Exploiting Blue Team OPSEC Failures with RedELK
Marc Smeets demonstrates using RedELK to track blue team investigations during red team operations, exploiting defensive OPSEC failures to maintain access.
Summary
The Operational Complexity of Modern Red Team Infrastructure
As offensive operations scale across diverse cloud redirectors and multi-stage payloads, managing operational telemetry and monitoring blue team activity becomes vital.
Monitoring Red Team Infrastructure with RedELK
Marc Smeets presents RedELK (Red Team's Elastic Stack), a centralized logging and analytics platform engineered to track all offensive traffic and agent interactions.
Exploiting Blue Team Investigation Footprints
When blue team analysts investigate suspicious endpoints, their automated sandboxes, IP queries, and VirusTotal submissions leave distinct digital footprints across red team infrastructure.
Real-Time Situational Awareness and Counter-Threat Hunting
Smeets shows how red teams use RedELK alerts to identify when defensive teams discover specific infrastructure, enabling timely evasive pivots.
Related talks
Main Stage·46 min
Tomer Bar
SafeBreach research director Tomer Bar exposes hilarious and critical operational security blunders made by state-sponsored Advanced Persistent Threat (APT) groups.
Adversary Village·30 min
Carlos Polop
Carlos Polop presents the new generation of PEAS (LinPEAS/WinPEAS), revealing advanced local privilege escalation techniques across Windows, Linux, and AD.
Adversary Village·47 min
Daniel Duggan
Daniel Duggan (Rasta Mouse) shares architectural lessons and design patterns for engineering resilient, stealthy Command & Control (C2) frameworks.