Blue Team & Detection
Phishing, indicators of compromise, the cyber kill chain, persistence, lateral movement, credential attacks and privilege escalation.
11 questions
JuniorTheoryVery commonWhat is phishing, and by what signs can you recognize a malicious email?
What is phishing, and by what signs can you recognize a malicious email?
Phishing is social engineering that tricks a victim into giving up credentials or running malware, usually by email. Red flags: a sender domain that mimics a brand, urgent calls to action, unexpected attachments or links to credential-harvesting forms, and spoofed headers. Defenses: SPF/DKIM/DMARC checks, anti-spam and attachment sandboxing, MFA, and user awareness training.
Common mistakes
- ✗Reducing phishing to a technical attack instead of social engineering
- ✗Assuming phishing has nothing to do with email
- ✗Relying only on antivirus while ignoring SPF/DKIM/DMARC and training
Follow-up questions
- →How do SPF, DKIM, and DMARC records help against sender spoofing?
- →How does targeted spear-phishing differ from a mass mailing?
MiddleTheoryVery commonWhat does the Cyber Kill Chain model describe, and what are its stages?
What does the Cyber Kill Chain model describe, and what are its stages?
The Cyber Kill Chain models the lifecycle of an intrusion as ordered stages: reconnaissance, weaponization, delivery, exploitation, installation, command-and-control, and actions on objectives. Defenders use it to map detection and disruption controls to each stage — breaking the chain at any earlier link stops the attack before impact.
Common mistakes
- ✗Treating an attack as a single event with no separable stages
- ✗Confusing the order of stages (reconnaissance comes first, not last)
- ✗Conflating the attacker's kill chain with the defender's response runbook
Follow-up questions
- →How does the MITRE ATT&CK matrix complement the linear Cyber Kill Chain?
- →Why is disrupting at an early stage cheaper for the defense than at a late one?
MiddleTheoryCommonWhat are indicators of compromise (IoC) and how are they used in detection?
What are indicators of compromise (IoC) and how are they used in detection?
Indicators of compromise (IoC) are forensic artifacts that signal malicious activity: file hashes, malicious IPs and domains, URLs, registry keys, mutex names. Analysts ingest IoC feeds into a SIEM/EDR to match against logs, hunt retroactively, and block known-bad. They are reactive — they catch known threats, not novel behavior.
Common mistakes
- ✗Treating IoCs as predictive rather than reactive artifacts
- ✗Thinking IoCs catch novel behavior as well as behavioral analytics does
- ✗Not connecting IoCs to ingestion into a SIEM/EDR for log matching
Follow-up questions
- →How do indicators of attack (IoA) differ from indicators of compromise (IoC)?
- →Why is a file hash a more fragile IoC than network infrastructure?
MiddleTheoryCommonWhat are the main attacks on the Kerberos authentication protocol in Active Directory that you know of?
What are the main attacks on the Kerberos authentication protocol in Active Directory that you know of?
Kerberoasting requests service tickets (TGS) for SPN accounts and cracks their RC4 blobs offline to recover service passwords. AS-REP roasting targets accounts without pre-authentication. Golden Ticket forges a TGT from the stolen krbtgt hash; Silver Ticket forges a service ticket. Pass-the-Ticket reuses a stolen valid ticket directly.
Common mistakes
- ✗Assuming Kerberos attacks require knowing the admin password in advance
- ✗Not understanding the role of the
krbtgthash in forging a Golden Ticket - ✗Confusing offline TGS cracking (Kerberoasting) with online login-form brute-forcing
Follow-up questions
- →Why is compromise of the
krbtgthash so dangerous for the entire domain? - →How does a Golden Ticket differ from a Silver Ticket in scope?
MiddleTheoryCommonBy what mechanisms does lateral movement occur, and by what events can it be detected?
By what mechanisms does lateral movement occur, and by what events can it be detected?
Lateral movement is spreading from the entry host to other systems: PsExec and remote services, WMI, RDP, SMB admin shares, and pass-the-hash with stolen credentials. Detection leans on Windows events — logon types 3/10 (4624/4625), explicit-credential logons (4648), service creation (7045), and anomalous named-pipe or admin-share access from unusual accounts.
Common mistakes
- ✗Assuming lateral movement leaves no trace in the event log
- ✗Thinking built-in tools (PsExec/WMI/RDP) can't be used for it
- ✗Relying only on signatures instead of correlating logon events across hosts
Follow-up questions
- →Why does pass-the-hash work without knowing the victim's actual password?
- →How does network segmentation raise the cost of lateral movement?
MiddleTheoryCommonName the persistence vectors in Windows and how they are detected.
Name the persistence vectors in Windows and how they are detected.
Windows persistence keeps code running after reboot via Run/RunOnce registry keys, scheduled tasks, auto-start services, the Startup folder, WMI event subscriptions, and DLL hijacking. Detection: monitor autostart locations (Autoruns), Sysmon registry/WMI events, service-creation event 7045, and unsigned binaries in startup paths.
