« Red Team Engineer

Phase 06 — Payload Development & Execution (Detection-Forward)

Operation Cedar Lattice, Phase 06. Phase 05 produced the Active Directory attack-path analysis for Meridian Freight International and identified which accounts, delegation relationships, and DACL edges create a path from the foothold to domain admin. Before executing that path, the engagement needs to load execution capability on the foothold host and stage the tools that the next phases require. This is the payload and execution phase.

This phase is the most detection-forward in the track. Every execution and injection technique is presented as a detection problem: which sensor sees it at which boundary, what the sensor records, and what detection rule catches it. The two labs are an injection-technique detection mapper and a payload-staging analyzer — both reason over synthetic metadata, neither contains weaponized code or shellcode.

Safety (non-negotiable). Authorized security-education only. The labs are detection mappers and staging analyzers over synthetic technique and metadata dicts. There is no shellcode, no working injection code, no reflective loader, no executable payload, and no bypass routine in this repo. Every injection technique is explained as a detection opportunity. This boundary is identical to the security track and to Phases 00–05.

Why this phase exists

A red team engagement moves capability onto a host before it can execute technique. "Capability" is the code that produces the ATT&CK technique's observable footprint — typically: (a) a process or thread that performs the technique, and (b) the staging artifact that delivers the code to memory.

Understanding how that works is a dual-use skill:

• Red team: choose the execution primitive that matches the engagement's OPSEC requirements and the target environment's detection capability.
• Blue team: understand which sensor covers which execution primitive, identify the gaps, and write the detection that closes them.

The JD requires understanding of "process injection, shellcode execution, C# and PowerShell for implant development." This phase covers the conceptual models — what each technique does to the OS, which sensor sees it, and the detection — not working code. The Phase 07 EDR phase builds directly on this: it uses the injection-technique sensor map from this phase to reason about residual visibility.

Learning Objectives

By the end of this phase you can, without notes:

1. Name and explain the six primary injection technique families and the OS primitives each uses: remote thread injection, APC injection, process hollowing, DLL injection, reflective DLL injection, and NtMapViewOfSection-based injection — each with its required API call sequence.
2. For each technique, state which sensor sees it (ETW-TI for alloc/write/protect/create, kernel callbacks for process/thread, Sysmon EID 1/8/10/7) and the detection rule that fires.
3. Explain process hollowing: create a suspended process, unmap its image, write attacker code, set the entry point via context manipulation, resume. Name the two sensors that catch it (CreateProcess with CREATE_SUSPENDED + WriteProcessMemory + SetThreadContext).
4. Explain reflective DLL injection: the DLL carries a ReflectiveLoader export that locates its own image in memory, maps it correctly, resolves imports, and calls DllMain — no file on disk, no LoadLibrary call. Name the sensors: ETW-TI ALLOCATE_VIRTUAL_MEMORY, image-load callback on the manually mapped image.
5. Explain AMSI and where it sits in the execution flow for PowerShell, .NET, and scripting hosts — and the detection for the bypass (Phase 07 detail, but AMSI's role starts here).
6. Explain the three staging strategies: disk staging (file on disk, then load), memory-only staging (reflective load from network or another process's memory), and LOLBin staging (use a built-in OS binary to download/execute without writing a file).
7. For each staging strategy, state its host and network telemetry and the detection.
8. Apply the Pyramid of Pain to execution techniques: a detection on a tool name is bypassed by renaming; a detection on the CREATE_SUSPENDED + cross-process write sequence is not.

The injection-technique sensor map

The pattern: every injection requires allocating writable+executable memory in a remote process or mapping executable content into it. ETW-TI sees that allocation. The kernel callback sees the thread or handle operation. No user-mode bypass removes both — Phase 07 formalizes this invariant.

The staging-strategy telemetry map

Concepts

Labs

cd lab-01-injection-technique-detection-mapper
LAB_MODULE=solution python3 -m pytest -q   # 13 tests

cd ../lab-02-payload-staging-analyzer
LAB_MODULE=solution python3 -m pytest -q   # 12 tests

Deliverables

• An injection-technique detection mapper that, for any injection technique in the catalog, returns its API sequence, required sensor set, Sysmon events, and detection rule; and that computes technique coverage given an org's actual sensor inventory.
• A payload staging analyzer that classifies staging events, identifies the telemetry artifacts per event, and returns a ranked list of staging findings with detection descriptions.
• The Operation Cedar Lattice Phase 06 artifact: the execution-technique and staging plan for the Meridian foothold — which techniques the engagement simulates, which sensors they generate events on, the detection that catches each, and the staging telemetry the engagement produces. All over synthetic metadata; no executable payloads.
• Fluency to explain every injection technique, its API sequence, the sensor that sees it, and the detection — and the staging strategies and their telemetry — in an interview.

