Red team testing podcast

This Red Team podcast episode highlights the differences between standard red teaming and penetration testing, as well as taking a look at why Evalian’s Red Team Essentials service is perfectly placed for organisations who do not have the budget to carry out full red teaming assessments that involve the physical side of it. 

Alex: I’m Alex Harper Davies, and I’m the head of the penetration testing practice at Evalian. And with me, I have Rory Hattingh.

Rory: I’ve been a pen tester for about 4 years now. I am sort of your jack-of-all-trades type pen tester. I’ve been with the Evalian now for just over a year and thoroughly enjoying it.

Alex: Today, we’re looking at red team testing and some other alternatives for companies that aren’t quite ready to carry out full red teaming asessments.

What is red team testing?

Rory: Red team testing differs from pen testing in that pen testing is looking for as many vulnerabilities as possible. So you go into a network, you scan it, you run a whole bunch of tests, you hack it every which way possible, you’re very loud, You don’t really care. You’re not there to evade anything, you’re just there to find as many things as possible so that the company knows where they’re vulnerable and they can patch everything at once.

Red teaming, on the other hand, is about testing the company’s security measures that are in place as well as their response to those security measures. So it can be testing their SOC, it can be testing their AV, their EDR, what notifications are popping up for them, so they can see how they would respond in a real-world type scenario.

Is red team testing right for every organisation?

Rory: In my personal opinion, I would say no. It’s not something that I would recommend to every client.

Red teaming is something that a client should only undertake once they’re more mature in their security journey, once they’ve had a few pen tests, they sort of know their way around the block, that sort of thing.

It’s pointless having a red team, finding a very specific vulnerability that allowed you to own their entire network when there are another 50 vulnerabilities that you could have found on a simple audit or an internal and external penetration test.

Alex: So by design red team testing is going to have gaps in the findings that you might otherwise have had in a regular pen test.

Rory: Essentially, red teaming has a lot of valuable parts, especially for SMEs who would normally not undertake red teaming. If we think about red teaming in the traditional sense of the word, it’s usually something that a large corporate like Intel or Apple, something that’s targeted by your nation-state level threat actors, would undertake – like the physical aspect of it, the large amounts of OSINT, phishing for example.

Many companies don’t necessarily find as much value in that, but where they would find value is actually looking at or knowing about their public infrastructure. What can someone from the outside actually see when it comes to that company?

That’s where red teaming is very valuable because if you think about it, in a penetration test, you’re often given the targets to attack. And if, say, for example, you have x amount of internal and external penetration tests or even web app penetration tests, over a few years, you’re usually given that same address space every single time.

Just because you’re given an IP address doesn’t necessarily mean that you’re hitting the service behind it. There are things like virtual host routing, you know, just this one example that you wouldn’t necessarily see unless you were doing something like subdomain enumeration.

Red teaming goes above and beyond what the client even knows their network looks like.

Typically the blocker for companies in engaging with red teams is going to be cost because to assess a space that big is going to take a significant amount of time.

What if a company didn’t have the budget for a red team assessment, is there something else they can do to get a similar test of their wider security posture?

Rory: Yes. And that’s something we’ve actually thought quite a bit about at Evalian.

We’ve created a new product called Red Team Essentials, which takes that value from red teaming, but sort of skips the fat and allows us to produce something in a much shorter period for a low much lower cost than a normal red team engagement.

What’s the structure of a Red Team Essentials assessment?

A Red Team Essentials assessment is a fairly simple structure. It consists of 2 main components, your external and your internal components, and then it has 2 additional add-ons.

The external component consists of primarily the first OSINT information gathering stage, which is where we take the domain that the client provides, and we find all the information that we can about it. We find anything about their external facing infrastructure, if anything’s been leaked on GitHub or Google, who their employees are, where their offices are, everything to do around that, just gathering that sort of information.

Then we go on to the scanning of that information. So we run stuff like subdomain enumeration to find different subdomains. We see what subnets they’re a part of. We sort of get an idea of their entire company and their flow.

The third aspect of that, which is the most important way I usually find the way in, is essentially the connectivity to the environment.

So think about during COVID, a lot of companies started allowing their employees to work remotely. That means that they have a VPN or something along those lines. Anytime you have employees accessing the network from an external area, that’s where the majority of the attacks are going to happen.

