Operational Purple Teaming for Defenders

Course Description

This hands-on training connects red and blue in a series of live attack-defense exercises and demos. The group of participants will work as one team against a simulated threat actor, APT 0x00, with full disclosure of the attacker’s progress and technical insights on the executed  techniques. The adversary’s capability and stealth will steadily improve over the course of the training.

Participants are dropped in a simulated corporate network environment, which they must defend from a threat actor over the course of the training. The attacker is simulated by a red team specialist, who will share valuable insights about commonly used threat actor techniques used in the attack. Together with a blue team instructor, you will learn how to hunt for these techniques, build detections that can help defend your organization and eradicate the attacker. Examples of covered techniques we will learn how to hunt for:

• Webshells.
• Process Injection.
• Credential dumping from LSASS.
• Lateral Movement via Service Execution.
• In-memory C# assembly execution.
• Persistence.
• Kerberoasting.
• AD Enumeration via BloodHound.
• Resource-Based Constrained Delegation Attacks.
• Headless RDP.

The first day focuses on threat hunting and detection engineering. APT 0x00 kicks off a campaign to breach the corporate Active Directory environment. The attacker relies on a mix of Metasploit (https://www.metasploit.com) and Sliver Command and Control https://github.com/BishopFox/sliver) to infiltrate the environment. Participants will learn how to collect telemetry on specific techniques and build detections.

The red team instructor will provide insights on the red team side during regular purple team meetings. This input enables the detection engineering process, where new detection rules are created in collaboration with the training participants. The blue team will use defensive security tools such as Elastic stack with security (EDR) (https://www.elastic.co), with additional log sources from Sysmon (https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon) and Velociraptor (https://github.com/Velocidex/velociraptor) for incident response.

Day two adds a live incident response component to the training. APT 0x00 becomes more advanced and initiates a new campaign against the lab environment overnight. Students join the blue team side during the aftermath of the attack. Students retrace the attacker’s steps and learn to eradicate the attacker from the environment.

On the final day, the threat actor reaches its peak performance with maximum stealth. The threat actor added a new Command and Control framework to the mix (Havoc) and focused on more complex implementations of some of the previously identified attacker techniques. The attacker has a solid presence in the network. Access to the same defensive tooling (Elastic incl. Security, Velociraptor) will be granted to the students to identify and stop the attacks as the threat actor progresses through the environment. The defenders will have to use their knowledge from the previous two days to detect the attacker and eradicate his footholds. Can the adversary be stopped before it reaches its goals?

Throughout all days, the red team specialist discloses technical details about the executed techniques. The attack can also be followed via Vectr (https://docs.vectr.io) to make it easier to hunt for certain activities. All days culminate in a lessons-learned moment. Every day, there are B33R objectives where participants can earn some top-quality Belgian beers.

During the evenings, participants have the option to continue playing around in the lab.