Blue Team & Detection

Blue-team looks at an intrusion not as a single "breach" but as a chain of stages: phishing for entry, credential theft, privilege escalation, movement across the network, persistence, and a command-and-control (C2) channel. At each stage the attacker leaves traces — log events, anomalies, indicators. The defender's job is to know those traces and break the chain as early as possible.

Here we examine attacker techniques from the detection and defense angle: not "how to break in" but "which events reveal it and what blocks it". We cover the Cyber Kill Chain model, phishing recognition, NTLM and Kerberos attacks in Active Directory, Linux and Windows privesc, lateral-movement and persistence mechanisms, C2 tunneling, and how indicators of compromise (IoC) turn into detection rules. The full map is in the layers below.

Topic map

• Cyber Kill Chain — the model of intrusion stages and mapping detection to each link.
• Phishing — social engineering as the entry point, email red flags, and SPF/DKIM/DMARC defenses.
• Credential attacks — where hashes live, dumping LSASS/SAM/shadow, and offline cracking.
• NTLM attacks — pass-the-hash, relay, and hash capture via LLMNR poisoning.
• Kerberos attacks — Kerberoasting, AS-REP roasting, Golden and Silver Ticket, pass-the-ticket.
• Privilege escalation — the general privesc principle and why the admin password is not needed.
• Linux privesc — sudo, SUID, capabilities, cron, and paths to root.
• Windows privesc — unquoted services, impersonation (Potato), looting SAM hives.
• Lateral movement — PsExec/WMI/RDP, pass-the-hash, and detection by logon events.
• Persistence mechanisms — Run keys, tasks, services, WMI subscriptions, cron, and systemd timers.
• C2 tunneling — egress bypass via DNS/ICMP/HTTPS and detecting the covert channel.
• Indicators of compromise — what an IoC is, feeding a SIEM/EDR, and the limit of reactive detection.

Common traps

Interview relevance

Blue-team questions test whether you think in attack stages and know the concrete traces. A candidate who answers "how do you catch lateral movement" with "I correlate logon events 4624/4648 and service creation 7045 across hosts, and look for type 3/10 logons from unusual accounts" immediately gets ahead of "I'd install antivirus".

Typical checks:

• Knowing the Cyber Kill Chain stages and that breaking an early link is cheaper.
• Specifics: where hashes are in Linux (/etc/shadow) and Windows (SAM/LSASS), which Windows events reveal movement and persistence.
• The difference between pass-the-hash, Kerberoasting, and offline cracking; the essence of NTLM relay.
• Privesc vectors and the general principle "a root/SYSTEM action a low-privileged user can influence".
• That IoCs are reactive and catch the known, not novel behavior.

Common wrong answer: "an attack shows up as one antivirus alert, and privesc is impossible without the admin password". In reality a modern attack is a quiet chain of "legitimate" tools, and privesc almost always relies on a misconfiguration, not on knowing a password.