Mitre - Caldera C2 - Red Team / Purple Team

We go over Caldera C2 from Mitre. Install using Docker, agent beacon deploy on Linux hosts using the Sandcat payload, and useful plugins such as visual mappings and Navigator.
Useful tooling for Red Team, Purple Team, and threat emulations.
github.com/mit...
caldera.readth...
attack.mitre.o...
mitre-attack.g...
github.com/Sec...

[@rajkrishnamurthy8474]

Great presentation Mitch.💯

[@lmaoroflcopter]

Nice presentation! Really interested in how you use vectr too. Would you use the two together? Or does the reporting in caldera somewhat replace vectr? Also what the heck is the blue team side of things in caldera? It feels like it's a sort of IR agent but then it seems to run the very same commands red does.

[@mitchodonnell3976]

We primarily use Vectr for our Purple Team engagements. Caldera can be used but not always, all depends on what we are testing or trying to achieve. For example, if you are testing your security tooling, you want to verify the tool does exactly what the vendor or engineering team claims the tool does. So you plan out your attack path and map it within Vectr. Then your red and blue teams jump into a room (virtual or real) and kick off the engagement. Caldera is useful for automating the engagement but I've found manual attacks work for the first run, then automate for the 2nd, 3rd, etc run using a profile in Caldera. For reporting, we have our own template built and integrated into GhostWriter, caldera logs are dumped using the json exported and converted over to GhostWriter oplogs. Usually the purple team stuff is fast and only requires screen shots dumped into a slide deck.

[@mitchodonnell3976]

Oh as far as the blue team agent, you are correct! It's for incident response, primarily automated threat profiles. I've never had to run one from the blue side, always was able to decompose a threat, put that into Caldera, then automate with the red team login.