maddev-engenuity / adversaryemulation Goto Github PK

MAD ATT&CK Defender: ATT&CK Adversary Emulation Repository

License: Apache License 2.0

Python 57.00% Shell 6.00% PowerShell 37.00%

adversary-emulation mitre-attack labs training-materials

adversaryemulation's Introduction

MITRE ATT&CK® Defender - ATT&CK Adversary Emulation

MITRE ATT&CK Defender is the cybersecurity community’s new ATT&CK training and certification program produced by MITRE’s own ATT&CK subject matter experts.

This repository contains the materials required for completing hands-on labs taught in the upcoming MITRE ATT&CK Defender Adversary Emulation course.

🌪️ Pardon our Dust

This repository is under active development.

You may observe frequent changes, and placeholders for future content.

Check out the releases section for stable content.

💻 Instructions

The following instructions describe how to install and configure a virtual environment needed to execute the MITRE ATT&CK Defender Adversary Emulation Fundamentals labs.

Download and install a virtual machine hypervisor such as the freely available VirtualBox.
Download and install two operating systems in your virtual machine hypervisor:

a. Kali Linux

b. Windows Server 2019 - Trial Version
From both your Kali and Windows Server 2019 virtual machines, git clone this repository.

git clone [email protected]:maddev-engenuity/AdversaryEmulation.git

Execute the automated setup scripts for your VMs:

a. Kali:
```
cd AdversaryEmulation/vm_setup_scripts/kali
sudo ./setup-kali-vm.sh
```
After installation completes, the server will reboot.

Log in with the following credentials:
```
Username: attacker
Password: ATT&CK
```
Setup will complete once you open a terminal window within the desktop session.

b. Windows Server 2019
```
# Open powershell.exe as Administrator
cd AdversaryEmulation\vm_setup_scripts\windows_server\
.\setup-dc.ps1
```
The setup process will take a few reboots to complete. When the script prompts you for a password, you may choose to provide the login password you created for the initial Administrator user. This will allow the reboots and logins for the setup to occur without user interaction.

Once the setup process completes, log in with the following credentials:
```
Username: madAdmin
Password: ATT&CK
```
Note: This process can take more than 20 minutes to complete. Chocolatey may seem to be hanging, but unless it errors out, it should complete. You will know that setup is complete when the log in screen is presented for the madAdmin user.
Configure the network settings for each VM so that the Windows Server 2019 VM can ping the Kali VM. If using VirtualBox, this can easily be done by giving both VM's a bridged network adapter.
You should be ready to execute the course labs after succesfully running the setup scripts. Access the written lab guides from the AdversaryEmulation/labs folder.

⚙️ Technical Issues

If you found a defect that is preventing you from completing the lab exercises, follow these steps:

Open a GitHub issue.
Clearly state the problem.
Provide steps to reproduce the problem.
Include pertinent screenshots, logs, and/or error messages.
We welcome recommended solutions and/or corrective pull requests.

🪲 Have a Bug-Fix?

Fork the repo.
Create a descriptive branch.
Add your changes.
Submit a pull request.

☣️ Malware Warning

Fundamentally, this course entails executing publicly known adversary TTPs so that we can assess and improve cybersecurity.

As a result, many of our tools and resources will likely be flagged malicious by security products. We make every effort to ensure that our adversary emulation content is trusted and safe for the purpose of offensive security testing.

As a precaution, you should not perform these labs on any system that contains sensitive data. Additionally, you should never use capabilities and/or techniques taught in this course without first obtaining explicit written permission from the system/network owner(s).

🗣️ Support MITRE ATT&CK Defender

MITRE ATT&CK Defender is committed to providing freely available educational content taught by ATT&CK subject matter experts.

To help keep this courseware free, please consider supporting the project.

Some ways you can help include:

Adding a GitHub star to the project.
Tweeting about MITRE ATT&CK Defender on your Twitter.
Get certified!

📫 Contact Us

For questions, feedback, or general inquiries, contact the MITRE ATT&CK Defender team at [email protected].

📋 Notice

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

This project makes use of ATT&CK®

ATT&CK Terms of Use

adversaryemulation's People

Contributors

Stargazers

Watchers

Forkers

maleus bbg-qx activeshadow kotopathe aleph-works joker2013 sujal11111 0-1-2-3-4 luizmorena yee-jonathan patol84 tejanarayana jamespichardo mrmoshkovitz meatloaf111 toniall pwn20wn jacchim mllanes

adversaryemulation's Issues

Add license to our repo

Our repository needs a license so that external users can use our content.

Please add the "Apache License 2.0" to the repo.

Create Lab 4.3 - Automating TTPs

We need a lab demonstrating how and why we automate TTPs.
Enter "Lab 4.3 - Automating TTPs."
This lab will immediately follow Lab 4.2 where the student implements APT 29 TTPs manually (.LNK payload).

Use the Lab 4.2 document on SharePoint as your standard template.

Office365BusinessInstaller

Hi,

Can you please help with Office365BusinessInstaller hanging and failing?

Add console output to xor python script in lab 4.2

AdversaryEmulation folder in wrong location?

Our written labs direct the user to CD into the adversary emulation folder from the desktop; however, the setup scripts do not copy the folder to the desktop.

