Key Highlights: 2024 HVV New Rules

HVV is imminent, and various enterprises and public institutions have entered an active state of preparation, ready to start participating in the intense offensive and defensive drills at any time.

From 2016 to 2024, the HVV campaign has entered its 9th year, experiencing a transformation from a small number of units participating to the "era of national cybersecurity drills". With the rapid development of cybersecurity technology and various emerging technologies, new rules and gameplay are added to HVV every year to achieve the purpose of practical and simulated drills.

Pyxsoft has summarised the following points of attention for all units participating in the 2024 HVV, and is committed to continuously improving the capabilities of the Blue Team through the Pyxsoft Security Validation Platform.

▌2024 Newly Upgraded HVV Gameplay Updates

1. Introduction of APT attacks: Focus on the defensive units' ability to detect and respond to Advanced Persistent Threat (APT) attacks, which will run through the entire process.

2. Bonus instances: Taking key threats such as ransomware, data leakage, and 0day as separate drill projects, which are both opportunities and challenges.

3. Key points for losing points: In addition to boundary breakthrough, privilege acquisition, data acquisition, and remote control, the persistence of privileges also needs to be valued.

4. Larger attack surface, higher intensity: The attack surface involves related assets, branch offices, various APPs, mini-programs, web pages, as well as various systems on private and public clouds, and also needs to consider third-party channels such as supply chains. Defenders need to pay close attention to upward and lateral attack paths.

5. Focus on key industry sectors: Attacks aimed at either economic or political goals will target some key industry sectors, so the HVV drill will also focus on testing the defensive capabilities of industries such as finance, energy, electricity, and broadcasting.

6. Attention to new technologies and new business formats: Large model artificial intelligence, drone platforms, public service platforms, etc., will also undergo targeted drills due to their technology or influence.

▌Summary of Key Points for Blue Team Bonus Points

A. Basic Score: Assessing Full-Lifecycle Security Capabilities

According to previous HVVs, the basic capability assessment for defenders is divided into the following six major parts, covering the entire lifecycle of security defence:

1. Monitoring and Detection: Examining whether the specific types of Red Team attack methods can be detected, as well as the coverage and timeliness of detection.

2. Analysis and Judgment: Examining the Blue Team's capability to analyze attack samples and extract attack traces, including analyzing the functional characteristics, call-back information, and attack status of specific malicious processes and samples, as well as log extraction, sample capture, etc.

3. Emergency Response: Focusing on the capability of attack blocking, including attack blocking on the internet side and intranet side, with event classification, grading, and response plans also being scoring points.

4. Notification and Warning: Examining the timeliness, standardization, and detail of notification releases.

5. Tracking and Traceability: Examining the capability to reconstruct the attack chain, focusing on attack entry, intranet stepping stones, and attack paths.

6. Troubleshooting and Rectification: Examining the specific rectification as well as the plan and effectiveness of comprehensive troubleshooting and rectification.

Key Focus: Defense Report

Consistency between defense disposal report and Red Team attack path: Tests the ability to analyze and judge attacks.

Timeliness of discovery, blocking, and reporting: Tests the perception capability, blocking capability, and output speed of reports regarding attacks.

B. Additional Score: Assessing Deployment and the Ability to Summarize and Improve Tactical Methods

The six major items mentioned above are the basic defensive capabilities that each unit needs to possess, testing the lower limit of capabilities, while the additional points focus more on the higher-level capability level of the defensive unit, previously including two main aspects:

1. Stage Summary: Including the review and improvement of the overall deployment in the offensive and defensive drills, the analysis and restoration of event handling, the division of labor in the collaborative linkage mechanism, etc.

2. Technical Tactics: Including the summary of emergency response, security operations, security management, policy configuration, etc., in response to new types of attacks or specific events.

▌Summary of Key Points for Blue Team Point Deductions

A. 5 Major Deduction Categories

The deduction items for the Blue Team are also the bonus items for the Red Team, which can be divided into the following five major categories:

1. Privilege Acquisition and Maintenance

Special attention needs to be paid to the administrator privileges of centralized systems such as email systems, identity and account management platforms, OA systems, domain control systems, bastion host operation and maintenance machines, cloud platforms, virtual machine platforms, and Docker control. Once obtained, it will cause knock-on effects and result in double deductions.

1. Boundary Breakthrough

Deductions resulting from the Red Team entering the logically isolated business intranet, logically strongly isolated business intranet, and core production intranet may increase compared to previous years.

1. System Control

Deductions for different target systems being controlled will also be adjusted, and the upper limit of deductions for target systems being controlled has also increased. The assessment of target system losses still needs to take the path into consideration.

1. Data Acquisition

Deductions are made to varying degrees according to the type, sensitivity, fields, scale of data, and whether it is acquired through the supply chain. If sensitive business data is obtained, it may cause more serious deductions than in previous years.

1. Bleeding Deductions

After the attack team attacks successfully, for every additional hour they stay in the defender's intranet, points will be deducted hourly. (Can the techniques of the latent stage still be ignored?)

