Intelligence Driven Testing with Atomic Red Team

Time is short, resources are spread thin, and you have the responsibility to ensure your security investments deliver on their promises. Intelligence-driven testing shows how you can prove your controls work against real-world adversary techniques by consuming information and about adversaries and adapting tests for use from the freely-available Atomic Red Team project.

Transcript

1. Intelligence-Driven Testing With Atomic Red Team
2. Detection & analysis at Red Canary Recovering sysadmin Loves to teach, hates to grade homework Tony Lambert Evil Finder Red Canary @ForensicITGuy $env:UserName
3. IDEA Anyone can test their own security controls.
4. ▪ Where are you in control testing? ▪ Problems in testing methodology ▪ A better way to test ▪ Atomic Red Team Overview
5. ▪ Adversary Simulation ▪ Red Teams ▪ Penetration Testing ▪ Blue Team Maintaining Controls Places in Testing
6. ▪ Not everyone can afford simulations ▪ Some do compliance only ▪ Testing without money to test ▪ Do you improve between tests? Where Are You?
7. LOLBINS & GTFOBINS Frustrating Tests Malware Zips Random Malicious Binary
8. Behavioral controls need context for testing!
9. ▪ Baseline current controls ◦ Simpler is better ▪ Construct a chain of adversary behavior ◦ Start with phishing ▪ Inspect your controls ▪ Improve coverage and configurations A Better Way
10. Baseline Heatmap MITRE ATT&CK Navigator Excel Spreadsheet Start Small
11. Make it real Start simple with phishing Chain of Behavior HTA Email Attachment (T1170) PowerShell to Download Something (T1086) Scheduled Task for Persistence (T1053)
12. What worked or didn’t? Inspect Controls ▪ HTA Attachment ◦ Email, AV, Endpoint Monitoring ▪ PowerShell Download ◦ Endpoint Logging ▪ Scheduled Task ◦ Hunts for persistence ◦ Windows Event Logs
13. ▪ Coverage ◦ Artifacts or hosts ▪ Configuration ◦ Did you think you’d catch it? ◦ Opportunity to fix things Improve
14. Atomic Red Team
15. ▪ Articles with adversary techniques ◦ Cybereason, Unit 42, ESET ▪ Visit MITRE ATT&CK ▪ Pivot to Atomic Red Team Start With Intelligence
16. OPTIONAL TAG
17. ▪ Execution Framework ◦ There’s a wizard for that! ▪ Chain Reactions ◦ Simulate a specific attack The Fancy Stuff
18. Other Cool Projects Metta RTA Caldera “Security Instrumentation & Validation”
19. Test and Improve with Atomic Red Team https:// atomicredteam.io https://www.redcanary.com/blog