Redteam & Blueteam Series

Exfiltrate Sensitive Data

Data exfiltration is an unauthorized copying, transferring or retrieval of data from a source. The attacker can…

Send Phishing Links

The process of creating a successful email phishing campaign is very methodical, and most of the time and effort goes up…

Maintain Remote access without a C2

As malware writers attempt to make their malware more resilient to take-down attempts and…

Perform Network Reconnaissance/Discovery

The process for internal reconnaissance is the same as the initial reconnaissance step in…

Find and Access Sensitive Data

Ransomware, insider threat and denial of service are considered the top threats to sensitive data by…

Find Suspicious activity

Type of suspicious activities

• Unusual/failed login attempts
• Single account used from multiple locations
• Anomalous access based on location, time of day, data assets etc.

Common persistence techniques registries lookup for blue-team..

====================

REGISTRY LOOKUP’S

====================

HKEY_CURRENT_USER\Volatile Environment — User Details

Perform local reconnaissance/discovery

Local Reconnaissance is done to understand about the system and internal network. The…

Maintain Local Persistence

Once the attacker exploits the system he tries to maintain a foothold/persistence. Persistence is any access…