Automating a Red Team Lab (Part 2): Monitoring and Logging

Tue, 15 Mar 2022 07:33:28 +0000

In our previous post we used Packer, Ansible and Terraform to automate the creation of a domain on our ESXi server. This is great for testing out tools and techniques, but as red teamers we really need to see what’s going on behind the scenes in the event logs so that when the blue team kick in our front door, we know exactly where we went wrong.

In this post we’ll cover adding in some monitoring services so that we can trace events. In order to achieve this, we’re going to add an Ubuntu server to our lab, and install the ELK stack across the network. As before, we’re going to do all this automagically using Infrastructure-as-Code, because as the old saying goes:

Automating a Red Team Lab (Part 1): Domain Creation

Thu, 17 Feb 2022 13:03:18 +0000

If you’re anything like me, you will tend to rip your test lab down and build it again at least once a day. Whilst this is definitely great fun and an efficient usage of your time, wouldn’t it be amazing to just have a fire and forget script that will set it up exactly how you want, every time?

Luckily this is achievable using Infrastructure-as-Code! In this post, I’m going to go over how we can use Packer, Terraform and Ansible to go from an empty ESXi server to an up and running Windows domain in no time.

Infrastructure on Nick Zero

Automating a Red Team Lab (Part 2): Monitoring and Logging

Automating a Red Team Lab (Part 1): Domain Creation