CrowdStrike Services

RED TEAM / BLUE TEAM

EXERCISE
Prepare your cybersecurity team to defend
against targeted attacks

CYBERATTACKS ARE CONSTANTLY EVOLVING KEY BENEFITS

Attack tactics, techniques and procedures (TTPs) are constantly evolving, and
every organization should know how to identify, stop and prevent a breach. Many
Discover and identify
organizations have a complex suite of security tools they count on for protection.
misconfigurations and
The challenge is understanding whether these tools and the associated policies
coverage gaps in existing
and procedures implemented in them are efficient and capable of preventing a
security products
modern-day attack.

Focus on maturing your

TRAIN TO DEFEND AGAINST A TARGETED ATTACK security team’s threat hunting

knowledge and overall
incident response processes
The CrowdStrike® Red Team / Blue Team Exercise helps prepare your in a safe training environment
cybersecurity team by learning from experts, as a Red Team attacks your systems
in a simulated exercise and a Blue Team helps your team defend against this
Enable your security staff
targeted attack within your environment.
to walk through the phases
During this exercise, CrowdStrike deploys two teams of consultants: a of a targeted attack and
Red Team that uses real-world attacker techniques to compromise your understand the mindset and
environment, and a Blue Team of incident responders who work side-by-side methodology of a real-world
with your security personnel using your existing tools to identify, assess and threat actor and how to
respond to malicious activity. detect its activity within your
environment
 CrowdStrike Services

RED TEAM / BLUE TEAM EXERCISE

KEY SERVICE FEATURES WHY CHOOSE

A typical exercise traces the following kill chain path: CROWDSTRIKE?
ACTIVE RECONNAISSANCE OPERATIONS
While the Red Team scans your public-facing The Red Team escalates privileges, Real-world targeted
infrastructure and looks for vulnerabilities, enumerates vulnerabilities, expands attack scenarios:
the Blue Team helps your personnel detect access and simulates data exfiltration in CrowdStrike’s Red Teams have
adversary reconnaissance and consider your environment. Meanwhile, the Blue extensive penetration testing
preventive measures that can be taken in Team works with your personnel to track experience and in-depth
response. these actions and assess the attacker’s understanding of the TTPs
objectives — one of the most difficult used in today’s sophisticated
analytic parts of incident response. attacks.
DELIVERY AND EXPLOITATION By identifying the systems, data and
The Red Team attempts to compromise your methods the attacker used to infiltrate your
public-facing infrastructure using available environment, the response team can better Cyber kill chain process:
application or system vulnerabilities, relying understand the organizational risk posed CrowdStrike’s Red Teams
on tactics and software used by real-world by the incident, anticipate future attacker incorporate the same tools and
adversaries. If the Red Team cannot gain activity, and develop containment and techniques that adversaries
access using the designed intrusion method, remediation strategies. use to mirror a targeted attack
or you would prefer to not exploit live that follows the steps of the
infrastructure, then a trusted agent will manually cyber kill chain.
execute the tactic so that artifacts are present
AFTER-ACTION REVIEW
for investigation. The Blue Team works with Once the attack phases are completed, Advanced threat intelligence:
your security personnel to triage the incident, the Blue Team continues to work with CrowdStrike’s Blue Teams
conducting host and network-based analysis your security team, conducting host and provide insight into adversarial
and identifying the source and destination network-based analysis and piecing TTPs that specifically target
of the attack, exploitation method, rogue together a timeline and narrative of your industry. The exercise
processes, and level of privileged access. the events that transpired. Once this helps you better understand
is complete, the Red Team provides potential threats and how to
every detail of the attack to ensure a
COMMAND AND CONTROL complete understanding of the campaign.
protect yourself against a
targeted attack.
As the Red Team’s tools beacon out to the CrowdStrike consultants also facilitate a
attack infrastructure, the Blue Team helps review of response activities and record
your security personnel identify this traffic any lessons learned and recommendations
and search for other potential points of for improvement.
compromise to gain a more comprehensive
picture of the attacker’s access.

ABOUT CROWDSTRIKE SERVICES

CrowdStrike Services delivers Incident Response, Technical Assessments, Training, and Advisory Services that help you prepare to
defend against advanced threats, respond to widespread attacks, and enhance your cybersecurity practices and controls.

We help our customers assess and enhance their cybersecurity posture, test their defenses against real-world attacks, respond
to incidents, accelerate forensic investigations, and recover from a breach with speed and precision. Harnessing the power of our
Security Cloud and the CrowdStrike Falcon® platform, we help you protect critical areas of enterprise risk and hunt for threats using
adversary focused cyber threat intelligence to identify, track and prevent attacks from impacting your business and brand.

CrowdStrike: We stop breaches.

Learn more at www.crowdstrike.com/services/

Email: [email protected] © 2022 CrowdStrike, Inc. All rights reserved.