Red(team Mal)ware

TL;DR: clear overview of impact and deconfliction in comms between Red Teams and SOCs

Context

I am conducting a legitimate red team or pentest and need a piece of malware or dual-use software.

Possible Result

The EDR may correctly identify this software as malware and triggers an alert.

Problem

The alert is triaged and the impact must be determined. However, initially only the existence or execution of the malware is visible, and not necessarily the full impact.

Example 1

Beaconing behavior on a DC is observed from lol.exe. What is the impact? Are we f**ked or was it just a red team?

Example 2

DCSync is observed for a first time on a host from gimme.ps1. Is this an admin with a backup task, a legitimate setup of a new DC, or China?

Solution

I propose a new term: Redware. This solves the impact question. Redware means that the Red Team has full or sufficient knowlege, that their software or actions have no impact, yet EDRs must still classify it as Malware. Redware is thus also context dependent. If it's used by malicious actors, it is normal malware again.