1
@ DEFCON 30
Purple Teaming & Adversary Emulation
in the Cloud with Stratus Red Team
Christophe Tafani-Dereeper
@christophetd
Good morning!
2
Christophe Tafani-Dereeper
christophetd@datadoghq.com�@christophetd�
we’re hiring! (35 security positions open)
Agenda
3
A Primer in Detection Engineering
a.k.a. “finding evil”
4
From detecting IoCs…
5
… to detecting behaviors
6
Behavior (TTPs)
Tools
Network & host artifacts
Domain names
IP addresses
Hashes
harder to detect
harder to change
Attackers
Defenders
MITRE ATT&CK
7
Threat matrix for Kubernetes
8
Azure Threat Research Matrix (released August 2022)
9
Purple Teaming
10
Blue team
Red team
Blue team
Red team
Purple Teaming
11
Empowering defenders to understand, reproduce,
and detect common attacker tactics (TTPs)
Kolb's learning cycle
12
Active experimentation
Concrete experience
Abstract conceptualization
Reflective observation
[Kolb & Fry (1975). Theories of group processes]
13
Reproduce attack
Observe generated data�logs, artifacts, analytics
Develop / improve detection
“Detect when VPC Flow Logs are removed”
How to reproduce this attack?
14
prerequisites
“Detect when VPC Flow Logs are removed”
15
“Detect when VPC Flow Logs are removed”
16
“Detect when VPC Flow Logs are removed”
17
?
?
“Detect when VPC Flow Logs are removed”
18
“Detect when VPC Flow Logs are removed”
19
“Detect when VPC Flow Logs are removed”
20
Challenges in Reproducing Cloud Attacks
21
Stratus Red Team
22
23
Stratus Red Team
24
Attack Techniques in Stratus Red Team
25
What does Stratus Red Team bring?
Catalog of cloud attack techniques�
Easy reproduction against a live environment
26
Operating model
27
Stratus Red Team
Detonate attack techniques
Your AWS account
Your K8s cluster
Your Azure subscription
Attack Techniques Library
28
29
Anatomy of an Attack Technique
30
Anatomy of an Attack Technique
31
$ stratus show aws.defense-evasion.cloudtrail-stop
Stops a CloudTrail Trail from logging. Simulates an attacker disrupting CloudTrail logging.
Warm-up:
- Create a CloudTrail Trail.
Detonation:
- Call cloudtrail:StopLogging to stop CloudTrail logging.
Anatomy of an Attack Technique
32
Anatomy of an Attack Technique
Terraform code that handles pre-requisite infrastructure�������
33
Terraform instrumentation
34
Anatomy of an Attack Technique
“Attack-as-code” (Go)
35
Lifecycle of an Attack Technique
“Stop a CloudTrail trail” (AWS)
36
COLD
WARM
DETONATED
Initial state
Prerequisite infrastructure ready
Attack technique has been “detonated”
Create S3 bucket
Create CloudTrail trail
Stop CloudTrail trail
Other tools
37
Demo (3 minutes)
38
Stratus Red Team + automation = ❤️
40
Advanced usages
41
Programmatic Interface
42
Programmatic Interface
43
Programmatic Interface
44
44
Generating logs datasets
If I launch an attack technique, which logs do I get?
45
Stratus Red Team
Your AWS account
User-Agent: stratus-red-team_<uuid>
Generating logs datasets
If I reproduce an attack technique, which logs do I get?
2. Poll your SIEM for generated logs!
46
Give me all your logs where
userAgent := stratus-red-team_<uuid>
SIEM
Generating logs datasets
47
$ ./dump-logs aws.defense-evasion.cloudtrail-delete logs.json
Detonating 'aws.defense-evasion.cloudtrail-delete' with Stratus Red Team
Execution UID: b071a414-5f74-48d8-9346-31e3b01a24e3
Searching for logs in Datadog
No logs found. Sleeping for 1m0s
Searching for logs in Datadog
Dumped 1 matching logs to logs.json
End-to-end testing of threat detection
48
AWS Organization
CloudTrail trail
S3 bucket
Lambda function
AWS Accounts
logs
SIEM
Logs ingestion
Parsing
Aggregation
Detection rules
Alerts
What could possibly go wrong? 🙈
What could go wrong?
49
AWS Organization
CloudTrail trail
S3 bucket
Lambda function
AWS Accounts
logs
SIEM
Logs ingestion
Parsing
Aggregation
Detection rules
Alerts
Black box
Attacks
End-to-end detection testing
50
End-to-end detection testing
51
Announcement! Released just today August 13th, 2022 @ Las Vegas
Open-sourcing Threatest
52
Threatest
53
Threatest
54
Threatest - demo!
55
Wrapping up
56
What’s next
57
One more thing…
58
Released just today August 13th, 2022 @ Las Vegas
GCP support in Stratus Red Team!� thank you to Dakota Riley @ Aquia��
59
Thank you!
60
@ DEFCON 30
Christophe Tafani-Dereeper
@christophetd
slides: dtdg.co/stratusredteam-cloudvillage
Questions?
Modeling attacker behavior
61