Another year, new challenges

As every year, I took part in the Locked Shields cyber exercise. This year the team responsible for Red Team detection doubled in size — whether that doubled our chances of eliminating the Red Team (attackers) was hard to judge in advance.

We spent the preparation phase tuning our detection machine and looking for behavioral patterns of the Green Team (the one handling scoring for availability and penetration). We also thought through the strategy we'd use against the attackers.

Once the exercise started, everyone knew what to do. We divided the network by segments (internal, DMZ, and SCADA) so we didn't have to split our attention across multiple segments.

Even so, the DMZ kept giving us trouble as usual. It's full of holes like Swiss cheese and we essentially just help figure out how each breach happened — which is possible until attacks move to HTTPS. After that we're completely reliant on endpoint data.

Where we do better is the internal segment — the RT tries to compromise endpoints, exfiltrate credentials, and pivot across the domain. We typically manage to identify domains and IP addresses belonging to the attackers and block their activity. Though that has its own limitations too. This year EDR (Endgame) was a big help — at one point we were able to kill all PowerShell instances on infected machines and force the RT to play by our rules.

SCADA is always its own chapter, comprising 4 different segments (water treatment, power plant, etc.). Specific devices and protocols make it complicated when you need to detect a modified packet — most tools (Wireshark being an exception) can't properly parse these packets.

JA3 fingerprints, the Alexa TOP level domain list, and thorough preparation all proved their worth.

We finished in a very solid 2nd place, so the team expansion was worth something. We'll see in a year.