WEBVTT

00:00:01.640 --> 00:00:03.670
I really didn't want to miss a chance to get in a good,

00:00:03.670 --> 00:00:07.170
hackneyed Sun Tzu quote in there, and this seemed like the perfect time.

00:00:07.770 --> 00:00:11.340
These tools are made and distributed publicly for free so that you can

00:00:11.340 --> 00:00:14.950
understand the techniques that adversaries are using, or will be using in the

00:00:14.950 --> 00:00:17.570
future, and prepare your organization accordingly.

00:00:17.770 --> 00:00:19.920
It's like when you're on a long road trip with your friends and

00:00:19.920 --> 00:00:21.790
you're planning for the future zombie apocalypse.

00:00:22.070 --> 00:00:25.060
Do you take over an old bank, do you hollow out a tanker at sea?

00:00:25.490 --> 00:00:27.720
What defenses do you have ready, is barbed wire enough?

00:00:27.720 --> 00:00:28.950
Are you going to have electricity?

00:00:29.340 --> 00:00:31.390
We all know there's no one answer to that equation.

00:00:31.400 --> 00:00:33.790
And first of all, what kind of zombies are you dealing with?

00:00:34.030 --> 00:00:37.630
Are these slow shuffley dumb zombies or like World War Z zombies that can act

00:00:37.630 --> 00:00:41.600
as a group and sprint at full speed indefinitely? It matters, and red team

00:00:41.600 --> 00:00:44.940
adversary emulation matters because it's letting you know what kind of

00:00:44.940 --> 00:00:48.650
zombies you have to defend against so that you can test your defenses to see

00:00:48.650 --> 00:00:49.880
what's going to keep you safe.

00:00:50.540 --> 00:00:53.040
EDR is catching on to PowerShell and memory tricks,

00:00:53.310 --> 00:00:55.440
but tools like Covenant are changing the game,

00:00:55.450 --> 00:00:58.880
and you can guarantee that cybercriminals and national‑level APTs

00:00:58.880 --> 00:01:01.250
alike are already working with these capabilities.

00:01:01.530 --> 00:01:03.220
When you start using this in your environment,

00:01:03.360 --> 00:01:06.620
make sure to look up listener profiles, find ways to make them tricky,

00:01:06.630 --> 00:01:08.650
make them blend in, and make them hard to find.

00:01:09.240 --> 00:01:10.660
If you want to take it to the next level,

00:01:10.780 --> 00:01:13.540
get into using the exposed Covenant API to integrate these

00:01:13.540 --> 00:01:16.860
capabilities with other tools and work on automated actions.

00:01:17.130 --> 00:01:19.930
Command and control frameworks and channels are really interesting in

00:01:19.930 --> 00:01:22.810
general because if you can't talk within a network,

00:01:22.810 --> 00:01:26.180
you can't really operate. With a few exceptions, but even things like

00:01:26.180 --> 00:01:29.500
Stuxnet had to spread in one way or another, and understanding how

00:01:29.500 --> 00:01:32.660
the next generation of C2 is unfolding is good information whether

00:01:32.660 --> 00:01:35.830
you're on the red or the blue team. And now, covenant is one more

00:01:35.830 --> 00:01:37.110
tool in your tool belt.

00:01:37.740 --> 00:01:39.320
Thank you for watching Pluralsight,

00:01:39.630 --> 00:01:42.440
and I hope you join me and other authors to add to your

00:01:42.440 --> 00:01:44.450
arsenal of red team tools in the future.