so uh welcome to my talk uh Cloud
ination Mastery the RM Edition uh uh
this is who I am I'm RM engineer at grab
and also a young lecturer at Singapore
management University my free time I
play CTS for cfsg and HK and every year
I pay money to go Vegas just to play CTF
for I don't know people go to fun I go
there to play CTF for three four days at
Dev so uh who is this so for anyone
literally anyone uh and with an open
mind to learn more about uh what's my
spe perspective on rting planning
especially the internal uh Cloud uh and
environment so let's so for those who
are new or you know trying to get the r
team let let me cover some like ground
you know foundations of white with team
right um we are not uh testing pens nor
vulnerability scanners okay we are
literally paid to make trouble so I
asked Che gbt in this no less than 20
words explain why great team tells me
you know it simulates adversary tactics
and regularity test and identify
weakness in organization so by this
sentence right you know that there not
your one of the meal pen testing
vulnerability scanning or whatever it is
it's literally end to endend in your
organization the key word is
organization which brings me to this
chart as well by picker right that you
see when we talk about rate teaming uh
it is end to end coverage it's not like
you know pen testing okay up to here and
what we do do not stop a detection we
continue and we test the response and
the organ organization's maneuverability
as well in the event of
detection so whenever we look at rate
teaming there always what should be
happening as defined by engineering or
the tech people or even the organization
and what is actually happening and
normally we stop here right as a pent
tester or as a vity scanner right weiz
your buet is exposed to the internet
right that's all but the question comes
when rate teamers are involved what can
we achieve afterwards with this open
bucket so this ex some like very
simple sentence that you can use to
describe what every tea does and it's
work so uh I'm a bit unconventional like
people like to use people process
technology I like to use people process
organization and I like to point out
this big highlighter what called budget
priorities because coming from a private
sector it's really true that wherever
the money goes is wherever the company
is making money and if your budget
priority is not at the right places then
it's very likely that that area is being
neglected right so when we talk about
people we talk about our users in the
organization the functions and the
engineers that's involved right and also
the processes they are part of the
entire uh business flow right your
change management it operations assess
management Etc at the same time we also
talk about organizational structure and
budget priorities Within These whole
entire families of um departments
verticals within a huge uh
orc and rim testing is about looking at
scenarios right we look at scenarios you
try to emulate actors you try to study
what has happened in the past so these
are some high profile ones like OCTA Jam
Cloud even drop box very recent right
and some of you who might be experienc
CTI would also know that hey these are
places CTI will look at to learn what TR
actors are doing right but to be frank
as real team Engineers we are looking at
this as well to know what other people
are doing in apart from looking in like
you know um small small level small tier
lowlevel adversary group telegram group
chats we also to study what people has
discovered and just yesterday right
locally jumbo and Mustafa got hit by
cyber attacks right so no one is safe
people keep thinking who hit us yeah but
Mustafa and jumbo just got hit yesterday
right so more to become this is from
straight slime so I'm not cooking
anything out this from straight time
okay this is a real straight time not
the fake one I you go and buy crypto
this is really straight time.com okay so
just yesterday this was reported and
there was their likely is going to be a
postm about how they got you or what but
depend on their disclosure news will go
about
so what are our goals as weight teamers
so I'm still covering what as we teaming
so our goal is to answer anything that
our boss say I think if those who attend
who talk yesterday if your manager say
if your big boss say red teaming is
pentesting then you are pentesting
whatever at end of the day you have to
achieve goals right are we emulating a
tractor uh is it a feasible attack
Vector right uh is there any regulatory
concerns
W out of scope so this is very important
because sometimes you might not want to
touch things that can get you into
trouble and you lose your job right and
also what are the crown Jews but I say
so much right let's do whatever it
takes let's do whatever it takes really
that's way teers do whatever it takes to
achieve your goal but within your
boundaries within your rules okay so
depending on your Rules of Engagement
that set internally you have to achieve
that so before I talk about Cloud
engagement okay I want to share
throughout my entire career of studying
what other people have said we will look
at current works that that is done by
other people when you're starting out in
teaming so the very first one that I
really recommend people to read is this
book called R oper R team development
and operations by zes and James
thille so it's a mouthful but I like to
point out this thing right in R teaming
right effective planning dramatically
increases the speed and accuracy of both
engagement and culation of reports right