Please update the setup scripts to duplicate the AdvEmu folder on the attacker desktop.

cd ~/Desktop/AdversaryEmulation/labs/lab_4.2/

Module 2 - inconsistent terminology: TTP vs Scenario

Some module 2 content does not consistently use the term "TTP Outline", instead it uses "Scenario Outline."
TTP Outline is the preferred term, as it is less ambiguous than Scenario, and also aligned with ATT&CK vernacular.

Module 2 slides 38 and 39 need to be changed, and correpsonding videos need to be edited.

Give attacker user sudo rights with no password

On the Kali VM, the attacker user must enter the password to invoke sudo commands.

While this is a desirable security configuration, it degrades the student experience by slowing the pace and detracting from the interesting adversary emulation content.

Can we configure the the attacker user to not require a password for all sudo commands?

This configuration should be made in our automated setup scripts.

Desktop background missing on the Kali VM

The MAD desktop background appears to be missing on login as the attacker user to the Kali VM.

This poses no immediate impact to students, but I would like to fix it for consistency when possible.

Can we investigate and fix?

Create new release

@garunagiri
Please create a launch release of this repository after resolving the remaining issues.
This should happen no later than March 31st.

Upload Lab 4.2 Writeup

We need to update / revise the lab 4.2 Implementing Adversary TTPs walkthrough PDF.

Once the walkthrough PDF is finalized, please upload it to the labs/lab_4.2 folder.

Improve Lab Setup Process

Presently our setup procedure has students cloning the repo and running shell scripts.

We would like to elevate the process to utilize a more professional solution, such as Vagrant and Packer.

The desired end state is for students to be able to stand up our lab environment in a trivial number of steps, for example:

vagrant up --provider=virtualbox

See DetectionLab for example implementations:

https://github.com/clong/DetectionLab

Disable MS Teams on the Windows Server

Microsoft Teams spawns immediately on login to the Windows Server 2019 system.

It is a minor nuisance to students; can we disable it in our setup scripts?

Change Desktop Background for VMs

Our VM setup scripts need to be able to change the desktop backgrounds.

The desired end state is that the user logs in and sees a unique background for the attacker VM, and a unique background for the target VM.

We don't have the final desktop images yet, so for now, I'll suggest you make two simple desktops with black background and overlay text.

The text should say:

MITRE ATT&CK Defender
ATT&CK Adversary Emulation
Hostname: < attacker > or < target >

Apple M1 Pro Fix for VMs

I highly recommend using AWS EC2s to follow the lab instructions if your mac is having issues setting up with Windows & Kali VM's due to the well documented error of "This virtual machine cannot be powered on because it requires the X86 machine architecture, which is incompatible with this Arm machine architecture host."

The Windows_Server-2019-English-Full-Base is the EC2 with a GUI is the best option that has worked for me after launching several AMI's

Create Lab 4.4 - Identifying Detections and Mitigations

Create a lab that demonstrates how to examine TTPs to identify detections and mitigations.

Add a README to the automation folder

Please add a README to the automation folder that explains how to use the project and state the purpose of each script.

Winpcap\Unintall.exe

winpcapinstall.ahk generating errors.
Illegal character in expression,etc

Add GUI instructions for terminal hotkeys

Lab 1.3 features terminal hotkey commands like "ctrl + shift + t" to open a new tab.

The problem is those hotkeys don't work when accessing VM's inside a web browser, as is the case in the Cybrary range.

We need to provide alternative guidance using the GUI to achieve the same effect as the terminal hotkeys.

Desktop Background Bug

I receive a no such file or directory error when opening the terminal after setup.

Steps to reproduce:

Download this repo from the releases page to the kali user downloads folders
Rename folder to /home/kali/Downloads/AdversaryEmulation/
Run setup scripts
Reboot
Login as attacker user
Open terminal

Please update instructions to account for users downloading the AdversaryEmulation repo in unpredictable locations.

Fill out project README's

We would like project README's to guide external users through our content.
The desired end state is for our README's to make the project to look professional while being easy-to-use for our external users.

At a minimum we should have README's for these folders:

AdversaryEmulation
vm_setup_scripts
labs

Here are some general sections I would like to see; use your discretion to alter format/content if it makes sense for the particular section you're working on.

An intro explaining the purpose of this project or folder.
Instructions so external users know how to use our content.
Malware warning on the root README (copy the language from lab 4.2 on Sharepoint)
Instructions for people to submit git issues
Instructions for people to submit changes / contributions

Add Remarks for recommended VM configuration under the vm_setup_scripts folder:

2 core CPU
50 GB disk space
8 GB RAM
Kali and Windows VM should be networked / able to ping each other
Kali and Windows VM should have Internet access
Install VMWare Tools / VirtualBox Extensions for copy/paste between host and VMs

Malware Warning text - list this on the front page of our repo:

Fundamentally, this course entails executing publicly known adversary TTPs so that we can assess and improve cybersecurity. As a result, many of our tools and resources will likely be flagged malicious by security products. We make every effort to ensure that our adversary emulation content is trusted and safe for the purpose of offensive security testing.  
  
As a precaution, you should not perform these labs on any system that contains sensitive data. Additionally, you should never use capabilities and/or techniques taught in this course without first obtaining explicit written permission from the system/network owner(s).

Windows DC Setup Defective

The Windows DC setup script appears to be defective.