Fast recall for the engagement lifecycle, the frameworks, and the per-phase tradecraft. Each row
points at the phase that covers it from zero. All of this is for authorized engagements only.
Recon → Resource-Dev → Initial-Access → Execution → Persistence → Priv-Esc →
Defense-Evasion → Credential-Access → Discovery → Lateral-Movement → Collection →
Command-and-Control → Exfiltration → Impact
Defenders "defend left": the earlier in the chain you can detect/break it, the cheaper the win.
Lens Question it answers Use when
Cyber Kill Chain "how far along is this intrusion?" sequencing a campaign, defend-left MITRE ATT&CK "what behavior, and can we detect it?" planning emulation, coverage, reporting Diamond Model "what else is connected to this?" pivoting on infra/capability, attribution
ROE first : owner, scope (in/out), methods, data handling, time window, rate limits, stop
conditions, deconfliction contact , get-out-of-jail-letter.OPSEC : every action emits indicators — host, network, identity, time. Minimize, blend, log your
own actions for deconfliction.Emulation plan : CTI on a named actor → selected ATT&CK techniques → procedures → success criteria.
Phase The one thing Key telemetry the blue team has
02 Tooling a tool you can't name the IOCs of is a liability static signatures, import tables, named pipes, on-disk artifacts 03 Network pivoting = reachability over a host/credential graph netflow, DNS, proxy logs, segmentation boundaries 04 Privesc misconfig > exploit; enumerate the local trust graph process creation, token use, service changes, SUID/sudo 05 AD identity is the perimeter; Kerberos is the language 4768/4769 tickets, 4624 logons, LDAP queries, ADCS issuance 06 Payloads execution always emits something; pick the quiet primitive image/thread/handle events, AMSI, ETW, memory anomalies 07 EDR predict what the sensor sees; evasion ≙ a detection idea kernel callbacks, ETW-TI, user-mode hooks, AMSI 08 C2 beacons have a rhythm; OPSEC is in the traffic profile jitter/interval, JA3/JA4, SNI/domain, byte counts 09 Cloud identity is the cloud perimeter; metadata = keys CloudTrail/Activity logs, IAM changes, IMDS hits 10 SocEng the human is the easiest initial-access vector email auth (SPF/DKIM/DMARC), proxy, link detonation 11 RE/Vuln imports + strings tell you a binary's capability n/a (your own analysis) 12 Report the finding is the detection gap, not "we won" VECTR coverage, Sigma rules delivered
Action Host telemetry Network telemetry Identity telemetry
Run a tool process create, image load, AMSI/ETW — — Inject into a process thread create (cross-proc), handle, RWX memory — — Lateral move (SMB/WMI/WinRM) service/named-pipe, 4624 type 3 SMB/RPC flows new logon, ticket request Kerberoast — — 4769 RC4, many SPNs C2 beacon — periodic flows, JA3/JA4, SNI — Cloud key use — IMDS hit CloudTrail AssumeRole from new IP
TTPs ← hardest to change → focus detections here (behavioral)
Tools
Network/Host Artifacts
Domain Names
IP Addresses
Hash Values ← trivial to change → weakest detection
Executive summary (business risk, one page, no jargon)
Engagement scope & ROE recap
Attack narrative (the kill chain, mapped to ATT&CK)
Findings (each: precondition, evidence, demonstrated vs. plausible impact, remediation, detection )
Detection-gap matrix (ATT&CK Navigator layer: what fired, what didn't)
Prioritized remediation roadmap (cost vs. risk)
Appendices (evidence manifest, tooling IOCs handed to the SOC for purge)
Authorization and intent — not knowledge — separate you from the adversary.
Every offensive action ends in a detection.
Stop at minimum proof.
The deliverable is a defensible risk decision , not a trophy.