Fantastic Red-Team Attacks and How to Find Them
Explore prevalent gaps in organizational defenses uncovered through Atomic Red Team testing in this 40-minute Black Hat conference talk. Dive into adversary behaviors spanning multiple events in an event stream, often separated by nuisance events. Learn about the Atomic Red Team framework, example YAML attacks, and frequently missed MITRE ATT&CK techniques leveraging native OS tools. Discover how to prepare for actual incidents using Event Query Language, event sequences, and data pipes for effective threat hunting. Examine a Windows endpoint with Sysmon installed, featuring mixed true and false positives. Investigate the DBGSRV tool, which provides functionality equivalent to reverse TCP connections, process hollowing, and whitelist evasion. Gain insights into identifying true positives, building environmental baselines, and understanding the pitfalls of behavioral detection. Conclude with practical steps to implement DIY Red & Blue team exercises and focus on commonly seen behaviors to improve overall security posture. Read more