#HITBGSEC 2018 D1: A Year Of Purple

### Overview In this presentation at Hack in the Box GSEC 2018, Ryan Sheppard, a Detection and Response Investigator at Countercept (an MWR InfoSecurity company acquired by F-Secure), shares insights from his experiences bridging offensive and defensive security under the concept of purple teaming. Sheppard argues that skilled practitioners drive defensive technology rather than the reverse. He explores real-world case studies contrasting offline versus online investigation methods, discusses modern Incident Response (IR) collaboration alongside real-time attack detection during a major banking heist, and advocates for building isolated attack and defense simulation environments to safely cross-train security personnel.

### Key Topics - **People Over Technology**: Emphasizing that analyst experience and methodology outweigh tool limitations, especially when critical telemetry or endpoint agents are unavailable. - **The Time Factor in Investigations**: Comparing attacker dwell time and defensive urgency across low-level opportunistic malware versus long-duration Advanced Persistent Threats (APTs). - **Attack Detection vs. Incident Response**: Evolving traditional IR from post-incident cleanup to proactive, real-time collaboration with detection teams during active intrusions. - **Limitations of Red Team Engagements**: Understanding how artificial scope constraints limit what defenders can learn compared to unrestricted real-world adversaries. - **Purple Team Simulation Labs**: Utilizing automated, isolated lab environments (such as DetectionLab) to safely mirror production estates, run attacks, and build detection pipelines.

### Technical Details Sheppard details a case study where the same malware infection was analyzed by two different teams within one week: - **First Team (Offline Host)**: Investigating historical data without active endpoint agent access, analysts identified suspicious PowerShell activity downloading a payload from an IP address. They retrieved the payload over Tor, revealing an obfuscated PowerShell script referencing open-source GitLab code designed for reflective DLL loading. Analyzing historical telemetry uncovered a phishing email vector delivering an `.scr` file disguised as a PDF via Outlook and Internet Explorer. Execution involved AutoIt scripting binaries (`fkqf.exe`) and `regsvcs.exe` (a .NET utility capable of registering COM objects and running code across privilege boundaries). Forensic clues included Windows UserAssist ROT13-encoded entries. - **Second Team (Online Host)**: With endpoint agents active, analysts detected the reflective load directly into `regsvcs.exe`, captured memory thread mappings, gathered live network traces, and extracted process dumps. When the host went offline mid-investigation, analysts leveraged the Master File Table (MFT) to reconstruct file write timestamps back to the original Outlook download.

A secondary case study reviewed a $40 million bank heist where attackers bypassed standard credit card switch targets to access the generic transaction switch. Over a three-month reconnaissance and testing period, the adversaries reverse-engineered a custom switch application to issue automatic transaction authorization loops, enabling mules to withdraw funds with blank cards encoded only with target IBAN numbers. By analyzing attacker enumeration paths using BloodHound graph analysis, the defense team mapped relationship paths, closed critical privilege escalation routes, and detected the adversary's re-entry before initial users were compromised.

### Takeaways - Purple teaming creates a direct feedback loop: offensive knowledge enhances threat hunting, threat hunting sharpens live attack detection, and attack detection empowers incident response. - Long-running APT attacks offer defenders substantial time windows to identify anomalous reconnaissance or lateral movement before the final objective is executed. - To overcome the risks of testing in production and the scope limitations of red teams, organizations should deploy standalone simulation labs utilizing tools like Sysmon, Windows Event Forwarding (WEF), Bro/Zeek, and the Elastic Stack (referencing open-source work by Chris Long).