Readings (primary sources)

• Windows Internals, 7th ed. — process/thread creation, NtCreateSection/NtMapViewOfSection, virtual memory API family.
• Microsoft Docs: CreateRemoteThread, VirtualAllocEx, WriteProcessMemory, SetThreadContext, NtMapViewOfSection, QueueUserAPC.
• MITRE ATT&CK: T1055 (Process Injection — all sub-techniques), T1218 (Signed Binary Proxy Execution — LOLBins), T1059 (Command and Scripting Interpreter), T1027 (Obfuscated Files/ Information), T1105 (Ingress Tool Transfer — staging).
• ETW Threat Intelligence provider documentation — Microsoft docs, Elastic Security Labs.
• Sysmon event reference — EID 1, 3, 7, 8, 10, 11.
• LOLBAS (lolbas-project.github.io) — catalog of signed Windows binaries with staging/ execution capability and detection notes per binary.
• Sigma repository — T1055.* process injection rules.

Common Mistakes

• Describing injection without the detection. Every injection technique on every slide in an interview or client report must be paired with the sensor and the detection. "We used X" alone delivers nothing actionable.
• Confusing remote thread with APC. Remote thread creates a new thread in the target; APC queues a callback to execute next time an existing thread enters an alertable wait state. Detection overlaps at the alloc/write level but diverges at the thread-creation vs. APC-queue level.
• Claiming process hollowing is "undetectable." The CREATE_SUSPENDED process creation, the cross-process write, and the SetThreadContext are all observable via ETW-TI and Sysmon. What hollowing achieves is inheriting the process name and PID — not hiding from sensors.
• Treating LOLBin use as low-risk. Sysmon EID 1 (command-line logging) plus Sysmon EID 3 (network connection) for certutil.exe reaching an external IP is a high-fidelity detection. LOLBin execution from an unusual parent (or with an unusual command line) is one of the most commonly detected initial-access techniques.
• Missing ETW-TI as the injection residual detection. User-mode hooks in ntdll can be bypassed; ETW-TI is kernel-emitted and cannot be bypassed from user mode. If you claim a technique evades detection, name the sensor it evades AND the one that still sees it.

Interview Questions

1. Walk me through remote thread injection — the API sequence, the process it generates, the sensors that fire, and the detection rule.
2. What is process hollowing? How does it differ from remote thread injection, and what is the residual detection that catches it?
3. What makes reflective DLL injection different from standard DLL injection, and why does it leave an "unbacked" image load?
4. Explain APC injection: what is an APC, what does "alertable" mean, and how is it detected?
5. What is NtMapViewOfSection-based injection, and how does ETW-TI see it?
6. What are the three staging strategies? For each, name the host-telemetry artifact and the detection.
7. Why does ETW-TI survive user-mode hooking bypass, and why does that make it the residual injection detection?
8. You are writing a detection for "execution of a LOLBin used for staging." Walk me through the Sigma rule — log source, detection fields, false-positive handling.

(Full answers are in WARMUP.md.)

Portfolio artifact

Cedar Lattice Phase 06 execution plan: the injection-technique detection map for the engagement's planned execution primitive (which technique, which API sequence, which sensors fire, the detection); the staging plan (which strategy, which telemetry artifacts, the proxy/Sysmon findings); and the OPSEC assessment of the chosen approach (which indicators survive, which are default-on). All over synthetic metadata. Part of 06-07-payloads-edr/ in the capstone portfolio.

Guides

• WARMUP.md — the from-zero deep dive: OS memory primitives, the six injection families (API sequence + sensor + detection for each), process hollowing in depth, reflective DLL mechanics, ETW-TI as the residual sensor, AMSI in the execution path, staging strategies and their telemetry, the Pyramid of Pain applied to execution.
• HITCHHIKERS-GUIDE.md — on an owned range: run benign Atomic Red Team tests for injection telemetry (T1055), observe which Sysmon events fire, identify the gap, close it with a Sysmon EID 8/10 rule.