mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-09-11 19:00:50 +03:00
Initial commit - 611 cybersecurity skills across all subdomains
This commit is contained in:
mukul975
@@ -0,0 +1,106 @@
|
||||
# Standards and References: Full-Scope Red Team Engagement
|
||||
|
||||
## MITRE ATT&CK Techniques
|
||||
|
||||
### Reconnaissance (TA0043)
|
||||
- **T1593** - Search Open Websites/Domains
|
||||
- **T1593.001** - Social Media
|
||||
- **T1593.002** - Search Engines
|
||||
- **T1589** - Gather Victim Identity Information
|
||||
- **T1589.001** - Credentials
|
||||
- **T1589.002** - Email Addresses
|
||||
- **T1590** - Gather Victim Network Information
|
||||
- **T1590.002** - DNS
|
||||
- **T1590.005** - IP Addresses
|
||||
- **T1591** - Gather Victim Org Information
|
||||
|
||||
### Resource Development (TA0042)
|
||||
- **T1583.001** - Acquire Infrastructure: Domains
|
||||
- **T1583.003** - Acquire Infrastructure: Virtual Private Server
|
||||
- **T1587.001** - Develop Capabilities: Malware
|
||||
- **T1587.003** - Develop Capabilities: Digital Certificates
|
||||
- **T1608.001** - Stage Capabilities: Upload Malware
|
||||
|
||||
### Initial Access (TA0001)
|
||||
- **T1566.001** - Phishing: Spearphishing Attachment
|
||||
- **T1566.002** - Phishing: Spearphishing Link
|
||||
- **T1190** - Exploit Public-Facing Application
|
||||
- **T1078** - Valid Accounts
|
||||
- **T1133** - External Remote Services
|
||||
- **T1195.002** - Supply Chain Compromise: Compromise Software Supply Chain
|
||||
|
||||
### Execution (TA0002)
|
||||
- **T1059.001** - Command and Scripting Interpreter: PowerShell
|
||||
- **T1059.003** - Command and Scripting Interpreter: Windows Command Shell
|
||||
- **T1204.001** - User Execution: Malicious Link
|
||||
- **T1204.002** - User Execution: Malicious File
|
||||
- **T1047** - Windows Management Instrumentation
|
||||
|
||||
### Persistence (TA0003)
|
||||
- **T1053.005** - Scheduled Task/Job: Scheduled Task
|
||||
- **T1547.001** - Boot or Logon Autostart Execution: Registry Run Keys
|
||||
- **T1136.001** - Create Account: Local Account
|
||||
- **T1098** - Account Manipulation
|
||||
|
||||
### Privilege Escalation (TA0004)
|
||||
- **T1068** - Exploitation for Privilege Escalation
|
||||
- **T1548.002** - Abuse Elevation Control Mechanism: Bypass User Account Control
|
||||
- **T1134** - Access Token Manipulation
|
||||
|
||||
### Defense Evasion (TA0005)
|
||||
- **T1055** - Process Injection
|
||||
- **T1027** - Obfuscated Files or Information
|
||||
- **T1562.001** - Impair Defenses: Disable or Modify Tools
|
||||
- **T1070.004** - Indicator Removal: File Deletion
|
||||
|
||||
### Credential Access (TA0006)
|
||||
- **T1003.001** - OS Credential Dumping: LSASS Memory
|
||||
- **T1003.006** - OS Credential Dumping: DCSync
|
||||
- **T1558.003** - Steal or Forge Kerberos Tickets: Kerberoasting
|
||||
- **T1110** - Brute Force
|
||||
|
||||
### Discovery (TA0007)
|
||||
- **T1087.002** - Account Discovery: Domain Account
|
||||
- **T1018** - Remote System Discovery
|
||||
- **T1069.002** - Permission Groups Discovery: Domain Groups
|
||||
- **T1082** - System Information Discovery
|
||||
|
||||
### Lateral Movement (TA0008)
|
||||
- **T1021.002** - Remote Services: SMB/Windows Admin Shares
|
||||
- **T1021.001** - Remote Services: Remote Desktop Protocol
|
||||
- **T1550.002** - Use Alternate Authentication Material: Pass the Hash
|
||||
- **T1047** - Windows Management Instrumentation
|
||||
|
||||
### Collection (TA0009)
|
||||
- **T1560** - Archive Collected Data
|
||||
- **T1213** - Data from Information Repositories
|
||||
|
||||
### Exfiltration (TA0010)
|
||||
- **T1041** - Exfiltration Over C2 Channel
|
||||