what this means is that you can do
whatever you want in engagement but
having an effective planning will really
um show great results okay next I look
at gitlab handbook okay so I also at G
hand one so uh when we do effective
taming it helps us to recommend uh and
help us to come up recommendations to
improve detection and prevention as well
at the same time it's also uh the way
where we can use to emulate real life
attacks so that the uh Defenders the the
and detection enging can um react to
something that near real life I mean of
course we are real but we are fake
because we are not stealing money we're
just ring hey we got here okay so for
those who are very familiar with the
capability maturity model in it
operations okay so there is this recent
model called the r te matur model which
stipulates the five levels as well you
can see I credit here I never any cook
one so level one is um things you are
doing things that occasional and one
size fits all then go out to level five
which you are being a proactive team and
it's easily customizable within your
operation operating Norms okay so this
is how um uh maturity of R team is but
they have many different categories and
because today I'm talking about planning
so I I picked out a section so there is
even a section of planning and selection
that has five different levels so we can
go to this this website with team
maturity. comom and find out more right
so there are people already talking
about you know how you should plan Al
what you should plan for what is the
mental model you should go towards right
and even gitlab has another article on
how do you run asynchronous teams so uh
you can run you can run things uh
asynchronously if your blue team so is
why it's purple and then when you do the
attack right this happens and then it
basically telling you that hey you don't
need everyone to be in the same room you
can run things online okay asly right it
can be in different timelines but so
many authors and works talk about what
you should do but when I read and read
and read I think okayy how do I do the
planning is it Go GitHub go and find a
template go and do all right so uh
before I go to the meid of theid of the
entire talk this is um some disclaimer
the following views are solely mine they
do not represent what my organization
things or say right and um or however
organization Affiliated to so but if you
think this is useful and you have open
mind and in fact have feedback about it
I'm open to hearing it as well Okay cool
so this is my vision there's always
three important
phases in entire engagement there's
pre-ops doing Ops and post-ops now due
to the time constraint of this session I
only go into detail about pre-ops
element and I also explain why because
pre-ops elements would heavily affect
your during Ops and postop elements as
well so in pre-ops this is what I would
look at it usually it's two to six
months before the actual operation you
have these activities that you will go
through 100% okay you you take photo you
take
so so there scoping onboarding P meeting
sub study Logistics and force
preparation Ms planning conditioning
planning and Dy runs okay so I'll go
each go into each and every one of them
so yeah let's take a look so first of
all scoping and engagement
right it's important to do this first
step because if you don't this do this
first step right it might make or break
your entire operation or rather you do
they accept it or not it's sen
management accept it or not it's at this
point of time really right first you
identify boundaries usually I would say
no boundaries but in not all
organizations are very liberal so
identify boundaries to make your
stakeholder feel safe right so things
can continue as usual and you define
guard rails okay so once you define your
boundary and gut rails you know that you
can hit
certain uh areas and still protect your
business because gut wheels are supposed
to prevent you from hitting things you
should not or even better you should not
hit people who are not within
organization so maybe in your payload
you should do things that check for uh
check for things if check for certain uh
keywords that belongs to your
organization if not you know you don't
do right so this is one
example and then of course you check
with compliance and legal to see if you
can even do this operation right maybe
you're not allowed to do it because even
if you're inhouse team you're not
allowed to do it because of certain Lego
compliance issue or maybe for example
your company owns a certain sub entity
and because of some legal problem right
you cannot do on the sub entity that
could be an issue as well right so
always check with legal and compliance
and this is the biggest pain in the okay
and next is once you have checked all
your administrative stuff okay you can
start defining your scenarios and
Persona these scenarios are scenarios
that you're trying to bring out okay
it's not it's not the user is trying to
use a app and log into to Facebook no
not those kind of user story scenario
I'm talking about like you have an
adversary and what is the goal of the
adversary okay and what is the personal
of this adversary okay this adversar
personal can be highly skilled medium
skilled highly funded okay not so okay
funded or it can be SC KES you can have
any Persona you want right but we always
assume the worst so this is this is
about this is more like painting the
story communic communicating with
stakeholders the seniors and personal so
whenever someone reads a report after
