In & Out – COMBO Attack, Detection & Hunting with PurpleLabs [HITB+ CYBERWEEK 2021]

Agenda

• By default, all hands-on lab scenarios have been categorized by Tactics:

  • Initial Access (TA001) • Execution (TA002) • Persistence (TA003) • Privilege Escalation (TA004) • Defense Evasion (TA005) • Credential Access (TA006) • Discovery (TA007) • Lateral Movement (TA008) • Collection (TA009) • Command and Control (TA0011) • Exfiltration (TA0010) • Impact (TA0040) • Breach and Attack Simulations • Forensics

• Linux RED vs BLUE HANDS-ON LABS INDEX:

  ● Introduction to PurpleLabs ● Current state of Linux malware / APT campaigns ● Analysis of Linux C2 implants and interesting post-exploitation modules ● Linux LOLbins / one-liners for bind & reverse shells, download/upload, file compression ● Linux Network / Service / User / Local Enumeration ● /proc exploration ● Linux ELF in-memory code execution vs live process analysis ● Linux syscall faulting for C2 agent execution ● Injecting an ELF file into a remote Linux process ● Linux GDB Shared Library Injection ● Linux sshd Injection + password extraction ● Linux Apache rootkit + command execution over HTTP ● Linux kernel space rootkits and backdoors vs LKRG ● Building Linux custom payloads ● Linux Runtime Security / syscall filtering / kernel instrumentation using falco, tracee and systemtap ● Linux persistence and hunting methods ● Linux process hiding and in-memory code injection techniques ● Linux buffer overflow / privilege escalation artifacts ● Linux hardening best practices / OpenSCAP ● Chroot / nsjail / SELinux / caps / seccomp vs exploitation ● Socket command execution ● Auditd vs Falco vs Tracee vs local adversary simulations ● Invoking Linux Reverse shell from kernel space in response to ICMP ● Linux shells over hidden ICMP channel ● Data exfiltration over DNS vs detection ● Pwn remote docker host over DNS rebinding ● Escaping Docker containers ● In-memory DNS AAAA implant for Linux ● DNS AXFR Payload Delivery ● SSH tunneling, lateral movement and pivoting vs HASSH ● HTTP2 Exfiltration and DNS over HTTPS C2 ● Playing with LDAP as payload delivery channel / hidden storage ● Tunneling traffic into internal networks ● Port Knocking vs Full Packet Capture Analysis ● Mutual TLS / SSL C2 communication vs JA3 / JARM ● SNI-based TLS data exfiltration ● The world of web shells vs Yara / OSquery / Velociraptor detection at scale ● Threat Hunting and Detection with Web Proxy Logs ● Linux Memory Forensics using Volatility Framework ● The importance of Linux Process trees ● HTTP exfiltration and covert channels based on UA, cookies / encrypted cookies, WebDAV, WebSockets ● Youtube-based command delivery and execution ● Google Translator as a C2 Proxy ● Overview of Linux Security Benchmarks / Linux Hardening guides vs PurpleLabs offensive content ● Introduction to Fapolicyd framework ● Introduction to FreeIPA - a “domain controller” for Linux clusters ● Linux Tips and Tricks for Rapid Triage ● and more

• Windows RED vs BLUE HANDS-ON LABS INDEX:

  ● Introduction to PurpleLabs ● Current state of Windows malware / APT campaigns ● Analysis of Windows C2 implants and interesting post-exploitation modules (execute-shellcode, execute-assembly) ● Using malleable C2 profiles over Empire Framework ● LOLbins / one-liners for bind & reverse shells, download/upload, file compression tricks ● Active Directory Network / local Enumeration ● AD Kerberos password spraying and brute-forcing ● Windows Integrity Levels ● Evil-WinRM pivoting + Ghostpack enumeration ● Bypassing UAC over Koadic C3, Empire, Metasploit ● Dump lsass at scale and detection ● AD Credential Dumping using Impacket’s secretsdump ● Dumping DC Hashes via wmic and Vssadmin Shadow Copy ● PPID spoofing and command argument spoofing ● DLL Hijacking against MSDTC service for persistence ● Windows OCI DLL Hijacking ● Windows Process Injection / Hollowing Techniques ● Windows CMSTP + Rundll Network Connection ● Windows MSBuild In-memory Code Execution ● Windows MSHTA + Windows Script Component ● Windows Bitsadmin ● Windows New Firewall Rule ● Windows Sharpshooter + Metasploit Framework + SMB Named Pipe Pivoting ● Windows Schtasks Persistence ● Windows Application Shimming Persistence ● Windows AMSI-Provider for Persistence ● Windows Winlogon Helper DLL Persistence ● Windows ADS NTFS persistence and hiding ● Windows AD Skeleton Key Persistence ● Differences in behavior between dcomexec / psexec / wmiexec / smbexec / atexec / wmiexec + Pass The Hash ● Evading Sysmon and Windows Event Logging ● SMB named pipes for Lateral movement ● RDP no-GUI Remote Command Execution ● Ask for Windows passwords from Powershell ● Shad0w beacons ● Donuts, donuts, anyone? ● The power of SharpDPAPI ● Windows Pcap driver installation ● AD Silver and Golden tickets ● Kerberoasting / DCsync / DCShadow ● Tunneling traffic into internal networks ● Mutual TLS / SSL C2 communication ● SNI-based TLS data exfiltration ● Clone, armor, and phish popular websites and use them for covert channel ● Playing “QUIC” network exfil game ● Local network scanning from the pwned OS/browser through XSS ● Octopus AES-256 Encrypted C2 ● Playing with PoshC2 post-exploitation modules ● Network/exfiltration modules of Nishang, PowerSploit, Powercat, Empire ● Infection Monkey Automated Adversary Simulations ● Network Flight Simulator / testIDS ● Purple Team ATT&CK Automation ● Atomic Red Team Simulations ● PurpleSharp Simulations ● Playing with CME + atsvc ● Analysis of a collection of Windows print spooler exploits ● Word Exploitation and detection (CVE-2021-40444) ● PetitPotam – NTLM Relay to AD CS ● Sliver C2 extensions ● Process scanning at scale against malicious behavior - Velociraptor + hollow_hunter ● APT Lazarus simulation vs hunting ● Emulating and hunting for APT29 / FIN7 / FIN6 / menuPass / Hafnium / Carbanak ● Windows Rapid Triage using Velociraptor IR ● The power of Mordor and EVTX-ATTACK-SAMPLES vs HELK ● DNSStager for payload delivery over DNS vs dns.log ● and more