Blue Team Tactics

[strandjs at gmail.com (John Strand)]

Command line and open source/free tools are ok.

Trying to keep it to a "living off of the land" theme.


On Jul 28, 2009, at 7:16 AM, Tim Mugherini wrote:

> Great idea John. One question why command line only?
>
> On Tue, Jul 28, 2009 at 8:54 AM, John Strand <strandjs at gmail.com>  
> wrote:
> Please! PSW land! Share your Blue Team tactics!
>
> What tools, scripts, and techniques do you use as part of Incident  
> Response and Blue Team Activities?
>
> I have sat in on one to many Red/Blue/CTF games where the Red team  
> gets Core, Canvas, Metasploit, Nessus, Satan, Sara, Cain and Able,  
> Ettercap, Dsniff, Hydra, 0phcrack, Nmap, BT4 and various torture  
> techniques (including IronGeek's rubber hoses) and the the Blue team  
> gets....
>
> "An un-patched Windows 2000 box and a slew of un-patched  
> software!!!!!''
>
> Please see the following video for reference:
>
> http://www.youtube.com/watch?v=Y77n--Af1qo
>
> Yea..  Thats right.... As of today the Blue Team is what you get  
> assigned to when you are caught stuffing peas up your nose.
>
> This stops today!!!
>
> There are a few rules.  Tricks and scripts must be able to run at  
> the command line of your operating system of choice and all tools  
> must be freeware or open source.
>
> Thats it!!!
>
> Look, the Blue Team can rock!!!  So please share your tricks.
>
> I am going to collect and add to them so we have a solid list and  
> this will serve as the playbook for the Blues going forward.
>
> Be expecting this on the PDC site soon.
>
> strandjs
>
> _______________________________________________
> Pauldotcom mailing list
> Pauldotcom at mail.pauldotcom.com
> http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
> Main Web Site: http://pauldotcom.com
>
> _______________________________________________
> Pauldotcom mailing list
> Pauldotcom at mail.pauldotcom.com
> http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
> Main Web Site: http://pauldotcom.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mail.pauldotcom.com/pipermail/pauldotcom/attachments/20090728/7a3fb44b/attachment-0001.htm