Credential access
Where detection most often has a hole.
- Kerberoasting and AS-REP roasting
- LSASS access and dumping
- Password spraying at a realistic rate
- Token theft and impersonation
A red team tells you what was missed. A purple team fixes it in the room. We run a technique, your defenders go looking for it in their own tooling, and if nothing fires we work out together why - log source missing, rule too narrow, alert going to a queue nobody reads - and then try again. It is less dramatic than a red team and it improves detection faster than anything else we sell.
If your last red team ended with "you did not see any of it", the next engagement should probably be this one rather than another red team. You already know the answer. What you need now is the work of closing the gaps, done with somebody who knows what the attack looks like from the other side.
It also suits an organization that has just bought tooling. A SIEM or an EDR out of the box detects what the vendor thought was important, not what reaches your environment. A few days of running real techniques against it is worth more than months of tuning in the dark.
Techniques are chosen from MITRE ATT&CK against what actually threatens your sector, not from a generic list.
Where detection most often has a hole.
The noisiest thing an attacker does, and the most often missed.
What survives a reboot, and whether anything notices.
Where modern tooling is supposed to earn its licence fee.
The last chance to catch it.
The output is working rules, not a document.
From what actually threatens your sector and what your tooling claims to cover.
One technique at a time, with both sides watching.
A miss is the useful part of the day.
Rules written and tested in the session, not listed for later.
A matrix you can re-run yourselves next quarter.
Two documents and a conversation. Written so the person who signs the invoice and the person who writes the fix can both use them.
The work follows MITRE ATT&CK, Atomic Red Team and NIST SP 800-115, so the coverage can be checked rather than taken on trust, and the report maps to what your auditor or your enterprise customer already recognises.
This page is one part of our red teaming service. Where a finding needs a different kind of engagement to answer properly, we say so in the report rather than selling you the test we happen to be running.
A red team hides and measures whether you notice. A purple team tells you exactly what is coming and measures whether you can see it, then fixes what you cannot. One produces a verdict; the other produces working detection.
You need somebody who looks at security logs, whether that is a SOC, an MSSP or one engineer with a SIEM. If nobody looks at the logs, the detection gaps are not the problem worth spending on first.
A matrix of every technique we ran against whether it was detected, logged or missed, the rules we wrote during the session, the log sources you are missing by name, and a script so you can run the same exercise again in six months without us.
Yes, and it is usually revealing. An exercise where your provider has to hunt in real time, in front of you, answers a question about that contract which is very hard to answer any other way.
No. It measures detection, not exposure. You still need something that tells you what is exploitable, which is what a penetration test is for.
Tell us what you need tested. Our team will reply with a clear scope and quote.
An assistant, not a person, so check anything important with us. Please do not type passwords or card numbers here. Messages are kept so we can answer you better.