Mapping the Path: A Black Team's Guide to Route Selection

Introduction

A route is a meticulously planned path designed to navigate threats and gain access to a facility. For black teams, which simulate advanced adversarial behavior, the selection of a route is paramount. It determines the methods used to bypass security, the timing of the operation, and the degree of risk assumed. A well-chosen route ensures the team can test a facility's defenses effectively, gathering critical insights without unnecessary exposure.

This post is going o be discussing what route selection is, why its important, how to create and adjust based on recon and client goals.

Planning Phase

The planning phase is the foundation of a successful black team engagement. The goal here is to understand the client's objectives and identify critical components that, if compromised, would significantly affect the client’s operations. Key steps in the planning phase include:

1. Understanding Objectives: Clarify what success looks like for the client, focusing on high-impact assets such as proprietary data, infrastructure, or equipment.

2. Threat Modeling: Think like an attacker to identify bottlenecks that, if compromised, would cripple the client's operations.

3. Risk Assessment: Assess the facility’s environment and potential risks to your team’s operations, accounting for both external and internal threats.

Remember that physical risk is often very different than its cyber counterpart. For example, in a cyber attack compromising the Domain Admin on the internal network is often the ultimate goal and the entire engagemnt and methods used are usually chosen for this purpose.

On a physical attack however, bugging the corporate board room to listen in on sensitive meetings may be the ultimate goal, which is something that likely couldn’t even be achieved via the internet.

So when considering your route, consider what is your ultimate goal, sub goals and the most likely methods to get you and your team there.

Attacker Mindset

Every physical engagement has distinct goals, and adopting the mindset of an attacker is crucial for a black team to understand how to compromise critical assets.

Here’s how to think like an attacker: