Tradecraft Concerns

This section outlines various tradecraft considerations that should be made while operating in a live environment.

Artifact Creation and Uploading

  • Do created artifact names and configurations blend in with the target environment (service names, descriptions, file names, etc.)?
  • Is the payload packed/obfuscated?
  • Was the payload created matching target system architecture, C2 type, and payload type?
  • Is the artifact uploaded to a non-descript location?

Persistence Actions

  • Do I have the correct ‘permission’ to execute this persistence method (administrator versus user persistence methods)?
  • Once the persistence executes, is the payload process suspicious?
  • After persistence executes, is the implant call back interval too fast or too slow?
  • Should I log this persistence?

Remote Execution

  • Is the remote machine in scope?
  • Is it normal to see this machine talk to the remote system?
  • Do I hold the correct permission to remotely execute?
  • Once the persistence executes, is the payload process suspicious?
  • Should I remove the artifact after gaining persistence?
  • Should I log this remote execution?

Infrastructure Setup

  • Purchase a VPS for C2 redirection.
  • SSL certs purchased and configured successfully on redirector.
  • Age redirector as long as possible.
  • Redirector content uploaded and ‘categorized’.
  • ProxyPass or similar traffic pass thru technique configured to push implant traffic to team server.
  • Iptables configured to block unwanted traffic from redirector and Red Team attack machine.
  • Passwords changed on redirector, and any other Red Team owned machines.
  • SSH keys configured and password protected.

Token Manipulation

  • Is the correct privilege held to run this token manipulation method?
  • Is the ‘domain’ section of the technique set correctly?
  • Is the hash or password still valid (it could be expired)?
  • Does the user belong to any concerning groups (HBSS admin, firewall admin, etc.)?
  • Is the user account enabled?
  • Has the user logged in recently?
  • Has the user authenticated from this machine before?
  • Is an active user credential required for this task?

End of Day Operations

  • Revert all credentials in implant sessions (rev2self, drop_token, etc.).
  • Exit any implants no longer needed for the operation.
  • Unlink from all SMB implants (beginning with outer chain and working back).
  • Sleep down all HTTPS implants to a slower call back interval (such as 4 hours).
  • Update any organizational logs with end of day information.