בס״ד

⚜️ Aภl๏miuภuຮ ⚜️

⫷ HacKingPro ⫸
⫷ TryHackMe | KoTH ⫸
⫷ Privilege-Escalation⫸
⫷ ScanPro | Linfo | Diablo ⫸
⫷ Offensive-Security | PenTest ⫸
⫷ Goals | Studies | HacKing | AnyTeam ⫸

• TTP - Tactics, Techniques and Procedures
• TI - Threat Intelligence
• CTI - Cyber Threat Intelligence
• ISAC - Information and Sharing Analysis Centers

• 1 Reconnaissance:
  • No identified TTPs, use internal team methodology
• 2 Weaponization:
  • Command and Scripting Interpreter
    • PowerShell
    • Python
    • VBA
    • Ruby
    • Bash
    • Shell
  • User executed malicious attachments
• 3 Delivery:
  • Exploit Public-Facing Applications
  • Spearphishing
• 4 Exploitation:
  • Registry modification
  • Scheduled tasks
  • Keylogging
  • Credential dumping
• 5 Installation:
  • Ingress tool transfer
  • Proxy usage
• 6 Command & Control:
  • Web protocols (HTTP/HTTPS)
  • DNS
  • Actions on Objectives
  • Exfiltration over C2

• Determine required knowledge and skills
• Identify and implement alternate methods for bridging knowledge gaps
• Develop roles and responsibilities guide
• Develop red team methodology
• Develop TTP guidance for engagements
• Includes Bag of tricks
• Develop data collection guide and tools
• Develop operational process plan
• Develop communication plan template
• Develop ROE template: Rules of Engagement (RoE)
• Develop technical briefing template
• Develop report template: Diablo

• Client Name
• Service Provider
• Timeframe
• General Objectives/Phases
• Other Training Objectives (Exfiltration)
• High-Level Tools/Techniques planned to be used
• Threat group to emulate (if any)

• Header
  • Personnel writing
  • Dates
  • Customer
• Engagement Dates
  • Reconnaissance Dates
  • Initial Compromise Dates
  • Post-Exploitation and Persistence Dates
  • Misc. Dates
• Knowledge Required (optional)
  • Reconnaissance
  • Initial Compromise
  • Post-Exploitation
• Resource Requirements
  • Personnel
  • Hardware
  • Cloud
  • Misc.

• Objectives:
• Operators
• Exploits/Attacks
• Targets
  • Users:
  • Machines:
  • Objectives:
• Execution plan variations

• Engagement Planning
  • ROE
    • Event Communication plan
    • Distribute Deconfliction Process
    • Entry point/method
    • Scope
    • Goals/Objectives (should address at least one of the following)
      • Protect
      • Detect
      • Respond
      • Restore
    • Target Restrictions
    • Target Infrastructure / Asset verification / Approvals
  • Scenario Development
  • Operational Impact planning
• Develop threat profiles
  • Network and Host Activity
  • IOC Generation (incl subsequent Analysis) and Management
• Plan threat infrastructure
  • Tier 1
    • IPs
    • Systems
    • Redirectors
    • PPS
  • Tier 2
    • IPs
    • Systems
    • Redirectors
    • PPS
  • Tier 3
  • IPs
  • Systems
  • Redirectors
  • PPS
  • Deploy tools to infrastructure
• Data collection repository

• A THREAT’S ABILITY TO ACCESS TO COMMON AND RESTRICTED AREAS (PHYSICAL)

  • What ability does a threat have to access common areas?
  • What ability does a threat have to access restricted areas?
  • Can a threat use access gained to enable cyber capabilities?
  • What impacts can a threat have through gained access?

• A THREAT’S ABILITY TO ACCESS KEY/CRITICAL SYSTEMS

  • Can a threat access key/critical systems?
  • What impacts can a threat have on key/critical systems?

• A THREAT’S ABILITY TO MOVE FREELY THROUGHOUT A NETWORK

  • What ability does a threat have to freely move throughout a network?

• A THREAT’S ABILITY TO GAIN DOMAIN WIDE AND LOCAL ADMINISTRATIVE ACCESS?

  • What ability does a threat have to gain local administrative access?
  • What ability does a threat have to gain domain administrative access?
  • What ability does a threat have to gain elevated access?

• A THREAT’S ABILITY TO ACCESS OR IDENTIFY SENSITIVE INFORMATION

  • What ability does a threat have to access sensitive information?
  • What ability does a threat have to identify sensitive information?

• A THREAT’S ABILITY TO EXFILTRATE DATA OUTSIDE AN ORGANIZATION

  • What ability does a threat have to exfiltrate data outside an organization?
  • How much data must be exfiltrated to impact an organization?

• A THREAT’S ABILITY TO ACT UNDETECTED FOR A GIVEN TIME FRAME

  • How long can a threat go undetected?
  • Can a threat achieve its goals undetected?
  • What must a threat do to stimulate a reaction from an organization?

• A THREAT’S ABILITY TO PERFORM OPERATIONAL IMPACTS

  • What impacts can a threat perform against an organization?
  • How can a threat affect X?

• Rules of Engagement
  • Executive Summary
    • Overarching summary of all contents and authorization within RoE document
  • Purpose
    • Defines why the RoE document is used
  • References
    • Any references used throughout the RoE document (HIPAA, ISO, etc.)
  • Scope
    • Statement of the agreement to restrictions and guidelines
  • Definitions
    • Definitions of technical terms used throughout the RoE document
  • Rules of Engagement and Support Agreement
    • Defines obligations of both parties and general technical expectations of engagement conduct
  • Provisions
    • Define exceptions and additional information from the Rules of Engagement
  • Requirements, Restrictions, and Authority
    • Define specific expectations of the red team cell
  • Ground Rules
    • Define limitations of the red team cell's interactions
  • Resolution of Issues/Points of Contact
    • Contains all essential personnel involved in an engagement
  • Authorization
    • Statement of authorization for the engagement
  • Approval
    • Signatures from both parties approving all subsections of the preceding document
  • Appendix
    • Any further information from preceding subsections

• TryHackMe: Red Team Engagements:
  • Learn the steps and procedures of a red team engagement, including planning, frameworks, and documentation.
• Red Teaming Toolkit

This tool kit is very much influenced by infosecn1nja's kit. Use this script to grab majority of the repos.

NOTE: hard coded in /opt and made for Kali Linux

• Total Size (so far): 2.5+Gb