Belajar Penetration Tester - Red vs Blue Team & Frameworks
Mempelajari dinamika red team vs blue team dalam keamanan siber, kerangka kerja MITRE ATT&CK dan Cyber Kill Chain, serta bagaimana pemahaman defensi meningkatkan kualitas penetration testing
#Pendahuluan
Setelah di episode 17 kita mempelajari report writing & remediation — menulis laporan yang efektif dengan CVSS scoring — pada episode ini kita melebarkan perspektif: memahami bagaimana red team dan blue team berkolaborasi dalam pertahanan keamanan, serta framework seperti MITRE ATT&CK dan Cyber Kill Chain yang memberikan bahasa bersama antara penyerang dan pemeriksa.
Sebagai penetration tester, memahami sisi pertahanan (blue team) membuat kalian menjadi pentester yang lebih baik. Kalian bisa memilih teknik yang lebih realistis, menghindari detection yang sudah matang, dan memberikan rekomendasi remediation yang lebih spesifik.
#Red Team vs Blue Team vs Purple Team
#Definisi
| Tim | Fokus | Peran |
|---|---|---|
| Red Team | Offense | Mensimulasikan adversary untuk menguji deteksi & respons |
| Blue Team | Defense | Mencegah, mendeteksi, dan merespons insiden |
| Purple Team | Collaboration | Memastikan red & blue team saling menguatkan |
#Purple Team — Kolaborasi
Purple team bukan tim terpisah, melainkan pendekatan di mana red team dan blue team bekerja sama untuk memperkuat pertahanan:
Purple Team Workflow
======================
1. Red Team: plan attack scenario
2. Blue Team: prepare detection rules
3. Red Team: execute attack
4. Blue Team: observe & analyze detection
5. Both: review gap → improve detection/response
6. Repeat until detection coverage memadai#MITRE ATT&CK
MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) adalah framework yang memetakan taktik, teknik, dan prosedur (TTP) adversary secara komprehensif.
#MATRICES
| Matrix | Domain |
|---|---|
| Enterprise | Windows, macOS, Linux, Cloud, Network, Containers |
| Mobile | Android, iOS |
| ICS | Industrial Control Systems |
#14 Tactics (Enterprise)
| ID | Tactic | Keterangan |
|---|---|---|
| TA0043 | Reconnaissance | Mengumpulkan informasi |
| TA0042 | Resource Development | Membuat resources untuk support attack |
| TA0001 | Initial Access | Mendapatkan foothold |
| TA0002 | Execution | Menjalankan kode berbahaya |
| TA0003 | Persistence | Mempertahankan akses |
| TA0004 | Privilege Escalation | Meningkatkan hak akses |
| TA0005 | Defense Evasion | Menghindari deteksi |
| TA0006 | Credential Access | Mendapatkan credentials |
| TA0007 | Discovery | Memahami environment |
| TA0008 | Lateral Movement | Bergerak ke sistem lain |
| TA0009 | Collection | Mengumpulkan data |
| TA0011 | Command and Control | Komunikasi dengan compromised systems |
| TA0010 | Exfiltration | Mengekstrak data |
| TA0040 | Impact | Mencapai tujuan akhir |
#Contoh Mapping ke Pentest
Our Pentest → ATT&CK Mapping
==============================
Reconnaissance → TA0043 (OSINT, Scanning)
Initial Access → TA0001 (Phishing, Exploit Public-Facing App)
Execution → TA0002 (Command Injection, PowerShell)
Persistence → TA0003 (Scheduled Tasks, Registry)
Priv Esc → TA0004 (Sudo Abuse, Token Impersonation)
Defense Evasion → TA0005 (Obfuscation, Disable Logging)
Lateral Movement → TA0008 (PsExec, WMI, Pass-the-Hash)#Cyber Kill Chain (Revisited)
#Attack Chain Mapping
#Kill Chain → Defense Mapping
| Kill Chain Phase | Defense Controls |
|---|---|
| Reconnaissance | OSINT monitoring, takedown phishing domains |
| Weaponization | Email gateway, sandbox analysis |
| Delivery | Email filtering, endpoint protection |
| Exploitation | Patch management, IPS |
| Installation | EDR, application whitelisting |
| C2 | Network monitoring, DNS filtering |
| Actions | DLP, incident response |
#ATT&CK for Pentest
#Tabel Mapping Pentest → ATT&CK
| Pentest Activity | ATT&CK Technique |
|---|---|
| Nmap scanning | T1046 - Network Service Discovery |
| SQLMap exploitation | T1190 - Exploit Public-Facing Application |
| Reverse shell | T1059 - Command and Scripting Interpreter |
| Sudo escalation | T1548 - Abuse Elevation Control Mechanism |
| Kerberoasting | T1558 - Steal or Forge Kerberos Tickets |
| Phishing | T1566 - Phishing |
| PsExec lateral movement | T1021 - Remote Services |
Tip
Saat menulis laporan, sertakan mapping ke MITRE ATT&CK technique ID. Ini memudahkan blue team membuat detection rules yang tepat dan menunjukkan kedalaman analisis kalian.
#Praktik: ATT&CK Mapping
Untuk setiap finding di laporan pentest, mapping ke ATT&CK:
Finding: SQL Injection
→ Initial Access: T1190 (Exploit Public-Facing Application)
→ Collection: T1005 (Data from Local System)
→ Impact: T1485 (Data Destruction) [potential]
Finding: Reverse Shell via Command Injection
→ Execution: T1059.004 (Unix Shell)
→ C2: T1071 (Application Layer Protocol)
→ Persistence: T1053.003 (Cron)#Penutup
Inti yang harus dibawa pulang:
- Red team: offensive; Blue team: defensive; Purple team: collaborative improvement.
- MITRE ATT&CK: 14 tactics, ratusan teknik — bahasa bersama untuk TTP adversary.
- Cyber Kill Chain: urutan logis serangan dengan mapping ke defense controls.
- Mapping pentest → ATT&CK: meningkatkan kualitas laporan dan membantu blue team.
Di episode 19 selanjutnya, kita akan mempelajari evasion & detection bypass — teknik menghindari AV/EDR, payload obfuscation, dan opsec dalam pentesting.