Belajar Red Team Operator - Red Team Reporting & Engagements

#Pendahuluan

Setelah di episode 11 kita mempelajari detection & blue team understanding — EDR, SIEM, dan detection rules — pada episode ini kita membahas reporting & engagements: bagaimana mendokumentasikan aktivitas red team, menganalisis gap, dan melakukan debrief yang menghasilkan action items nyata.

Reporting dalam red team sangat berbeda dari pentesting. Laporan penting berfokus pada "apa kerentanan yang ditemukan" — laporan red team berfokus pada "apa yang bisa dan tidak bisa dideteksi oleh blue team".

#Red Team Report Structure

#Template

text

RED TEAM ENGAGEMENT REPORT
============================
 
1. Executive Summary
   - Engagement overview
   - Objectives & achievement status
   - Key findings (detection capability)
   - Overall risk assessment
 
2. Engagement Details
   - Scope & rules of engagement
   - Duration & team composition
   - Infrastructure used
   - Attack narrative (high-level)
 
3. Attack Narrative (Technical)
   - Timeline reconstruction
   - Each phase: what happened, when, what was detected
   - MITRE ATT&CK mapping
 
4. Detection Analysis
   - What was detected (and how quickly)
   - What was NOT detected (gaps)
   - False positives/negatives observed
 
5. Recommendations
   - Priority detection improvements
   - Process improvements
   - Training recommendations
 
6. Appendix
   - Technical details (tools, commands)
   - Log references
   - IOC list (what was left behind)

#Objectives & Milestone Reporting

#Tracking Objectives

yaml

engagement_objectives:
  - id: OBJ-01
    description: "Obtain Domain Admin credentials"
    status: "achieved"
    timeline: "Week 3"
    technique: "Kerberoasting → crack → DA"
    detection: "Not detected until Week 4"
    
  - id: OBJ-02
    description: "Exfiltrate mock customer database"
    status: "achieved"
    timeline: "Week 5"
    technique: "HTTPS tunnel via C2"
    detection: "Partially detected (network anomaly)"
    
  - id: OBJ-03
    description: "Test incident response capability"
    status: "achieved"
    timeline: "Week 4-5"
    technique: "Social engineering + lateral movement"
    detection: "IR team responded in 72 hours"

#Milestone Reporting

text

Milestone Reports (every 2-4 weeks)
======================================
Week 2: Initial access achieved, 2/5 objectives in progress
Week 4: DA compromised, detection not triggered
Week 6: Data exfiltration achieved, IR response time measured
Week 8: Final report, debrief scheduled

#Timeline Reconstruction

#Post-Engagement Analysis

text

Timeline Reconstruction
=========================
Week 1-2: Reconnaissance
  - Subdomain enumeration (NOT logged)
  - LinkedIn profiling (NOT logged)
  - Port scanning (partially logged in firewall)
 
Week 2: Initial Access
  - Spearphishing sent (email gateway logged)
  - Macro executed (EDR detected but LOW alert)
  - C2 established (NOT detected)
 
Week 3: Persistence
  - Scheduled task created (Sysmon logged, not alerted)
  - Registry modification (logged)
 
Week 3-4: Lateral Movement
  - Pass-the-hash (logged, not alerted)
  - PSRemoting (logged as legitimate admin)
 
Week 4: Privilege Escalation
  - Kerberoasting (Event 4769 logged)
  - Cracked service account (offline)
 
Week 5: Data Exfiltration
  - HTTPS C2 tunnel (looks like normal traffic)
  - 500MB data extracted (DLP not triggered)
 
Week 6: Detection
  - Blue team noticed anomaly in network traffic
  - IR initiated 72 hours after initial compromise

#Detection Gap Analysis

#Gap Categories

Category	Gap Type	Priority
Technical	Missing detection rules	High
Process	Slow IR response	Medium
People	User awareness	Medium
Training	SOC skill gaps	Medium
Visibility	Insufficient logging	High

#Gap Report Format

markdown

## GAP-001: Credential Dumping Not Detected
 
**Severity**: High
**MITRE ATT&CK**: T1003.001 (LSASS Memory)
 
### Description
Credential dumping via Mimikatz was not detected by EDR or SIEM.
The following events were generated but not alerted:
- Event 4688: Process creation (mimikatz.exe)
- Sysmon Event 1: Process access to lsass.exe
 
### Recommendation
1. Create detection rule for LSASS access by non-system processes
2. Enable credential guard on sensitive systems
3. Monitor for Mimikatz process name patterns
 
### Detection Rule (Sigma)
title: LSASS Access by Non-System
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: '\lsass.exe'
    SourceImage|endswith:
      - '\mimikatz.exe'
      - '\pypykatz.exe'
      - '\nanodump.exe'
  condition: selection
level: critical

#Debrief

#Debrief Structure

text

Debrief Agenda (2-3 hours)
============================
1. Red team presentation (45 min)
   - High-level narrative
   - Objectives & achievement
   - Key detection gaps
 
2. Blue team response (30 min)
   - What they saw
   - What they didn't see
   - Response timeline
 
3. Discussion (45 min)
   - Gap analysis
   - Root cause analysis
   - Improvement recommendations
 
4. Action items (30 min)
   - Assign owners
   - Set deadlines
   - Follow-up schedule

Note

Debrief harus constructive, bukan blame game. Red team dan blue team punya tujuan yang sama: memperkuat pertahanan organisasi. Fokus pada improvement, bukan kesalahan.

#Praktik: Red Team Report

Buat laporan untuk engagement fiktif:

Executive summary (1 halaman)
Timeline reconstruction
Minimal 3 detection gaps
Action items dengan owner

#Penutup

Inti yang harus dibawa pulang:

Report structure: executive summary, attack narrative, detection analysis, recommendations.
Objectives tracking: status, timeline, technique, detection response.
Timeline reconstruction: post-engagement analysis of what happened when.
Gap analysis: technical, process, people, training, visibility.
Debrief: constructive discussion → actionable improvement items.

Di episode 13 selanjutnya, kita akan mempelajari purple team operations — validasi deteksi, gap analysis, dan kolaborasi blue team yang lebih mendalam.