According to Vest and Tubberville, red teaming is the process of using TTPs to emulate a real-world threat to measure the effectiveness of an organization’s _____, _____, and _____.
people, processes, and technologies
What is the primary goal of a red team engagement?
To achieve a pre-agreed operational objective, demonstrating business risk.
In the TTP framework, what does ‘Tactics’ represent?
A tactic is the overall tactical goal or the reason for performing an action, such as privilege escalation or lateral movement.
In the TTP framework, what does ‘Techniques’ describe?
A technique describes how an adversary will achieve a tactic, such as extracting credentials from LSASS memory.
In the TTP framework, what does ‘Procedures’ describe?
A procedure describes the exact step-by-step process of how a technique is performed, such as using Mimikatz to read LSASS memory.
What is the primary role of a blue team?
A blue team’s role is to defend an organization from attack by detecting and responding to incursions.
What do blue teams heavily rely on to differentiate between malicious and non-malicious activity?
They rely heavily on log telemetry from assets like workstations, servers, and firewalls.
Adversary _____ involves mimicking a specific, known threat actor using their established TTPs.
emulation
Which type of adversary engagement is narrow in scope and designed to enhance defenses against a specific threat?
Adversary emulation.
Adversary _____ involves acting as a hypothetical threat, leveraging unknown or unique TTPs.
simulation
Which type of adversary engagement is broad in scope and designed to enhance defenses against a range of threats?
Adversary simulation.
What is a common strategy organizations use that combines both emulation and simulation?
They use emulation to set a baseline capability, then use simulation to improve that capability against more advanced TTPs.
What is the English translation of the Latin phrase “primum non nocere”?
“First, do no harm.”
In the context of red teaming, what is the risk of performing harmful actions like disabling security controls?
Once in place, you cannot guarantee they won’t be abused by another party, increasing the client’s risk exposure.
What should a red teamer do before performing any potentially harmful actions during an engagement?
They should ensure the actions are permitted and have the consent of the client, as documented in the rules of engagement.
Term: OPSEC (Operations Security)
Definition: A measure of how likely a red team’s actions can be observed and subsequently interrupted by a blue team.
OPSEC is a more significant concern during adversary simulation than emulation. Why?
In a simulation, the goal is to achieve the objective without getting caught, whereas emulation is constrained to specific, known TTPs.
According to Gartner, what is threat intelligence?
Evidence-based knowledge about a menace or hazard that can be used to inform decisions regarding response.
What do the initials STIX stand for in the context of threat intelligence standards?
Structured Threat Information eXpression.
What do the initials TAXII stand for in the context of threat intelligence standards?
Trusted Automated eXchange of Indicator Information.
Who introduced the attack lifecycle framework known as the ‘Cyber Kill Chain’?
Lockheed Martin.
What is the first phase of the Cyber Kill Chain?
Reconnaissance: scouting a target and finding potential attack vectors.
What is the ‘Weaponisation’ phase of the Cyber Kill Chain?
Developing a malicious payload.
In the Cyber Kill Chain, the ‘Exploitation’ phase refers to what action?
The initial attack of delivering the weaponized payload.
-
Module 144
-
Module 243
-
Module 360
-
Module 466
-
Module 550
-
Module 660
-
Module 762
-
Module 856
-
Module 918
-
Module 1052
-
Module 1153
-
Module 1250
-
Module 1336
-
Module 1441
-
Module 1567
-
Module 1653
-
Module 1728
-
Module 1851
-
Module 1954
-
Module 2022
-
Cobalt Strike User Guide161
-
Cobalt Strike Installation Guide37
