Automation Tactics for Modern Threat Emulation
summary
Automated red team infrastructure uses terraform + Ansible to provision AWS VPCs, Bastion hosts, private C2s and public redirectors, then configure Havoc/Cobalt Strike or Mythic; redirectors run as either a dumb redirector (socat style) or a smart redirector with URL/IP/geo checks and burnable CDN front-ends. Phishing stacks use GoFish → SMTP redirector → Mailgun → EvilGenius, GitHub workflows strip IOCs from open-source tools, ELK ingests logs, and domain age/reputation plus code signing materially improve delivery and evasion.
AI-written summary · about
chapters (20)
- 0:00Introduction to red teaming
- 1:30Lessons from early red team infra
- 2:34Real world vs CTF red teaming
- 4:01Red team engagement lifecycle
- 6:26Fitting infra components to phases
- 8:52Essentials of red team infrastructure
- 9:55Traditional vs modern infra
- 12:01Prerequisites for red team infra
- 15:31Fishing infra setup explained
- 18:24Risks of hosting infra without redirector
- 20:49How redirectors protect your infra
- 23:40Dumb vs smart redirectors
- 24:44Using CDN as redirector
- 26:31AWS VPC for red team ops
- 27:15Role of Bastion host
- 29:03Automating infra with Terraform
- 30:07Ansible for configuration
- 32:55Cleaning tools of IOCs
- 34:19Log analysis with ELK stack
- 35:43Creating adversary templates
related talks
30mTales of Red Teaming
35mThe Best Defense is a Great Offense: Leveraging Automated...
12mIntroduction To Red Team Tooling And Opsec
12mSpeed, scale & stealth: Securing against ATO events
33mOffensive Javascript Techniques for Red Teamers
29mRed Teaming AWS: Practice What You Preach
54mDark Fairytales From A Phisherman
20mAI Red Teaming and Automation: Exploring Societal Risks in...