RED TEAM OPS // PHASE 09
Detection Review
Swap chairs. Walk through what the blue-team pipeline caught, missed, or fired late.
Objectives
- 01Cross-reference each red action with Kibana events.
- 02Score each ATT&CK technique: detected / partial / missed.
- 03Write three concrete detection improvements.
ATT&CK techniques
DS0009DS0022DS0026
Operator Checklist
operator@linux01 ~ /ops/detect
[hit] 14:41:03 Sysmon EID 1 - powershell.exe -enc <b64>
[miss] 14:52:17 Impacket SMBExec service install (no rule)
$