02. x33fcon 2019 - Out of the Blue by Marc Smeets & Mark Bergman

### Overview In this presentation at x33fcon 2019, Marc Smeets and Mark Bergman discuss the concept of red teaming as a collaborative sparring match rather than an adversarial contest. They explain that the goal of a red team is to train and improve the defensive capabilities of the blue team. As red team operations expand across complex infrastructure—often encompassing dozens of redirectors and multiple command-and-control (C2) servers—operators face significant challenges maintaining operational oversight and insight. To address this, the speakers introduce two open-source tools: RedELK, an operational data collection and SIEM framework for red teams, and RedFile, a lightweight Python-based tool for dynamic, rule-based payload delivery.

### Key Topics - **Philosophy of Red Teaming**: Comparing red teaming to boxing training, the speakers emphasize that an undetected operation is a failure because it denies the blue team an opportunity to learn. Red teaming should focus on engagement, training, and reaching actual business crown jewels rather than simply achieving domain admin privileges. - **Operational Scale and Complexity**: Realistic offensive operations often scale to 40–50 systems, including 4–5 backend C2 servers and 15–20 redirectors across multiple concurrent scenarios. Operators require centralized management to track who is scanning, interacting with, or analyzing their infrastructure. - **Locard's Exchange Principle Applied to Cyber Operations**: Citing Edmond Locard's principle that "every contact leaves a trace," the speakers note that while red teams leave traces for blue teams to find, blue team investigations, online sandboxes, and automated scanners also leave detectable traces for red teams. - **Centralized Telemetry with RedELK**: Combining the ELK stack (Elasticsearch, Logstash, and Kibana) with Filebeat, RedELK aggregates web traffic logs from front-end redirectors (such as HAProxy) and operational logs from C2 platforms like Cobalt Strike into a unified interface. - **Dynamic Payload Delivery with RedFile**: A modular Python tool deployed on web servers that dynamically serves payloads or decoy content based on request attributes such as IP addresses, user agents, frequency, or request sequence.

### Technical Details - **RedELK Architecture**: RedELK uses Filebeat agents deployed on first-line redirectors and C2 team servers to ingest traffic and operational logs into Logstash, enrich the data, and index it into Elasticsearch with a tailored Kibana front end. It periodically copies screenshots, keystrokes, and downloaded files from C2 servers to a central repository. - **Supported Platforms & Integrations**: RedELK natively supports Cobalt Strike out of the box without requiring custom CNA scripts, with planned future support for Faction C2 and Empire. For redirection, initial support centers on HAProxy, with upcoming support for Nginx and Apache. - **Data Enrichment & Periodic Tasks**: RedELK runs background tasks that execute every minute to tag IP addresses (categorizing them as belonging to the red team, the customer, or unknown entities via GeoIP and IP whitelists). Every two minutes, operational files are synchronized from team servers. Every five minutes, rule-based alarms run to detect anomalies, such as an internal IOC appearing on external security providers (VirusTotal, IBM X-Force, hybrid analysis) or unexpected IP addresses interacting with C2 endpoints. - **Defensive Artifacts and Investigation Traces**: The speakers demonstrate how EDR solutions (such as Symantec EDR and Microsoft Defender ATP) allow analysts to submit samples to cloud sandboxes with a single click. These sandbox detonations trigger live call-backs with distinctive, identifiable computer names and behavior patterns, followed hours later by broader waves of automated multi-sandbox and vendor scanners (e.g., Trustwave). - **RedFile Capabilities**: RedFile enables dynamic file serving in very few lines of Python code. Demonstrated use cases include restricting payloads by IP whitelists, rate-limiting payload delivery (e.g., serving a payload only once every 30 seconds to prevent runaway migrations caused by a user opening multiple documents), and sequentially changing responses per URL (e.g., returning robots.txt on the first click, a fake bitcoin stealer on the second, and a rickroll video on subsequent clicks to mislead defensive investigations).

### Takeaways - Centralizing red team operational data into a dedicated SIEM like RedELK provides situational awareness, enables swift reporting of IOCs and operator commands to the client, and monitors when defenders detect offensive infrastructure. - Defensive actions and EDR sandboxes inadvertently signal their activities back to red teams by querying online threat intelligence platforms and generating automated analysis traffic. - Pairing passive monitoring (RedELK) with active, dynamic file delivery (RedFile) empowers red teams to tailor their activities in real time to match the blue team's training needs.