I really didn't want to miss a chance to get in a good,
hackneyed Sun Tzu quote in there, and this seemed like the perfect time.
These tools are made and distributed publicly for free so that you can
understand the techniques that adversaries are using, or will be using in the
future, and prepare your organization accordingly.
It's like when you're on a long road trip with your friends and
you're planning for the future zombie apocalypse.
Do you take over an old bank, do you hollow out a tanker at sea?
What defenses do you have ready, is barbed wire enough?
Are you going to have electricity?
We all know there's no one answer to that equation.
And first of all, what kind of zombies are you dealing with?
Are these slow shuffley dumb zombies or like World War Z zombies that can act
as a group and sprint at full speed indefinitely? It matters, and red team
adversary emulation matters because it's letting you know what kind of
zombies you have to defend against so that you can test your defenses to see
what's going to keep you safe.
EDR is catching on to PowerShell and memory tricks,
but tools like Covenant are changing the game,
and you can guarantee that cybercriminals and national‑level APTs
alike are already working with these capabilities.
When you start using this in your environment,
make sure to look up listener profiles, find ways to make them tricky,
make them blend in, and make them hard to find.
If you want to take it to the next level,
get into using the exposed Covenant API to integrate these
capabilities with other tools and work on automated actions.
Command and control frameworks and channels are really interesting in
general because if you can't talk within a network,
you can't really operate. With a few exceptions, but even things like
Stuxnet had to spread in one way or another, and understanding how
the next generation of C2 is unfolding is good information whether
you're on the red or the blue team. And now, covenant is one more
tool in your tool belt.
Thank you for watching Pluralsight,
and I hope you join me and other authors to add to your
arsenal of red team tools in the future.