THE COMPLETE TEAM FIELD MANUAL By Allyson Brian TABLE OF CONTENTS 1 *NIX 1.1 GENERAL INFORMATION 1.1.1 Linux Kernels 1.1.2 Linux Common Directories and Configuration Files 1.1.3 Linux System Information 1.1.4 Linux Network Commands 1.1.5 Linux Basic and Administrative Commands 1.2 INITIAL ACCESS 1.2.1 ATTACK 1.2.2 DETECTION 1.3 EXECUTION 1.3.1 ATTACK 1.3.2 DETECTION 1.4 PERSISTENCE 1.4.1 ATTACK 1.4.2 DETECTION 1.5 PRIVILEGE ESCALATION 1.5.1 ATTACK 1.5.2 DETECTION 1.6 DEFENSE EVASION 1.6.1 ATTACK 1.6.2 DETECTION 1.7 CREDENTIAL ACCESS 1.7.1 ATTACK 1.7.2 DETECTION 1.8 DISCOVERY 1.8.1 ATTACK 1.8.2 DETECTION 1.9 LATERAL MOVEMENT 1.9.1 ATTACK 1.9.2 DETECTION 1.10 COLLECTION 1.10.1 ATTACK 1.10.2 DETECTION 1.11 COMMAND AND CONTROL 1.11.1 Relevant Information 1.11.2 ATTACK 1.11.3 DETECTION 1.12 EXFILTRATION 1.12.1 ATTACK 1.12.2 DETECTION 2 WINDOWS 2.1 GENERAL INFORMATION 2.1.1 Windows NT versions 2.1.2 Commonly Used Windows Registry Locations 2.1.3 Windows Directories 2.1.4 Windows cmd basics 2.1.5 Windows powershell 2.2 INITIAL ACCESS 2.2.1 ATTACK 2.2.2 DETECTION 2.3 EXECUTION 2.3.1 ATTACK 2.3.2 DETECTION 2.4 PERSISTENCE 2.4.1 ATTACK 2.4.2 DETECTION 2.5 PRIVILEGE ESCALATION 2.5.1 ATTACK 2.5.2 DETECTION 2.6 DEFENSE EVASION 2.6.1 ATTACK 2.6.2 DETECTION 2.7 CREDENTIAL ACCESS 2.7.1 ATTACK 2.7.2 DETECTION 2.8 DISCOVERY 2.8.1 ATTACK 2.8.2 DETECTION 2.9 LATERAL MOVEMENT 2.9.1 ATTACK 2.9.2 DETECTION 2.10 COLLECTION 2.10.1 Relevant Information - Attack 2.10.2 DETECTION 2.10.3 MITIGATION 2.11 COMMAND AND CONTROL 2.11.1 RELEVANT INFORMATION 2.11.2 ATTACK 2.11.3 Detection 2.12 EXFILTRATION 2.12.1 ATTACK 2.12.2 DETECTION 3 Network 3.1 GENERAL INFORMATION 3.1.1 Common Ports 3.2 IPV4 3.2.1 IPv4 Header 3.2.2 IPv4 ICMP Header 3.2.3 IPv4 Subnet Class Ranges 3.2.4 ICMPv4 Type Codes 3.2.5 IPv6 3.2.6 TCP Header 3.2.7 UDP Header 3.2.8 DNS Header 3.2.9 ARP Header 3.2.10 TTL and Windows Size by OS 3.2.11 Common Wireshark Filters 3.3 ATTACK 3.3.1 ARP Cache Poisoning 3.3.2 DNS Spoofing 3.3.3 Switch Flood 3.3.4 Rogue IPv6 Attack 3.3.5 Network Scans 3.3.6 Denial of Service 3.4 DETECTION 4 Container Breakout 4.1 KUBERNETES 4.1.1 Determine if you are on kubernetes cluster 4.1.2 Kubernetes enumeration 4.1.3 Kubernetes Pod RBAC Breakout 4.2 DOCKER 4.2.1 Determine if you are on docker container 5 OSINT 5.1 recong-ng 5.2 theHarvester 6 Malware Analysis 6.1 STATIC ANALYSIS 6.1.1 Executable Packing 6.1.2 Hash Check 6.1.3 Strings Check 6.1.4 Inspect Portable Executable 6.1.5 PE Disassembly 6.2 DYNAMIC ANALYSIS 