This is a corporate-branded presentation by Andy Gill and Craig Underhill from the CrowdStrike Services Red Team, focusing on the modern evolution of cyber adversarial tactics and how their position within a major EDR vendor (CrowdStrike) informs their offensive engagements. The core difference between red team simulation (creative, operator-driven, based on threat actor profiles) and emulation (step-by-step reproduction of known historical attacks) is detailed. Modern red teaming, mimicking actors like Scatter Spider, focuses heavily on living off the land, identity-based attacks (ADCS, MFA bypass), and compromising cloud infrastructure (vCenter, Snowflake, CI/CD pipelines) rather than traditional Domain Admin objectives. The presentation highlights the unique intelligence, collaboration, specialized tools (e.g., high-end Hashcat rigs), and ethical constraints inherent to performing authorized offensive operations within a major defensive security firm.
Drinking from the Same Fire Hose: Outrunning Threat Actors
0:00:04 Opening Rituals: The presentation opens with a lengthy discussion regarding the conference's 10th year and audience participation involving simulated shooting upon the use of swear words—a tiresome attempt at engagement, as far as I can tell.
0:01:34 Corporate Disclaimer: The talk is corporate branded; attack paths discussed are examples and do not represent specific clients.
Emulation is based on historical, known TTPs of caught threat actors (testing known defenses).
Simulation takes known threat actor profiles (like Fancy Bear or Scatter Spider) and applies operator creativity, deviating from step-by-step replication.
0:11:06 Threat Actor Shift: Threat actors (especially Scatter Spider, categorized as e-crime) are increasingly operating as Adversarial SysAdmins, using remote management tools and systems as designed to avoid detection, focusing on cloud and supply chain rather than disk-based malware.
0:14:10 Red Team OSINT Tactics: Effective Open Source Intelligence (OSINT) involves creating plausible fake LinkedIn profiles (e.g., as a former intern) months in advance to build connections, especially targeting HR staff, to unlock second-degree connections.
0:16:05 C2 Infrastructure: The speakers favor creating robust external infrastructure (e.g., fake recruitment agencies using ChatGPT/GitHub Pages) and using calculated C2 channels that blend in with the environment (e.g., Azure redirects for Azure-hosted compromised systems).
0:20:46 Adversarial Documentation: Red teams prioritize obtaining and reading internal client documentation (wikis, Jira, onboarding guides) to understand how the business operates, allowing them to act as standard users and evade capture (0:21:09).
0:22:02 Identity Focus: Attacks are shifting heavily toward identity-based compromise (e.g., Active Directory Certificate Services, stale service accounts) because basic EDR solutions often lack visibility in this area.
0:24:50 The Vendor Advantage: Working for CrowdStrike provides access to real-time, emerging TTPs from their Threat Intelligence and Incident Response (IR) teams (0:25:35), allowing the red team to incorporate newly observed tactics immediately into engagements.
0:26:24 Double-Edged Sword: Red team success against Falcon customers forces internal engineering teams to address detection gaps, while failures validate the product's effectiveness (telemetry feedback loop).
0:32:17 Budget and Equipment: The team has access to significant resources, including a water-cooled Hashcat cracking rig with 8x 4090 GPUs (0:32:40), capable of brute-forcing an 8-character keyspace in roughly three minutes (0:33:12). I don't care much for hardware flex, but this confirms high brute-force capacity.
0:34:04 Modern Objectives: Proper red teaming focuses on systems, cloud, identity, and developer pipelines—not just achieving Domain Admin, which is often only a zero-stage objective (0:35:32).
0:37:38 New TTP: Commit Stomping: A technique discovered by reading GitHub Enterprise documentation that allows an attacker to backdate the author and timestamp of Git commits (a feature of Git) to push malicious code undetected, as Enterprise environments often disable default "vigilant mode" warnings.
0:40:09 Eating Your Own Dog Food: The team is pressured to apply the highest defensive security standards (OpSec, robust payload protections, monitoring infrastructure) derived from their own products to ensure they remain undetected by competitors or other threat actors.
0:50:05 Red Team Constraints vs. Criminal Freedom: Red teams are highly constrained by legal/ethical boundaries, business impact stability, and the client’s right to intervention (0:51:05). Criminal actors ("I just love money," 0:52:46) operate without these constraints, performing "smash and grab" attacks focused solely on maximizing profit/data exfiltration (0:51:26).
0:53:05 Scatter Spider Attack Path Detail: Key initial access includes vishing the IT help desk for password/MFA reset, followed by SIM swapping (0:53:41). Persistence is maintained by modifying MFA settings (0:54:26) and deleting alert emails via Outlook transport rules (0:55:03). The ultimate objective often involves compromising VMware vCenter to exfiltrate virtual machine data (e.g., the unencrypted NTDS.dit file containing NTLM hashes) or creating undetectable guest VMs (0:56:45).
1:00:32 High-Impact, Non-DA Objectives: Successful engagements demonstrated real-world impact without gaining Domain Admin, such as obtaining route access to live infrastructure systems to remotely open and close highway toll booths (1:01:15) and introducing benign code into client application source code (1:01:46).