Главная
Study mode:
on
1
Intro
2
Maturity level
3
Why Adversary Emulation ?
4
Our Adversary Emulator Goals
5
Agenda
6
Architecture
7
Infrastructure Builder
8
Attack Simulator
9
Playbook design
10
Playbook - Design Concept
11
Dogeza Playbook Scenario
12
Dogeza Red-Blue Team Step
13
Red Team Procedure: Step 3 Initial Acce • Use CVE-2019-9194 to exploit elFinder for www-data privilege shell . elFinder is a famous file manager for web, and many 3rd party integration
14
Red Team Procedure: Step 7
15
Escalate privilege from IIS to system • Use wehshell to trigger privilege escalation
16
12 • Red team uses several administrative tools to control Victim C
17
Red team collect top confidential information and send back to Victim B's web, then these stolen data exfiltrate via Victim A's tunnel.
18
Metasploit Integrated
19
Empire Integrated
20
Repurpose the APT malware
21
APT malware - DBGPRINT
22
DBGPRINT stager flow
23
The attack method want to detect
24
Detect from command line
25
Detect from process loaded library
26
Check PowerShell eventlog
27
04 Check called API
28
Data Sources Evolution
29
Investigation ! Not Just Detection
30
The key benefit for the Red Team
31
The key benefit for the Blue Team
Description:
Explore how adversary emulation can enhance blue team performance in this conference talk from the Hack In The Box Security Conference. Learn about the development of an adversary emulator designed to address the challenges of blue team training and automated security product testing. Discover how the emulator integrates popular red team tools, allows for quick addition of new attack scenarios, and incorporates real-world APT attacks for realistic training. Examine the architecture, infrastructure builder, and attack simulator components of the emulator. Follow along with a detailed Dogeza Playbook scenario, including red team procedures for initial access and privilege escalation. Gain insights into the integration of Metasploit, Empire, and repurposed APT malware. Understand the key benefits for both red and blue teams, and see how the emulator can be used to evaluate and train blue team members, as well as enhance security product development and participate in ATT&CK evaluations.

How Adversary Emulation Can Enhance Blue Team Performance

Hack In The Box Security Conference
Add to list
0:00 / 0:00