Trainer Name: Yash Bharadwaj , Manish Gupta

Title: StealthOps: Red Team Tradecraft Targeting Enterprise Security Controls

Duration: 3 Days

Dates: Sept. 20, 2023 To Sept. 22, 2023

Training Objectives

With the increase in Ransomware attacks, fortune companies, and business critical companies have overlooked security controls placement and configuration. This training helps enhance the visibility of Enterprise Based Security Controls.

This training focuses on the tactics, techniques, procedures, and tools of Threat Groups - how stealthily they operate, and how they circumvent the security mechanisms employed in a patched & monitored environment.

Training level: Intermediate; Advanced

Training Outlines

Full Course Abstract :

Day 1 (Red Team Resource Development)

  • Security Controls
  • Resource Development
  • C2 & Server-less Re-director Setup (AWS / Azure)
  • Working Initial Access Attack Vectors
  • Bypassing Initial Security Controls (Proxy, DNS, Sandbox)
  • .NET <3 Serialization with Initial Access TTP [1 Exercise]
  • End-Point Defender Features (AMSI, CLM, UAC, Applocker, WDAC, WDAG, WDEG (ASR))

Day 2 (Tradecraft Development for Offensive Operations)

  • APT29 Initial Access [1 Exercise]
  • CSharp Essentials [4 Hands-on Labs]
  • Offensive C# Trade-Craft [3 Hands-on Labs]
  • Windows API Essentials
  • Utilizing Windows API for Red Team Profit [3 Hands-on Lab]

Day 3 (Utilizing Tradecraft for Red Teaming in Hardened Environment)

  • AMSI, CLM, ASR Rules
  • File-less UAC Bypass
  • Application Whitelisting: Applocker, WDAC
  • Abusing Windows Features
  • Introduction to Telemetry Collection
  • ETW & EDR's
  • General Evasion Areas [4 Exercises]
  • Native APIs
  • Unhooking by Patching
  • DLL Unhooking
  • Direct Syscalls
  • Challenge Lab Scope of Engagement [SOE]

What to Bring?

  • A system with at least 16GB RAM having a VMWare workstation installed
  • Attacker Linux Box [Parrot] With Internet Connectivity

(Team will share updated documentation 2 weeks prior to the training date.)

Training Prerequisite

  • Comfortable with command line environment
  • Fair knowledge of Penetration Testing Methodology

Who Should Attend?

  • Penetration Testers / Red Teams
  • System Administrators
  • Malware Developers
  • SOC analysts
  • Threat Hunting Team
  • Last but not least, anyone who is interested in strengthening their offensive and detection capabilities

What to Expect?

  • With the increase in Ransomware attacks, it is widely known that Fortune companies, as well as business critical companies, have overlooked security controls in their placement and configuration. This training helps in enhancing the visibility of Enterprise Based Security Controls in the organization.
  • Training will brief on the tactics, techniques, procedures, and tools of Threat Groups like how stealthily they operate. OR How they circumvent the security mechanisms employed in a patched & monitored environment.
  • Candidates will get enhanced threat visibility capabilities in both Host & Network-level on Windows, and Linux Environments.
  • Candidates will learn effective ways to get initial access & ways to circumvent security controls

What attendees will get

  • Virtual machine infrastructure provided by trainers, all course material including commands, slides, and enterprise lab walk-through, 10 days full challenge lab access with technical support during and after the training class.
  • Upon completion of Challenge Lab, Candidates will earn CyberWarFare Labs Digital Badge as well.

What not to expect?

  • 0 Day Exploit or vulnerability disclosure

About the Trainer

Yash Bharadwaj, Co-Founder & Technical Architect at CyberWarFare Labs with over 5.5 Years of Experience as a Technologist. Highly attentive towards finding, learning, and discovering new TTPs used during offensive engagements. His area of interest includes building Red / Blue team infrastructure, evading AVs & EDRs, Pwning On-Prem infrastructure & Multi-cloud attacks. Previously he has delivered hands-on red/blue/purple team training/talks/workshops at Nullcon, X33fCon, c0c0n, NorthSec, BSIDES Chapters, OWASP, CISO Platform, and YASCON. You can reach out to him on Twitter @flopyash

Manish Gupta is the Director of CyberWarFare Labs and has 6.5+ years of expertise in offensive Information Security. Where he specializes in Red Teaming Activities in enterprise Environments. His research interest includes Real World Cyber Attack Simulation and Advanced Persistent Threat (APT). Previously he has presented his research at reputed conferences like Blackhat USA, DEFCON, Nullcon, c0c0n, BSIDES Chapters, X33fcon, NorthSec & other corporate training, etc.