Windows Remote Management

Once inside, the group creates accounts or takes over existing ones.

Then it moves using PSExec, WinRM and remote tools such as ScreenConnect, AnyDesk and TeamViewer, all of which look like routine IT work.

It disables security software.

Sometimes it changes users' passwords so the real owners are locked out.

Red teamers love creative, novel attacks, but defenders benefit most when red teams test realistic behaviors adversaries actually use.

Simple lateral movement methods, such as WinRM, can provide far more defensive value than overly complex one-off techniques.

And with AI making it easier to automate both the simple and the sophisticated, aligning red team exercises with real-world attacker behavior is becoming more important than ever.

Joining us for today's conversation is Ben Lieberman.

So basically what you're saying is the red teamers tend to focus, or at least in your experience on the threat hunting side, the red teamers tended to focus on trying to come up with their own novel approaches, and maybe sometimes they missed testing- The most basic things.

Is that what you're getting at?

Yeah, so they could use a, you know, a novel protocol for lateral movement, um, that may exist on the environment when they could've just used WinRM, we could attempted to catch that instead, right? And we may have caught them, and that may have been something that they wouldn't have been happy about, but that's what the nation-state actor likely would've done.

Uh, so as we continue on in this progression from threat hunting, red teaming, and now we're kinda- kinda get into from a defensive approach to an offensive approach, I just wanted to pause real quick and make sure, uh...

Right.

Because the tools being used, Teams, QuickAssist, Curl, and then Windows Remote Management, which they use to move laterally across the network to the domain controllers, they are all legitimate administrative tools.

The network logs look completely normal.

To the multi-million dollar security software, it just looks like an authorized IT administrator doing their job.