the entire engagement they know the St
story or the type of scenario trying to
emulate and questions are quite
streamlined from through there okay so
it's it's it's about P padding your
scenario or your engagement to make it
more legitimate okay it's really legit
but some people when they read the
report they don't feel legit then this
one make it
legit so once you have defined your
scenarios and Persona you then can
cumulate the Trap profile so this is a
track profile I'm trying to emulate okay
then once you have that that done you
need to Define your goals this is very
important because
any engagement right you need to have an
angle so this angle is usually what your
tread actors would look for for example
I want to get data I want to transfer
money off your account okay I want to
exfiltrate XYZ thing um data from let's
say uh uh air gap environment right so
if you can achieve that that is your
goal and this is usually something that
when a business see they will jump out
of their seat and scream out and sco
people who didn't do it
okay then once you defin your primary
goals which you must achieve or try to
achieve Die Trying you can you can do
something called a stretch goal a
secondary goal this is basically saying
hey I I achiev this goal I can also
achieve this goal so I you know okay
times too okay so that is that's why you
should try to do right stretch yourself
to do more okay and then get the whole
entire proposal approved so this
thing maximum one week set right so if
you need to email Del daily all this
right it's it's up to organization's uh
timing and time and space but usually
this one will take one week to
plan okay now you go for the stakeholder
on boarding this one is like like the
very easy to follow just make sure your
manager is there your manager manager is
there your C is there whatever whoever
you think that needs to know this
engagement is happening let them be
there okay system owners ined so that uh
they know this thing is about to happen
do not panic it's a fire drill it's not
no dff okay and then shortly secondary
white cell members so what do I mean by
secondary white cell members secondary
white cell members are members who are
not onboarded yet because they might not
be needed then so the more white sell
people you onboard the more people know
about your operation the more chances of
people leaking out and rabbits all the
back right so to prevent people from
doing that you short list them whenever
needed so for example you hit a certain
service and you know that this service
uh is is likely required to have this
stakeholder to be on board as a white
cell to know what's happening then you
on board but if you're not going to hit
it in in the in the engagement right you
don't need to on board right so keep
that in the dark if you need
to so this come as a PS meeting so when
you are done uh doing your
your pre uh two two activities right you
can do your pre-ops meting this is where
you and your team will meet up and say
okay this is let's finalize the scenario
and Persona this is what we will be
acting on we have to put oursel in the
track actor shoe the adversary shoes
what with dating okay and this is where
you also do passive recognisance when
you do passive recognisance this will be
a
typical uh model that you draw okay my
version is like this maybe someone here
can do dra a nicer model but I always
take out um Google slides and just put a
few boxes put a few names SL a few logos
okay this is my terrain okay so when you
do passive reconnaissance you using
tools like mono anything as open source
that does some of scanning right
subdomain imation SE scanning all this
you find out everything about the target
you're targeting okay so this even for
internal rate team you have some
intimate knowledge you still can do that
to understand what your attacker is
going through so when you write in your
report what has been done right you can
say that hey even an external attacker
can do this so as an internal te it
doesn't make it it does not matter at
all right so always do this due
diligence to do the passive
reconnaissance and all unless you say
that hey the attacker got through a
initial exess broker different story but
over here passive Recon is still very
important right go and find out what you
can find out from the Internet it's very
important th1 to you can pick a
poison so after youve got all
intelligence right you consolidate them
and through out those that does not make
sense okay you thr out and say Okay this
not make sense does not it's not part of
the entire engagement toway okay so once
you consolidate you define the terrain
okay this will this will affect your all
planning in the later later part okay
you define the terrain what does it mean
Define the terrain you draw this model
and say this is the terrain this is how
it looks like okay this is what we are
likely facing likely facing okay I
always the ter likely
facing and you postulate weaknesses and
generate Sub sub study so how do you
postulate weaknesses is by oh my godness
a
typo how do you post wies is by looking
at the generated terrain Target terrain
right you think what is the likely
weakness that this organization is
facing this target vertical is facing
and from there you just postulate so
it's just possibilities they all
possibilities and once you have done all
possibilities you know for sure that
when you go into your office planning it
will be part of your consideration as
well okay and then you gener sub studies
which basically means that okay from
