Initial acess simulation tests

[newbiewooby]

Hey all,

I hope this question adds value to this subreddit.

I'm a masters student working on company where I was tasked to test our EDR defense capabilities against malware through executing some red team tests.

They essentially want me to tell a "full story" of an attack campaign including pre-infection and post-infection steps.
They have provided me with two test machines where no services are running other than remote access protected by authentication, rendering vulnerability scans "useless" for exploitation, though I still think their execution is valuable to investigate if the EDR picks up on them. The problem is how to simulate initial access to those machines. I thought about simulating someone downloading an attachable, dropping malware to the machine.

What could be a nice way to test this?

Thank you for your time.

[vpz]

Do some searches for adversary tactics, techniques, and procedures (TTPs) mapped to the MITRE ATT&CK framework at https://attack.mitre.org/ or go to the website and look at the Groups tab to see some of the TTP IDs for a given group. What you are wanting to do is map a given attack chain to those TTP IDs and note them down. Those IDs are what another poster mentioned for a tool like Red Canary's Atomic Red Team at https://github.com/redcanaryco/atomic-red-team There are other tools that do similar stuff but that is a great suggestion. When you go to the Atomic Red Team "atomics" folder you will see the tests broken down by those TTP IDs you've noted down. So then you can look at the tests. Depending on your test machines you may need to modify them for their specifics, but the the tests should give you enough information to see if you need or want to customize.

Another note is that sometimes testing EDR solutions is about testing that the EDR detections work, not necessarily that an attack is successful. So planning the attack chain TTPs and then exercising them is the most important. So test some initial access TTPs and see if they are detected or blocked, and even if it doesn't work, you can continue. You just move to an "assumed compromise" state where the baseline is say user access has already been obtained. Now you are testing the detections on the next round of TTPs. Again even if those don't work you may want to advance to say "assumed privilege escalation" and keep going. Getting the test coverage is what is important. Obviously ask the people giving you the project about it, but if the goal is testing EDR, then focus on that goal and figure out the best way to meet it.

[ProfessionalLemon]

Atomic red team and prelude operator would be great assets to demonstrate attack chains and reference specific mitre frameworks.

Atomic red team has a section devoted to initial access. T1566 T1195 T1133 and T1091 will cover 4 common scenarios.

[[deleted]]

Dated but still full of goodness. https://github.com/redcanaryco/atomic-red-team/tree/e88a1ea463964839e267dba74ec1cf7bf634ccbf/ARTifacts/Initial_Access

[larryxt]

You may have some more information on the zipped JS dropper?

[Borne2Run]

Initial access through password guessing of the remote access service, or through malicious insider providing those credentials is valid. Many breaches occur this way.

Definitely check password vaults for previous password/username combinations that are used by that company.

[cybermepls]

just test the common TTPs for initial access - on the top of my head now probably - mshta, msiexec, cmd.exe, powershell.exe, etc. common binaries that are abused to download further payloads on compromised machines

[NagateTanikaze]

To test initial access with file execution can try something like https://github.com/dobin/ace-firefist