The hope is that Blue Teams can setup preventions to stop this from happening or the ability to detect it. Throughout these competitions, the Red Team will attack Blue Teams and perform malicious actions. Blue competitions(CCDC, IRSeC, ISTS, UB Lockdown, Alfred state) as a Blue Teamer, and all of them had incident response(IR) reports. Incident response reportsĪs an undergrad, I competed in several Red vs. Please review each mitigation carefully if you choose to use them outside a competition environment. The mitigations in this blog post are targeted at competition environments.

Blue competitions who need to defend Windows. This blog post is targeted at individuals competing in Red vs. This video generated the idea for this blog post and a majority of the content. Before we start, I would like to give credit to Mark Russinovich’s Youtube video on Sysinternals. We will utilize Powershell Empire (Empire) to simulate an adversary so we can detect actions performed by Empire with Sysinternals. This quote illustrates a very important concept and in which to defend, you must understand your adversary. If you know neither the enemy nor yourself, you will succumb in every battle.” If you know yourself but not the enemy, for every victory gained you will also suffer a defeat. In the famous words of Sun Tzu, “If you know the enemy and know yourself, you need not fear the result of a hundred battles. The information contained in this blog post is for educational purposes ONLY! /HoldMyBeer.xyz and its authors DO NOT hold any responsibility for any misuse or damage of the information provided in blog posts, discussions, activities, or exercises. In this blog post, I will be covering how to use Sysinternals in Red vs.Blue competitions to detect Red team activity. Sysinternals contain tools that enable the user to analyze the inner workings of a Windows system. Sysinternals is my go to Windows toolkit for malware analysis, incident response, and troubleshooting.

Sysinternals suite security