How to Spot the Blue Team

Red and Blue Teaming is a competitive training simulation between two teams; a Red Team and a Blue Team. The Red Team is the attacking team also known as the bad guys, and the Blue Team is the defending team known as the good guys. The goal of the Red Team is to infiltrate an infrastructure, stay undetected and steal data. Whereas the Blue Team’s goal is to secure this infrastructure by preventing, detecting, and securing from such intrusions. Knowing if a Red Team’s operation has been spotted by the Blue Team or not can make the difference between losing the target and securing the target. If the Red Team is aware that their operation has been spotted by the Blue Team, the team can change and adapt their techniques to become undetected again and keep ensuring its long-term engagement. The goal of this research is to find a way to detect Blue Team’s actions so that the Red Team can stay undetected and achieve long-term engagement. This leads to the following research question: ”How to secure a Red Team’s infrastructure to detect a Blue Team’s analysis?” A logging and monitored Red Team infrastructure can be used to detect a Blue Team’s analysis by using anomaly-based detection. A Proof of Concept was built using the Elastic Stack and Python scripts that is able to detect anomalies in the Command and Control (C2) communication. As the Elastic Stack brought challenges with it in alerting and detection during multiple Red Team operations, a Python script was created. This Python script is able to spot the Blue Team in a fast and dynamic way by searching for anomalies based on the operational details given as input.