Fantastic Red-Team Attacks and How to Find Them

Overview: Casey Smith, Director of Applied Research at Red Canary, and Ross Wolf, security researcher at Endgame, introduce an empirical, question-based framework for testing and validating endpoint detection capabilities. The speakers address how defenders can objectively verify whether their security telemetry and detection rules are effective against both known and novel adversary techniques. The presentation details the architecture and operational usage of Atomic Red Team—an open-source testing framework mapped to MITRE ATT&CK—alongside the Event Query Language (EQL) for querying endpoint event streams and identifying living-off-the-land tradecraft.

Key Topics: - Question-based methodology for validating endpoint telemetry collection and behavioral detection logic - Atomic Red Team framework: YAML-based, MITRE ATT&CK-mapped functional test automation - Event Query Language (EQL) for structured endpoint behavioral querying and correlation - Frequently missed living-off-the-land techniques: `InstallUtil` whitelisting bypasses, masquerading, WMI, and script hosts

Technical Details: Security operations teams frequently operate under untested assumptions regarding the efficacy of their detection engines and endpoint telemetry pipelines. Smith and Wolf emphasize that behavioral detection systems require continuous empirical testing to expose configuration errors, agent dropouts, and telemetry pipeline gaps. To operationalize this testing, the authors developed Atomic Red Team, a library of discrete, open-source tests mapped directly to the MITRE ATT&CK matrix. Each atomic test is codified in YAML format, detailing execution requirements, command-line syntax, and input arguments. Tests execute benign actions (such as spawning `calc.exe` or creating canary files) to generate authentic endpoint telemetry without causing system disruption.

The framework enables automated test execution and chaining through PowerShell harnesses (`Invoke-AtomicTest`), allowing defenders to simulate multi-stage attack scenarios. Through community feedback and real-world assessments, the speakers identified multiple built-in operating system capabilities that defenders routinely fail to detect. A prominent focus is MITRE ATT&CK technique T1118: abusing Microsoft .NET’s trusted `InstallUtil.exe` utility to bypass application whitelisting solutions like AppLocker. By invoking `InstallUtil` against a compiled assembly, adversaries leverage its automated execution of the assembly’s uninstall or help methods (`/U` or `/help`), achieving arbitrary code execution within a signed Microsoft binary.

Other commonly unmonitored tradecraft includes binary masquerading (renaming native binaries or copying them to attacker-writable directories), Windows Management Instrumentation (WMI) event subscriptions, process injection, Windows Script Host execution (`cscript.exe`, `wscript.exe`), `mshta.exe` abusing HTML applications, and XSL stylesheet script execution via tools like `wmic.exe`. To locate these stealthy behaviors within high-volume telemetry, the speakers introduce Event Query Language (EQL). EQL provides expressive, structured syntax for correlating parent-child process relationships, detecting unusual command-line invocations, and identifying when signed developer utilities execute unsigned scripts.

Key Takeaways: Defenders must actively and continuously test their detection controls rather than assuming endpoint security products maintain complete coverage. Leveraging open-source frameworks like Atomic Red Team allows security teams to systematically exercise ATT&CK techniques and validate that logging and alerting pipelines function as expected. Pairing atomic testing with expressive behavioral query languages like EQL enables organizations to detect stealthy living-off-the-land binaries, script host abuses, and whitelisting bypasses that evade traditional signature-based defenses.

(AI summary — Gemini Flash)