Who watches the watchmen?
summary
A new version of RedELK centralizes logs from dozens of C2 servers, gives one‑click overviews of IOCs, full‑text keystroke search and alerts when samples hit VirusTotal. The infrastructure uses tracking pixels and per‑server profiles to detect blue‑team visits, analyzes user‑agents and sandbox submissions, and orchestrates multi‑month, multi‑C2 operations. Live demos show payload persistence techniques, proxy checking to avoid scanners, concrete examples of blue‑team OPSEC failures and exact tooling used to find them.
AI-written summary · about
chapters (14)
- 0:00Introduction to red teaming
- 3:37Infrastructure setup explained
- 6:05Red teaming as Sherlock Holmes
- 10:00Blue team training simulations
- 13:30Customer incident insights
- 17:23Malware analysis techniques
- 20:31Service provider challenges
- 24:07Persistence and user agents
- 27:38Payload delivery methods
- 30:05Blue team response strategies
- 32:12Proxy and victim checks
- 33:18Bitcoin mining investigations
- 35:00Training and attacker mindset
- 36:30Q&A and closing remarks
related talks
40mFantastic Red-Team Attacks and How to Find Them
39mI Watched You Roll the Die: Unparalleled RDP Monitoring Reveal Attackers' Tradecraft
29mDetection Engineering: Defending Networks with Purpose
24mDetect known unknowns
45mAdvanced Security Operations with Elastic Security
42mRed vs. Bank: Surviving a Three Year Red Team
30mSpotting Threats with Elastic SIEM
54mLessons and Lulz: The 5th Annual Black Hat USA NOC Report