Fantastic Red-Team Attacks and How to Find Them
summary
Provides concrete tools and outcomes: Atomic Red Team supplies YAML-mapped, single-command tests tied to MITRE that generate telemetry; a 350,000‑event developer workstation log is triaged down to a few dozen hits with the Event Query Language by asking sequence, join and lineage questions; the novel finding is a debugserver remote debugger abuse where a trusted debugger process opens a reverse TCP, allocates RWX memory in Notepad and injects shellcode; detection is implemented as an EQL sequence matching debugserve/original filename + outbound network + child process or cross‑process memory operations.
AI-written summary · about
chapters (23)
- 0:00Intro
- 3:12What is Atomic Red Team?
- 4:48Example Atomic Technique YAML attack
- 5:36Easy to Automate, Chain Tests Together.
- 7:09Frequently Missed MITRE ATT&CK Techniques Often leverage built-in native OS tools
- 8:30Prepare For Actual Incidents
- 9:00Atomic Red Team May Help Organizations Prepare
- 10:32Event Query Language
- 11:35Event Queries where
- 12:12Sequences Match multiple events in order Shared properties with by syntax • Timeouts with maxspan 5m • Statefully expire sequences with until condition
- 14:02Data Pipes Perform data stacking while hunting • Process results by filtering, counting and removing duplicates
- 16:45Setting the Stage Windows endpoint with Sysmon installed Real background noise • Mixed data set, with true & false positives
- 17:59Investigative Process
- 21:25Guiding Questions • Is the path unexpected?
- 22:54explicate parvuli What descendants were spawned from the interactive PowerShell console?
- 26:51nota vocatio
- 28:42DBGSRV: A Fantastic Red-Team Attack Think of this tool as giving you what is functionally equivalent to • Reverse TCP Connection • Process Hollowing • Whitelist Evasion
- 29:16DBGSRV: Reverse TCP Connection
- 33:31EQL Analytics Library
- 34:41Identifying True Positives • Build a baseline of your environment • What do you find multiple times?
- 35:38Pitfalls of Behavioral Detection • False positives from administrators and background software • Lack of context to improve detections
- 37:20DIY Red & Blue team - Install and configure Microsoft Sysmon on a Windows endpoint
- 38:26Conclusion • Understand what data sources you have • Focus on commonly seen behaviors • Practice on small known sets then scale up
related talks
53mAtomic Red Team: Where Adversary Emulation and EDR Testing Meet
12mIntroduction To Red Team Tooling And Opsec
41mPurple Is the New Red - Providing the Most Value from Offensive Security
33mBuilding Red Team Capability
46mNext Generation Red Teaming
50mAdversary Emulation: How I Stopped Being Polite and Got Real Results
34mPurple Team Strategies for Application Security
35mRed Teaming AWS: Practice What You Preach/