Masterclass: Red Team - Blue Team Operations

Course Overview

This is a deep dive course on Red Team – Blue Team Operations: The cyber kill chain 

Security is a business enabler, and it is only when it is viewed from a business perspective that we can truly make the right decisions.  Identifying, protecting and restricting data that can be monetized by adversaries is essential and should be reviewed and defined on a regular basis as only then can you identify potential gaps in your security posture. 

Every organisation should expect to be hacked at some point so it is vital that all members of your blue and red teams are up to speed on the latest hacking techniques.

The term Cyber Kill Chain defines the steps used by cyber attackers in today’s cyber based attacks and this course reviews all of those steps from both a red and blue team perspective. 

Reconnaissance is the first phase, during which the attacker gathers information on the target before the actual attack starts. The data gathering is essential skill of every red teamer. From blue teamer perspective, it is crucial to understand what kind of information is publicly available and to learn how to protect that information.

Without remote code execution vulnerability even the most sophisticated payload needs to be delivered to the victim. There are plenty of ways to achieve that so blue team needs to ensure that payloads are detected and blocked at early stage.

After successful delivery, malicious code exploits a vulnerability to execute code on victim’s system. There are many mechanisms that, if properly configured, significantly reduce attack scope.

The successful exploitation attack often results in code execution with limited privileges. Both, red teamers and blue teamers should be familiar with common techniques and misconfigurations allowing for privilege escalation.

The next after gaining admin privileges on single host is lateral movement that gives access to additional resources within the company. Before red teamer can reach Domain Controller or other critical servers, blue team can implement numerous protections against that threat

Even after attack is stopped and contained, the attacker will want to ensure persistency and possibility of returning to a compromised host.

Target Audience

Red team and blue team members, enterprise administrators, infrastructure architects, security professionals, systems engineers, network administrators, IT professionals, security consultants and other people responsible for implementing network and perimeter security.

Course Objectives

After completing this course you should be able to:

• Analyze emerging trends in attacks
• Identify areas of vulnerability within your organization
• Prepare a risk assessment for your organization
• Report and recommend countermeasures
• Develop a threat management plan for your organization
• Organize Red Team – Blue Team exercises

Course Content

Module 1: Identifying Areas of Vulnerability

• Defining the assets which your company needs to protect
• Defining the other sensitive information that needs to be protected

Module 2: Modern Attack Techniques

• OS platform threats and attacks
• Web based threats and attacks
• E-mail threats and attacks
• Physical access threats and attacks
• Social threats and attacks
• Wireless threats and attacks

Module 3: Reconnaissance

• Open Source Intelligence (OSINT)
• Google hacking
• Social Media presence
• DNS 5. Shodan
• Physical reconnaissance
• Port scanning
• Service discovery
• SIEM
• Intrusion Prevention Systems 

Module 4: Weaponization

•  Generating malicious payload
• Hiding malicious content in Office Suite documents
• Reverse shells
• Metasploit
• Empire
• AV evasion techniques

Module 5: Delivery

• Building phishing campaign
• Planting malicious device
• Attacks on 3rd parties
• Enabling phishing protection
• O365 / Safe links
• Smart Screen
• Secure proxy
• Sinkholing
• APT campaigns

Module 6: Exploitation and Installation

• Types of vulnerabilities
• Establishing foothold
• Stage-less and staged payloads / C&C
• Anti-Virus
• Firewall
• Application Whitelisting
• WDAC
• Living Off the Land Binaries
• Exploit Guard
• AMSI

Module 7: Privilege escalation

• Privileged accounts
• System services security
• Common misconfigurations
• Security tokens
• Just Enough Administration
• Patch maintenance

Module 8: Lateral movement

• Credential harvesting
• Mimikatz
• Network reconnaissance
• Building network map
• Responder
• Pass-the-hash
• Pass-the-ticket
• Credential Guard
• LAPS
• GPO policies
• Windows ATA
• Defender ATP

Module 9: Persistency

• Sleeping agents
• Piggybacking on network packets
• Rootkits
• Sysinternals
• Searching for rogue servers
• Looking for network anomalies

Course Prerequisites

Attendees should meet the following prerequisites:

Good hands-on experience in administering Windows infrastructure. At least 8 years in the field is recommended.

Test Certification

Recommended preparation for exams:

• There are no exams aligned to this course