What is password spraying?

As a Pen Tester, I have had great success with something that’s called password spraying. Where essentially you use your OSINT stage to go on to LinkedIn. You find all the employees. You then generate a bunch of email addresses. You can find out if those email addresses are valid.

Once you find a whole bunch of valid email addresses, because there are only about 6 different ways in which an email address is structured, you can then start running password sprays. And if your organisation is fairly large, the chances of someone having the bare minimum required password of say password 1 exclamation mark, is fairly high.

So if you have about 10 of the most common passwords, and you’re spraying it over an organisation of about 1000 people, you can often get a hit or 2. If you’re lucky, they don’t have MFA enabled. Now there are ways to pass MFA if you find an account that is, but that would then be a way into at least their email.

We do have 2 options, and where we differ from red teaming again is if within a certain period, which will be discussed in the scope, we don’t manage to, breach the perimeter, we then move on to the internal assessment via something called assumed breach. Now assumed breach might come in the way of us giving you a USB stick to execute a file on or sending you an email to just click a link or something along those lines.

And that basically will give us our initial foothold into the infrastructure if we haven’t already got that. Of course, that will then go in the report saying that in order to gain initial access, we had to do this.

That is something you wouldn’t normally find in red teaming. Usually, red teaming, there’s very little back and forth like that.

Why are there two modules in Red Team Essentials?

We’re looking at a more modular perspective because we want clients to get real value out of the testing. We don’t just want to spend the entire time hitting you externally. So once we get the internal breach, that payload gets executed or the macro gets executed, and downloads our payload.

Payload basically creates a connection to our C2 server and the internal assessment begins. The internal assessment is actually fairly similar to how we do our internal engagement, where we’re not just looking for straight-up vulnerabilities running things like Nessus and that. We’re actually looking for ways to escalate, ways to laterally move around the network.

Is this internal module the same as a standard internal pen test?

No. Where it differs is instead of being very loud, like a normal internal pentest, we’re going to be as quiet as possible. We have written ways of bypassing EDR, and AV. We’re not just immediately going to start blasting crack map exec scans across the network. We’re going to be stealthy like a real APT would as we worm our way through the environment. We see how far we get and that sort of ends those two components.

What are the Red Team Essentials add-ons?

We have 2 add-ons.

Add-on 1: Phishing

Phishing will take place simultaneously with the external components. Why I’ve made phishing an external add-on is because a lot of clients either don’t want to be disrupted by the phishing or they have phishing training programs already, which I believe are a lot more efficient in stopping phishing rather than just running a phishing engagement.

So we’re saving on value there. We don’t want to waste precious time on just phishing.

Add-on 2: APT Simulation

This is essentially where we go to the MITRE framework and copy a specific APT or a bunch of APTs within that environment, and then simulate their exact attack paths.

Now it should be noted that while we’re doing our internal engagement and external engagement, we’re following these and we’re doing more.

Take, for example, an APT like Darkseid. On one engagement, they phished the clients, got credentials, managed to get into the network, then, privileged owned a Windows machine and used PowerShell Empire. That might have just been the C2 server that was the flavour of the month at that time. It doesn’t mean that they didn’t try something else or they haven’t moved on from that.

So it’s important that you hit every possible escalation path, rather than just following a single APT. In some cases, there is value in copying that exact APT, so we do offer it as a service, but it’s not part of the baseline.

How do Red Team Essentials stages differ at each point?

During the OSINT stage, we’ve used a whole bunch of new AI machine-learning tools to cover a lot of the OSINT. So a lot of that is automated.

This means instead of having a whole team that specialises in OSINT, you can have a single tester running a bunch of code, generating that, and then passing it, to find out everything they need to.

There are a lot of new tools that have popped up on the market that allow us to go through many dumps of accounts and any sort of breaches you can imagine.

We also cut down on the amount of time it would take to gain initial access. So in a traditional red team engagement, they’re going to spend a lot of time on phishing and physical. A lot of the time, you’ll find they will try phish, spearphish, SMH, every sort of iteration of it to try to gain access.

