This is a deep dive course on Red Team – Blue Team Operations: The cyber kill chain

Security is a business enabler, and it is only when it is viewed from a business perspective that we can truly make the right decisions.  Identifying, protecting and restricting data that can be monetized by adversaries is essential and should be reviewed and defined on a regular basis as only then can you identify potential gaps in your security posture. 

Every organisation should expect to be hacked at some point so it is vital that all members of your blue and red teams are up to speed on the latest hacking techniques.

The term Cyber Kill Chain defines the steps used by cyber attackers in today’s cyber based attacks and this course reviews all of those steps from both a red and blue team perspective. 

Reconnaissance is the first phase, during which the attacker gathers information on the target before the actual attack starts. The data gathering is essential skill of every red teamer. From blue teamer perspective, it is crucial to understand what kind of information is publicly available and to learn how to protect that information.

Without remote code execution vulnerability even the most sophisticated payload needs to be delivered to the victim. There are plenty of ways to achieve that so blue team needs to ensure that payloads are detected and blocked at early stage.

After successful delivery, malicious code exploits a vulnerability to execute code on victim’s system. There are many mechanisms that, if properly configured, significantly reduce attack scope.

The successful exploitation attack often results in code execution with limited privileges. Both, red teamers and blue teamers should be familiar with common techniques and misconfigurations allowing for privilege escalation.

The next after gaining admin privileges on single host is lateral movement that gives access to additional resources within the company. Before red teamer can reach Domain Controller or other critical servers, blue team can implement numerous protections against that threat.Even after an attack is stopped and contained, the attacker will want to ensure persistency and possibility of returning to a compromised host.