Playbook Objectives:

• To understand and mitigate the risks associated with privileged user escalation.
• To train the IT security team to detect and respond to privilege escalation attempts.
• To ensure that the security controls around elevated permissions are robust and effective.
• To validate the incident response plan and improve the readiness of the organization against insider threats or external actors targeting privileged accounts.

Difficulty level:

• Advanced

Scenario:

• TechFuture Inc., a leading software development company, has recently been the target of multiple cyber attacks that have compromised low-level user accounts. After an investigation, the cybersecurity experts at TechFuture Inc. have determined that attackers are attempting privilege escalation to gain access to critical systems. As the Chief Information Security Officer (CISO) Gabriel Lawson prepares for a potential surge in these attacks, they decide that it’s vital to conduct a Cyber Range exercise focusing on Privileged User Escalation Prevention.
• The company has a wide array of networked systems, some of which contain sensitive IP and customer data, making them high-value targets. Given recent security breaches in the industry, Gabriel knows that it’s not a matter of if, but when, they might experience an incident involving privileged user escalation.
• A story unfolds where a mock attacker, presumed to be a disgruntled employee, is looking to exploit system vulnerabilities to elevate their user privileges. The company sets up a simulated environment that mirrors their production network, complete with servers, a domain controller named DC-Server01, workstations, and a variety of users with varying permission levels. IT specialists David Chen and Sarah Gomez are assigned as the blue team to defend against the red team, represented by external penetration testers.
• The company aims to prevent any potential disruption to its business operations, protect its reputation, and safeguard against financial losses by improving their detection and response capabilities. This Cyber Range exercise is a proactive step, simulating realistic attack vectors and scenarios to hone the defenses of TechFuture Inc.

Category:

• Insider Threat Mitigation
• Privilege Escalation Prevention
• Access Control and Identity Management
• Incident Response and Handling

Exercise Attack Steps:

• Initial Reconnaissance:
  • The red team will conduct a network scan to identify live hosts, open ports, and services.
  • Enumerate domain users, groups, and machines using tools such as BloodHound.
• Gaining Access:
  • Exploit a known vulnerability on a low-security workstation identified as WS-Dev01 to gain user-level access.
  • Extract hashed user credentials from the compromised workstation.
• Local Privilege Escalation:
  • The red team will use common privilege escalation techniques such as exploiting unpatched vulnerabilities or misconfigurations within WS-Dev01 to gain administrative access on the local machine.
• Lateral Movement:
  • Utilize the compromised credentials or token impersonation to move laterally within the network and try to access other workstations or servers.
• Domain Privilege Escalation:
  • Attempt to escalate privileges in the Active Directory environment, either by exploiting service accounts, Kerberoasting, or Pass-the-Hash techniques to gain access to the DC-Server01.
• Maintaining Access and Cleanup:
  • Aim to maintain persistent access through backdoors or scheduled tasks without being detected.
  • Cover tracks by deleting logs or using anti-forensic methods to make the detection more challenging for the blue team.
• Incident Detection and Response:
  • The blue team, consisting of IT specialists from TechFuture Inc., will monitor network traffic, analyze logs, and set up intrusion detection systems to identify and respond to the red team’s activities.
  • Devise a containment strategy to prevent the red team from achieving domain admin level access.
  • When the blue team detects an attack, they must effectively respond by isolating compromised accounts, conducting a thorough investigation, and remediating vulnerabilities.
• Debriefing:
  • After the exercise, both teams will engage in a debrief to discuss the successes and failures of the exercise, with a focus on identifying security gaps and improving policies and procedures.