Alexander Rymdeko-Harvey

### Overview In this presentation, Alexander Rymdeko-Harvey discusses the concept of Repurposing Adversarial Tradecraft (RAT)—the practice of analyzing real-world advanced persistent threat (APT) tactics, techniques, and procedures (TTPs) from threat intelligence reports and implementing them into red team tooling. While red teamers often aim to emulate adversaries, they frequently face tighter time constraints than well-funded nation-state groups. By studying public technical reports on actors like Duqu and APT29, offensive security practitioners can advance their capabilities, build resilient implants, and educate clients on realistic attack vectors.

### Key Topics - **Repurposing Adversarial Tradecraft (RAT)**: Borrowing military wargaming principles to evaluate adversary behavior and advance offensive tooling beyond off-the-shelf pen testing utilities. - **Duqu-Style In-Memory Persistence**: Evaluating enterprise systems to determine optimal, long-term in-memory placement without writing binaries to disk. - **Native Packet Capture & Sniffing**: Deploying packet sniffing capabilities natively in user mode and kernel mode via reflective DLL injection. - **Kernel Driver Loading**: Comparing service control manager (`sc`) driver creation against native, undocumented `NtLoadDriver` execution for deploying signed or vulnerable kernel drivers. - **APT29 TTPs & Advanced Agent Development**: Emulating high-frequency sample creation, WMI integration, and situational awareness monitoring inside a long-term C++ implant.

### Technical Details - **In-Memory Survivability Rating**: Inspired by Duqu's in-memory persistence strategy, Rymdeko-Harvey built a PowerShell tool leveraging PowerView (`Get-NetComputer`) and WMI. It queries specific organizational units (OUs), hardware enclosures, virtualization indicators, and system boot times. By calculating weighted metrics, standard deviation, and variance, operators can identify outlier systems—such as server-rack hardware with long uptimes that are unaffected by nightly reboot GPOs—to maximize agent lifetime without touching disk. - **Native User-Mode Sniffing**: To avoid shipping third-party WinPcap binaries, the speaker implemented a C++ reflective DLL using Winsock 2 (`WSAStartup` 2.2). Calling `WSAIoctl` sets the socket into promiscuous mode, capturing IPv4 traffic (Layer 3 and above). Captured packets are streamed through language-agnostic Windows named pipes (IPC) to an operator interface or PowerShell handler and assembled into raw PCAP format. - **Kernel Driver Management**: For full Layer 2 network interaction and ndis/NPF driver leverage, two deployment methods were weaponized via reflective DLLs: 1. *Service Control Manager (SC)*: Standard service creation using administrative rights to register and start a kernel driver service. While straightforward, it creates observable service entries and registry artifacts. 2. *`NtLoadDriver`*: An undocumented low-level API call located in `ntdll.dll`. After enabling `SeLoadDriverPrivilege` using token adjustment, the loader manually establishes required registry service keys (`ImagePath`, `Type`, `Start`, `ErrorControl`), converts the subkey into a Unicode string, and invokes `NtLoadDriver` directly to avoid high-level service creation logs. - **APT29-Inspired Situational Awareness Agent**: Built in C++ as a long-term backup beacon, this agent incorporates native string obfuscation, in-memory logging, VM/AV detection, and token manipulation for secondary process/shellcode injection. Most notably, it features an internal WMI event-monitoring thread that evaluates process creations, service installations, and driver loads against JSON-defined heuristic rules. If defensive tools (e.g., Wireshark or incident response memory-acquisition drivers like Mandiant Memorize) are detected, the agent initiates panic routines—such as zeroing heap memory, wiping in-memory logs, and terminating cleanly to frustrate incident response analysis.

### Takeaways The speaker emphasizes that building low-level C++ and PowerShell tools grounded in real-world APT techniques bridges the gap between penetration testing and high-tier threat emulation. By adopting in-memory persistence scoring, native packet inspection, stealthy driver deployment, and proactive defensive-tool monitoring, red teams can replicate sophisticated adversary behaviors and build durable operational capabilities. All demonstrated projects and reflective DLL loaders were released open-source on the presenter's GitHub repository.