6.2.1 Setup 6.2.2 Common Tools Used 7 Attack Frameworks 7.1 Metasploit 7.2 Meterpreter 7.3 PowerShell Empire 7.3.1 Host Tools 7.3.2 Network Tools 7.3.3 Common Zeek/Bro Options 7.3.4 NetworkMiner 7.3.5 Moloch 7.3.6 Suricata 7.3.7 Snort 7.3.8 Nmap 7.3.9 Wireshark 8 Wireless 8.1 Attack 8.1.1 WEP 8.1.2 WPA 8.1.3 Evil Twin 8.1.4 Mac Spoofing 8.2 Detection 8.2.1 Wireshark detect WiFi DOS 8.2.2 Kismet 9 Database 9.1 MYSQL 9.2 POSTGRESQL 9.3 MS SQL 10 Scripting 10.1 POWERSHELL 10.2 PYTHON 10.3 BASH 10.4 ASCII TABLE 11 Web 11.1 USER AGENTS 1 *NIX 1.1 GENERAL INFORMATION 1.1.1 Linux Kernels Kernel Version Name (Reason) 1.2.0 Linux '95 1.3.51 Greased Weasel 2.2.1 Brown Paper Bag 2.4.15 Greased Turkey 2.6.2–2.6.3–2.6.4– Feisty Dunnart 2.6.5–2.6.6–2.6.7–2.6.8–2.6.9 Zonked Quokka 2.6.10- rc1–2.6.10–2.6.11–2.6.12–2.6.13– Woozy Numbat 2.6.14-rc1–2.6.14– Affluent Albatross 2.6.15-rc6–2.6.15–2.6.16– Sliding Snow Leopard stable: 2.6.16.28-rc2– Stable Penguin 2.6.17-rc5 Lordi Rules 2.6.17-rc6–2.6.17– Crazed Snow-Weasel 2.6.18–2.6.19– Avast! A bilge rat! 2.6.20-rc2–2.6.20– Homicidal Dwarf Hamster 2.6.21-rc4–2.6.21– Nocturnal Monster Puppy Jeff Thinks I Should Change This, But To 2.6.22-rc3–2.6.22-rc4 What? 2.6.22-rc5–2.6.22— Holy Dancing Manatees, Batman! 2.6.23-rc4–2.6.23-rc6 Pink Farting Weasel 2.6.23-rc7–2.6.23–2.6.24– Arr Matey! A Hairy Bilge Rat! stable: 2.6.24.1– Err Metey! A Heury Beelge-a Ret! 2.6.25-rc2–2.6.25– Funky Weasel is Jiggy wit it 2.6.26-rc6–2.6.26–2.6.27– Rotary Wombat stable: 2.6.27.3– Trembling Tortoise 2.6.28-rc1–2.6.28-rc6 Killer Bat of Doom 2.6.28-rc7–2.6.28–2.6.29-rc8 Erotic Pickled Herring 2.6.29 Temporary Tasmanian Devil 2.6.30-rc4–2.6.30-rc6 Vindictive Armadillo 2.6.30- rc7–2.6.30–2.6.31–2.6.32–2.6.33– Man-Eating Seals of Antiquity 2.6.34-rc4 2.6.34-rc5-2.6.34–2.6.35 Sheep on Meth stable: 2.6.35.7– Yokohama 2.6.36-rc8–2.6.36–2.6.37–2.6.38- Flesh-Eating Bats with Fangs 2.6.39 3.0-rc1–3.0 Sneaky Weasel 3.1-rc2 Wet Seal Divemaster Edition (Linus' diving activities) 3.1-rc3–3.1 3.2-rc1–3.2–3.3–3.4–3.5– Saber-toothed Squirrel 3.6-rc7–3.6–3.7— Terrified Chipmunk 3.8-rc6–3.8–3.9–3.10– Unicycling Gorilla stable: 3.8.5– Displaced Humerus Anterior stable: 3.9.6– Black Squirrel Wakeup Call stable: 3.10.6– TOSSUG Baby Fish Linux for Workgroups (20 years of 3.11-rc1–3.11 Windows 3.11) 3.12-rc1– Suicidal Squirrel One Giant Leap for Frogkind (NASA 3.13-rc1 LADEE launch photo) 3.14-rc1 Shuffling Zombie Juror 3.18-rc3 Diseased Newt 4 Hurr durr I'ma sheep 4.1.1 Series 4800