Offensive Tradecraft Development
Offensive Tradecraft Development

By Soumyadeep Basu, Aravind Prakash & Arun Nair

TRAINING OBJECTIVES

This intensive training program is designed to empower participants with the expertise and capabilities required for the development of sophisticated tradecraft, tailored for responsible red teaming. Through a combination of comprehensive theoretical lectures, hands-on demonstrations, and practical exercises, participants will acquire an in-depth comprehension of cutting-edge malware development techniques.

Emphasizing ethical considerations and legal boundaries, this training equips participants with the ability to craft evasive malware that can infiltrate targeted systems while adhering to responsible red teaming practices. By the end of the training, participants will not only possess a comprehensive understanding of the latest malware development techniques but will also be proficient in developing customized malware tailored for red team operations

Training level: Intermediate; Advanced

Training Outline

Day 1

  • PE file format and parsing
    • IAT
    • EAT
    • Imports
    • Exports
  • Encrypting and encoding payloads
  • Windows API essentials
    • NTAPI
    • Data types in Windows
    • Pinvoke
    • Dinvoke
    • Syswhispers and the concept of direct syscalls
  • Process Injection Techniques
    • Simple shellcode runner
    • Simple process injection
    • Process Injection via callbacks
    • Queue User APC Injection
    • Early Bird APC Queue Code Injection
    • Map-view injection

    Day 2

    • AV/Signature bypass
    • Reflective Injection
    • ETW and AMSI bypass
    • PPID spoofing
    • Cmdline spoofing
    • EDR Evasion Techniques
    • IAT Unhooking
    • Indirect syscalls
    • NTDLL unhooking
    • Hells Gate
    • Halos gate

    WHAT TO BRING?

    • A laptop with at least 16GB RAM having either VMware or VirtualBox

    TRAINING PREREQUISITE

    Comfortable with writing code in C++ and C

    Basic understanding of the Windows environment

    WHO SHOULD ATTEND?

    Penetration Testers / Red Teams

    Blue Teams

    Malware Developers

    Threat Hunter

    WHAT TO EXPECT?

    You can expect to gain hands-on experience in malware development during this training. Experienced instructors will deliver the training with years of practical experience in red teaming and are well-versed in the latest trends and techniques.

    The training will be divided into modules covering various topics related to malware development, and each module will consist of a theoretical lecture followed by hands-on demonstrations and practical exercises, allowing you to apply what you have learned in a simulated environment.

    You can also expect to network and collaborate with other participants in the training and the instructors, who will be available to provide guidance and answer any questions. By the end of the training, you will have a solid understanding of malware development and be equipped with the knowledge and skills needed to perform effective red teaming and penetration testing activities professionally.

    WHAT ATTENDEES WILL GET

    All course material, including commands, slides and source code snippets for malware Additionally, technical support will be extended during and after the training class. Participants will be provided with a customised virtual machine with the necessary tools required for the training pre-installed.

    WHAT NOT TO EXPECT

    0 days or exploit development knowledge

    Bypasses on commercial security products

    ABOUT THE TRAINERS

    Soumyadeep Basu

    Soumyadeep is a cybersecurity professional with expertise in both offensive and defensive security. Having earned certifications such as OSCP, OSEP, eCPTX and AZ-500, Soumyadeep possesses extensive skills and knowledge in both offensive and defensive cybersecurity domains. Soumyadeep has a strong foundation in red teaming and has worked with multiple red team consulting companies. Soumyadeep is a Cloud Threat Detection Engineer at CRED, specializing in identifying and mitigating cloud-based security threats.

    Aravind Prakash

    Aravind is an experienced Red Teamer working in Resillion with a strong background in offensive security and a passion for malware development. With multiple certifications, including CRTP, CRTE and CRTO. Having conducted numerous engagements, Aravind has gained valuable insights into the tactics used by real-world adversaries. Their expertise allows them to simulate attacks and identify system and network vulnerabilities.

    Arun Nair

    Arun is an experienced Red Teamer and holds expertise in the field of malware development and evasion. Having obtained multiple certifications like Offensive Security Certified Professional (OSCP) and Malware on Steroids, Arun deeply understands penetration testing methodologies and techniques. This knowledge, combined with hands-on experience gained through engagements with organisation like Mandiant, has equipped Arun with invaluable insights into the tactics employed by real-world adversaries.

    Logo

    ©2024 BSides GOA All rights reserved