StealthOps: Red Team Tradecraft Targeting Enterprise Security Controls

REGISTRATION CLOSED

DATE: 15-16 May 2023

Candidates will get FULL 30 Days Lab Access after training which comes with technical support.

Most enterprises have improper placement and mis-configured security controls in their infrastructure. It is well known that attackers have evaded, circumvented and even abused these controls for their intention to gain access to critical assets.

Apex Threat Actors having advanced capabilities like leveraging in-memory implants, writing custom codes to evade AVs & EDR, moving laterally with custom made Tools, evading host and network level security solutions with covertness etc are constantly consolidating their attack techniques (and Tactics)
against Defensive Teams. To strengthen the enterprise grade security, the training is designed for penetration testers, system administrators and Blue Team members to understand different tactics, techniques and attacks used by adversaries.

Students will gain enough knowledge of the enterprise-grade security controls and how they can be stealthily evaded in Host-level, Network-level and Active Directory network. Class will go through the threat actors TTPs, writing custom scripts in C# & abusing Windows API for evading host & network controls to
abusing restrictions in Active Directory Environment of Windows & Linux platforms in order to better refine detection in an enterprise.

Agenda

Module 1 (Red Team Resource Development)

• Red Team Infrastructure Setup

– Mythic C2
– Domain Setup
– Redirector Setup

– Cloud Premise
– On-Premises

– Payload Server
– Operational Security (OPSEC)

• Initial Access Defenses
• APT29 Initial Access Exercise
• CSharp Beginner [4 Hands-on Labs]

Module 2 (Tradecraft Development for Offensive Operations)

• Offensive C# Tradecraft [3 Hands-on Labs]
• Windows API Essentials
• Utilizing Windows API for Red Team Profit [4 Hands-on Lab]

Module 3 (Utilizing Tradecraft for Red Teaming in Hardened Environment)

• Defense Evasion

– AMSI, CLM, ASR Rules, UAC Bypass, AppLocker, Credential Guard

• Credential Access in Windows & Linux
• Abusing Windows Features (PowerShell, LOLBAS, WSL)
• AD Network:

– Constrained Delegation & Resource based constrained delegation
– Cross Forest Abuse Scenarios [5 Different Techniques]

Module 4

• ETW & EDR’s
• General Evasion Areas [4 Exercises]
• Instructions to access the Enterprise Simulated Lab with updated & patched security controls [for practice]
• Scope of Engagement [SOE]
• Technical Support

**Candidates will get FULL 30 Days Lab Access after training which comes with technical support.

HealthCare Simulation Lab Architecture:

The cyber range lab has deployment of various Host–Level, Network–Level and AD Level security controls. Enterprise grade EDRs with cloud–level protection are enabled, training will provide ways of bypassing these security controls in real–time.