Common mistakes
- ✗Thinking persistence requires physical access to the disk
- ✗Confusing Windows mechanisms with Linux cron instead of Run keys and WMI
- ✗Ignoring monitoring of autostart locations and Sysmon/7045 events
Follow-up questions
- →Why is a WMI event subscription a stealthy persistence vector?
- →How does DLL search-order hijacking differ from directly replacing a DLL?
MiddleTheoryCommonName common privilege escalation techniques in Windows.
Name common privilege escalation techniques in Windows.
Windows privesc: unquoted service paths and weak service permissions, AlwaysInstallElevated, DLL/PATH hijacking, abusing impersonation privileges (the Potato family), looting credentials (SAM/SYSTEM hives, unattend.xml), and kernel exploits. Many rely on a misconfiguration letting a low-privileged user influence a SYSTEM-level action.
Common mistakes
- ✗Assuming escalation requires the administrator password up front
- ✗Underestimating unquoted paths and weak service permissions
- ✗Ignoring credential looting from the SAM/SYSTEM hives
Follow-up questions
- →Why does an unquoted service path with a space lead to code execution?
- →How do Potato-family attacks use impersonation privileges to reach SYSTEM?
JuniorTheoryOccasionalWith direct egress blocked, C2 tunnels out over an allowed protocol. What covert channels should a defender anticipate and detect?
With direct egress blocked, C2 tunnels out over an allowed protocol. What covert channels should a defender anticipate and detect?
Blocked direct egress does not stop C2 — it rides a protocol the firewall already permits. Anticipate covert channels: DNS tunneling (TXT/A queries), ICMP tunneling, an SSL reverse shell, SSH port forwarding, and trusted CDN relays. Detect them by the tells: abnormal DNS volume/entropy, oversized ICMP, long-lived beacons.
Common mistakes
- ✗Assuming a blocked direct egress rules out any C2 channel to detect
- ✗Thinking the firewall passes all protocols equally (DNS/ICMP are often open)
- ✗Watching only a suspicious port instead of tunnels over an allowed protocol
Follow-up questions
- →Why is DNS tunneling so hard to fully block in a corporate network?
- →How do defenders detect a DNS tunnel by query volume and entropy?
JuniorTheoryOccasionalWhat persistence vectors exist in Linux, and where are local users' password hashes stored?
What persistence vectors exist in Linux, and where are local users' password hashes stored?
Persistence vectors keep code running after reboot: cron jobs and systemd timers/units, an SSH key dropped in ~/.ssh/authorized_keys, shell rc files like .bashrc, and SUID binaries or modified service binaries. Local password hashes live in /etc/shadow (readable only by root), while /etc/passwd holds account data without the hashes.
Common mistakes
- ✗Thinking password hashes are stored in /etc/passwd rather than /etc/shadow
- ✗Assuming persistence is impossible without root privileges
- ✗Ignoring cron, systemd timers, and SSH keys as persistence vectors
Follow-up questions
- →Why is
/etc/shadowreadable only by root while/etc/passwdis readable by everyone? - →How do you detect a malicious cron job or systemd unit?
JuniorTheoryOccasionalWhat are the main paths to escalate privileges to root in Linux?
What are the main paths to escalate privileges to root in Linux?
Common Linux privesc paths: misconfigured sudo rules (NOPASSWD, LD_PRELOAD), abusable SUID binaries (see GTFOBins), dangerous capabilities, writable /etc/passwd or /etc/sudoers, modifiable root cron jobs and systemd timers, and kernel exploits (DirtyCow). The theme is a root-owned action an unprivileged user can influence.
Common mistakes
- ✗Assuming privilege escalation is impossible without the root password
- ✗Ignoring SUID binaries, capabilities, and sudo rules as vectors
- ✗Not checking cron jobs and systemd timers that run as root
Follow-up questions
- →How does the GTFOBins resource help turn a SUID binary into a root shell?
- →Why does a writable
/etc/passwdlead straight to root?
MiddleTheoryOccasionalWhat attacks exist against the legacy NTLM authentication protocol?
What attacks exist against the legacy NTLM authentication protocol?
Pass-the-Hash reuses a captured NTLM hash to authenticate without cracking the password, since NTLM proves knowledge of the hash, not the cleartext. NTLM relay forwards a victim's authentication to another service (SMB/LDAP) to act as them. Hashes are also captured by coercing authentication (LLMNR poisoning) and cracked offline.
Common mistakes
- ✗Considering an NTLM hash useless without knowing the cleartext password (pass-the-hash)
- ✗Not understanding NTLM relay as forwarding authentication to another service
- ✗Ignoring LLMNR/NBT-NS poisoning as a way to harvest hashes
Follow-up questions
- →Why does SMB signing break the classic NTLM relay attack?
- →How does pass-the-hash fundamentally differ from offline hash cracking?
