Attack Emulation Tools: Atomic Red Team, CALDERA and More w/ Carrie Roberts

Instructor: Carrie Roberts
Course Length: 16-Hours

Includes: 12 months of complimentary access to the Antisyphon Cyber Range, certificate of participation, six months access to class recordings.

Attack Emulation tools help you measure, monitor, and improve your security controls by executing scripted attacks. Atomic Red Team is a community developed open-source library of these scripted attacks that are mapped directly to the MITRE ATT&CK Framework. There are several frameworks available for executing these scripted attacks including MITRE CALDERA, Prelude Operator and VECTR. This class will provide an overview of the MITRE ATT&CK framework and give you in-depth, hands-on knowledge of how to execute scripted attacks that exercise many of the techniques defined in MITRE ATT&CK. You will be provided with hands-on lab instructions for emulating a variety of attacks and creating visualizations using the MITRE ATT&CK Navigator. At the end of this class, you will have the knowledge and tools to begin executing simulated attacks within your own test environment, allowing you to create and validate detections in a script-able and consistent way.

An abundance of well documented labs with screenshots provided on the following topics:

• MITRE ATT&CK and the ATT&CK Navigator
• Atomic Red Team
• Prelude Operator
• Mitre CALDERA
• Vectr

Whether you are a student of information security or a seasoned network defender there is something to learn from getting involved in the Attack Emulation space and this course will help you do that.

Note: We do not write detections in this class.

KEY TAKEAWAYS

• General understanding of MITRE ATT&CK and Attack Emulation tools
• In-Depth knowledge of Atomic Red Team and tools for executing this library of attacks
• Understanding of how Attack Emulation can help you build and validate your detections

WHO SHOULD TAKE THIS COURSE

Anyone interested in hands-on learning about cyber-attacks including tools to emulate and report on them should take this course.

• Defenders and Blue Teamers
• Students interested in Information Security
• Penetration Testers and Red Teamers
• General Security Practitioners

AUDIENCE SKILL LEVEL

Entry level through advanced information security skills.

STUDENT REQUIREMENTS

General familiarity with the Windows and Linux operating systems.

WHAT EACH STUDENT SHOULD BRING

• A computer with VMware Player/Workstation/Fusion installed
  • Note: Administrative Access required for install
• At least 8GB RAM and 50 GB free disk space
• Solid internet access

TRAINER & AUTHOR

Carrie Roberts
Carrie Roberts is a web application developer, turned pentester, turned red teamer, turned blue. She loves to learn and give back to the community. She is currently one of the primary Atomic Red Team project maintainers and developers and has developed many of her own open source tools including the Domain Password Audit Tool (DPAT) and Slack Extract. She holds master’s Degrees in both Computer Science and Information Security Engineering. She has earned 12 GIAC certifications including the prestigious “Security Expert” (GSE) certification. She has spoken at numerous security conferences including DerbyCon and Wild West Hackin’ Fest, published many blog posts on topics ranging from social engineering to bypassing anti-virus, and contributed new research on the VBA Stomping maldoc technique. She is currently a Defense Engineer at Fortune 1.

COURSE SCHEDULE