this postulation I need to have a subt
study that says how can I take advantage
of this how should I break in how should
I explo this issue X Y and Z right it's
basically saying I have this possibility
I need to have some time to study and I
need time to generate the exploit or
payload or delivery method whatever
right it's what you need as part of your
delivery approach later in the actual
Ops so yeah even subtask study have his
own his own activity okay when you study
the subt study you are supposed to
understand the subt study in
consideration of the target environment
and then once you know that you generate
your unit test which is basically saying
okay if this sub study aims to exploit
this service okay I need to generate
unit test to prove that this test is
working so you can either have a offline
version of it if let's say you are
looking at open source uh open source
project or if it's a blackbox
environment there's no choice but you
have to try and fle with it and tickle
it and you know see what are the
responses right so entire process that
you're going through you have to have
upset consideration so don't go and show
some public tools you got to go to Pon
console open vs code and C the out
of it okay so you have to code you have
to understand you have to really
visualize what's happening and think
what is the defender doing because at
this time you are already having you're
already in the part of active engagement
you are slowly poking slowly testing out
the system right what are the possible
uh weaknesses in the Target environment
and at this point of time right you are
already testing the detection as well
because you are actively testing in this
sub study and see what are the behaviors
of the system which is also a bit like
penetration testing right so what's the
difference right so you're also pin
testing okay so uh then once you done
you have done the exploitability
research then as a team you will say is
this subtask worth it or not is it worth
doing it is it not right do you have the
time to really go and find a zero day to
exploit them yes or no it depends on the
team right most of the time you say no
because short of time right you don't
have L time in the world but if you
manage to find something that is low
hanging you can Target them away why not
accept the subas okay and then next is
result presentation within the team or
to your whell or whatever right so
whatever you do in a sub study you still
have to let your white cell know uh and
that's part of your engagement process
okay don't know that hey we have done
this and this is what will happen right
so they know and they are prepared that
they are prepared for this so of course
you trust the white sell do not spill
the beans but if they do then you know
it's a management issue but
in in terms of like the entire
engagement you should always ensure that
all stakeholders are okay with what
you're
doing which also does not mean that they
should not stop you so you get like a
good working relationship with the
people that are trying to test
for okay so once you have done your sub
study it's time to provision all your
big things your fun your fun toys okay
so you have your infrastructure
provisioning your collector and re
director provisioning all right from
there you'll probably do like multi CL
environment right maybe you do digital
ocean here a8s there then L on the other
side right and then you put like 101
clock flare accounts everywhere you just
you know one one goes one get Block you
just change to another one block just
change with another one you know or use
um what's the cloud front Cloud front
also very good they can block Cloud
front so yeah that's one thing right and
then DNS resource cation so uh just a
tip if you're trying to do engagement
always try to register a DNS like do the
six months in advance I myself
registered them I cannot tell you when
right because people are
listening but I registered them X months
and years ahead and I will also uh
ensure that uh there are certain things
that are checked off right so um just
fun fact when you register a domain and
you register it that's similar to a
certain track actor group that using
right spam house will block it for you
and that's a pain in the yes okay so I
registered something and then my CTI guy
is like bro is this you two days you
know fast so so I registered something
and then got blocked by spam house so
cannot use really so just all the r
teers here and the whoever want to do
adversary just know that if you are
following a certain track group know
that there's a international CTI group
looking at all these domains as well
okay if you do things like something
something there something do something
okay that's likely going to be block but
you can try you can try right just pay
$10 on you pay 10 USD boom does it go
through it go through okay good and then
it doesn't go through it got blocked by
spam house two days later you're screw
let try something
else okay so once DNS is done which is
very important because DNS makes or
breaks part of your project you people
see your DNS people oh this is
legitimate let me click on it and then
they realize they screw so you have to
make sure that your DNS is registered
um as part of your profiling so in the
early part of this uh pre-ops meeting
right when you you define the the you're
supposed to profile your organization as
well when you profile organization you
understand what the types of Technology
they're using what the POS possible
domains you can use or to to to trick
