Speaker 2: the network environment?
Speaker 1: Like?
Speaker 2: What level of detection are you trying to avoid? So
Speaker 2: it's really it's a strategic decision.
Speaker 1: A strategic decision based on.
Speaker 2: Based on the specific goals and constraints of that engagement,
Speaker 2: the engagement exactly. So for example, if they need to exfiltrate,
Speaker 2: if you need.
Speaker 1: To get a lot of data.
Speaker 2: Out, a large amount of data quickly, Yeah, and you
Speaker 2: need to do it quickly, I might use a method like.
Speaker 1: You might use something like FTP.
Speaker 2: PAYP, but if stealth is paramount.
Speaker 1: But if you need to be really sneaky, then you
Speaker 1: might choose something more covert, like DNS tunneling or staganography.
Speaker 2: So it's really is a balancing act, a balancing app
Speaker 2: between speed, between speed stell and how much data you
Speaker 2: need to extract and a skilled Red team, a skilled
Speaker 2: Red team will carefully weigh all these factors to choose
Speaker 2: the most effective and discrete exiltration method. Refiltration method. You
Speaker 2: got it?
Speaker 1: Well, this has been It has been a whirlwind.
Speaker 2: Tour, a whirlwind tour of.
Speaker 1: Red Team tactics and technique.
Speaker 2: Tactics and techniques. Yeah, it's amazing.
Speaker 1: We've covered a lot, how much we've covered from initial accents.
Speaker 2: Persistence to persistence, mann and control, man and control, data exfiltration,
Speaker 2: data exciltration. We've hit all the major points, but I.
Speaker 1: Feel like we've only just scratched the surface.
Speaker 2: We've just scratched the surface of this.
Speaker 1: There's so much more to learn.
Speaker 2: Fascinating field.
Speaker 1: It's a fascinating field for sure.
Speaker 2: So as we wrap up this deep dive, what's the one.
Speaker 1: The one key takeaway? Key takeaway?
Speaker 2: You want our listener to walk away.
Speaker 1: With our listener to walk away with Remember that site.
Speaker 2: Our security is an ongoing process. Okay, there's no finish line, right,
Speaker 2: It's about continuously learning, adapting, and strengthening those defenses.
Speaker 1: So for our listener, yeah, if you were taffed with,
Speaker 1: if you were in charge of.
Speaker 2: Defending your organization, defending your organizations from these types of attacks,
Speaker 2: from these Red Team attacks.
Speaker 1: What would be priority after learning about based on what
Speaker 1: you've learned today, all these Red Team tactics.
Speaker 2: That's a great question to ponder as we conclude our
Speaker 2: deep dive.
Speaker 1: Yeah, that's something you can think about. All right, let's uh,
Speaker 1: let's jump back into those persistence techniques. Okay, we were
Speaker 1: talking about manipulating scheduled tasks right right. Remember those are
Speaker 1: tasks that are set to run automatically and attackers can
Speaker 1: kind of hijack them to launch their malicious code.
Speaker 2: So they're building in and blending in yeah, with.
Speaker 1: Those normal system process.
Speaker 2: With normal system activity to avoid detection.
Speaker 1: Yeah, So it's all about being stealthy.
Speaker 2: It is. It's all about being stealthy.
Speaker 1: And we also talked about registry keys.
Speaker 2: Oh yeah, register keys are a gold mine.
Speaker 1: Another area that's ripe for exploitation. Absolutely, the registry is
Speaker 1: like the central nervous system of Windows. Attackers can modify
Speaker 1: those keys that determine what programs run on startup or
Speaker 1: during specific.
Speaker 2: Events, so they could ensure they could that their malicious
Speaker 2: code runs.
Speaker 1: They could make sure that it runs every time the computer.
Speaker 2: Boots up, every time the computer starts up. You got it,
Speaker 2: And I imagine, oh yeah. They use all sorts of
Speaker 2: use occuscation techniques.
