BadSalt Adversarial DevOps

Casey Erdmann explores the offensive capabilities of enterprise configuration management tools, presenting "BadSalt"—a research project and toolset demonstrating how SaltStack infrastructure can be leveraged by red teams and adversaries for stealthy command-and-control (C2) and automated post-exploitation.

[05:25] Erdmann explains the underlying architecture of SaltStack, detailing how the Salt Master communicates with distributed Minion agents across ZeroMQ publish and request ports (4505 and 4506). He examines the cryptographic authentication model, highlighting security risks during minion bootstrapping where missing or unverified master key fingerprints enable man-in-the-middle (MITM) attacks [15:20] that allow an attacker to hijack agent connections.

[22:01] The presentation highlights the evasion benefits of living off the land with legitimate, enterprise-signed Salt minion software. Because Salt agents are trusted administrative tools, they routinely bypass endpoint detection and response (EDR) and antivirus software. Erdmann demonstrates using declarative Salt state files (.sls) [26:03] to automate complex post-exploitation tasks across thousands of systems simultaneously, such as adding persistent administrative backdoor accounts, reconfiguring local firewalls, and establishing secondary access. He concludes by analyzing SaltStack network traffic patterns [32:55] and logging artifacts, providing blue teams with actionable detection strategies to identify rogue configuration activity.

(AI summary — Gemini Flash)