Redteam & Blueteam Series

Find Suspicious activity

Type of suspicious activities

• Unusual/failed login attempts
• Single account used from multiple locations
• Anomalous access based on location, time of day, data assets etc.

Maintain Remote access without a C2

As malware writers attempt to make their malware more resilient to take-down attempts and…

Exfiltrate Sensitive Data

Data exfiltration is an unauthorized copying, transferring or retrieval of data from a source. The attacker can…

Find and Access Sensitive Data

Ransomware, insider threat and denial of service are considered the top threats to sensitive data by…

Escalate Domain privileges

Many of the methods for gaining domain administrative privileges are the same as or similar to those used to…

Lateral Movement

The number and complexity of cyber-attacks are ceaselessly increasing while the existing security measures is far lagging in…

Perform Network Reconnaissance/Discovery

The process for internal reconnaissance is the same as the initial reconnaissance step in…

Perform local reconnaissance/discovery

Local Reconnaissance is done to understand about the system and internal network. The…

Escalate Local Privileges

Local privilege escalation happens when one user acquires the system rights of another user, means getting…