CHALLENGE INFORMATION
 | Platform: TryHackMe Path: Red Teaming Module: Red Team Fundamentals Room: Red Team Threat Intel |
DESCRIPTION:
Apply threat intelligence to red team engagements and adversary emulation.
Introduction
Threat Intelligence (TI) and Cyber Threat Intelligence (CTI) refer to information gathered about an adversary’s tactics, techniques, and procedures (TTPs). This intelligence is primarily used by defenders to enhance their ability to detect and respond to threats.
From an offensive standpoint, such intelligence can be utilized by red cells (teams simulating attacks) to assist in creating realistic adversarial simulations, aiding in the preparation and understanding of potential attacker behaviors.
Question 1: Read the above and continue to the next task.
No answer needed
What Is Threat Intelligence
CTI entails gathering information on Indicators of Compromise (IOCs) and TTPs from adversaries.
These IOCs and TTPs are often sourced from Information Sharing Analysis Centers (ISACs), which can also be considered platforms for threat intelligence. CTI provides chronological data that helps defenders analyze potential threats.
Traditionally, blue teams use CTI to detect adversarial behavior by leveraging IOCs. Conversely, red teams utilize this intelligence to evaluate how effectively defenders can counter potential attacks, particularly focusing on Advanced Persistent Threats (APTs) and their documented TTPs. This approach ensures a comprehensive understanding of both the threat landscape and defensive capabilities.
Question 1: Read the above and continue to the next task.
No answer needed
Applying Threat Intel to the Red Team
The red team utilizes CTI to gather and analyze adversaries’ behaviors, employing tools such as MITRE ATT&CK, TIBER-EU, and OST Map.
These platforms categorize TTPs based on factors like threat groups, kill chain phases, and objectives.
This intelligence is instrumental in planning attacks, allowing the red team to develop tooling and mimic adversary behavior. The focus lies in understanding and replicating specific stages of an attack cycle, guided by categorized TTPs.
Question 1: Read the above and continue to the next task.
No answer needed
The TIBER-EU Framework
The TIBER-EU (Threat Intelligence-based Ethical Red Teaming) framework developed by the European Central Bank emphasizes the integration of threat intelligence into ethical red team practices.
Its unique aspect is the Testing phase, which involves using threat intelligence to enhance the red team’s ability to simulate attacks and evaluate an organization’s resilience against cyber threats.
This framework serves as a best practice guide rather than providing actionable steps.
The following diagram depicts the TIBER-EU process, taken directly from the framework white paper.
Figure 1: The TIBER-EU framework process flow diagram
Question 1: Read the above and continue to the next task.
No answer needed
TTP Mapping
The process of TTP mapping involves associating an adversary’s TTPs with a standard cyber kill chain to facilitate effective red teaming. The goal is to emulate adversaries accurately during engagements.
Adversary Selection
Factors such as target industry, attack vectors, country of origin, and other criteria are considered.
Kill Chain Framework
TTPs from frameworks like MITRE ATT&CK are mapped to specific phases of the kill chain, aiding in planning and execution.
Tools and Resources
- MITRE ATT&CK: Provides TTP categorization, with tools like ATT&CK Navigator aiding in visualization.
- OST Map: Offers a visual link between threat actors and their TTPs.
- Other Platforms: Resources such as Mandiant Advantage, Ontic, and CrowdStrike Falcon supplement TTP mapping efforts.
This structured approach ensures red teams can emulate adversaries effectively, enhancing the accuracy and realism of cyber engagement exercises.
Question 1: Read the above and use MITRE ATT&CK Navigator to answer the questions below using a Carbanak layer.
No answer needed
First, we navigate to the MITRE ATT&CK website and search for our APT (Carbanak). Once we find a match, we select it.
Figure 2: Search results for the Carbanak threat actor group on MITRE ATT&CK
On the page dedicated to our APT, select ATT&CK® Navigator Layers and then select view.
Figure 3: ATT&CK Navigator layer selection interface for Carbanak
The following page highlights the mappings; all we have to do is search for our answers.
