-
Notifications
You must be signed in to change notification settings - Fork 1
Quiet Recon and "Non‐scanning"
It is ok to touch the things you want to observe or detect. But we do want to consider negative outcomes (like the possiblity of detection or materially changing the things we are trying to measure).
Determining therefore, in the face of all TTPs and information resources available within your constraints, what approach is necessary, is important.
After all, if you end up getting busted for doing anything in the graphic below, at least in a skript-kiddy, sloppy, pedestrian, or otherwise easily detectable, you're done, no? You may have a "get-out-of-jail-free" red team card from your boss, but the assessment will be done. Also consider task ordering- if your assessment has "pirate" parts that are unavoidably loud, figure out how to do those things later or last in the order, so that you can collect the value of the softer, quieter "ninja" parts, first.
Even better, figure out how to gather the data for which you were going to scan, from sources that already have it. Eliminate the need to poke everything in the eye if you can.