{"id":4291,"date":"2019-08-12T11:05:34","date_gmt":"2019-08-12T03:05:34","guid":{"rendered":"http:\/\/mayanknauni.com\/?p=4291"},"modified":"2019-08-12T11:14:32","modified_gmt":"2019-08-12T03:14:32","slug":"adversary-emulation-tools-for-red-blue-teams","status":"publish","type":"post","link":"https:\/\/mayanknauni.com\/?p=4291","title":{"rendered":"Adversary Emulation Tools for Red \/ Blue Teams"},"content":{"rendered":"\n

Disclaimer: \u2013 This note was written by me (Mayank Nauni) in my \npersonal capacity. The opinions expressed in this article are solely my \n own and do not reflect the view of my employer or my preference towards\n any of the OEMs.<\/em><\/p>\n\n\n\n

This long weekend, I was\nthinking of an automated pipeline for Blue \/ Red Teams which could potentially perform\ntheir routine testing, freeing them to address other critical tasks,\nin short, I was looking for Adversary Emulation tools<\/p>\n\n\n\n

Driving Factors for Adversary Emulation Tools <\/strong><\/p>\n\n\n\n

\u00b7       \nFirewalls\nand Anti-Virus can be easily bypassed by the attackers<\/p>\n\n\n\n

\u00b7       \nExisting\nSecurity policies are reactive i.e. detect and address <\/p>\n\n\n\n

\u00b7       \nExtreme\nshortage of InfoSec professionals <\/p>\n\n\n\n

What should be the focus: –<\/strong><\/p>\n\n\n\n

\u00b7        Analyse the network traffic and identify anomalous activity , proactive approach<\/p>\n\n\n\n

\u00b7       \nThreat\nmodelling, conduct research, analysis and correlation across source data sets<\/p>\n\n\n\n

\u00b7       \nNotify\nthe users promptly on the possible attacks <\/p>\n\n\n\n

Did some research and\nstumbled upon this wonderful tool called Caldera, it is an automated adversary\nemulation system, built on the ATT&CK framework, that performs\npost-compromise adversarial behaviour inside the networks.<\/p>\n\n\n\n

What did I like about Caldera:-<\/strong><\/p>\n\n\n\n

\u00d8  It keeps it real<\/p>\n\n\n\n

\u00d8  Focuses on end to end security <\/p>\n\n\n\n

\u00d8  Reusable <\/p>\n\n\n\n

Follow these documents to\nlearn about Caldera<\/p>\n\n\n\n

https:\/\/www.blackhat.com\/docs\/eu-17\/materials\/eu-17-Miller-CALDERA-Automating-Adversary-Emulation.pdf<\/a><\/p>\n\n\n\n

https:\/\/www.mitre.org\/research\/technology-transfer\/open-source-software\/caldera<\/a><\/p>\n\n\n\n

https:\/\/github.com\/mitre\/caldera<\/a><\/p>\n\n\n\n

 <\/h1>\n","protected":false},"excerpt":{"rendered":"

Disclaimer: \u2013 This note was written by me (Mayank Nauni) in my personal capacity. The opinions expressed in this article are solely my own and do not reflect the view of my employer or my preference towards any of the OEMs....<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[53],"tags":[49,51,52,50],"class_list":["post-4291","post","type-post","status-publish","format-standard","hentry","category-cyber-security","tag-adversary-emulatiom","tag-blue-team","tag-cyber-security","tag-red-team"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t