#tag

Detection

4 matching posts.

PentestSep 7, 202611 min read

The Event Was Visible. The Detection Still Needed Context.

Endpoint Security can deliver macOS authorization requests and event notifications, but an event is not yet a verdict. A defensible design preserves timing, sequence gaps, process identity, policy version, privacy, outcome, and the resulting system effect.

#apple-security#macos-security#detection#resilience#methodology

PentestAug 30, 202618 min read

The Red Team Reached Domain Admin. The Exercise Still Failed.

Domain Admin is a capability, not a business objective. This field methodology turns an authorized red team operation into a testable chain of objective, runtime authority, technical action, defender signal, response decision, evidence, and verified recovery.

#red-team#pentest#attack-paths#detection#resilience

PentestJan 16, 20267 min read

The Blast Radius Is One Number. Almost Nobody Has Measured It.

Part four of testing the ransomware playbook: lateral movement runs on your own administrative tooling, so detection is a signal-to-noise problem — and the number that actually decides the outcome is how many hosts accept the same credential.

#ransomware#active-directory#detection#access-control

PentestNov 21, 20257 min read

Enumeration Cannot Be Prevented. Ask Whether It Was Seen.

Part two of testing the ransomware playbook: the affiliate's first hour is the same directory collection you run, it cannot be blocked, and the engagement usually destroys the only question worth asking about it on day one.

#ransomware#detection#active-directory#methodology