Belajar Red Team Operator - Detection & Blue Team Understanding

#Pendahuluan

Setelah di episode 10 kita mempelajari evasion & OPSEC — noise reduction, timing, dan C2 stealth — pada episode ini kita memahami bagaimana pertahanan bekerja: EDR (Endpoint Detection & Response), SIEM (Security Information and Event Management), dan detection rules.

Red team yang memahami blue team akan jauh lebih efektif. Kalian bisa memilih teknik yang tepat untuk bypass detection spesifik, atau — dalam purple team engagement — membantu blue team memperkuat pertahanan.

#EDR — Endpoint Detection & Response

#How EDR Works

text

EDR Architecture
==================
1. Agent di endpoint → collect telemetry
2. Behavioral analysis → detect anomalies
3. Correlation engine → identify attack patterns
4. Alert generation → ke SIEM/SOC
5. Response capability → isolate, kill process

#EDR Detection Methods

Method	Detects	Bypass Concept
Signature-based	Known malware	Polymorphism, encryption
Behavioral analysis	Process injection, fileless	Living off the land
Memory scanning	In-memory payloads	Encryption, process hollowing
Network monitoring	C2 traffic	Domain fronting, traffic mimicry
Threat intelligence	Known TTPs	Novel techniques

#EDR Products & Their Strengths

EDR	Strength	Weakness
CrowdStrike	Cloud-native, fast detection	Expensive
SentinelOne	Autonomous response	Can be bypassed with timing
Microsoft Defender	Deep Windows integration	Complex configuration
Carbon Black	Process monitoring	High false positives

#SIEM — Security Information and Event Management

#SIEM Architecture

text

SIEM Flow
===========
Endpoints → Logs → Log Collector → SIEM → Correlation → Alerts
                                    ↓
                              Dashboards
                              Reports
                              Forensics

#Key Log Sources

Source	Events	Value
Windows Security	4624, 4625, 4672, 4688	Login, privilege, process
Sysmon	1, 3, 7, 8, 10, 11	Process, network, image
DNS	Query logs	C2 detection
Network flow	NetFlow/IPFIX	Lateral movement
Authentication	AD logs	Credential abuse

#Detection Rules (Examples)

sql

-- SQL-style detection rule concept
-- Detect credential dumping
SELECT * FROM windows_events
WHERE EventID = 4688
AND ProcessName LIKE '%mimikatz%'
OR (ProcessName = 'lsass.exe' AND AccessMask = 0x1010)
 
-- Detect lateral movement
SELECT * FROM windows_events
WHERE EventID = 4624
AND LogonType = 3
AND IpAddress != 'local'
GROUP BY AccountName
HAVING COUNT(DISTINCT IpAddress) > 5

#Detection Rule Types

#Signature-Based

text

Detect Mimikatz:
  Process: mimikatz.exe OR
  Process: pypykatz AND Command contains 'logonpasswords'

#Behavioral

text

Detect credential dumping:
  LSASS accessed by non-system process AND
  Process created via WMI OR PowerShell

#Statistical

text

Detect brute force:
  Failed login count > threshold (10) in 5 minutes
  OR from same source IP

#Correlation

text

Detect full attack chain:
  Phishing email (Event 1) AND
  Macro execution (Event 2) AND
  PowerShell download cradle (Event 3) AND
  Reverse shell connection (Event 4)

#Blue Team Telemetry

#What Blue Team Sees

text

Telemetry Available to Blue
==============================
1. Process creation & command line
2. Network connections (source, dest, port)
3. File creation & modification
4. Registry changes
5. Authentication events
6. DNS queries
7. Service creation
8. Scheduled task creation

#Gaps in Detection

text

Common Detection Gaps
=======================
1. Legitimate tools misuse (LOLBins)
2. Low-and-slow attacks (spread over days)
3. Encrypted C2 (looks like HTTPS)
4. Compromised credentials (looks legitimate)
5. Custom/unknown tools (no signature)
6. Memory-only attacks (no file)

Tip

Baca detection rules di SIEM target (jika purple team engagement) untuk memahami apa yang bisa dan tidak bisa dideteksi. Ini membantu kalian memilih teknik yang tepat untuk menguji gap spesifik.

#Praktik: Detection Understanding

bash

# 1. Jalankan attack technique di lab
# 2. Periksa Windows Event Logs: EventID apa yang di-generate?
# 3. Periksa Sysmon logs
# 4. Buat detection rule (Sigma format)
# 5. Test: apakah rule menangkap attack?

#Sigma Rule Format

yaml

title: Detect Mimikatz Execution
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\mimikatz.exe'
  condition: selection
level: critical
tags:
  - attack.credential_access
  - attack.t1003.001

#Penutup

Inti yang harus dibawa pulang:

EDR: behavioral analysis, memory scanning, threat intelligence — bypass via LOLBins dan timing.
SIEM: log correlation, detection rules — gaps di encrypted C2 dan custom tools.
Detection rules: signature-based, behavioral, statistical, correlation.
Blue team telemetry: process, network, file, registry, auth events.

Di episode 12 selanjutnya, kita akan mempelajari red team reporting & engagements — objectives, milestone-based reporting, dan debrief dengan blue team.