For this section, we'll be going over some basics of evasion, what it is an example of how Blue Teamer
could spot malicious activity and a few videos that show some quick demos like how Red Teamer can minimize
their tracks from getting caught.
When red team is doing anything on a target network, it is in the red team's best interest to do it
while remaining undetected, because in the end, it comes to a cat and mouse game where a Blue Team is
looking for your presence on the network and trying to kill your connection one way or another. Two of the
most common ways a blue teamer might catch and stop you, are either by terminating the connection to your
IP address or stopping your process and or deleting your payload.
This is, of course, assuming they just want to get rid of you instead of taking a step back and watching
what you're doing every step of the way.
That way they can learn what your objective is.
Now, there are ways to mitigate these actions as a red teamer, depending on how advanced and skilled
you are,
but also some C2 post exploitation frameworks have added features to help in this arena as well.
When it comes to mitigation, your mindset as a red teamer must be in the realm where you are asking
questions like "How do I blend into my target network?"
"What looks normal?" "What security defenses are implemented on the network?" Like maybe an IDS or IPS,
a firewall, any host base loggers, or an antivirus or anything else.
The more you understand your target environment, the better the chance of you blending in.
Think of it this way.
If you cash out a million dollars from your bank account right now and you're in a ghetto part of town,
would you walk out with a business suit with the money in a nice briefcase, or would you wear something
that blends into your environment, like maybe put the cash in a worn out backpack and walk normally
through the crowd?
It is this type of awareness of knowing your target network that's important.
You might be wondering what are some options for you to do evasion on the target environment? It may
require some knowledge of your environment you're going up against.
Well, the first method is pretty straightforward. To disable any security defenses you run into.
This would sort of be like that spy movie approach of shooting down cameras, although it is very effective
at preventing your tactic from being stopped by anything automated,
it could be a major red flag for any active security defender on the network if they notice their defenses
going down.
This is probably not the best approach
if you want to stay under the radar and you don't want your target to know you were ever even there.
The next option is to blend into your environment, sort of like walking into the person's territory
undetected by wearing the same clothes or uniform and maybe a fake badge
that seems right. For the target network,
you could potentially do this by doing things like making your HTTP, HTTPS, or any other protocol's
traffic for that matter, very similar to the rest of the traffic going on. Maybe using names for things
like processes, executables and such, that blend in with the rest, changing timestamps of files uploaded
to others around it, or maybe even stealing and using the session of the person already logged into
the target.
Last example is by using unwatched areas.
This requires you to know way more about the security defenses you're going up against. Sort of like if
you know, a security guards daily patrol path and knew the areas he never checks.
For example, maybe there's a host based logger that you grab the configuration files for and find what
areas it targets and which areas it ignores.
You may ask yourself the question, "Is there any exclusion?"
A simple example is the antivirus could have an added exclusion for a folder which won't ever flag
for any virus
put it in the folder.
So as a red teamer, you successfully find a way to blend into your target environment, accomplish
your tasks and decide it's time to leave, but since there's logs left behind, whether suspicious looking
activity or normal is probably best to clear those tracks.
You may want to check for any Windows logs on the system you're on,
also check if there's any remote server that's collecting logs.
Check if you can access the log server and if so, can you clear specific logs off it?
What about any security tools installed on the system?
Are there any additional logs from these tools being stored somewhere for the security defenders to
view later?
Also be concerned about any potential log that could be created
when you close a session to a system. When conducting any red team operations, it is vital to ensure
you make note of every artifact you put on the target system.
These include any scripts, executables, or any files you staged in another directory, whether compressed
or not.
Now, if you're a defender and trying to find malicious activity, you might find yourself looking through
many, many logs if you're trying to pin down where the red teamer might be. Although depending on which
logs to narrow down on can really depend on how advanced your opponent is.
For example, a beginner level adversary might depend on automated tools to do their tactics and might not
even be concerned as much about evasion.
You could probably just take a step back and let your security measures do most of the work or alarm
you where the red teamer is.
On the other hand, the more advanced the red teamer is, the more effort and thinking you might have
to put into figuring out what's going on.
For example, maybe you find a point where the attacker was and are trying to follow the tracks to figure
out what the attacker did and where the attacker currently is on the network.
Maybe you'll be thrown off when trying to follow obvious tracks that the attacker placed on purpose
to try to throw you off. Whatever the case is,
it is vitally important for someone in cyber security to understand general red team tactics and how
they work, to understand how they can take apart what's going on in their network.
Let's use the antivirus on your computer as an example, sure, if you keep it up to date, it'll catch
most, if not all, the latest automated payloads and viruses out there.
But if an adversary targeting you spent more time on his craft, he could easily obfuscate his payload
to bypass any antivirus.
And in this case, if you depend on automated antivirus scanners waiting for a flag to come up for malicious
activity, you'd be doomed against any more advanced adversary.
By having knowledge of how a payload works or any malware for that matter, you could manually find that
suspicious activity on your computer or network and eradicate that issue.
So in the end, it really depends on your skill as a defender or attacker on how well you can either
catch or evade on the target network.