-
Notifications
You must be signed in to change notification settings - Fork 1
Quiet Recon and "Non‐scanning"
It is ok to touch the things you want to observe or detect. But we do want to consider negative outcomes (like the possiblity of detection or materially changing the things we are trying to measure).
Determining therefore, in the face of all TTPs and information resources available within your constraints, what approach is necessary, is important.
After all, if you end up getting busted for doing anything in the graphic below, at least in a way skript-kiddy load, pedestrian, or otherwise totally detectable, you may have a "get-out-of-jail-free" card from your boss, but the assessment is done. Also consider ordering- if your assessment has "pirate" parts that are unavoidably loud, figure out how to do those things later or last in the order, so that you can collect the value of the softer, quieter "ninja" parts, first.
Even better, figure out how to gather the data for which you were going to scan, from sources that already have it. Eliminate the need to poke everything in the eye if you can.