them into clicking so for example lock-
facebook.com okay so maybe people like
be trick to lock into it right so it's
very fun now when you when you go to
pan.com or Go Daddy yeah by the way if
you are trying to Target a organization
right just go and do a DNS look up on
their domain
and see who is at registra if the
registra is something that you can
register on your own now you can just go
and do the same thing then make sure
everything is the same and when you
register you will look exactly like this
organization registered this weird
looking domain and then the defender
will be like what the hell is going on
right especially when you're trying to
do a third party attack oh and it's
quite quite quite crazy and then your
Defenders were like what is this then
you do your C2 checks in deployment so
this is when
this is when you uh test everything that
you have done here and test your payload
and test your delivery what does it mean
is that at this point before you even
start anything you make sure your thing
works right you make sure your payload
works you make sure it's calling back
you make sure all executions are working
and delivery does not trigger any alarms
so usually as a internal team we have uh
a different cyber range that we can test
on to see if it trips any if you're exal
team uh I'm sorry but you have to spend
more money to buy every single possible
ADR and test on in your own VCH this is
one thing you should
test so now comes at o planning which is
the
most most uh worthy
part so first of all you have the ter in
general okay you can name it differently
but I like to name it ter in general so
for all the military X Singapore
military people find it very familiar so
ter in general is basically saying
you're looking at the terrain that
you're targeting in general right what
does it mean to the attacker so for
example over here the asset IDP provider
X right suggest that the attacker could
leverage on leak andity keys and move
laterally this just one p that you have
done in uh Terin General and but maybe
Jenkins right suggest that it could be
used as a foot CLE once accessed to the
Jenkins successful so that's what it
means to the attacker so when there's
attacker there's also Defender
okay so you must also think okay the
terrain also has it has got Duty what
can a Defender use this as its Advantage
okay and is effects is the Pres of G
Duty suggest that uh any event should be
uh detected right so G Duty has uh has
publish what it will detect and how it
will detect and in what scenarios okay
and got Duty you can also pay for your
own and use it for free right and then
you will see like um what will and Beed
in what scenarios and because of this
you have to be aware of the nature of a
payload and it and if you reach Ching G
Duty uh you need to change your payload
a bit okay or maybe edrx the presence of
edia you assume the worst right you
assume okay presence of maybe TRX TRX
suggest the risky commands executed in
the environment will be flag and hence
attacker should perform nonstandard
execution or maybe follow what the
speaker said yesterday right thousand to
EV Ed right so once that's done okay you
look that the terrain in detail okay so
from the terrain that you have drawn
here right you can kind of use this same
terrain and you can you can draw out
this terrain General and and uh terrain
General and terrain uh detail and and
really identify the key terrain that the
attacker must capture right in order to
uh gain a effective foothold in the C
environment this could be a cicd runner
it could be a server with with high
permissions Etc this is totally up to
you but for this talk I'll talk about
Jenkins right so maybe I would say like
Jenkins being a prime target of majority
engine of access enemies configured uh
jobs or Works spaces can result in rce
okay and you know you can also say
something like it was observed that J
was primarily used in early days you
know and then therefore hence due to it
history the RO could have had high
permissions to it and is a prim Target
you have to capture it right so this
gives you a plan okay like I said a plan
but you can sometimes don't follow it
when you're executing in the actual
environment right because things can
change but here you are planning so that
you are moving in um tend them with your
uh plan
execution so once you have done your ti
T ID you will then do this mini thing
called uh War gaming what does it mean
is that as an attacker what do I do as a
Defender what will happen and then as an
attacker how do I mitigate this so story
telling here okay I don't I tell a story
here so uh there was a RC on Jenkins and
got and got detected by EDR so I talk
about executed here I did some process
hollowing thing and then got detected by
the EDR so one F day I was like okay H
let's try and execute something like
process hollowing something cool you
execute a go binary in Python that uses
uh process hollowing and then boom boom
Christmas light light on but because
everything was automated it got
completed there so always remember um
whenever you are doing this attacker
Defender postulation you need to test
your
mitigation so there was my mistake there
and I'm Shar my mistake and then next
thing is say maybe you're doing a data
exitation and you're trying to and then
the defender will like block you your
web hooks right you block your DNS and
okay maybe I have backup so then next
one okay when I'm trying to run previous
escalation okay what will happen to
Defender Defender will say maybe it will
disconnect suspend aom minute your
instance and then what we you do maybe
you will do something like uh use a user
data to instantaneously run the commands
and then uh kill the instance for
example right so these are steps you can
do you you can plan in advance like okay
when I as adversary execute this action
what my Defender might do and if my
Defender was successful in their efforts
what should I do as adversary to
mitigate that so that when I'm executing
my actions I'm making their life more
difficult right so that's the mindset of
wargaming okay so this is still within a
team so once you have done your
wargaming then you have to think about
your delivery okay so I like to name it
quick attack and air strike so quick
attack in my terms basically means
fast right stealth and we prepare
prescripted payloads okay they will
execute and exit okay and that's one is
air strike this one is my favorite one
which I've not done yet it's quite it's
quite as whole basically I will just
trigger many alerts so much that they
don't know which one they're going to
look at and then in those millions or
maybe hundreds or thousands of alerts
one of them will be my intended action
okay so the would thin out the Defenders
um
Manpower right and some people would
prefer 8 hours of work instead of 24
hours of work to be honest so so when
this happens uh you're really thinging
out tinging out the entire defenses and
going in and buying yourself more time
so not every time in a rame engagement
you should
expect no detection in fact you should
always assume detected and then what
should you do when you get detected
that's why you always going with a plan
you always going with a mindset of what
should I do if I get detected what
should I do to get to mitigate this uh
counteractions from The
Defenders so once you have done okay you
can do your Ops infra confirmation okay
this is what we have da da da da and
then uh once this is done you'll do your
phases of attack so the phases of attack
well this this is something uh uh
something that I picked off from a uh
lesson I gave so you can use you can
draw like okay this is how your Tech
will work and then this is how uh the
phases will work so having this phases
Tech is not the best drawing right this
is like super Primary School level if
someone has a better way of using like
modeling or some stuff you can go ahead
but this is like Google St 101 so you
can you can derive okay this is what
happen so I left out the I left out the
the description so there's supposed to
be a box that describe okay what what is
phase one uh step one step two step
three so these phases and all right
would tell your team tell your white
cell what's going to happen Okay so any
concerns or what not you know people can
raise it up if they need to
okay so once you have confirmed your
attack plan which you know these lines
are very nice so you know it's
methodical way 1 two 3 4 5 6 7 8 right
then you go to your
manow okay your manow is very like rary
administrative stuff basically are
telling people okay these are my
operators these are my leads okay who
are my blue team who is my white sell
etc etc etc so this is very uh
administrative it's just part of your
plan right so you know who to look for
when things happen and then timings
right you always need to have timings so
maybe at a first hour when you start
your attack you doation then you do your
staging then you launch your stage
stages of attack and then you will Ex
fluctuate persistence and cover and then
you do Post expectation right so this
exactly pains out what will happen as a
team and if you fall if you fall behind
of Time ahead of time you know your time
and space you know what you can or
cannot do and you can plan a hit as well
on the ball right I on the go you can
plan a it so this is like a it's like a
timetable for you so it might not you
might not need to follow this strictly
but it is a representation of what you
can or cannot do in the time of space
right and of course there's always
expected H hour right and also expected
end of engagement right so projected end
let's say it should end within one week
but if let's say you are still not
detected and you want to push further
and see what kind of um things you can
get out of then you should have a hard
limit to stop because you cannot be in
the system forever well yeah so that's
just Ops planning okay o planning can
take one to two weeks just thinking
putting things together looking at a
post talking to your peers talking to
system owners you know right doing your
open source Recon all this and know
research takes a lot of
time okay once you're done with what's
planning of course you do contingency
planning okay you know uh there there
something something law right assume
anything will go wrong right whatever
can go wrong will go wrong so you always
need to have contingency of plan so why
similar how is it similar to O plan is
basically you take your phases of attack
you you mode it you change it so that in
case okay if x happen you can do this if
y happens we can do that so it's taking
all plan and changing it to like
variation A variation B variation C so
this is very simple okay then you need
to ensure spare resources are allocated
recup plan run book so for example if
your if you are detected okay what is to
run book right which contingency plan
you're supposed to
run and then scripts to execute
contingency because you know we want it
to be automated we don't want it to be
manual so just just like do slash Boom
the script okay and then indicators to
