Skip to main Content

Masterclass: Red Team - Blue Team Operations

  • Code training RBO
  • Duur 5 dagen

Klassikale training Prijs

eur3.250,00

(excl. BTW)

Vraag een groepstraining aan Schrijf je in

Methode

Deze training is in de volgende formats beschikbaar:

  • Blended Live

    Training die op meerdere manieren gevolgd kan worden

  • Class Connect

    Verbind naar een klas in HD

  • Klassikale training

    Klassikaal leren

  • Op locatie klant

    Op locatie klant

  • Virtueel leren

    Virtueel leren

Vraag deze training aan in een andere lesvorm.

Trainingsbeschrijving

Naar boven
This is a deep dive course on Red Team – Blue Team Operations: The cyber kill chain

Security is a business enabler, and it is only when it is viewed from a business perspective that we can truly make the right decisions.  Identifying, protecting and restricting data that can be monetized by adversaries is essential and should be reviewed and defined on a regular basis as only then can you identify potential gaps in your security posture. 

Every organisation should expect to be hacked at some point so it is vital that all members of your blue and red teams are up to speed on the latest hacking techniques.

The term Cyber Kill Chain defines the steps used by cyber attackers in today’s cyber based attacks and this course reviews all of those steps from both a red and blue team perspective. 

Reconnaissance is the first phase, during which the attacker gathers information on the target before the actual attack starts. The data gathering is essential skill of every red teamer. From blue teamer perspective, it is crucial to understand what kind of information is publicly available and to learn how to protect that information.

Without remote code execution vulnerability even the most sophisticated payload needs to be delivered to the victim. There are plenty of ways to achieve that so blue team needs to ensure that payloads are detected and blocked at early stage.

After successful delivery, malicious code exploits a vulnerability to execute code on victim’s system. There are many mechanisms that, if properly configured, significantly reduce attack scope.

The successful exploitation attack often results in code execution with limited privileges. Both, red teamers and blue teamers should be familiar with common techniques and misconfigurations allowing for privilege escalation.

The next after gaining admin privileges on single host is lateral movement that gives access to additional resources within the company. Before red teamer can reach Domain Controller or other critical servers, blue team can implement numerous protections against that threat.Even after an attack is stopped and contained, the attacker will want to ensure persistency and possibility of returning to a compromised host.

Doelgroep

Naar boven
Red team and blue team members, enterprise administrators, infrastructure architects, security professionals, systems engineers, network administrators, IT professionals, security consultants and other people responsible for implementing network and perimeter security.

Trainingsdoelstellingen

Naar boven
After completing this course you should be able to:
  • Analyze emerging trends in attacks
  • Identify areas of vulnerability within your organization
  • Prepare a risk assessment for your organization
  • Report and recommend countermeasures
  • Develop a threat management plan for your organization
  • Organize Red Team – Blue Team exercises

Inhoud training

Naar boven
Module 1: Identifying Areas of Vulnerability
  • Defining the assets which your company needs to protect
  • Defining the other sensitive information that needs to be protected

Module 2: Modern Attack Techniques

  • OS platform threats and attacks
  • Web based threats and attacks
  • E-mail threats and attacks
  • Physical access threats and attacks
  • Social threats and attacks
  • Wireless threats and attacks

Module 3: Reconnaissance

  • Open Source Intelligence (OSINT)
  • Google hacking
  • Social Media presence
  • DNS 5. Shodan
  • Physical reconnaissance
  • Port scanning
  • Service discovery
  • SIEM
  • Intrusion Prevention Systems 

Module 4: Weaponization

  •  Generating malicious payload
  • Hiding malicious content in Office Suite documents
  • Reverse shells
  • Metasploit
  • Empire
  • AV evasion techniques

Module 5: Delivery

  • Building phishing campaign
  • Planting malicious device
  • Attacks on 3rd parties
  • Enabling phishing protection
  • O365 / Safe links
  • Smart Screen
  • Secure proxy
  • Sinkholing
  • APT campaigns

Module 6: Exploitation and Installation

  • Types of vulnerabilities
  • Establishing foothold
  • Stage-less and staged payloads / C&C
  • Anti-Virus
  • Firewall
  • Application Whitelisting
  • WDAC
  • Living Off the Land Binaries
  • Exploit Guard
  • AMSI

Module 7: Privilege escalation

  • Privileged accounts
  • System services security
  • Common misconfigurations
  • Security tokens
  • Just Enough Administration
  • Patch maintenance

Module 8: Lateral movement

  • Credential harvesting
  • Mimikatz
  • Network reconnaissance
  • Building network map
  • Responder
  • Pass-the-hash
  • Pass-the-ticket
  • Credential Guard
  • LAPS
  • GPO policies
  • Windows ATA
  • Defender ATP

Module 9: Persistency

  • Sleeping agents
  • Piggybacking on network packets
  • Rootkits
  • Sysinternals
  • Searching for rogue servers
  • Looking for network anomalies

Voorkennis

Naar boven

Attendees should meet the following prerequisites:

  • Good hands-on experience in administering Windows infrastructure.
  • At least 8 years in the field is recommended.

Recommended preparation for exams:

  • There are no exams aligned to this course

Aanvullende informatie

Naar boven

Please note that this Masterclass can be delivered in various formats:

Option 1 (ONE EXPERT, 4 days):

  • 1,5 days Red Team (Cyber-Attack)
  • 1,5 days Blue Team (Cyber-Defense)
  • 1-day Cyber-Competition Red Team vs Blue Team (Capture the Flag Experience!)

 Option 2 (ONE EXPERT, 5 days, as listed on this webpage):

  • 2 days Red Team (Cyber-Attack)
  • 2 days Blue Team (Cyber-Defense)
  • 1-day Cyber-Competition Red Team vs Blue Team (Capture the Flag Experience!)

Option 3 (TWO EXPERTS 4 days):

  • Red & Blue Day 1-3 (Cyber Attack & Defense) – 2 Different Experts leading two different groups
  • Red & Blue Team Day 4 – Competition Red Team vs Blue Team (Capture the Flag Experience