dylan

red team @mdseclabs

[dylan @_batsec_]

defend your memory.

coming soon.

[Dominic Chell 👻 @domchell]

@MDSecLabs will be running our Red Team Capability Training out in #BlackHatUSA26 again this year. This year the course features a big refresh, with a bunch of new additions on the latest evolving techniques!

Early bird discounts end this month! @BlackHatEvents
https://t.co/l3uAga4TS5

[dylan @_batsec_]

A couple more seats have been added to our AdSim and CapDev training at BlackHat Asia in a few weeks https://t.co/NzpDIzXX6o

[Dominic Chell 👻 @domchell]

This year we're bringing our Adversary Simulation and Capability Development training to Asia for the first time with @BlackHatEvents #blackhatasia26 https://t.co/ipPoV0UwvJ

If you want some hands on red teaming and tool development training from seasoned experts (@_batsec_ ), the early bird pricing is now available!

[dylan @_batsec_]

@_xpn_ and with all the KLM strikes etc, i’m sure even if i had come it would not have been a smooth journey

[dylan @_batsec_]

i can’t make it to redtreat this year sadly.

my karaoke set will have to wait till next year.

[dylan @_batsec_]

@NullMode_ means you’ll have to sing wonderwall in my place as well

[dylan @_batsec_]

@_xpn_ spent a bit too long in 🇪🇺 this year… bloody brexit

[dylan @_batsec_]

@__invictus_ my powers are stronger than i ever realised

[dylan @_batsec_]

join the waitlist https://t.co/Yz6hgyboq5

[dylan @_batsec_]

defend your memory.

coming soon.

[dylan @_batsec_]

@Teach2Breach @frodosobon @inversecos the large difference in standards when it comes to red teams

[dylan @_batsec_]

i really do not understand this recent take that “socks is all you need”.

imo nothing highlights the difference in standards of what a ‘red team’ is than this.

[WaaWaa @frodosobon]

Red teaming will go back ten years ago. Proxy Socks (nothing better than chisel) and no Fork&Run / BOF ... Only proxychains

[dylan @_batsec_]

the point is to use the necessary tradecraft to achieve the objectives, the client then advances their ability to detect this tradecraft and the cycle continues.

this type of exercise is mostly pointless unless the client already has a high level of maturity.

that’s why purple team exercises are more universal and offer the most benefit to organisations looking to start building their maturity level.

[dylan @_batsec_]

* CTO

[dylan @_batsec_]

i need to just start tweeting the CEO the next time i’m doing targeting for an op.

[DHH @dhh]

@BrandonTahedl We use Tailscale + GitHub for user/access management. LibreOffice, but rarely. Nothing for MDM, but there is Fleet MDM + Sandly Security.

[dylan @_batsec_]

@_EthicalChaos_ @frodosobon @inversecos for sure, there is a lot of value and lessons that are learnt from perform an effective threat hunt. tracking a TAs pathway thru the network and identifying alternative c2 channels or persistence is not an easy task.

[dylan @_batsec_]

@_EthicalChaos_ @frodosobon @inversecos yeh that’s true but a SOCs response to a detection is a whole new topic. this is why I like running a “detect and evict�� scenario at the end of an RT and raising the noise level massively. detection means nothing without eviction.

[dylan @_batsec_]

@_EthicalChaos_ @frodosobon @inversecos agreed, but emulation is not a red team. if a client what to check if they would catch a TA employing the same TTPs someone else caught them using, then that’s fair. but it’s a purple team.

[dylan @_batsec_]

@kyleavery

[dylan @_batsec_]

does the concept of a purple team not exist outside europe? why is the difference between simulation and emulation even a conversation.

[dylan @_batsec_]

@kyleavery yep, don’t get me started on this. the lack of any meaningful regulation is evident and really concerning.