Red Team Tools

The first course in this series discusses leveraging the MITRE ATT&CK framework in combination with open source tools to emulate adversary attacks.

Reconnaissance consists of techniques in which an adversary actively or passively tries to gather information that can be used to support targeting and plan future operations.

Resource development consists of techniques in which adversaries create, purchase, or compromise/steal resources that can be used to support targeted operations.

Initial Access consists of techniques that use various entry vectors to gain their initial foothold within a network. Techniques used to gain a foothold include targeted spear phishing and exploiting weaknesses on public-facing web servers. Footholds gained through initial access may allow for continued access, like valid accounts and use of external remote services, or may be limited-use due to changing passwords.

Execution consists of techniques that result in adversary-controlled code running on a local or remote system. Techniques that run malicious code are often coupled with techniques from other tactics to achieve broader goals, like stealing data.

Persistence consists of techniques that adversaries use to maintain their foothold on systems.

Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives.

Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware.

Credential access represents techniques that can be used by adversaries to obtain access to or control over passwords, tokens, cryptographic keys, or other values that could be used by an adversary to gain unauthorized access to resources. Credential access allows the adversary to assume the identity of an account, with all of that account's permissions on the system and network, and makes it harder for defenders to detect the adversary. With sufficient access within a network, an adversary can create accounts for later use within the environment.

Discovery consists of techniques an adversary may use to gain knowledge about the system and internal network. These techniques help adversaries observe the environment and orient themselves before deciding how to act. They also allow adversaries to explore what they can control and what’s around their entry point in order to discover how it could benefit their current objective.

Lateral Movement consists of techniques that adversaries use to enter and control remote systems on a network. Following through on their primary objective often requires exploring the network to find their target and subsequently gaining access to it. Reaching their objective often involves pivoting through multiple systems and accounts to gain.

Collection consists of techniques adversaries may use to gather information and the sources information is collected from that are relevant to following through on the adversary's objectives.

Command and Control consists of techniques that adversaries use to communicate with systems under their control within a victim network. Adversaries commonly attempt to mimic normal, expected traffic to avoid detection.

Exfiltration consists of techniques that adversaries may use to steal data from your network. Once data has been obtained, adversaries will often times package it to avoid detection as it is removed.

Impact consists of techniques that adversaries use to disrupt availability or compromise integrity by manipulating business and operational processes. Adversaries are trying to manipulate, interrupt, or destroy your systems and data.