Cyb3rWard0g
commented
4 years ago Tasks:
Create issues with the respective steps
Anticipating the initial following steps: 1) [Caldera-Execution] Prepare FIN6 YAML File
- Take template: https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/master/fin6/Emulation_Plan/FIN6.yaml
- Use initial script from PR: https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/b8763ef84d139f86e99f8e864db4d1b98f1b8537/resources/ctid_aep_to_caldera.py to start the translation
- Only create the structure and do not create payloads or define a source file with facts 2) [Manual-Execution]
- Identify C2 frameworks
- Create spreadsheet for emulation plan with respective commands
- Read recent blog announcing the release of this emulation plan and the video walkthrough.
3) Create folder with Payloads
- go through all the template and see if there are any payloads that can be provided
4) [Caldera-Exection] Create Source / Facts file
- Go over template and identify variables that can be set in a source/fact file 5) [Manual-Execution] Define variables used in emulation plan
- Define potential variables that need to be added while deploying environment
4) [Caldera-Execution] Build/Test Caldera (Dockerized) with plugin resources
- Validate plugin folder and all resources show up in Caldera gui
5) Design Environment for Azure Templates
- Define the scope of endpoints
- Document network environment
- Define virtual network and subnets
- Update Plugin facts (i.e. IP addresses, domain names, usernames, passwords, etc)
6) Build ARM templates (Infrastructure as code)
- Write ARM templates
- Initial Validation that environment works without executing anything (Download payloads and scripts ONLY)
7) Execute Emulation Plan in Azure
- Go through the whole emulation plan (Caldera and Manually)
- Do not record any data yet
8) Execution and Datasets Creation
- Host security logs
- Network Logs PCAPs
FIN6 Template: https://github.com/center-for-threat-informed-defense/adversary_emulation_library/tree/master/fin6