MENTOR TRACK // M09
Red Team + Blue Team Passes
Every offensive exercise gets a defender's pass afterward.
Pass 1 - Attacker
Execute the technique cleanly. Note commands, timing, and the exact behavior.
Pass 2 - Defender
- 01What did I do, in plain English?
- 02What evidence did I leave (logs, artifacts, network)?
- 03What should have detected me and did it?
- 04Which control failed or was missing?
- 05How would the defender investigate it end to end?
- 06How would I improve that control without breaking the business?
Payoff
Understanding detection makes you a better attacker: you learn what is loud, what is quiet, and what is invisible.