My talk at @BSidesLV is now available! In this session I shared insights on how we’re using purple teaming and threat intelligence at Banco do Brasil to enhance our security strategy.
Catch the full video here and let me know your thoughts: https://youtu.be/Rx0wWb8zlQE
@cgoncalves I appreciated your honesty when it came to developing your Purple Team workflow! To be frank, I’ve seen Vectr mentioned before, but I have not used it. I see that you use Vectr to build an executable that launches the campaign. I’ve previously used Caldera to do something similar, but instead of an executable, the Caldera agent acts as a Remote Access Trojan on an endpoint. I would like to hear about why you selected Vectr instead of something else.
It also sounded like the assumption was the red team exercise started at the point that someone has already gotten inside your network aka “assume breach.” Is that correct? You were more interested in spending time detecting the threat activity after the initial access was established…hence the whole purpose of purple-teaming.
I’d be curious to hear about how your CTI team prioritizes certain Mitre Att&ck techniques to use within the Purple Team exercise.
@thekileen thanks for the questions. Let's break it down.
Vectr is being used right now as a tool for managing the purple team campaigns. We ingest intel data, create the test cases and extract reports from there. The red team decides how to execute their part, whether it's with tools like Caldera, Cymulate, or even launching attacks manually.
Yes, we took an assumed breach approach. It doesn't mean that the organization is ignoring initial access, we have other initiatives focusing on that. But we think that this helps us focus on the real risk once someone gets in, and at the same time we're covering the insider threat. Also, the reason for this links with the third question.
We're using Mitre's Top ATT&CK Techniques (https://top-attack-techniques.mitre-engenuity.org/) to help us prioritize technique simulations. When applying this methodology, initial access and impact rarely rank as top priorities. With limited resources and time, we're heavily relying on the concepts of choke points and actionability from the methodology to select which techniques to simulate.
And, as I mentioned in the talk, it's important to reassess the top techniques regularly to make sure they align with your needs, especially as your defense capacity improves for certain tactics.
Oh, and I haven't even mentioned how the risk team joins the purple team exercise...
Carlos Gonçalves 🇧🇷
Kileen
Claus Cramon Houmann