Skip to content

README.md

Latest commit

 

History

History
178 lines (125 loc) · 5.7 KB

README.md

File metadata and controls

178 lines (125 loc) · 5.7 KB
Raw

MITRE-Turla-Carbon

This project simulates Phase 1 - "Carbon" of the MITRE Turla adversary emulation scenario released in 2023. It replicates a multi-phase cyber espionage campaign conducted by the Turla threat group, targeting high-value government and defense-related entities.

📌 Scenario Summary

In this phase, the Turla group:

  1. Initial Access: Gains entry via a spearphishing email delivering a fake software installer.
  2. Execution: Installs the EPIC backdoor onto the victim machine.
  3. Persistence & C2: Establishes persistence and command-and-control (C2) channels.
  4. Discovery: Identifies and accesses the Domain Controller.
  5. Lateral Movement: Deploys CARBON-DLL into the Windows environment.
  6. Linux Compromise: Moves laterally to a Linux Apache web server and installs PENGUIN to create a watering hole.

🧪 Attack Sequence: MITRE Turla Carbon Scenario

This section outlines the key phases of the Turla Carbon attack:

  1. Initial Access: Spearphishing email installs EPIC backdoor.
  2. Execution: EPIC backdoor establishes C2 communication.
  3. Privilege Escalation: Misconfigurations allow privilege escalation.
  4. Lateral Movement: Attacker moves across Windows hosts and the domain controller.
  5. Credential Access: Mimikatz dumps credentials, followed by keylogging.
  6. Linux Compromise: Penquin malware is deployed on Apache server.
  7. Watering Hole: Malicious web page created for later exploitation.

For a detailed attack sequence, refer to the full Carbon Detections Scenario.

⚙️ Lab Requirements

The emulation uses the MITRE ATT&CK Evaluations range configuration, requiring specific Windows and Linux operating systems. Provisioning is automated using Ansible.

🔧 Lab Setup Instructions

  1. Login to the host: support-dns-srv1

  2. Clone the repo:

    git clone https://github.com/scottbrumley/mitre-turla-config.git
cd mitre-turla-config

  3. Initialize Ansible:

    ./init.sh

  4. Run main lab configuration:

    ansible-playbook -i inventory runall.yml --ask-pass -u adminuser

🔄 Operational Commands

Update GitHub Content

git pull origin main

Ping All Hosts

ansible-playbook -i inventory pingall.yml --ask-pass -u lab-user

Restart Redirectors

ansible-playbook -i inventory redirectors.yml --ask-pass -u lab-user --ask-become-pass

Disable Microsoft Defender (Destructive)

ansible-playbook -i inventory disable_defender.yml --ask-pass -u lab-user --ask-become-pass

🛡️ XDR Agent Installation

Step 1: Create/Edit Secrets Vault

Create:

ansible-playbook create_secrets.yml

Edit:

ansible-playbook edit_secrets.yml

Vault content format:

xsiamKEY: <XSIAM API Key>
xsiamID: <XSIAM API ID>
xsiamURL: <XSIAM API URL>
xsiamWINDIST: <Windows Installer Distribution ID>
xsiamWINPACKTYPE: <Package Type (i.e. x64)>
xsiamLINDIST: <Linux Installer Distribution ID>
xsiamLINPACKTYPE: <Package Type (i.e. sh)>
falconCID: <CrowdStrike Falcon Customer ID>

Step 2: Retrieve Required Info

  • XSIAM API URL:
    Settings → Integrations → API Keys → Copy API URL

  • API Key & ID:

    • Create key with Standard Security Level
    • Role: Instance Administrator or Account Admin
    • Copy generated key and ID

  • Installer Distribution IDs:
    Endpoints → Agent Instructions → ⋮ → Show ID → Copy Windows and Linux IDs

Step 3: Install Agents

ansible-playbook -i inventory xdr_agent_install.yml --ask-pass -u lab-user --ask-become-pass --ask-vault-pass

Step 4: Validate in XSIAM

Navigate to: Endpoints → All Endpoints

Step 5: Grouping Best Practice

  • Servers: bannik, brieftragerin, kagarov
  • Workstations: domovoy, khabibulin, hobgoblin

🧰 Script Overview

Script Description
runall.yml Full environment setup including users, Exchange servers, hostnames, etc.
pingall.yml Pings all inventory hosts to check if they're online
redirectors.yml Restarts HTTP redirectors
disable_defender.yml Disables Windows Defender (irreversible without manual steps)
xdr_agent_install.yml Installs Cortex XDR agents using XSIAM API and Ansible Vault
create_secrets.yml Creates the encrypted Ansible Vault secrets file
edit_secrets.yml Opens existing Vault for editing

📁 Repo Structure

mitre-turla-config/
├── README.md
├── init.sh
├── runall.yml
├── inventory/
├── pingall.yml
├── redirectors.yml
├── disable_defender.yml
├── xdr_agent_install.yml
├── create_secrets.yml
├── edit_secrets.yml
├── scripts/
└── docs/

📚 References

Disclaimer: This project is for research and educational purposes only. Do not run outside of a secure, isolated lab environment.