stop engagement this is very important
because if let's say there's a certain
uh there's a certain scenario or
condition that's being hit and because
of the condition we cannot continue we
must stop and declare it as a with Team
engagement okay so always remember
indicators to start engagement is super
important in stakeholder management
right you don't to make people
unhappy and yep One does not simply test
in production right so uh you need to
run your exports in your sandbox right
verify payload and production production
ready okay test and run your C2 with
agent so this testing the whole entire
thing ready right before you run okay
Rec record and detail the expected
behaviors what this means is that when
you run let's say a payload and you know
that this is the is the it is the uh
behavior of the payload or the behavior
of a script then you should you should
record it in a way that when people read
when the uh IR team or detection
engineering people read they know what's
happening right they know that this is
supposed to be expected Behavior right
sometimes it's very as simple as writing
one line say this payload does this done
right it can be that right so this helps
them with a Reconciliation the
future right second or third person
verification this like just check get
check check check right and then
approval of attack so basically the
attack plans that you have come out in
the HS plan okay let's get it agreed in
terms
right but it's a more formal saying
approval so just let it get agreed
internally and say let's do this this is
the way we're going to do it right
there's no point doing it if you know
the team uh majority doesn't agree so we
must uh agree as a
team so that's end off pre-ops like
that's a lot of things
and I still some time so um now this is
when you test in production okay so uh
usually there will be two weeks before
two weeks before usually two week before
the execution you get like approval of
plan if you need to right certain rate
team do not need approval they just
execute once they approve it once they
agree internally but what I would
recommend is that get it approved two
weeks before with your stakeholders if
you need to if you do not need to get it
approved because you have a overarching
uh Charter that says rting can do do
whatever the hell they want by all means
you don't need the first step already
you can just go to the second second
step right start managing your C2 okay
monitoring it right right infrastructure
as well is it up you know so you should
set some like um you should go a bit of
devops mindset already know put some
monitoring on the infrastructure right
are we getting call backs right pipeline
right when you create payloads with
pipelines how can you manage it how
should you how how should you manage the
payloads how should you publish it all
this you know how do you keep it under
the rep so that nobody knows what's
happening right te sh team coordination
is basically saying okay this person is
doing this this then the other person is
doing another task so how do you
coordinate and say okay you do this and
I do that right so this helps um this
entire team to run effectively right
everybody knows what they're doing right
so you
coordinate then Target monitoring what
they means is that you monitor your
Target and its behaviors after you have
done your execution the went down no it
didn't went down good he didn't he
didn't break anything production but why
you why should you still continue the
monitor because sometimes the aftermath
comes in like hours or days after
because you did something and then it
cuts it result in a cascading failure
days later this can happen um I
personally didn't do it as a team
engineer but I did it as a softare
engineer I dropped a table I Dro a
column by accident and then but thank
God it was in staging and then only it
was was discovered hours later right so
always do Target monitoring to ensure
that your target is still healthy right
you you're not supposed to break things
but of course accidents can
happen Okay back door management is
simply as as as saying okay I implanted
this back door in the cloud okay I can
use this method or that method but I
must check if the back door is still
valid or not okay so how do you do this
is periodically you try and do some of a
um sanity check on the on the resource
and see if it exist or not right or by
by by trying to Ping the the resource or
by trying to execute certain commands
Okay or trying to do some AWS gcp or
Azure C that would result in action or
reaction from that
resource okay the artifact management
whatever you have gotten from the
environment in the CL environment you
should manage it properly you should
encrypt it okay you should keep it well
record order and make sure it's all in
Ops lock right this Ops lock basically
tells everyone what has been done so the
moment you have started executing your
operation you need to ensure every
single action is locked what I mean by
that is when you have a terminal open
when you type something that is
targeting a resource you need to lock
that into your opsl okay you can do it
in Google Sheets you can do it in your
own ter locks and then you know
transpose it into some kind of Excel or
CSV format whatever that fits your use
case is right and then contingency
activation is basically right if during
Ops in production if any con contingency
needs to be activated activate them
so now we have finished your Ops ready
in the cloud
environment okay it's time to do poost
cleanup okay this is where you say hi
