μν λ―Ή λ λ ν ν μ€νΈ μ€ νλκ° λ΄ ν μ€νΈμμ μ’ λ£λλ λ° 30 λΆ μ΄μ 걸리λ κ² κ°μ΅λλ€. λ°λμ λ¬Έμ κ° λ νμλ μμ§λ§ ν μ€νΈ μνκ° μκ° μ΄κ³Ό λ λκΉμ§ κΈ°λ€λ¦¬λ μκ°μ attack.confμμ κ΅¬μ± ν μμλ κΈ°λ₯ μμ²μ λ§λ€κ³ μΆμ΅λλ€ (κ°λ₯νλ€λ©΄). νμ μ€ν¬νλ λ‘컬 ν μ€νΈμμ T1071μ μ€ν μμκ³Ό λμ 보μ¬μ€λλ€.
μμ : 2020-02-04 14:49:35
μ’
λ£ : 2020-02-04 15:21:35
python attack_range.py -m terraform -a simulate -st T1071 -t attack-range-windows-domain-controller
`2020-02-04 14 : 49 : 35,618-μ 보-곡격 _ λ²μ-INIT-곡격 _ λ²μ v1
PLAY [all] * * * * * * * * * * * * * * * * * * * * * **
TASK [atomic_red_team : Atomic Red Teamμ μ€μΉνλμ§ νμΈ] * * * **
νμΈ : [44.228.118.166]
μμ
[atomic_red_team : Atomic Red Team PS λͺ¨λ 볡μ¬] * * * * * * **
λ³κ²½λ¨ : [44.228.118.166]
μμ
[atomic_red_team : Atomic Red Team PS λͺ¨λ μ€μΉ] * * * * * **
λ³κ²½λ¨ : [44.228.118.166]
μμ
[atomic_red_team : μ€ν μ μ 리 C : \ Windows \ Temp] * * *
λ³κ²½λ¨ : [44.228.118.166]
TASK [atomic_red_team : μ€ν μ C : \ Windows \ Temp μ¬μμ±] * * *
λ³κ²½λ¨ : [44.228.118.166]
TASK [atomic_red_team : set_fact * * * * * * * * * * * * * *
νμΈ : [44.228.118.166]
μμ
[atomic_red_team : μ€ν κΈ°λ²] * * * * * * * * * * * *
νμΈ : [44.228.118.166] => {
"κΈ°μ ": [
"T1071"
]
}
μμ
[atomic_red_team : Atomic Red Team μ€ν λλ ν 리 λ§λ€κΈ°] * * * *
λ³κ²½λ¨ : [44.228.118.166]
μμ
[atomic_red_team : λͺ¨λ Atomic Red Team ν
μ€νΈ μ€ν] * * * * * * *
건λ λ°κΈ° : [44.228.118.166]
TASK [atomic_red_team : μ§μ λ Atomic Red Team κΈ°μ μ€ν] * * * **
λ³κ²½λ¨ : [44.228.118.166] => (νλͺ© = T1071)
TASK [atomic_red_team : μ€ν λ‘κ·Έ νμΌ νμΈ] * * * * * * * * **
νμΈ : [44.228.118.166]
TASK [atomic_red_team : μ μ₯ λ‘κ·Έ νμΌ] * * * * * * * * * * * * *
λ³κ²½λ¨ : [44.228.118.166]
TASK [atomic_red_team : νλ‘μΈμ€ μ 리] * * * * * * * * * * **
λ³κ²½λ¨ : [44.228.118.166]
TASK [atomic_red_team : μ€ν ν μ 리] * * * * * * * * **
λ³κ²½λ¨ : [44.228.118.166]
μ¬μ μμ½ * * * * * * * * * * * * * * * * * * * * * **
44.228.118.166 : ok = 13 changed = 9 unreachable = 0 failed = 0 skipped = 1 ꡬ쑰 λ¨ = 0 무μ = 0
2020-02-04 15 : 21 : 35,465-INFO-attack_range-target : attack-range-windows-domain-controllerμ λν΄ μ±κ³΅μ μΌλ‘ μ€ν λ κΈ°μ ID T1071
@jzsplunk λ atomic red ν κ·Έλ£Ήκ³Ό μ½κ°μ λνλ₯Ό λλ΄λλ°, μ΄λ μ°λ¦¬κ° κΈ°μ μ example.com
λμ μ ν¨ν λλ©μΈ μ΄λ¦μ μ€μ νμ§ μμκΈ° λλ¬ΈμΌ μ μμ΅λλ€. : https : / /github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1071/T1071.yaml#L79 λ°λΌμ 1000 κ°μ μμ² μκ° μ΄κ³Όκ° μμ΅λλ€. μ΄κ²μ΄ κ·Έ ν
μ€νΈλ₯Ό μ§μ°μν€λ μμΈ μΌ μ μμ΅λλ€. μ§κΈμ μ°λ¦¬κ°νλ μΌμ΄ μλκΈ° λλ¬Έμ μ΄λ¬ν ν
μ€νΈλ₯Ό μ¬μ©μ μ μνλ λ°©λ²μ μ°ΎμμΌν©λλ€.
μ΄ λ¬Έμ λ μ΅κ·Ό νλμ΄ μμκΈ° λλ¬Έμ μλμΌλ‘ μ€λλ κ²μΌλ‘ νμλμμ΅λλ€. λ μ΄μ νλμ΄ λ°μνμ§ μμΌλ©΄ νμλ©λλ€. κ·νμ κΈ°μ¬μ κ°μ¬λ립λλ€.
μ λ²μ μλ μκ° μ ν λ° κΈ°ν λ©μ§ κΈ°λ₯μ΄ λ΄μ₯λμ΄ μμ΅λλ€.
https://redcanary.com/blog/invoke-atomicredteam-leaves-the-nest/
λ€μ κΈ°μ μ νμ¬ μλνμ§ μμ΅λλ€. python attack_range.py -m terraform -a simulate -st T1086 -t attack-range-windows-domain-controller
κ·Έλ₯ μ€ν μ€μ μ€λ¨λ©λλ€.
μ΄ λ¬Έμ λ @ P4T12ICKκ° μμ ν λ³κ²½ μ¬νμ λ³ν© ν ν μ΅μ κ°λ° λΈλμΉμ λνλμ§ μμ΅λλ€.
κ°μ₯ μ μ©ν λκΈ
μ λ²μ μλ μκ° μ ν λ° κΈ°ν λ©μ§ κΈ°λ₯μ΄ λ΄μ₯λμ΄ μμ΅λλ€.
https://redcanary.com/blog/invoke-atomicredteam-leaves-the-nest/