Diana Initiative 2020 - Abhijith B R (abx) - Internal Red Team Operations Framework

### Overview In this talk presented at Diana Initiative 2020, Abhijith B R (known as abx) presents a structured methodology called the Internal Red Team Operations Framework (IRTOF). The framework is designed to help organizations transition from traditional internal penetration testing and vulnerability assessments toward a mature, practical internal red teaming program. The speaker emphasizes that while vulnerability assessments produce exhaustive lists of flaws and penetration tests focus on compromising specific targets, red teaming represents a full-scope adversarial simulation aimed at testing people, processes, and technology across the entire organization to systematically enhance defensive capabilities.

### Key Topics - **Distinction Between Disciplines**: Clarifying the differences between vulnerability assessment (listing all potential weaknesses), penetration testing (goal-oriented compromise of specific targets), and red teaming (full-scope adversarial simulation aimed at challenging defensive measures). - **The IRTOF Phased Progression**: A five-phase progressive roadmap modeled from "crawling" to "flying" (Phase 1: Crawling, Phase 2, Phase 3, Phase 4: Running, and Phase 5: Flying). - **Team Composition and Skill Sets**: Building a multidisciplinary offensive unit inspired by diverse teams like The A-Team, including both deeply technical operators and non-technical advisors who can assist with realistic social engineering and business communications. - **Collaboration with Blue Teams**: Emphasizing that red teams exist to make defenders stronger, advocating for continuous purple teaming and constructive relationships rather than adversarial friction. - **Strategic vs. Tactical Execution**: Structuring the framework as individual short-term tactical plans (spanning 3 to 6 months per phase) chained together into an overarching long-term strategic plan.

### Technical Details IRTOF breaks down red team maturity into five distinct phases: 1. **Phase 1 (Crawling / Foundation)**: Securing executive budget approval, establishing rules of engagement with legal and leadership oversight, defining clear objectives focused on protecting critical organizational crown jewels and sensitive data, identifying vulnerable key personnel, evaluating the existing security posture, and recruiting core talent. 2. **Phase 2 (Initial Operations & Emulation)**: Setting up external infrastructure (cloud environments, domain names, email hosting) and leveraging open-source command-and-control (C2) frameworks, implants, and tools. Initiating adversary emulation using open-source resources like MITRE ATT&CK, Atomic Red Team, and Caldera to test antivirus, EDR, and SOC logging. Mapping external attack surfaces, establishing remediation processes, and running basic phishing campaigns across employee tiers to test mail filters and proxy controls. 3. **Phase 3 (Improvisation & Process Maturation)**: Advancing tools, techniques, and procedures (TTPs) when standard methods are restricted (e.g., employing unmanaged PowerShell when standard PowerShell is blocked). Testing and attempting continuous EDR and antivirus bypasses, identifying exploitation paths toward crown jewels, evaluating incident response times and containment procedures, conducting automated emulation campaigns across random machines, and drafting formal operational documentation. 4. **Phase 4 (Running / Collaboration & Physical Assessment)**: Transitioning into continuous, collaborative purple team exercises and incorporating enterprise tooling alongside open-source platforms. Executing targeted spear-phishing campaigns against executives and management using custom tooling rather than easily detectable frameworks. Conducting overt physical security assessments (official walk-throughs inspecting doors, locks, RFID checkpoints, and CCTV, referencing work by Deviant Ollam) with proper operational security (avoiding tactical backpacks or sticker-covered laptops), and instituting continuous operator/defender training. 5. **Phase 5 (Flying / Full Maturity)**: Achieving advanced internal capabilities, including internally developed custom C2 platforms, custom implants, and exploit scripts. Running a formal purple team metrics model to evaluate blue team coverage and red team progress. Conducting covert physical security assessments once organizational trust and confidence are established, executing continuous adversary simulation, and running iterative cycles of the IRTOF operational process.

### Takeaways Building an effective internal red team requires incremental growth rather than jumping immediately into complex, covert operations. By viewing each IRTOF phase as an achievable 3-to-6-month tactical plan, security leaders can progressively assemble diverse talent, establish open-source infrastructure, advance to custom development, and integrate collaborative purple team exercises that continually challenge and enhance the organization's overall cyber defense posture.