Setting up SCYTHE-VECTR integration

Many SCYTHE customers like to track their red and purple team exercises in a free reporting tool called VECTR. VECTR is maintained by Security Risk Advisors and we have been working with them on integrations for over a year. Naturally, we help our customers set up VECTR so that they can import SCYTHE campaigns more easily. Normally, you have to manually fill out each test case in VECTR. By importing from SCYTHE, you will get all of the Red Team details and only have to fill out the Blue Team side. This is a quick start guide that should help you set up VECTR with SCYTHE integration.

Installing VECTR

If you want a dedicated system for VECTR, then create an Ubuntu Virtual Machine wherever you want (AWS, Azure, GCP, Digital Ocean, etc). VECTR recommendation is an Amazon t3.medium instance which translates to:

• 2 vCPUs
• 4GB Memory
• 100+Gb free space
• Internet access to GitHub and DockerHub
  

If you want to use a distribution that already has VECTR, then check out the SANS Slingshot C2 Matrix Edition virtual machine.

For a new Ubuntu system, open a shell to prepare for the installation:

curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -

sudo add-apt-repository \

   "deb [arch=amd64] https://download.docker.com/linux/ubuntu \

   $(lsb_release -cs) \

   stable"

sudo apt update

sudo apt-get install docker-ce docker-ce-cli containerd.io docker-compose unzip

sudo apt upgrade

sudo systemctl enable docker

Install VECTR with the following commands:

mkdir -p /opt/vectr

cd /opt/vectr

wget https://github.com/SecurityRiskAdvisors/VECTR/releases/download/ce-6.2.1/sra-vectr-runtime-6.2.1-ce.zip

unzip sra-vectr-runtime-6.2.1-ce.zip

Now customize your install:

sudo vim .env‍

Edit these fields:

• APP_NAME= This is the "name" displayed by the application at the login screen.
• VECTR_HOSTNAME= This is the URL you will be accessing VECTR from
• VECTR_PORT= This is the port the Tomcat instance will be listening on for HTTPS
• VECTR_DATA_KEY= This is the encryption key for the Mongo database. Needed for future integrations or potentially data recovery. Change this and store in a safe place.
• JWS_KEY= JWT signing (JWS) Do not use the same value for both signing and encryption! It is recommended to use at least 16 characters. You may use any printable unicode character
• JWE_KEY= JWT Encryption Key(JWS) Do not use the same value for both signing and encryption! It is recommended to use at least 16 characters. You may use any printable unicode character
• MONGO_INITDB_ROOT_PASSWORD= This is the password for the default login of the MongoDB. You may need this in the future if manual access to your database is required. Change and store in a safe place.
• COMPOSE_PROJECT_NAME= project name you would like to name the containers
• Add this line so you can import SCYTHE campaigns:

VECTR_FEATURES_SCYTHELOG=true

Start VECTR

docker-compose up -d

Using VECTR for the first time

Login to VECTR:

• Navigate to https://<VECTR_HOSTNAME>:<VECTR_PORT>
• Accept the invalid certificate.
• User: admin
• Password: 11_ThisIsTheFirstPassword_11
  

On the Select Your Organization screen:

• Click the +
• Fill out the information for your organization
  

On the Select Session Database screen:

• Click the +
• Give your new database a name
  

In the Assessments screen:

• Click Create New
• Provide a Name and Description
• Click Save

Import SCYTHE campaigns

To import your first SCYTHE campaign

• Click the assessment where you want to import a campaign
• Click Assessment Actions on the top right
• Import log
• Select the CSV from your SCYTHE campaign
  

Click on the new assessment that was imported and you will see the escalation path, timeline, and test cases.

Importing a SCYTHE log to VECTR provides the following information per TTP (called a Test Case in VECTR) that executed in your campaign:

• Test Case Name
• Description
• Status
• Attack Start
• Attack Stop
• MITRE ATT&CK Technique Mapping
• MITRE ATT&CK Tactic Mapping
• Operator Guidance
• Attacker Tool
• Target Asset
• Outcome notes

‍

‍

Now all you have to do is select the Blue Team outcome for the TTP. Was the TTP:

• Blocked
• Not Detected (but maybe logged locally)
• Detected

You can also select the time of the detection and the security tool that detected the TTP.

Best Practices

As we have performed many Purple Team exercises using SCYTHE and importing it into VECTR, we have a few best practices:

• Download the CSV report per device/process ID, not the entire campaign. In the image below, you would download the CSV for DESKTOP-D6823U3~408 and GEORGYP1~20008

• Only tag one MITRE ATT&CK technique per action in SCYTHE. VECTR has a 1 to 1 mapping between a SCYTHE TTP and ATT&CK technique. To get around this limitation, you can copy the test case in VECTR after importing the log.
• Add a new case for Execution based on how the SCYTHE payload was executed. Here is a blog with test case ideas.
• Copy the “payload shutdown” test case and set it as the C2 channel. We generally set that for the time the initial execution happened. The “payload shutdown” is when the attack is completed.
• Create tags in VECTR for:

Not logged

Logged but no alert

Alert but no Response

Reporting

One of the best features of VECTR is how it can show historical trends over various adversary emulations. It is assumed you will run the emulation more than once to show the delta of what has improved. This is one of the reasons that SCYTHE is the leading purple team tool, it allows you to emulate the same TTPs consistently and reliably so you can focus on improving and training your people, process, and technology. 

Run the same emulation again after you have performed some detection engineering and enabled logs and alerts. Import the CSV from SCYTHE, fill out the Blue Team side for the outcome and use the tags as outlined in the best practices. Next go to the Reports section on the left side of VECTR. There are multiple options to view the results of the emulations:

• Metrics - high level pie charts of total test cases, detected, blocked, and failed.
• Test Case Drilldown - list of all test cases
• Historical Trending - show the improvement emulation over emulation
• Heat Map - MITRE ATT&CK Heat Map (not a Bingo card) that shows

Conclusion

Importing SCYTHE campaigns into VECTR is simple thanks to the integrations we have created with Security Risk Advisors. Being able to emulate the same TTPs consistently and reliably will allow accurate metrics for showing how your program has tested, measured, and improved your people, process, and technology.

References

https://www.scythe.io/library/vectr-integration 

https://docs.vectr.io/Installation/