One Day Left! Get an iPad, Tab A, or $250 Off with your OnDemand registration

Tokyo Winter 2021 - Live Online

Virtual, Japan Standard Time | Mon, Nov 29, 2021 - Sat, Dec 11, 2021

SEC699: Purple Team Tactics - Adversary Emulation for Breach Prevention & Detection

Mon, November 29 - Sat, December 4, 2021

Course Syllabus  ·  36 CPEs  ·   Lab Requirements
Instructor: Staff  ·  Price: 7,340 USD

SEC699 is SANS's advanced purple team offering, with a key focus on adversary emulation for data breach prevention and detection. Throughout this course, students will learn how real-life threat actors can be emulated in a realistic enterprise environment. In true purple fashion, the goal of the course is to educate students on how adversarial techniques can be emulated and detected.

A natural follow-up to SEC599, this is an advanced SANS course offering, with 60 percent of class time spent on labs. Highlights of class activities include:

  • A course section on typical automation strategies such as Ansible, Docker and Terraform. These can be used to deploy a full multi-domain enterprise environment for adversary emulation at the press of a button.
  • Building a proper process, tooling, and planning for purple teaming
  • Building adversary emulation plans that mimic real-life threat actors such as APT-28, APT-34, and Turla in order to execute these plans using tools such as Covenant and Caldera.
  • Building a proper process, tooling, and planning for purple teaming
  • In-depth techniques such as Kerberos Delegation attacks, Attack Surface Reduction / Applocker bypasses, AMSI, Process Injection, COM Object Hi-jacking and many more...
  • SIGMA rule-building to detect the above techniques.
  • A spectacular capstone that pits red and blue against one another. While red attempts to infiltrate the organization, blue builds a detection capability to detect adversary techniques.

Course authors Erik Van Buggenhout (the lead author SEC599) and James Shewmaker (the co-author SEC660) are both certified GIAC Security Experts (GSEs) and are hands-on practitioners who have built a deep understanding of how cyber attacks work through both red team (penetration testing) and blue team (incident response, security monitoring, threat hunting) activities. In this course, they combine these skill sets to educate students on adversary emulation methods for data breach prevention and detection.

The six-part SEC699 journey is structured as follows:

  • On day 1, we will lay the foundations that are required to perform successful adversary emulation and purple teaming. As this is an advanced course, we will go in-depth on several tools that we'll be using and learn how to further extend existing tools.
  • Days 2 to 4 will be heavily hands-on lecturing a number of advanced techniques and their defenses (focused on detection strategies). Day 2 focuses on Initial Access techniques, day 3 covers Lateral Movement and Privilege Escalation, while day 4 deals with Persistence.
  • On day 5, we will build an emulation plan for three different threat actors. These emulation plans will be executed in Covenant and Caldera.
  • On day 6, students will participate in an all-day lab that pits red and blue teams against one another. While red attempts to infiltrate the organization, blue builds a detection capability to detect adversary techniques.

Purple Team Course FAQ

You Will Be Able To

  • Build a purple team in your organization
  • Build realistic adversary emulation plans to better protect your organization
  • Develop custom tools and plugins for existing tools to fine-tune your red and purple teaming activities
  • Deliver advanced attacks, including application whitelisting bypasses, cross-forest attacks (abusing delegation), and stealth persistence strategies
  • Building SIGMA rules to detect advanced adversary techniques

What You Will Receive

  • A SEC699 course VM that includes a script that can be used to spin up a detection lab on-demand

Course Syllabus


Staff
Mon Nov 29th, 2021
9:30 AM - 5:30 PM JST

Overview

In section 1 we will lay the foundations for the rest of the course by:

  • Leveraging the power of automation to deploy our lab infrastructure.
  • Learning how to build a purple team in-house, covering process, approach, and tooling.
  • Tracking purple teaming exercises using VECTR.
  • Building an emulation and detection pipeline using a variety of available technology (SIGMA for detection rule development, and various adversary emulation tools, with a focus on Caldera).

Even if it's just the first day, this calls heavy hands-on, as students will complete five different exercises.

