Heavy Machinery and Burly Lumberjacks and Logging! Oh My!

No ratings

Presented at BSidesPittsburgh 2018 by

Dan Astor

Evan Perotti

Did we get the creds? Do we have a beacon? Are we burned? All questions that get asked during a red team engagement with high frequency. With a full red team infrastructure, you need to manage a mini-network to be successful. Cobbling together monitoring scripts, tailing files, or grepping for tokens to see if payloads were downloaded or if phishing credentials were entered can be painful and inefficient when you could instead be planning your next move or taking advantage of a successful compromise.We need some way to organize all these logs and data into a centralized location that can alert us when important events happen. Perhaps a SIEM... By ingesting logs from all our hosts used during an engagement, we can begin to visualize our network of attack machines and create alerts for priority events like phishing credentials being submitted, IR teams and security vendors hitting your server, and changes in server health. This talk will cover the ins and outs of why to use a SIEM for your red team infrastructure, the free products out there that can assist, and how we went down the path of using Elastic for our Red SIEM. We'll also be releasing our tools, scripts, and resources to aid you in deploying and monitoring your own Red SIEM.