Now that covers the offensive cyber guns for hire, the external teams
that are paid engagement to engagement, but there's a red team that
operates as part of the organization as well.
There are as many versions of a security organization
structure as there are memes for Tiger King,
but one general construct that seems to be agreed upon is
red team separate from the blue team,
operating without much contact but linked by threat intelligence.
The organization concerned about specific threats either to them by
name or simply their industry has the red team cyclically emulate
adversaries as the blue team attempts to run its continuous monitoring
and incident response functions.
One way that this is leveraged is as sort of a constant check up for the
detection of capabilities of your defensive functions.
Ensure that all that risk that you think is mitigated with policy is
actually mitigated in practice and in real‑time,
as well as serving as a validation for the budget being spent on security.
Now I don't want to get into a CISO debate about how
to leverage internal red teams,
but the main point is to identify you as someone who can benefit from
the tools and techniques presented in this path, and if you're part
of a team that functions in this way,
or simply want to provide these same functions for your team,
then this applies to you.
And on that note,
not every organization is large enough or funded well enough to
have their very own red team persistent threat,
ensuring that those mitigations and detections are paying off.
Instead,
you may have a team that is responsible for all the things. Now often I see
teams that are essentially responsible for everything.
They are the security team. From secure administration,
checking boxes and saving lives by turning off UNC path's
functionality and GPOs, or building detection mechanisms,
fielding alerts, performing response, and then,
after all of that, they just kind of stop.
They think maybe that's good enough.
Or in some people's mind,
maybe they're thinking that they can emulate attacker activity,
but that's too much power, or they might break something.
Or maybe they said, I was told I was blue team,
and I'm not about to change my whole outfit now and look ridiculous.
But the truth is that the same team that perform detections can have
a top‑notch individual that's closing the loop.
They are looking at root cause of incidents and then testing to see if
that secure admin functionality actually checked the correct box, or the
engineering team made sure that that packet wasn't dropped this time, or
whoever it is working detections properly wrote that Suricata rule.
Don't just assume that everything you did is going to work without
testing it, and for that individual or group within the security
organization, you are now a honorary red team member, and welcome to the armory.
Now I just called this the armory and a lot of ways
that's true, but more than anything, it just sounded cool in the moment to me.
But like any good origin story,
you need to be shown how to wield these powers without causing collateral
damage, and that starts with intelligent and focused emulation, because
without clear and direct purpose for attacker emulation,
the first collateral damage is going to be your salary.
Remember, business impact first.
If it doesn't matter to the business, then it's just a hobby for you.
So where do you start?
Well, this is where you can map to MITRE ATT&CK.
There's a lot of goodness in the MITRE ATT&CK matrices for more than one reason.
There's a comprehensive list that's tied to the threat actors,
and later we're going to take a look at the ATT&CK Navigator as well.
I'm going to show you how to map those attackers to techniques to really
leverage all of the data sets together for red team and defensive testing,
and every single one of the courses in this path is going to map directly to
one or more specific technique. Starting with PRE‑ATT&CK, the overarching
categories are called tactics.
These tactics map out to known and documented
adversary activity all pre‑compromise,
and then the enterprise ATT&CK matrix picks up essentially from
initial exploitation through impact on objective. Each of these
tactics splits out into specific techniques,
and this is what I really like about this framework is that we get out of the
land of the mystical generalizations and "10,000 foot views," and directly
into the hands‑on techniques that are being used.
So much so that they split them again into sub‑techniques
to ensure that the emulation capability,
as well as the associated detections are focused enough on
technical implementation that those sneaky adversaries don't
slip through the gaps too easy.