Exercises
  • Exercise: Getting to know the lab environment
  • Exercise: Introduction to VECTR
  • Exercise: Preparing our Elastic and SIGMA stack
  • Exercise: Preparing our adversary emulation stack
  • Exercise: Caldera

CPE/CMU Credits: 6

Topics
  • Introduction

    • Course objectives
    • Introducing CommandoVM
    • Ansible Automation
    • Purple Teaming Organization
  • Key Tools

    • Building a stack for detection
    • Rule-based versus anomaly-based detection
    • Building a stack for adversary emulation
    • Automated emulation using MITRE Caldera

Staff
Tue Nov 30th, 2021
9:30 AM - 5:30 PM JST

Overview

The following modules will be covered in section 2:

  • We?ll start with a ?state-of-the-art? overview on current attack strategies & defenses for initial execution.
  • Forcing Windows Authentication: Provided with network-level access (or an initial payload on a network-connected device), how can we obtain additional credentials through forcing other Windows systems to connect to us? Typical topics include the use of LLMNR, but also IPv6-based MitM attacks
  • Controlling execution on your endpoints using Attack Surface Reduction (ASR) rules. Introduced in Windows 10, ASR rules are an additional security layer that can be used to prevent execution of malicious payloads. We will zoom in on there effectiveness and test several bypasses.
  • Controlling execution on your endpoints using AppLocker. Introduced in Windows 7, Applocker is an application control technique that can be used to prevent execution of malicious payloads. We will zoom in on its effectiveness and test several bypasses.
  • The rise of Endpoint Detection & Response (EDR) tools has provided organisations with a means to enable in-depth detection and perform immediate response activities on their endpoints. These tools have changed the security landscape and have forced adversaries to get creative. We will look at a number of EDR bypass strategies including Child-Parent Process ID spoofing, Command line argument spoofing, Process injection & hollowing and finally the use of direct syscalls. It get?s quite technical here...
Exercises
  • Exercise: Creative NTLMv2 hash stealing
  • Exercise: Bypassing Attack Surface Reduction
  • Exercise: Bypassing AppLocker
  • Exercise: Child-parent and command-line spoofing
  • Exercise: Process hollowing
  • Exercise: Bypassing the Windows Native API

CPE/CMU Credits: 6

Topics
  • Initial Intrusion Strategies
  • Forcing Windows authentication
    • Stealing NTLMv2 hashes in a creative way
  • Getting Code Execution

    • Traditional Controls & State of Affairs
    • Bypassing Attack Surface Reduction Rules
    • Bypassing AppLocker
    • Child-Parent / Command-Line spoofing
    • Process Injection & Process Hollowing
    • Bypassing the Windows Native API
  • Conclusion

    • Debrief - Emulation plan conclusions and lessons learned

Staff
Wed Dec 1st, 2021
9:30 AM - 5:30 PM JST

Overview

The following modules will be covered in section 3:

  • Enumerating Active Directory resources and configurations to map the overall attack surface of an AD environment.
  • Understanding the Local Security Authority Subsystem Service (LSASS) process. What is its purpose and how is it traditionally attacked? We will go in-depth and explan topics such as Security Support Provicers (SSPs) and Authentcation Packages (APs). After this explanation, we will zoom in on the execution and detection of LSASS dumping attacks using a variety of tools (including Mimikatz, Dumpert, ProcDump,&)
  • Given the focus of security products on LSASS, we will also investigate other credential dumping techniques. How can adversaries steal credentials without touching LSASS? Key techniques will include Internal Monologue (NTLMv1 downgrade), NTDS.dit stealing and DCSync.
  • A refresh on Kerberos and traditional attacks such as Kerberoasting, ASReproasting, golden tickets, silver tickets and the Skeleton Key attack. After the refresh, we will focus on advanced attack strategies, primarily focused on delegation attacks. We will cover unconstrained delegation, constrained delegation and resource-based constrained delegation.
  • An explanation on the security boundaries in AD environment and how adversaries can possibly pivot between different domains and forests.

