Intelligence Driven Testing with Atomic Red Team

Time is short, resources are spread thin, and you have the responsibility to ensure your security investments deliver on their promises. Intelligence-driven testing shows how you can prove your controls work against real-world adversary techniques by consuming information and about adversaries and adapting tests for use from the freely-available Atomic Red Team project.

Transcript

1. Intelligence-Driven
   Testing
   With Atomic Red Team
   

   View Slide

2. Detection & analysis at Red Canary
   Recovering sysadmin
   Loves to teach, hates to grade homework
   Tony Lambert
   Evil Finder
   Red Canary
   @ForensicITGuy
   $env:UserName
   

   View Slide

3. IDEA
   Anyone can test their own
   security controls.
   

   View Slide

4. ▪ Where are you in control testing?
   ▪ Problems in testing methodology
   ▪ A better way to test
   ▪ Atomic Red Team
   Overview
   

   View Slide

5. ▪ Adversary Simulation
   ▪ Red Teams
   ▪ Penetration Testing
   ▪ Blue Team Maintaining Controls
   Places in Testing
   

   View Slide

6. ▪ Not everyone can afford simulations
   ▪ Some do compliance only
   ▪ Testing without money to test
   ▪ Do you improve between tests?
   Where Are You?
   

   View Slide

7. LOLBINS & GTFOBINS
   Frustrating Tests
   Malware Zips Random Malicious Binary
   

   View Slide

8. Behavioral controls need
   context for testing!
   

   View Slide

9. ▪ Baseline current controls
   ○ Simpler is better
   ▪ Construct a chain of adversary behavior
   ○ Start with phishing
   ▪ Inspect your controls
   ▪ Improve coverage and configurations
   A Better Way
   

   View Slide

10. Baseline Heatmap
    MITRE ATT&CK Navigator
    Excel Spreadsheet
    Start Small
    

    View Slide

11. Make it real
    Start simple with phishing
    Chain of Behavior
    HTA Email Attachment (T1170)
    PowerShell to Download Something (T1086)
    Scheduled Task for Persistence (T1053)
    

    View Slide

12. What worked or didn’t?
    Inspect Controls
    ▪ HTA Attachment
    ○ Email, AV, Endpoint Monitoring
    ▪ PowerShell Download
    ○ Endpoint Logging
    ▪ Scheduled Task
    ○ Hunts for persistence
    ○ Windows Event Logs
    

    View Slide

13. ▪ Coverage
    ○ Artifacts or hosts
    ▪ Configuration
    ○ Did you think you’d catch it?
    ○ Opportunity to fix things
    Improve
    

    View Slide

14. Atomic Red
    Team
    

    View Slide

15. ▪ Articles with adversary techniques
    ○ Cybereason, Unit 42, ESET
    ▪ Visit MITRE ATT&CK
    ▪ Pivot to Atomic Red Team
    Start With Intelligence
    

    View Slide

16. OPTIONAL TAG
    

    View Slide

17. ▪ Execution Framework
    ○ There’s a wizard for that!
    ▪ Chain Reactions
    ○ Simulate a specific attack
    The Fancy Stuff
    

    View Slide

18. Other Cool Projects
    Metta RTA Caldera
    “Security Instrumentation & Validation”
    

    View Slide

19. Test and Improve with
    Atomic Red Team
    https:// atomicredteam.io
    https://www.redcanary.com/blog
    

    View Slide