Question 2: How many Command and Control techniques are employed by Carbanak?
2
Figure 4: Carbanak command and control techniques in ATT&CK Navigator
Question 3: What signed binary did Carbanak use for defense evasion?
Rundll32
Figure 5: Carbanak defense evasion techniques showing signed binary usage
Question 4: What Initial Access technique is employed by Carbanak?
Valid Accounts
Figure 6: Carbanak initial access techniques in ATT&CK Navigator
Other Red Team Applications of CTI
CTI is used not only to gather insights about adversaries but also plays a crucial role during red teaming engagements. CTI can be applied to emulate adversaries’ behaviors in multiple ways.
C2 Traffic Manipulation
Red teams can modify Command and Control (C2) traffic to mimic that of the targeted adversary. This involves creating malleable profiles based on intelligence gathered from sources like IOCs, packet captures, or ISACs.
These profiles allow operators to manipulate aspects of C2 traffic, such as headers, URIs, server responses, and more, making the traffic indistinguishable from that of the actual adversary.
Analysis of Adversary Behavior
CTI can also be used to analyze how adversaries behave when using specific malware or tools. For example, a red team can study an adversary’s custom dropper by analyzing its network traffic, system calls, and objectives. This intelligence can then be used to develop offensive tooling that exhibits similar behaviors or incorporates vital indicators of the adversary’s tools.
By leveraging CTI during engagements, red teams can create more realistic and contextually accurate simulations, enhancing their ability to emulate adversaries effectively.
Question 1: Read the above and continue to the next task.
No answer needed
Creating a Threat Intel Driven Campaign
The process of creating a well-planned, threat-intel-driven red team campaign involves the following steps:
- Identify Framework and General Kill Chain
Start by choosing a relevant framework or kill chain model (e.g., MITRE ATT&CK) to structure your campaign.
- Determine Targeted Adversary
Identify an adversary based on specific criteria, such as industry, sector, or known behaviors.
- Identify Adversary’s TTPs and IOCs
Gather the adversary’s Tactics, Techniques, and Procedures (TTPs) as well as their Indicators of Compromise (IOCs). This can be done through open-source intelligence, threat reports, or other sources.
- Map Threat Intelligence to a Kill Chain
Use the gathered TTPs and IOCs to map out how the adversary would operate within the chosen framework or kill chain.
- Draft and Maintain Engagement Documentation
Prepare detailed documentation that outlines the campaign’s objectives, tactics, techniques, and resources needed for execution.
- Determine and Use Needed Engagement Resources
Identify and procure necessary tools, platforms, domains, and other assets required to execute the campaign effectively.
By following a structured approach, red teams can create a comprehensive and realistic simulation tailored to the targeted adversary’s behavior, enhancing their ability to conduct effective exercises.
Question 1: Once the chain is complete and you have received the flag, submit it below.
<redacted-flag>
One possible combination:
This is how it looks like when the flag is triggered:
Figure 7: Completed threat intelligence campaign with flag submission
Question 2: What web shell is APT 41 known to use?
ASPXSpy
Question 3: What LOLBAS (Living Off The Land Binaries and Scripts) tool does APT 41 use to aid in file transfers?
certutil
Question 4: What tool does APT 41 use to mine and monitor SMS traffic?
MESSAGETAP
Conclusion
When planning a red team engagement, it is essential to focus on adversary emulation and leverage threat intelligence to identify adversaries and their behaviors. Each red team will have its own methodology for collecting and analyzing threat intelligence in real-world scenarios.
It is crucial to approach the engagement from multiple perspectives – offensive, defensive, and adversarial – to ensure comprehensive planning.
Threat intelligence allows the red team to delve deeper into an adversary’s behavior by using blue team methodologies to their advantage. This enables more accurate emulation of adversaries’ tactics, techniques, and procedures, ultimately enhancing the effectiveness of the engagement.
Question 1: Read the above and continue learning!
No answer needed