// Internal · Red Team

OPSEC

OPSEC

Infrastructure

  • Use generic name for DNS, avoid company names

  • Use wildcard (*) when issuing certificates to avoid leaking internal name

  • Do not use the default certificates embedded in your C2: elastic/Default Cobalt Strike Team Server Certificate, zeek/zeek_default_cobalt_strike_certificate

    (event.dataset: network_traffic.tls or event.category: (network or network_traffic))
and (tls.server.hash.md5:950098276A495286EB2A2556FBAB6D83
or tls.server.hash.sha1:6ECE5ECE4192683D2D84E25B0BA7E04F9CB7EB7C
or tls.server.hash.sha256:87F2085C32B6A2CC709B365F55873E207A9CAA10BFFECF2FD16D3CF9D94D390C)

  • Disable staging endpoints or restrict the access

  • Do not upload your stealthy binaries to VirusTotal or other online scanners

  • Guardrails your payload to trigger for a specific user/domain/computer name

  • Use a redirector, don’t expose your C2 TLS stack to the web

Behavior

  • Avoid calling commands such as whoami
    • List your kerberos tickets
    • Look for the owner of the process that spawned your beacon
    • List your environment variables: dir env: and dir env:USERNAME
    • Use a beacon object file (BOF) to bring your own whoami
  • DCSync (Replication) is always done between domain controllers
    • DCSync from machine accounts look more legit than with a user account
    • You don’t need to dump the whole database, the account krbtgt will grant you every access you need.
  • Kerberoasting must use the correct encryption, RC4 is often the default in offensive tool instead of AES.

IOC

Gophish:

Impacket:

  • smbexec.py is using a service to execute commands. In the earliest version, it was named BTOBTO but it has now 8 random characters. Change it to 10+ characters to break other correlation rules.
  • psexec.py is based on a well known service released on January 2012: kavika13/RemComSvc
  • wmiexec.py every command will be prefixed with cmd.exe /Q /c : impacket/wmiexec.py#L127

NetExec:

  • NetExec uses Impacket library, it shares the same IOC

  • Kerberoasting search filter query all accounts: NetExec/ldap.py#L931

    (&(servicePrincipalName=*)(UserAccountControl:1.2.840.113556.1.4.803:=512)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))(!(objectCategory=computer)))

AWS:

  • AWS cli is using Boto3 library, it sends a User-Agent containing the operating system version in every requests

References

☧ CPTS · ordered posts

Locked

Unlock with your Main_Key through local GPG.

Start the local GPG helper

In your cheatsheet checkout, run:

npm run unlock:helper

Open the link it prints, or paste its pairing code below. Keep the terminal open until GPG finishes.

Import an index you already decrypted

Download the encrypted index, then decrypt with GPG:

gpg --output report-index.json --decrypt report-index.gpg

Your private key stays in GPG. The decrypted index is saved in this browser so you can reopen it after navigation, refreshes and restarts. Lock this browser or clear this site's browser data to remove the saved index. Nothing is uploaded.