0

We are in the process of developing a Red Teaming team to offer as a service, and one of the biggest obstacles we are struggling with is how to maintain a good op-sec and stealth during engagements.

Since most of our teams' experience comes from Penetration Testing, where you can afford to work with loud tools and scans and don't need to be concerned with detection, we are looking for methodologies that would be focused on stealth during engagements.

We have several methodologies developed over the years about how to approach internal infrastructure or web app pentesting, which really streamlines the test process since you know how to start and what not to forget. But for stealth Red Teaming engagements, where the main goal is to avoid detection, we're not even sure how to start - especially given the more and more advanced nature of detection tools we are up against.

Most of the methodologies or resources I have found so far are either too high-level, or fail to hold up against EDRs, which leads me to this question.

Are there any Red Teaming methodologies that would give us a starting point and introduce us to the mindset required for successful stealth Red Teaming engagement? Something similiar to OWASP Web App testing guide - which gives you a checklist of things you want to watch out for or a set of tools you need to have.

For example, if we take the reconnaissance phase - in traditional announced pentest, you can simply nmap the whole network, run Nessus and you have a pretty good starting point. But for Red Teaming, you can't do that. I'm looking for a methodology that would talk about how to start doing stealthy recon, what settings to watch out for in a stealth nmap scan, or what other concrete techniques or tools to start the recon with, along with some other recommendations of things to do to ensure success, i.e. have a lab with EDR and first try every action there, or consult every action with your SoC.

Are there such resources, or are we pretty much on our own and have to figure it out ourselves?

4
  • It sounds like you want an all-in-one guide, but that's not a reasonable request. As you say, technology changes all the time. So, yes, you will need to sort out how to be stealthy in the context of your target environment. And there are guides for individual use of different tools. nmap has stealth guides, for example.
    – schroeder
    May 26, 2023 at 11:12
  • @schroeder I wouldn't say that its an unreasonable request - I do realize that a complete all-in-one guide that would cover a Red Teaming engagement completely is not feasible, but I'm looking for something along the lines of OWASP Web App Testing guide - it describes what you should do, what tools to use and what to watch out for, gives an overview of the testing process while also giving you a starting point about what tools to use and explore further. There's also a lot of general dos and donts in RT, such as "never use whoami", which are harder to figure out but would be perfect in a book.
    – TheMikina
    May 27, 2023 at 16:20
  • So, it's not unreasonable but infeasible? Ok, I'll go with that. Either way, I don't think this is answerable.
    – schroeder
    May 27, 2023 at 16:39
  • Red Teaming is also referred to as "Adversary Simulation" in some contexts. Just like real adversaries/attackers, the techniques and methodologies of a successful Red Team engagement are fluid. Therefore, there is no true methodology. The reason you're seeing high-level and ineffective information online is that this is a cat-and-mouse game. The best Red Teams are developing their own techniques with extensive research, and they're definitely not going to just release them publicly while they still work. Your best bet is likely to be recent incident reports from APTs, which you can emulate
    – Unencoded
    May 27, 2023 at 17:32

1 Answer 1

0

Since you're mentioning nmap and it is often the primary reconnaissance tool: although it is noisy by nature there are plenty of options you can use to be more stealth.

Be patient. Probably this is the only generalization that can be made here. Don't scan several hosts at the same time. This is a telltale sign. Spread your scans over time. See: Timing and Performance

One useful option among many others: -sS to perform a SYN scan. This is normally sufficient for routine reconnaissance work. While this option alone may not escape detection it can be (and should be) combined with other techniques.

The nmap documentation has a whole chapter on the issue: Chapter 10. Detecting and Subverting Firewalls and Intrusion Detection Systems (note by the way that the book generally has more contents than the official website, so I would definitely recommend buying the book)

Then alter your signature so that the traffic does not stand out. Example: use data padding - see: Firewall/IDS Evasion and Spoofing for suggestions. The idea is to make your payloads dissimilar to known probe patterns, so that firewalls or IDS will not block them.

I also recommend to practice Wireshark to capture and analyze some of your traffic. Begin by capturing some packets relating to your usage of nmap to figure out what the current frames look like. Then use some of the options suggested above to alter them so they start looking more innocuous.

You'll need to be more focused in your attacks. Concentrate on certain ports where you think there is potential for exploitation. For example start with HTTP(s) endpoints, then broaden the net as required.

To avoid scanning a whole network range, you can try to build a list of hosts in advance, using available DNS data, reverse DNS or other sources like certificate transparency logs where applicable.

Nmap is an excellent tool but it's not the only port scanner available. In fact you could even use Scapy to create your own, with the advantage that you have near total control of the network frames that will be coming out from your machine.

Set up a lab, install Surricata or another IDS like Snort and find out what kind of behavior triggers an alert using default settings. This would be a good start.

If you can get information about what the client/target uses (software & hardware), then obtain the relevant documentation to understand how they work out of the box.

Here is one article that discusses detection of nmap sweeps using Snort: How to Detect NMAP Scan Using Snort. You should be able to find similar information about other IDS types, otherwise inspect the default ruleset and you can figure out ways of subverting them. Again, the nmap documentation describes techniques more in detail and has a discussion on defeating detection by Snort: Subverting Intrusion Detection Systems (aged contents but the concepts remain valid).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .