Belajar Red Team Operator - Attack Simulation Frameworks

#Pendahuluan

Setelah di episode 13 kita mempelajari purple team operations — detection validation real-time dan gap analysis — pada episode ini kita mempelajari attack simulation frameworks: tools yang menjalankan attack scenarios secara automated dan terstruktur.

Frameworks seperti Caldera dan Atomic Red Team memungkinkan red team menjalankan test cases secara konsisten dan reproducible — kritis untuk purple team yang membutuhkan repeatable testing.

#Caldera — Automated Adversary Emulation

#Konsep

Caldera (MITRE) adalah platform untuk automated adversary emulation berdasarkan MITRE ATT&CK:

text

Caldera Architecture
======================
1. Server: orchestrates operations
2. Agent (Sandcat): runs on target
3. Abilities: individual techniques
4. Adversaries: collections of abilities
5. Operations: runs adversary against targets

#Setup Caldera

bash

# Clone & install
git clone https://github.com/mitre/caldera.git --recursive
cd caldera
pip install -r requirements.txt
 
# Start server
python3 server.py --insecure
 
# Akses web UI: http://localhost:8888
# Default: admin / admin

#Creating Operations

text

Caldera Operation Flow
========================
1. Deploy agent ke target (Sandcat)
2. Select adversary profile (misal: APT29)
3. Start operation
4. Agent menjalankan abilities sesuai profile
5. Monitor progress di dashboard
6. Review results

#Custom Adversary Profiles

yaml

id: custom-apt
name: Custom APT Emulation
description: Emulate specific threat actor
 
facts:
  - name: host.ip
    value: "10.0.0.5"
 
rules:
  - fact: host.ip
    finish: false
    match: .*
 
abilities:
  - attack_id: T1059.001
    name: PowerShell Execution
    ability_id: unique-id-1
    
  - attack_id: T1053.005
    name: Scheduled Task
    ability_id: unique-id-2

#Atomic Red Team — Detailed

#Structure

text

Atomic Test Structure
========================
Test GUID: unique identifier
Name: test name
Description: what it tests
Supported Platforms: Windows, Linux, macOS
Executor: command to execute
Prerequisites: dependencies
Dependencies: auto-install if needed

#Running Tests

bash

# List available tests
Invoke-AtomicRedTeam.ps1 -ShowDetailsBrief
 
# Run specific test
Invoke-AtomicRedTeam.ps1 -TestGUID <guid>
 
# Run with cleanup
Invoke-AtomicRedTeam.ps1 -TestGUID <guid> -Cleanup
 
# Run all tests for technique
Invoke-AtomicRedTeam.ps1 -AtomicTestsGroup "T1003"

#Example: T1053.005 (Scheduled Task)

yaml

attack_technique: T1053.005
display_name: Scheduled Task
 
atomic_tests:
- name: Create a scheduled task
  supported_platforms:
  - windows
  executor:
    name: command_prompt
    command: |
      schtasks /create /tn "Atomic Task" /tr "notepad.exe" /sc daily /st 09:00
    cleanup_command: |
      schtasks /delete /tn "Atomic Task" /f

#Automated Emulation Pipeline

#Script

bash

#!/bin/bash
# purple_team_auto.sh
 
# 1. Select techniques
TECHNIQUES="T1003.001 T1059.001 T1053.005 T1021.002 T1558"
 
# 2. Baseline: check current detection
for TECH in $TECHNIQUES; do
    echo "[*] Testing $TECH"
    
    # Run atomic test
    Invoke-AtomicRedTeam.ps1 -AtomicTestsGroup "$TECH"
    
    # Wait for detection
    sleep 30
    
    # Check SIEM for alert
    ALERT=$(check_siem_alert "$TECH")
    
    if [ "$ALERT" = "detected" ]; then
        echo "[PASS] $TECH detected"
    else
        echo "[GAP] $TECH NOT detected"
        echo "$TECH" >> gaps.txt
    fi
    
    # Cleanup
    Invoke-AtomicRedTeam.ps1 -AtomicTestsGroup "$TECH" -Cleanup
done

#Comparison

Feature	Caldera	Atomic Red Team
Approach	Full emulation	Individual tests
Complexity	High	Low
Integration	Agent-based	PowerShell-based
Customization	High	Medium
Best for	Full scenarios	Specific technique testing

Note

Gunakan Atomic Red Team untuk testing individual techniques; gunakan Caldera untuk full adversary emulation scenarios. Keduanya bisa dipakai bersamaan dalam purple team engagement.

#Praktik: Automated Simulation

bash

# 1. Setup Caldera di lab
# 2. Deploy Sandcat agent ke target
# 3. Jalankan adversary profile
# 4. Monitor results
# 5. Compare: apa yang terdeteksi vs tidak

#Penutup

Inti yang harus dibawa pulang:

Caldera: automated adversary emulation, agent-based, MITRE-backed.
Atomic Red Team: 300+ individual test cases, PowerShell-based.
Pipeline: automate testing → check detection → document gaps.
Best practice: Atomic untuk individual testing, Caldera untuk full emulation.

Di episode 15 selanjutnya, kita akan mempelajari physical & social red team — social engineering, physical access testing, dan combined operations.