B. Red Team High-Frequency Techniques and Tactics

1. Initial Access:

   1. Phishing attacks (e.g., T1566.001 – Spearphishing Attachment)

   2. Exploiting software vulnerabilities (e.g., T1190 – Exploit Public-Facing Application)

2. Execution:

   1. Command-Line Interface (CLI) commands (e.g., T1059.003 – Windows Command Shell)

   2. PowerShell script execution (e.g., T1059.001 – PowerShell)

3. Persistence:

   1. Modifying scheduled tasks (e.g., T1542 – Scheduled Task/Job)

   2. DLL hijacking (e.g., T1574 – DLL Search Order Hijacking)

4. Privilege Escalation:

   1. Exploiting operating system vulnerabilities (e.g., T1068 – Exploitation for Privilege Escalation)

   2. Abusing high-privilege accounts (e.g., T1078 – Valid Accounts)

5. Defense Evasion:

   1. File deletion (e.g., T1107 – File Deletion)

   2. Exploiting trusted programs to execute malicious activities (e.g., T1218 – Signed Binary Proxy Execution)

6. Credential Access:

   1. Credential Dump (e.g., T1003 – Credential Dumping)

   2. Exploiting password managers (e.g., T1552 – Unsecured Credentials)

7. Discovery:

   1. Network mapping (e.g., T1046 – Network Service Scanning)

   2. System information discovery (e.g., T1082 – System Information Discovery)

8. Lateral Movement:

   1. Remote Procedure Call (RPC) service abuse (e.g., T1021.002 – SMB/Windows Admin Shares)

   2. Remote service vulnerability exploitation (e.g., T1210 – Exploitation of Remote Services)

9. Collection:

   1. Collecting data from local systems (e.g., T1005 – Data from Local System)

   2. Collecting data from network shares (e.g., T1039 – Data from Network Shared Drive)

10. Command and Control (C&C):

    1. Using custom command and control protocols (e.g., T1071 – Application Layer Protocol)

    2. Using remote access tools (e.g., T1219 – Remote Access Software)

11. Exfiltration:

    1. Data transmitted over C&C channels (e.g., T1041 – Exfiltration Over Command and Control Channel)

    2. Data transmitted over removable media (e.g., T1052 – Exfiltration Over Physical Device)

12. Impact:

    1. Data encryption (e.g., T1486 – Data Encrypted for Impact)

    2. System service interruption (e.g., T1531 – Account Access Removals)

These techniques, tactics, and sub-techniques are common methods used by the Red Team in simulated attacks, covering various stages of the attack, from initial information gathering to final data theft and impact generation. The Blue Team can leverage these techniques to strengthen monitoring, improve defensive measures, and optimize emergency response plans. Defensive units still need to be reminded that whether it is a real attack or an offensive and defensive drill scoring, the key lies in mastering the attack path, rather than focusing solely on a single stage of attack methods.

▌Pyxsoft Helps Enterprises Prepare for 2024 HVV

1. Most Comprehensive APT Attack Library

Pyxsoft Security Lab has tracked more than 370+ APT groups in the market, fully restoring the attack methods they use. Each unit can verify the weak points of its own security defense system in advance through the APT-related attack scenarios and methods within the Pyxsoft Security Metric Platform. Attack methods are continuously updated regularly, aiming to cover all kinds of common, popular, and latest attack methods.

1. Ransomware Drill

Pyxsoft has collected the attack methods of 130+ ransomware organizations, which can help enterprises in need conduct early ransomware drills, executing real ransomware samples while ensuring no harm to user assets and environments.

1. Restore Attack Paths

Over the years, HW has increasingly valued the defender's ability to trace and analyze attack paths, which is consistent with the purpose of Pyxsoft. By restoring the attack paths and methods in real attacks, we help users deeply understand and analyze the attackers' intentions and methods, helping the security operations team improve their traceability capabilities.

1. 7*24 Normalized Drills

HW assesses the Blue Team capabilities of defensive units. Various laws and regulations issued in recent years have also emphasized the requirements for practical and normalized offensive and defensive drills. To perform excellently in HW, abundant daily offensive and defensive exercises are indispensable. Pyxsoft provides enterprises with an automated drill platform to enhance various capabilities of the Blue Team in daily work.

1. Empowering Security Deployment

Pyxsoft translates first-hand victim threat intelligence into usable intelligence for enterprise security defense system self-inspection and security capability enhancement, helping enterprises discover their own weaknesses in advance and deploy defenses in advance.

1. HW Attack Methods Over the Years

Pyxsoft has collected and analyzed a large number of 0day vulnerabilities and attack methods discovered during HW over the years, covering multiple deduction types, helping enterprises proactively conduct validation drills, raise security baselines, and better prepare for new HW drills. Preparing for 2024 HVV, Pyxsoft continues to escort you

1. Providing Rectification and Optimization Recommendations

Optimization and rectification are additional scoring items to assess the capabilities of defensive units. The security validation provided by Pyxsoft also contains mitigation and optimization recommendations for related attack methods, helping enterprises carry out effective rectification after discovering their own defensive weaknesses.