Specter Ops Training - Posting SOW.docx

ADVERSARY TACTICS: RED TEAM OPERATIONS TRAINING COURSE

STATEMENT OF WORK (SOW)

1.0 BACKGROUND

NAVSEA Red Team requires the ability to provide advanced computer network aggressor training to four (4) of its personnel who are tasked to perform cyber adversary emulation. The training teaches Red Team operators how to exercise defensive personnel, processes and technologies and be taught via the worldwide web. The course should provide a realistic, hands-on approach that is representative of methodologies and Tactics, Techniques, and Procedures (TTPs) used by attackers in real-world breaches. It also should help students with techniques to infiltrate networks, gather intelligence, and covertly persist in a network like an advanced adversary. The training should teach attendees adversary tradecraft required to identify weaknesses in enterprise security postures using the well-known offensive tools PowerView, PowerShell Empire, PowerSploit, PowerUp, and BloodHound. The training should provide an enterprise lab environment designed to mimic a mature real-world network, with multiple domains, up-to-date and patched operating systems, modern defenses, and active network defenders responding to Red Team activities. The training should cover all phases of a Red Team engagement to include advanced attack infrastructure setup and maintenance, user profiling and phishing, host enumeration and “safety checks”, advanced lateral movement, sophisticated Active Directory domain enumeration and escalation, persistence (userland, elevated, and domain flavors), advanced Kerberos attacks, data mining, and exfiltration.

2.0 APPLICABLE DOCUMENTS

None

3.2 The course shall consist of 1 day of classroom environment setup and 4 days of instruction.

3.3 The course shall be hosted virtually.

3.4 Students shall provide their own laptops for the course.

3.4 The contractor shall provide a schedule of courses upon award to the TPOC identified in paragraph 6.0.

3.5 The Contractor shall coordinate with the Technical Point of Contact (TPOC) identified in paragraph 6.0 to schedule the four vouchers within 120 days of contract award.

None

5.0 SECURITY

The work to be performed under this contract is unclassified.

6.0 TRAVEL

No travel is required for this work.

7.0 TECHNICAL POINT OF CONTACT

TBD – Will be provided at time of award.