- **T1048.003** - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol
|
||||
|
||||
## NIST References
|
||||
|
||||
- **NIST SP 800-115** - Technical Guide to Information Security Testing and Assessment
|
||||
- **NIST SP 800-53 Rev. 5** - Security and Privacy Controls (CA-8: Penetration Testing)
|
||||
- **NIST SP 800-53A** - Assessing Security and Privacy Controls (CA-8 assessment procedures)
|
||||
- **NIST CSF 2.0** - Identify, Protect, Detect, Respond, Recover functions
|
||||
|
||||
## Industry Frameworks
|
||||
|
||||
- **PTES** - Penetration Testing Execution Standard (Pre-engagement, Intelligence Gathering, Threat Modeling, Vulnerability Analysis, Exploitation, Post-Exploitation, Reporting)
|
||||
- **OSSTMM** - Open Source Security Testing Methodology Manual v3
|
||||
- **TIBER-EU** - European Central Bank Threat Intelligence-Based Ethical Red Teaming
|
||||
- **CBEST** - Bank of England intelligence-led penetration testing framework
|
||||
- **CREST** - Council of Registered Ethical Security Testers certification standards
|
||||
- **STAR** - Simulated Targeted Attack and Response (Bank of Canada)
|
||||
|
||||
## Compliance Alignments
|
||||
|
||||
| Framework | Control | Description |
|
||||
|---|---|---|
|
||||
| PCI DSS 4.0 | 11.4 | External and internal penetration testing |
|
||||
| SOC 2 | CC7.1 | Identification and management of vulnerabilities |
|
||||
| ISO 27001 | A.18.2.3 | Technical compliance review |
|
||||
| HIPAA | 164.308(a)(8) | Evaluation of security measures |
|
||||
| FFIEC | IS.2.M.7 | Penetration testing program |
|
||||
@@ -0,0 +1,131 @@
|
||||
# Workflows: Full-Scope Red Team Engagement
|
||||
|
||||
## Engagement Lifecycle Workflow
|
||||
|
||||
```
|
||||
┌─────────────────────────────────────────────────────────────────┐
|
||||
│ RED TEAM ENGAGEMENT LIFECYCLE │
|
||||
├─────────────────────────────────────────────────────────────────┤
|
||||
│ │
|
||||
│ 1. SCOPING & PLANNING │
|
||||
│ ├── Define Rules of Engagement (RoE) │
|
||||
│ ├── Identify threat actors to emulate │
|
||||
│ ├── Define objectives and success criteria │
|
||||
│ ├── Establish communication channels and emergency stops │
|
||||
│ └── Legal authorization and sign-off │
|
||||
│ │
|
||||
│ 2. RECONNAISSANCE (2-4 weeks) │
|
||||
│ ├── Passive OSINT collection │
|
||||
│ │ ├── DNS enumeration (Amass, subfinder) │
|
||||
│ │ ├── Email harvesting (theHarvester) │
|
||||
│ │ ├── Social media profiling (LinkedIn, Twitter) │
|
||||
│ │ └── Credential breach searches (DeHashed) │
|
||||
│ ├── Active scanning (if in scope) │
|
||||
│ │ ├── Port/service scanning (Nmap) │
|
||||
│ │ ├── Web application discovery (Aquatone) │
|
||||
│ │ └── Vulnerability scanning (Nuclei) │
|
||||
│ └── Target prioritization matrix │
|
||||
│ │
|
||||
│ 3. WEAPONIZATION (1-2 weeks) │
|
||||
│ ├── Develop custom payloads │
|
||||
│ │ ├── Shellcode generation and encryption │
|
||||
│ │ ├── Loader development (C/C++, Rust, Nim) │
|
||||
│ │ └── Sandbox evasion techniques │
|
||||
│ ├── Configure C2 infrastructure │
|
||||
│ │ ├── Deploy team server (Havoc/Cobalt Strike) │
|
||||
│ │ ├── Set up HTTPS redirectors │
|
||||
│ │ ├── Configure domain fronting or CDN │
|
||||
│ │ └── Test beacon callbacks │
|
||||
│ └── Prepare phishing infrastructure │
|
||||
│ ├── Register look-alike domains │
|
||||
│ ├── Configure SPF/DKIM/DMARC │
|
||||
│ └── Design email templates │
|
||||
│ │
|
||||
│ 4. INITIAL ACCESS (1-2 weeks) │
|
||||
│ ├── Execute phishing campaign (T1566) │
|
||||
│ ├── Exploit external services (T1190) │
|
||||
│ ├── Credential stuffing/spraying (T1110) │
|
||||
│ ├── Supply chain vectors (T1195) │
|
||||
│ └── Physical access attempts (if in scope) │
|
||||
│ │
|
||||