guys it's me okay and then you do UPS
slau reconciliation right report
generation so how do you do this report
generation it's very simp
take whatever you have done in pre-ops
and during Ops and just try in right
because that is why I have a heavy
empasis on pre-ops because with this
pre-ops right everything is planned uh
planned and modeled out we can just copy
and paste to post Ops and then say hey
this is what was done and if there's any
changes what do you do just change the
model accordingly and put it back into
the report that simple right then you
Deb a stakeholder have a long nice chat
with your IR and detection detection
team right buy them some whiskey you can
clean up the environment okay don't
forget to do that you do not want to
leave any back do for other adversaries
to take advantage of right um remodel
the attack process if you have to so if
let's say the attack process change due
to the uh shifting nature of production
environment you have to change your
attack model so that it reflects what
you actually did and lastly you reflect
and improve as a
team
so uh that is the end okay I also like
to take this opportunity to thank this
uh thank people who mentored me all
these years uh my Collective knowledge
in planning with Team engagement for the
cloud uh it's not just what I've went
through it's also what people have
taught me so some some of you are here
and you know who you are I I thanks for
mentoring me this years and yeah if any
questions want contact me this is me my
LinkedIn there's no other slides already
so thank you
[Applause]
all right thanks Chun for the insightful
sharing and the interesting stories um
yeah we still have a bit of time so we
will open up to the floor for any
questions you might
have
yeah hi um just would like to understand
uh I'm not really in the rate teaming
but just curious
uh in the event of conducting a rate
teing uh exercise uh do you have any
contingency plan in case a ra attack is
also happening at the same
time okay so um that's where we where we
stop immediately right if we if we
realize that there's more than 1%
environment something is wrong that's
where we have the uh activation to stop
and let the detection engineer I team
hey someone's in there so we should stop
when we see such things
yeah and then let them do their job
two that's why we have the C2 management
P management the thing during Ops you
should know the the behavior of whatever
you generate your infrastructure you
should be monitoring it so that only you
yeah they expect all come after
yeah all right any more
questions
okay hi um Melvin Hill so can I just
check how long is each phase of the red
team roughly usually
th uh pre-ops um pre-ops and doing
Ops so this one two to six months right
so this one depends on when you're
starting when
you're so it could be like I I start on
1 May and maybe end on 30th June for
example so there's a there's a heart me
expected St let's say expect stth June
but if I'm still not detected maybe I
can try and stretch a b and
do so those are the two timings that we
have to follow but it's a bit
debatable follow
hard May stretch depending
on and po usually is where we try to do
the report as fast as possible uh but
accurately as well so all these element
and
elements create the report for effects
share
with usually share with we get Comm
leaders okay and then whoever you share
with engineering leaders holders
so that should take about one
month it depends so this and this is
quite fixed but this can be
stretched years who knows you deep in
the system M but in the cloud it's quite
flat because people can do defense in
dep infrastructure but you h a API is
the model of all
after
some right cool any more
questions all right you really do need a
mic hi uh so I got two questions
uh this is basically um internal
penetration testing right so my first
question is I'm also interested in
detecting the threats let's say a hacker
who already has a C2 Channel
inside so is that part of red team or is
that part of ir and detection team
that's number one and because second
question is my company is small I'm
looking at P penetration testing so uh
we can't afford to build a red team
uh for ourselves and we want to engage
an outside partner so from a management
perspective right what are the things
that uh I should take note of uh from a
from a stakeholder perspective that I
should you
know take yeah consideration
thanks okay so first of all
um if there is another attacker in the
channel it is the Defenders job to do
the their job scope right though we can
help as the adversary simulators and
emulators but they got their run books
their playbooks their systems they know
they know best right they know the
system so it should be their scope but
we can support in an event where we
detect there say third party in the
entire you know sou Sans we doing with
the systems but from the from a question
about you know we have low on budget or
this right then I say you are not mature
as a company you're not mature enough to
do a full-fledged with Team engagement
but that does not mean that you should
not do right you should scope your
systems based on these requirements and
needs and maybe do a ski down uh V
assessment right and then from there we
will look at something like you know
what the technology risk your
organizational risk okay and then you
yourself can make the Judgment call
right because is the processes are still
uh small skill so having a r engagement
will be overkill for a small skill
business and I totally agree with you on
that
[Applause]