Belajar Red Team Operator - Operasional Red Team (TTP, Objectives)

#Pendahuluan

Setelah di episode 1 kita memahami perbedaan red team vs pentest — tujuan, metodologi, dan output — pada episode ini kita masuk ke bagaimana red team beroperasi secara praktis: TTP (Tactics, Techniques, and Procedures), objectives, dan emulation planning.

Red team operations membutuhkan perencanaan yang jauh lebih mendalam dibanding pentesting. Setiap engagement harus dirancang untuk menguji aspek spesifik dari pertahanan organisasi — bukan sekadar "menyerang sebanyak mungkin".

#MITRE ATT&CK — Fondasi Red Team

#14 Tactics

ID	Tactic	Red Team Focus
TA0043	Reconnaissance	OSINT sebelum engagement
TA0042	Resource Development	C2 infrastructure
TA0001	Initial Access	Phishing, exploit
TA0002	Execution	Command execution
TA0003	Persistence	Backdoor, scheduled tasks
TA0004	Privilege Escalation	Token abuse, AD exploitation
TA0005	Defense Evasion	AV/EDR bypass
TA0006	Credential Access	Credential dumping
TA0007	Discovery	Network & AD enumeration
TA0008	Lateral Movement	PsExec, WMI
TA0009	Collection	Data staging
TA0011	C2	Command channel
TA0010	Exfiltration	Data exfil
TA0040	Impact	Objective achievement

#ATT&CK Navigator

text

ATT&CK Navigator Usage
========================
1. Map threat actor TTP → coverage plan
2. Identify detection gaps → engagement focus
3. Track red team activities → post-engagement analysis
4. Compare detection before/after → improvement measurement

#Emulation Planning

#Engagement Structure

text

Red Team Engagement Structure
================================
1. Planning Phase (2-4 minggu)
   ├── Scope definition
   ├── Objective setting
   ├── Infrastructure setup
   ├── TTP selection (ATT&CK mapping)
   └── Legal & rules of engagement
 
2. Execution Phase (1-6 bulan)
   ├── Initial access attempts
   ├── Objective achievement
   ├── Adaptation based on detection
   └── Stealth maintenance
 
3. Reporting Phase (2-4 minggu)
   ├── Timeline reconstruction
   ├── Detection gap analysis
   ├── Recommendations
   └── Debrief with blue team

#Objective Setting

yaml

engagement_objectives:
  primary:
    - objective: "Compromise domain admin credentials"
      success_criteria: "Obtain DA hash or token"
      timeline: "Within 3 months"
    
    - objective: "Exfiltrate sensitive data"
      success_criteria: "Extract 1GB mock data from file share"
      timeline: "After DA compromise"
  
  secondary:
    - objective: "Test email gateway detection"
      success_criteria: "Determine if phishing emails are detected"
      timeline: "Week 1-2"
    
    - objective: "Test endpoint detection"
      success_criteria: "Determine if C2 implant is detected"
      timeline: "Throughout engagement"
 
  detection_challenges:
    - "Can blue team detect credential dumping?"
    - "Can blue team detect lateral movement?"
    - "Can blue team detect data exfiltration?"

#Operational Phases

#1. Reconnaissance (Pre-Engagement)

bash

# OSINT
subfinder -d target.com -o subs.txt
amass enum -passive -d target.com >> subs.txt
theHarvester -d target.com -b google,linkedin,github
 
# Infrastructure mapping
nmap -sV -sC target.com
 
# Employee profiling
# LinkedIn, social media, job postings

#2. Initial Access

text

Initial Access Vectors
========================
- Spearphishing (email)
- Watering hole (website)
- Valid accounts (credential stuffing)
- Supply chain compromise
- Physical access (tailgating)

#3. Execution & Persistence

text

Execution Methods
==================
- PowerShell/CMD (native)
- WMI
- Scheduled Tasks
- Registry Run keys
- DLL hijacking

#4. Defense Evasion

text

Evasion Techniques
====================
- AMSI bypass
- ETW patching
- Process hollowing
- Reflective DLL injection
- Timestomping
- Log clearing

#5. Credential Access

text

Credential Access
==================
- LSASS dump (Mimikatz)
- Kerberoasting
- DCSync
- Token impersonation
- Password spraying

#6. Lateral Movement

text

Lateral Movement
==================
- PsExec
- WMI
- PSRemoting
- Pass-the-Hash
- Pass-the-Ticket

#7. Data Exfiltration

text

Exfiltration Methods
======================
- DNS exfil
- HTTPS tunnel
- Cloud storage
- Physical media
- Steganography

Tip

Setiap fase harus memiliki detection challenges yang terukur. Misal: "Apakah blue team mendeteksi credential dumping?" → ukur dengan memeriksa SIEM logs setelah engagement.

#Praktik: Emulation Plan

Buat emulation plan untuk engagement fiktif:

yaml

target: "E-commerce company"
scope: "Production environment"
duration: "3 months"
 
objectives:
  - "Obtain domain admin credentials"
  - "Exfiltrate mock customer database"
  - "Test IR response time"
 
attack_chain:
  - phase: "Initial Access"
    technique: "T1566.001 - Spearphishing"
  - phase: "Execution"
    technique: "T1059.001 - PowerShell"
  - phase: "Persistence"
    technique: "T1053.005 - Scheduled Task"
  - phase: "Privilege Escalation"
    technique: "T1558 - Kerberoasting"
  - phase: "Credential Access"
    technique: "T1003.001 - LSASS Dump"
  - phase: "Lateral Movement"
    technique: "T1021.002 - SMB/WinRM"
  - phase: "Data Exfiltration"
    technique: "T1041 - Exfil over C2"

#Penutup

Inti yang harus dibawa pulang:

MITRE ATT&CK: fondasi TTP untuk red team operations.
Emulation planning: scope, objectives, attack chain, detection challenges.
Operational phases: recon → initial access → execution → persistence → evasion → credential access → lateral movement → exfiltration.
Detection challenges: setiap fase harus bisa diukur dari sisi blue team.

Di episode 3 selanjutnya, kita akan mempelajari initial access & delivery — teknik phishing advanced, drive-by compromise, dan valid accounts untuk mendapatkan foothold.