│ 5. POST-EXPLOITATION (2-4 weeks) │
|
||||
│ ├── Establish persistence (T1053, T1547) │
|
||||
│ ├── Privilege escalation │
|
||||
│ │ ├── Local priv esc (T1068, T1548) │
|
||||
│ │ └── Domain priv esc (Kerberoasting, DCSync) │
|
||||
│ ├── Credential harvesting │
|
||||
│ │ ├── LSASS dump (T1003.001) │
|
||||
│ │ ├── SAM database (T1003.002) │
|
||||
│ │ └── Kerberos tickets (T1558) │
|
||||
│ ├── Lateral movement │
|
||||
│ │ ├── SMB (T1021.002) │
|
||||
│ │ ├── WMI (T1047) │
|
||||
│ │ ├── WinRM (T1021.006) │
|
||||
│ │ └── RDP (T1021.001) │
|
||||
│ └── Objective pursuit │
|
||||
│ ├── Crown jewel identification │
|
||||
│ ├── Data staging (T1074) │
|
||||
│ └── Exfiltration demonstration (T1041) │
|
||||
│ │
|
||||
│ 6. REPORTING & DEBRIEF (1-2 weeks) │
|
||||
│ ├── Attack narrative with timeline │
|
||||
│ ├── MITRE ATT&CK heat map │
|
||||
│ ├── Detection gap analysis │
|
||||
│ ├── Remediation recommendations │
|
||||
│ ├── Executive debrief presentation │
|
||||
│ └── Purple team follow-up sessions │
|
||||
│ │
|
||||
└─────────────────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
## Decision Tree: Initial Access Vector Selection
|
||||
|
||||
```
|
||||
START: Select Initial Access Vector
|
||||
│
|
||||
├── Is phishing in scope?
|
||||
│ ├── YES → Target high-value employees
|
||||
│ │ ├── C-suite → CEO fraud / whale phishing
|
||||
│ │ ├── IT Staff → Credential harvesting
|
||||
│ │ └── HR/Finance → Malicious attachment
|
||||
│ └── NO → Proceed to external attack surface
|
||||
│
|
||||
├── External-facing services found?
|
||||
│ ├── VPN → Check for CVEs (Fortinet, Pulse Secure, Citrix)
|
||||
│ ├── Exchange → ProxyShell/ProxyLogon
|
||||
│ ├── Web Apps → OWASP Top 10, file upload, RCE
|
||||
│ └── RDP → Brute force / credential stuffing
|
||||
│
|
||||
└── Physical access in scope?
|
||||
├── Badge cloning (Proxmark3)
|
||||
├── Tailgating
|
||||
└── Rogue device deployment (LAN Turtle)
|
||||
```
|
||||
|
||||
## Operational Security (OPSEC) Checklist
|
||||
|
||||
1. **Infrastructure Separation**: Separate attack infrastructure from assessment infrastructure
|
||||
2. **Redirectors**: Use HTTPS redirectors between C2 and targets
|
||||
3. **Domain Aging**: Register domains 30+ days before engagement
|
||||
4. **Categorization**: Categorize phishing domains before use (Bluecoat, Fortiguard)
|
||||
5. **Payload Testing**: Test payloads against VirusTotal alternatives (antiscan.me)
|
||||
6. **Log Rotation**: Rotate and encrypt operational logs
|
||||
7. **Clean-up**: Remove all implants and artifacts post-engagement
|
||||
8. **Communication**: Use encrypted channels for team coordination (Signal, Keybase)
|
||||
|
||||
## TTPs Execution Checklist
|
||||
|
||||
| Phase | TTP | Tool | Status |
|
||||
|---|---|---|---|
|
||||
| Recon | T1593 - Open Website Search | Amass, Recon-ng | [ ] |
|
||||
| Recon | T1589 - Victim Identity Info | theHarvester, LinkedIn | [ ] |
|
||||
| Initial Access | T1566.001 - Spearphishing | GoPhish, custom | [ ] |
|
||||
| Execution | T1059.001 - PowerShell | Custom stager | [ ] |
|
||||
| Persistence | T1053.005 - Scheduled Task | schtasks.exe | [ ] |
|
||||
| Priv Esc | T1558.003 - Kerberoasting | Rubeus | [ ] |
|
||||
| Defense Evasion | T1055 - Process Injection | Custom loader | [ ] |
|
||||
| Credential Access | T1003.001 - LSASS Memory | Mimikatz/SafetyKatz | [ ] |
|
||||
| Discovery | T1087.002 - Domain Account Discovery | BloodHound/SharpHound | [ ] |
|
||||
| Lateral Movement | T1021.002 - SMB/Admin Shares | PsExec, wmiexec | [ ] |
|
||||
| Collection | T1560 - Archive Data | 7-Zip, tar | [ ] |
|
||||
| Exfiltration | T1041 - Exfil Over C2 | Havoc/CS download | [ ] |
|
||||
Reference in New Issue
Block a user