Exercises
  • Exercise: Analyzing BloodHound attack chains
  • Exercise: Stealing credentials from LSASS
  • Exercise: Internal Monologue in NTLMv1 downgrades
  • Exercise: Unconstrained delegation attacks
  • Exercise: (Resource-based) Constrained delegation
  • Exercise: Pivoting between domains and forests

CPE/CMU Credits: 6

Topics
  • Active Directory Enumeration

    • Bloodhound Enumeration
  • Credential Dumping

    • LSASS Credential Stealing Techniques
    • Stealing credentials without touching LSASS
  • Kerberos Attacks

    • Kerberos refresh
    • Unconstrained Delegation Attacks
    • (Resource-based) Constrained Delegation Attacks
    • Breaking Domain & Forest trusts
  • Conclusion

    • Debrief - Emulation plan conclusions and lessons learned

Staff
Thu Dec 2nd, 2021
9:30 AM - 5:30 PM JST

Overview

The following modules will be covered in section 4:

  • Explaining typical persistence strategies used by adversaries. We will also discuss typical detection strategies.
  • Abusing the Component Object Model (COM) to establish a persistent foothold in a target environment. Attacks we will cover include Phantom COM Objects and COM Search Order Hijacking
  • Obtaining persistence through the use of Windows Management Instrumentation (WMI). We will explain WMI Event Filters, Event Consumers and Event Filter to Consumer bindings
  • Establishing persistence through DLLs such as AppCert, AppInit and Netshell.
  • Leveraging Microsoft Office for persistence, with a key focus on template shenanigans and malicious add-ins
  • Abusing the Application Compatibility Toolkit (ACT) to obtain persistence through application shims.
  • Stealth persistence using the AD
Exercises
  • Exercise: COM Object Hijacking
  • Exercise: WMI Persistence
  • Exercise: Implementing Netsh helper DLLs
  • Exercise: Office Persistence
  • Exercise: Application Shimming
  • Exercise: Stealth AD persistence

CPE/CMU Credits: 6

Topics
  • Persistence

    • Typical Persistence Strategies & Detection Methods
  • Stealth Persistence Strategies
    • COM Object Hijacking
    • WMI Persistence
    • AppCert, AppInit & Netsh Helper DLLs
    • Office Template & Library tricks
    • Application shimming
    • Sealth AD Persistence
  • Conclusion

    • Debrief - Emulation plan conclusions and lessons learned

Staff
Fri Dec 3rd, 2021
9:30 AM - 5:30 PM JST

Overview

The following modules will be covered in section 5:

  • We will first perform a lecture on Azure AD attack strategies. We will introduce Azure AD and its security mechanisms and how they can possibly be attacked. We will also look in logging strategies for Azure AD.
  • Afterwards, we will build out emulation plans for three specific threat actors: APT-28, APT-34 and Turla.
  • Upon completing the emulation plans, we will execute them using Caldera and Covenant
Exercises
  • Exercise: APT-28 Emulation Plan
  • Exercise: APT-34 Emulation Plan
  • Exercise: Turla Emulation Plan

CPE/CMU Credits: 6

Topics
  • Azure AD

    • Azure AD Structure and Management
    • Azure AD Hybrid Authentication
    • Azure AD Authentication Methods
    • Azure AD Conditional Access
    • Introduction to Azure Identities
    • Azure AD Security Logging
  • Executing Emulation Plans
    • APT-28 Emulation Plan
    • APT-34 Emulation Plan
    • Turla Emulation Plan
  • Conclusion

    • Debrief - Emulation plan conclusions and lessons learned

Staff
Sat Dec 4th, 2021
9:30 AM - 5:30 PM JST

Overview

On this final day of the SEC699 course, participants can choose whether to join the red or blue team in an epic capstone battle to infiltrate or defend the corporate environment. Students will leverage all of the tools and techniques they've learned throughout the course!

Exercises
  • Hands-on red and blue team capstone

CPE/CMU Credits: 6

Additional Information

Important! Bring your own system configured according to these instructions!

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will likely leave the class unsatisfied because you will not be able to participate in hands-on exercises that are essential to this course. Therefore, we strongly urge you to arrive with a system meeting all the requirements specified for the course.

Mandatory System Requirements

  • System running Windows, Linux, or Mac OS X 64-bit version
  • At least 8 GB RAM
  • 60 GB of available disk space (more space is recommended)
  • Administrator access to the operating system
  • Anti-virus software will need to be disabled in order to install some of the tools
  • An available USB port
  • Wireless NIC for network connectivity
  • Machines should NOT contain any personal or company data
  • Verify that under BIOS, Virtual Support is ENABLED
  • Disable Windows 10 Credential Guard and Device Guard

Mandatory Preparation steps Prior to Coming to Class:

  • Installed 64-bit host operating systems (Windows is recommended)
  • Download and install VM Workstation Pro 15.5 or higher, VMware Fusion 11.5 or higher, or VMware Workstation Player 15.5 or higher versions on your system prior to the start of class
  • Adobe Acrobat or other PDF reader application
  • An AWS account is required to do hands-on exercises during this course. The AWS account must be created prior to the start of class. Your ability to execute the hands-on exercises will be delayed if you wait to set up the AWS account in class.
  • A credit card should be linked to the AWS account that was created. Estimated additional costs for the week of AWS account usage are $50.
  • For detailed instructions on these preparation steps, please refer to the following URL: https://sans-sec699-vm.s3.eu-west-2.amazonaws.com/README_LESSON_0.pdf

It is critical that your CPU and operating system support 64-bits so that our 64-bit guest virtual machine will run on your laptop. VMware provides a free tool for Windows and Linux that will detect whether or not your host supports 64-bit guest virtual machines. For further troubleshooting, this article also provides good instructions for Windows users to determine more about CPU and OS capabilities. For Macs, please use this support page from Apple to determine 64-bit capability.

Please download and install VM Workstation Pro 15.5 or higher, VMware Fusion 11.5 or higher, or VMware Workstation Player 15.5 or higher versions on your system prior to the start of the class. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial on its website.

Other virtualization software, such as VirtualBox and Hyper-V, are not appropriate because of compatibility and troubleshooting problems you might encounter during class.

VMware Workstation Pro and VMware Player on Windows 10 is not compatible with Windows 10 Credential Guard and Device Guard technologies. Please disable these capabilities for the duration of the class, if they're enabled on your system, by following instructions in this document.

Your course media will now be delivered via download. The media files for class can be large, some in the 40 - 50 GB range. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as you get the link. You will need your course media immediately on the first day of class. Waiting until the night before the class starts to begin your download has a high probability of failure.

SANS has begun providing printed materials in PDF form. Additionally, certain classes are using an electronic workbook in addition to the PDFs. The number of classes using eWorkbooks will grow quickly. In this new environment, we have found that a second monitor and/or a tablet device can be useful by keeping the class materials visible while the instructor is presenting or while you are working on lab exercises.

If you have additional questions about the laptop specifications, please contact laptop_prep@sans.org.

  • Penetration testers
  • Ethical hackers
  • Defenders who want to better understand offensive methodologies, tools, and techniques
  • Red team members
  • Blue team members
  • Purple Team members
  • Forensics specialists who want to better understand offensive tactics

"I've been in this field a long time, and I've learned something new from each segment of SEC699. That's not something I'm used to at this point in my career." - Taya Steere, Lyft

This is a fast-paced, advanced course that requires a strong desire to learn advanced red and blue team techniques. The following SANS courses are recommended either prior to or as a companion to taking this course:

Experience with programming in any language is highly recommended. At a minimum, students are advised to read up on basic programming concepts.

You should also be well versed with the fundamentals of penetration testing prior to taking this course. Familiarity with Linux and Windows is mandatory. A solid understanding of TCP/IP and networking concepts is required. Please contact the author at evanbuggenhout@nviso.be if you have any questions or concerns about the prerequisites.

Author Statement

"After the success of SEC599, I'm very excited to unleash this course offering upon the SANS audience! SEC699 is an amazing course that came about because we listened to student requests for a hands-on adversary emulation class leveraging an enterprise lab environment. This is it!

"SEC699 attendees will learn advanced red and blue team techniques for proper purple teaming in an enterprise environment. Throughout the week we do not just focus on explaining 'tips and tricks,' but also empower students to build and adapt their own tooling for proper adversary emulation. This includes, for example, custom Caldera, SIGMA and Velociraptor development.

"The SEC699 lab environment is fully built using Ansible playbooks and covers multiple domains and forests that can be attacked! As promised, students will receive the Ansible playbooks AND will acquire the necessary skills to further extend and tailor them for their own custom needs."

- Erik Van Buggenhout

"The depth of the labs helps me tremendously to reinforce the concepts taught, and Jim has a clear communication style and offers context to help make the learning meaningful." - Fitzroy Roswell, JP Morgan Chase