Course Overview

This hands-on training connects red and blue in a series of live attack-defense exercises and demos. The group of participants will work as one team against a simulated threat actor, APT 0x00, with full disclosure of the attacker’s progress and technical insights on the executed techniques. The adversary’s capability and stealth will steadily improve

over the course of the training.

The attacker is simulated by a red team specialist, who will share valuable insights about commonly used threat actor techniques used in the attack. Together with a blue team instructor, you will learn how to hunt for these techniques, build detections that can help defend your organization and eradicate the attacker. Examples of covered techniques we

will learn how to hunt for:

• Webshells.

• Process Injection.

• Credential dumping from LSASS.

• Lateral Movement via Service Execution.

• In-memory C# assembly execution.

• Persistence.

• Kerberoasting.

• AD Enumeration via BloodHound.

• Resource-Based Constrained Delegation Attacks.

• LAPS abuse.

• Headless RDP.

  
  

The first day focuses on threat hunting and detection engineering. APT 0x00 kicks off a campaign to breach the corporate Active Directory environment. The attacker relies on a mix of Metasploit (https://www.metasploit.com) and Sliver Command and Control (https://github.com/BishopFox/sliver) to infiltrate the environment. Participants will learn how tocollect telemetry on specific techniques and build detections.

The red team instructor will provide insights on the red team side during regular purple team meetings. This input enables the detection engineering process, where new detection rules are created in collaboration with the training participants. The blue team will use defensive security tools such as Elastic stack with security (EDR) (https://www.elastic.co), with additional log sources from Sysmon (https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon).

Day two adds a live incident response component to the training. APT 0x00 becomes more advanced and initiates a new campaign against the lab environment overnight. Students join the blue team side during the aftermath of the attack. Students retrace the attacker’s steps using Velociraptor (https://github.com/Velocidex/velociraptor) for incident response.

On the final day, the threat actor reaches its peak performance with maximum stealth. The threat actor added a new Command and Control framework to the mix (Havoc) and focused on more complex implementations of some of the previously identified attacker techniques. The attacker has a solid presence in the network. Access to the same defensive

tooling (Elastic incl. Security, Velociraptor) will be granted to the students to identify and stop the attacks as the threat actor progresses through the environment. The defenders will have to use their knowledge from the previous two days to detect the attacker and eradicate his footholds. Can the adversary be stopped before it reaches its goals?

Throughout all days, the red team specialist discloses technical details about the executed techniques. The attack can also be followed via Vectr (https://docs.vectr.io) to make it easier to hunt for certain activities. All days culminate in a lessons-learned moment. Every day, there are B33R objectives where participants can earn some top-quality Belgian beers.

During the evenings, participants have the option to continue playing around in the lab.

Agenda

Students will be guided by a Red Team and Blue Team instructor during the exercise. This training does NOT cover the latest attacker techniques but aims to provide a mix of stealthy and less-stealthy attack techniques and propose detection strategies to augment your organization’s defensive capability.

Day 1

The red team instructor simulates APT 0x00 and provides technical insights in the attacker techniques. The blue team  instructor provides insight in detection. The goal of this day is to learn how to detect specific attack techniques. Topics  covered include: 

• Introduction to the lab environment. 

• Machines. 

  • Networks. 

  • Elastic (SIEM) with security detection rules and additional log sources: 

    • Sysmon. 

    • PowerShell logs. 

    • Application logs. 

  • Elastic Agent with Security in detection mode (Free EDR). 

  • Velociraptor for artifact collection and live incident response. 

• Testing VPN connection. 

• Preparation and introduction to the exercise. 

• Introduction to red, blue & purple teaming. 

• Purple Teaming: Attacker techniques, threat hunting & detection engineering: 

  • Establishing a foothold in the lab via exploitation. 

  • BloodHound and active directory attacks. 

  • Process Injection. 

  • In-memory C# assembly execution. 

  • Credential dumping.

  • Persistence. 

  • Lateral movement via service execution. 

  • dcsync 

  • …

Day 2

The red team instructor simulates a more advanced version of APT 0x00 and provides technical insights in the attacker  techniques. During the day, students are guided by the blue team instructor to reconstruct the timeline of two pre executed attacks. The goal of this day is to identify and eradicate the attacker based on knowledge from day 1. 

• Preparation and introduction to the exercise. 

• Anomaly detection in the lab environment. 

• Investigating alerts and IoCs to discover underlying techniques. 

• Purple Teaming: More advanced attacker techniques, threat hunting & detection engineering.

  • Establishing a foothold in the lab via exploitation of a different vulnerability.

  • Resource-Based Constrained Delegation attacks. 

  • Phishing. 

  • Kerberoasting. 

  • Lateral Movement via WinRM 

  • LAPS abuse. 

  • Headless RDP 

  • … 

• Live response to the ongoing attack. 

• Eradication of the threat actor in the environment. 

• Lessons learned. 

Day 3

The red team instructor simulates the stealthiest version of APT 0x00 and provides technical insights in the attacker  techniques. During the day, students are guided by the blue team instructor to track and stop the live ongoing threat  actor campaign. The goal of this day is to stop the threat actor before it reaches its goals. 

• Preparation and introduction to the exercise. 

• Identification and elimination of attacker footholds. 

• Identifying anomalies in the lab environment. 

• Investigating alerts and IoCs to discover underlying techniques. 

• Purple Teaming: More advanced attacker techniques, threat hunting & detection engineering.

• Live response to the ongoing attack. 

• Eradication of the threat actor in the environment. 

• Lessons learned. 

Key Takeaways

We hope that after this training you will be able to:

• Better understand and identify attacker techniques.

• Build custom threat hunt queries and detection rules to identify attackers hiding in the shadows.

• Implement decoy objects to proactively identify certain common attacks.

• Identify how red and blue can work together to identify and close the gaps in your defense, improving detection and response capability.