On top of that, we’ve also removed the physical aspect. It takes a large amount of time canvassing the building, getting inside, working your way through all the infrastructure and the employees and everything like that. We’ve removed that section because a lot of SMEs aren’t targeted by these nation-state-level threat actors that are going to show up to your place of work and try and breach it in the ways that a normal nation-state-level threat actor would.

They’re going to find the attacks coming from more cyber side of things over the network rather than in person. So you’ll see a lot of phishing and a lot of, password spraying.

We’re focusing more on the network side, what your environment looks like, what can we find on the Internet in terms of networking services, GitHub leaks, anything along the lines of third-party breaches, those types of things, rather than spending time on the physical and phishing.

How do they make sure that the techniques used mimic the real world and provide that assurance of how a SOC is gonna respond or how resilient the network is going to be?

Essentially, how that works is there are 2 different flavours of Red Team Essentials.

Option 1:

There’s Red Team Essentials where we come at the engagement as if it was a threat actor and the company doesn’t know anything about it. So the SOC won’t be involved or, very few people within the company actually know what’s going on.

Option 2:

The other option is we come at it more from a purple teaming perspective, where the SOC are involved. They know what you’re doing, and that’s more of “are our systems working?” We can check it at every stage of the test.

The techniques that we’re using and the tools that we’re using are the techniques and tools that are used by the current threat actors.

Everything is up to date, and, there’s even an option around following the exact attack path of one of these threat actors on the MITRE framework. But essentially, the test is done completely remotely.

It’s all conducted through a C2 server, just as a normal TTP would be mimicking the exact attack path that these threat actors are currently using.

Does the blue team have a role to play?

We can scope it in a way that notifies the blue team of each step that we’re taking along the way, and that involves from external to internal to privilege escalation, as well as if you take any of the add-ons. So you’d be giving them things like indicators of compromise they should be picking up with their tools so that they can validate whether it is working or not.

We will be providing them with the type of attack that we’re doing in the section of the infrastructure that we’re attacking as well as, say say, for example, we’re trying to run some type of curve relay to gain access, to privilege escalate within the AD environment, we would notify them of this just so they can make sure that their tools are picking it up in the purple team engagements.

What is the MITRE ATT&CK framework?

The MITRE framework is essentially a framework where MITRE go and catalogues every APT, and they look at exactly how that APT went about executing whatever they wanted, where where it was phishing to ransomware. They sort of map out exactly how it happened as it happened, and that allows us to mimic that.

Alex: There’s quite a lot of collaborative scoping that needs to happen before one of these engagements between the client and the service provider, but for clients that aren’t at that point yet, they may be thinking about having a pen test, looking at what their options are…

How do you know if you need a pen test or a red team test?

You shouldn’t be looking at a red teaming type product if you’re not mature in your security journey.

Red team assessments are not there to find lots of vulnerabilities. Say for example, your organisation hasn’t been on your security journey for that long and there are still a lot of vulnerabilities in your network. You’re going to get a lot more value, per pound, per hour out of a normal pen test.

Have at least 2 external and internal tests before you move on to the Red Teaming Essentials product.

make sure that you’re coming out of those internal and external tests with very few findings.

Another scenario is where you’ve just implemented a new security measure, whether that be something advanced like Darktrace, or you’ve just implemented a new, or a fancy EDR solution like CrowdStrike or something you need to test that out first.

Alex: From this side, as a pen tester, what would you say to testers who are aspiring to get into this sort of more advanced testing?

Essentially, there there’s a couple of really good certifications and parts that you can follow that will get you up to scratch in terms of red teaming. You need to learn a bit about EDR evasion, how these systems work and how to be quiet during an engagement. So I would say you first need to have a little bit of experience in pen testing.

Then I would look at doing a certification along the lines of Red Team Operator by 0 Point Labs. They’ve got 2 certifications that take you through sort of the whole red teaming type space. There’s a lot of, good material there. You need to know your way around AD and your way around OSINT.

You also need to have a bit of malware development especially when it comes to EDR evasion. When you’re looking at bypassing Windows API calls, you need to have a little bit of knowledge about that. So it is more of a reading exercise and that is gonna be personal research.

Conclusion

Red Team Essentials is the perfect solution for organisations that don’t have the budget to justify a full red team test. If you would like to know more about Evalian’s Red Team Essentials Service or would like a quote, get in touch today.