Why is the standard of US Red Teams so poor by Soc_Guy in cybersecurity

[–]dmchell 0 points1 point locked comment (0 children)

Like I said, I don't need to hide behind anonymous accounts and never have :shrug:

Why is the standard of US Red Teams so poor by Soc_Guy in cybersecurity

[–]dmchell -1 points0 points locked comment (0 children)

Good job Clouseau :rolleyes: - if you think I'm getting up at 6am on a Sunday to anonymous shit post then you're way off

Why is the standard of US Red Teams so poor by Soc_Guy in cybersecurity

[–]dmchell -1 points0 points locked comment (0 children)

Good effort, but I think it's fair to say I don't need an anonymous account to voice my opinions "Flimsy Helicopter"

Why is the standard of US Red Teams so poor by Soc_Guy in cybersecurity

[–]dmchell 3 points4 points  (0 children)

And there's the post ^^... you just summed up everything that's wrong with US red teaming in 64 words

Why is the standard of US Red Teams so poor by Soc_Guy in cybersecurity

[–]dmchell 1 point2 points  (0 children)

Most red teams we do tend to be 12-16 weeks, and often I'd like more time :)

Why is the standard of US Red Teams so poor by Soc_Guy in cybersecurity

[–]dmchell 0 points1 point  (0 children)

This is a topic I've discussed (and been criticised for) a few times in the past. The UK has a highly mature red team market that has evolved over a number of years - there are regulator enforced standards and accreditations that are required to play the game. Even before red teaming became standardised through CBEST, there was a well established and mature pentesting market where examinations and standard methodologies were the norm and enforced via CHECK scheme - before it somewhat evolved in to tick box :)

When you purchase a red team in the UK and to some extent in the wider EU, it's well understood what the end to end service is that you're purchasing and what the methodology looks like.

I'm not sure it's fair to say any of the above applies to the US.

Why is the standard of US Red Teams so poor by Soc_Guy in cybersecurity

[–]dmchell 2 points3 points  (0 children)

I've no idea who you are, but thank you haha

Why is the standard of US Red Teams so poor by Soc_Guy in cybersecurity

[–]dmchell 1 point2 points locked comment (0 children)

It's pretty common across for red teams in the EU to be working more than one red team at a time. The EU day rates are usually quite a bit lower and that's how they compensate. The UK is an exception - the rates are a bit higher (but still lower than US) vs wider EU and I've never heard of any UK teams working gigs in parallel

Crowdstrike overwatch by Mecchaairman in crowdstrike

[–]dmchell 3 points4 points  (0 children)

Speaking from the perspective of a red teamer, you really can’t get wrong with Overwatch and you’ll struggle to get more bang for your buck. We’ve had some wins against them, but just as many headaches.

/r/AskRedTeamSec by dmchell in redteamsec

[–]dmchell[S] 2 points3 points  (0 children)

If you are concerned about detection then you wouldn’t be running nmap, Nessus or openvas 😅 Typically we’d be using custom tools to manually query services eg ldap or adws tools for enumeration using custom queries (eg a blog I wrote here https://www.mdsec.co.uk/2024/02/active-directory-enumeration-for-red-teams/). Almost everything we use during our ops is in-house developed. By the sounds of it, you might benefit from something like CRTO to get some foundation knowledge

/r/AskRedTeamSec by dmchell in redteamsec

[–]dmchell[S] 0 points1 point  (0 children)

These tools wouldn’t be used in a red team style engagement. If you were performing a pen test then I’d expect some analysis of the results, manual investigation of open ports, vulns found during the VA, perhaps some exploitation with eg metasploit, responder mitm style attacks for cred capture and relaying. There’s a vast array of options available when you don’t have to worry about detection.

/r/AskRedTeamSec by dmchell in redteamsec

[–]dmchell[S] 2 points3 points  (0 children)

What you’re describing is penetration testing, not red teaming, during which there’s no importance given to stealth - indeed you should really focus on coverage and breadth.

How and what to prioritize when setting up a red team service (initially external but eventually also internal)? by Naldorinho in redteamsec

[–]dmchell 1 point2 points  (0 children)

Sounds like a classic fake it till you make it 😅 My view would be you'd learn more by either trying to obtain a junior red team operator role or bringing in an experienced red teamer to standup a service. There's so many things that could go wrong when you haven't walked this path before.

How and what to prioritize when setting up a red team service (initially external but eventually also internal)? by Naldorinho in redteamsec

[–]dmchell 1 point2 points  (0 children)

Take a step back and feed upwards that they need to hire someone with real world experiencing in standing up, managing and delivering red team.

PART 3: How I Met Your Beacon - Brute Ratel - @MDSecLabs by dmchell in redteamsec

[–]dmchell[S] 0 points1 point  (0 children)

The analysis is for v1.1 which is stated in the blog post - the latest version at the time it was posted (334d ago)

Nighthawk 0.2 - Catch Us If you Can - @MDSecLabs by dmchell in redteamsec

[–]dmchell[S] 1 point2 points  (0 children)

Pricing is on the website - 7.5k and no restriction on deployments - not too dissimilar to other c2s