Speaker 1: Obfuscation techniques, anti forensic technique to.
Speaker 2: Make those modifications harder to spot, to.
Speaker 1: Make it as difficult as possible for the blue team
Speaker 1: to find them.
Speaker 2: It's like trying to find a needle.
Speaker 1: It is. It's a very apt analogy in a haystack. Yeah,
Speaker 1: and then there are rogue services.
Speaker 2: Rogue services, right.
Speaker 1: Are those basically fake services.
Speaker 2: Disguised disguis does legitimate system processes himan ones. Attackers can
Speaker 2: create services that run in the background and execute their code,
Speaker 2: and they'll often use names that mimic legitimate services right
Speaker 2: to avoid suspicion, To avoid raising suspicion. If you see
Speaker 2: a service running right, if it looks like a like.
Speaker 1: A normal system, you're not going to think twice or
Speaker 1: think twice about it. So this is getting into deep
Speaker 1: it's deep technical, deep technical territory. Yeah, and it sounds
Speaker 1: incredibly difficult. It's not easy to root out these back doors.
Speaker 2: It requires specialized knowledge and tools. And that's why, and
Speaker 2: that's one of the big reasons why red teaming is
Speaker 2: so valuable.
Speaker 1: Red teaming is so valuable.
Speaker 2: It gives organizations.
Speaker 1: It helps organizations understand.
Speaker 2: That real world exposure, the sophisticated tactics that they need
Speaker 2: to develop those.
Speaker 1: Countermeasures countermeasures against them.
Speaker 2: Yeah.
Speaker 1: So it's like this never ending is it's a.
Speaker 2: Cat and mouse give of cat mouse. The cybersecurity landscape
Speaker 2: is cond instantly.
Speaker 1: Evolving between attackers and defenders.
Speaker 2: Attackers are always coming up with new methods, right, and
Speaker 2: defenders have to adapt and stay one step ahead.
Speaker 1: So given all this, given all this, yeah, what can
Speaker 1: organizations actually do?
Speaker 2: That's the million dollar questions.
Speaker 1: To protect themselves? Yeah, from these advanced threats.
Speaker 2: Organizations can't rely on those traditional security measures anymore. Okay,
Speaker 2: you know your firewalls and antivirus software. Those are important, right,
Speaker 2: but they're not enough. They're not enough these days, not
Speaker 2: in today's threat landscape.
Speaker 1: Okay, so what else can they do?
Speaker 2: They need a multi layered approach. Okay, that combines prevention
Speaker 2: with proactive threat hunting and incident response capabilities.
Speaker 1: So it's not just about it's not just about building
Speaker 1: walls building walls.
Speaker 2: It's about having eyes on the inside rights actively looking
Speaker 2: for those subtle signs of an attack.
Speaker 1: Yeah, you've got to operate under the assumption. You have
Speaker 1: to that breaches are inevitable, breaches are going to happen, right,
Speaker 1: and focus on minimizing the impactly those breaches.
Speaker 2: You got to be able to attect them quickly, respond effectively,
Speaker 2: contain the damage, and recover efficiently. And that's where and
Speaker 2: that's where red teaming comes in.
Speaker 1: Red teaming really shines. Yeah, right, by simulating those real
Speaker 1: world attacks.
Speaker 2: By simulating those real world attacks, organizations can organizations can really.
Speaker 1: Thoroughly test their defense.
Speaker 2: Thoroughly test their defenses, pinpoint those weakness and point those weaknesses,
Speaker 2: and so it's can improve that overall security posture.
Speaker 1: Improve their overall security posture. Yeah, it's like a fire drill.
Speaker 2: It is. It's like a fire.
Speaker 1: Drill, but for cybersecurity.
Speaker 2: But for your cybersecurity.
Speaker 1: And this deep dive has it has been given me
Speaker 1: a deep.
Speaker 2: Dive, such a deeper appreciation good.
Speaker 1: I'm glad to hear that.
Speaker 2: For the complexity of cybersecurity.
