Charles Hamilton - A Journey into Red Team

### Overview In "A Journey into Red Team," Charles Hamilton from Mandiant/FireEye shares insights, methodologies, and custom tooling designed to execute stealthy red team engagements. Contrasting red teaming with noisy, automated internal penetration tests, Hamilton explains that red teaming focuses on evaluating client responsiveness and achieving specific objectives—such as accessing CEO emails or critical customer data—while evading detection. He emphasizes that red teamers do not necessarily need domain admin or zero-day exploits across dozens of machines; a sysadmin-like approach utilizing minimal footholds often achieves the desired mission objectives.

### Key Topics - **Target Identification and Reconnaissance:** Hamilton explores techniques for gathering target information without alert generation. Methods include analyzing corporate Facebook photos to map employee names and roles, examining public password breach dumps (e.g., Adobe, Ashley Madison), finding exposed developer emails and credentials in GitHub, and scraping Pastebin. He highlights leveraging Outlook Web Access (OWA) and Office 365 APIs to leak the Global Address List (GAL) and perform password spraying (e.g., season plus year format like "Summer 2018!"), even bypassing MFA due to basic authentication support. Additionally, checking bounced SMTP error headers helps fingerprint defensive tools like Proofpoint, McAfee, or Microsoft filtering. - **Crafting Effective Phishing Campaigns:** Successful phishing relies on blending into corporate environments rather than using flashy lures. Hamilton advocates using boring, standard corporate topics—such as timesheets or code of conduct updates—which arouse less suspicion and reporting. Core rules include hosting payloads on external sites rather than attaching them to emails, avoiding typosquatting in favor of corporate-styled subdomains, utilizing HTTPS (e.g., Let's Encrypt), and employing categorized/aged domains. - **Evasion and Payload Delivery:** To defeat inline inspection and sandbox analysis, Hamilton generates download links dynamically with JavaScript so non-rendering automated scrapers miss the payload. He also recommends avoiding direct invocation of `powershell.exe` due to aggressive endpoint detection, suggesting unmanaged runspace alternatives instead. - **Internal Reconnaissance and Lateral Movement:** Once inside, red teamers should avoid noisy network-wide scans and default Windows command-line binaries like `net.exe`. Hamilton demonstrates dumping user and email directories via unmanaged LDAP queries, inspecting browser bookmarks, extracting Kerberos tickets, querying domain trusts, and leveraging WMI without spawning obvious child processes.

### Technical Details - **Tooling Introduced:** - *Powerless Shell:* Executes PowerShell scripts via a custom C# runspace environment without launching `powershell.exe` directly. - *Malicious Macro Generator:* Creates obfuscated macros that trigger code via WMI (`WmiPrvSE.exe` / `winmgmt`) rather than `WScript.Shell` or standard shell execution, breaking the parent-child relationship with Microsoft Word (`winword.exe`). - *ClickOnce Generator:* Packages applications into ClickOnce deployment wrappers equipped with environmental sandbox evasion (such as verifying `iexplore.exe` is running). - *SCT Obfuscator & UniByAv:* Obfuscates COM scriptlets (`.sct`) and compiles heavily obfuscated executables from raw shellcode. - *Don't Kill My Cat:* Implements polyglot files that function simultaneously as valid image files and valid shellcode. - *Tundrashell:* A custom remote access trojan (RAT) using application-level RC4 encryption over HTTPS to bypass endpoint mini-filters performing TLS inspection, while avoiding plain-text second-stage DLL downloads. - **Sandbox Evasion Checks:** Payloads inspect system properties to detect sandboxes, such as verifying RAM (>4GB), disk space (>250GB), multiple CPU cores, system uptime, active clipboard data, domain-joined status, target timezone, and presence of targeted processes like Outlook. - **Lateral Movement & Kerberos:** Hamilton highlights using existing Kerberos tickets via unmanaged scripts (`remote_wmi_execute`) to move laterally. To maintain valid Kerberos ticket refreshing, he discusses migrating into processes like `explorer.exe` or `svchost.exe`.

### Takeaways Hamilton concludes that achieving true stealth requires understanding defensive tooling and adapting tactics accordingly. Avoiding common industry trends (like plain PowerShell commands or predictable binaries), querying Active Directory discreetly through LDAP, using boring corporate pretexts, and applying dual-layer payload encryption significantly reduce detection during red team operations.