Speaker 1: It is a complex field, there's no doubt about it
Speaker 1: and the challenges.
Speaker 2: It is a cross organization's.
Speaker 1: Face evolving field as well.
Speaker 2: But I have to admit it is it can be overwhelming,
Speaker 2: a little overwhelming to think about.
Speaker 1: It could be a lot to take.
Speaker 2: In the sheer scale and sophistication.
Speaker 1: The threat landscape is constantly evolving. New threats are emerging
Speaker 1: all the.
Speaker 2: Time of these attacks.
Speaker 1: Yeah, so it is a lot to keep up with.
Speaker 1: But the key takeaway here is that security is an
Speaker 1: ongoing journey. Yeah, it's not a destination. You never really arrive.
Speaker 2: It's not like you don't just set it and forget it,
Speaker 2: check a box and you're done.
Speaker 1: You can't do that with security. It's about continuous.
Speaker 2: Improvement, continuous improvement and resilience.
Speaker 1: And resilience being able to bounce back when those attacks
Speaker 1: inevitably happen, right because they will, because they will. So
Speaker 1: by staying informed about those emerging.
Speaker 2: Threats, you got to stay up today.
Speaker 1: Adopting those best practices, regularly testing those defenses.
Speaker 2: Testing is crucial. Organizations can organizations can really reduce their.
Speaker 1: Risks, really reduce their risks.
Speaker 2: You can't eliminate it entirely, but you can manage it.
Speaker 1: Well.
Speaker 2: This has been It has been quite a journey, an
Speaker 2: amazing journey, a.
Speaker 1: Whirlwind tour of Red Team tactics and techniques.
Speaker 2: Right, we've gone from those basic concepts.
Speaker 1: We've hit all the major points to those.
Speaker 2: Really sneaky persistence techniques. We dug deep and everything in
Speaker 2: between we did. So we've really.
Speaker 1: Hopefully this deep dive has sparked your curiosity.
Speaker 2: Explored the depths about cybersecurity.
Speaker 1: Of hands on Red Team tac days and.
Speaker 2: A constant battle between attackers.
Speaker 1: And a wealth of knowledge about Red teaming.
Speaker 2: Yeah, there's always more to learn.
Speaker 1: It certainly has for me. So as we wrap up
Speaker 1: this final episode, all right, this deep dive.
Speaker 2: The final episode of this deep dive.
Speaker 1: What is the one key takeaway?
Speaker 2: One key takeaway you want our listener, what do you
Speaker 2: want them to to walk away with to remember remember
Speaker 2: that cybersecurity is an ongoing process. Okay, there is no
Speaker 2: finish line.
Speaker 1: You never really arrived, right, It's about continuous learning.
Speaker 2: It's about continually learning, adapting and strengthening those defenses. And
Speaker 2: for our listeners, there are our listeners out there.
Speaker 1: If you were tasked with defending your organization, if.
Speaker 2: You're in charge of defending your organization from these types
Speaker 2: of attacks, from these Red Team attacks.
Speaker 1: What would you prioritize?
Speaker 2: What would you prioritize.
Speaker 1: After learning about all these Red Team tactics?
Speaker 2: Yeah, what would you do differently? What would you focus on?
Speaker 1: That is the question.
Speaker 2: That's the question to ponder, the ponder as we conclude
Speaker 2: our deep dive.
Speaker 1: As we conclude this deep dive into the world of
Speaker 1: Red teaming, exactly this has been. It has been truly insightful.
Speaker 2: Truly insightful exploration.
Speaker 1: Exploration into the world of.
Speaker 2: Red teaming, into the world of Red teaming, that's for sure.
Speaker 1: Thank you for joining us, Thanks for being here on
Speaker 1: this deep dive.
Speaker 2: Yeah, it's been fun.
Speaker 1: And until next time. Until next time, stay curious, stay
Speaker 1: in form.
Speaker 2: Stay curious, stay in form, and stay secure. And stay secure.