Planning: In close coordination with you SEC Consult’s Red Team defines the basics of the assessment (objective, scope, timeframe, communication, etc.) Reconnaissance: We gather information about your company, infrastructure, staff, etc. Weaponization: Based on the information obtained, we make a plan, target some objectives and generate the malicious payloads that will infect/exploit the targets. Delivery: Our Red Team will use the necessary (legal) methods to execute the malicious payloads/exploits within the environment. In this phase we often use social engineering. Command and Control: We establish a reliable communication with the attack infrastructure. Our Red Team will act dynamically and with stealth to be able to counteract the detection or block methods of the Blue Team. Lateral Movement: Having established the first foothold, the attack will be expanded through other layers of your organization – as far as possible but always in the direction of the agreed objectives. Escalating Privileges & Persistence: Privilege escalation on the systems is usually required to accomplish the objectives. Persistence is also necessary to avoid repeating the initial phases. Completing the mission: Our Red Teams accomplish the mission by exfiltrating data or performing the necessary actions agreed in the planning phase. Documentation and post-mortem: SEC Consult’s Red Team experts report all the methods they used in each phase, also documenting a clear timeline. This allows the Blue Team to investigate the incidents from its perspective. It is very useful to reserve some time for this phase: In some cases, it will be necessary to clarify multiple concepts or repeat interesting cases with the Blue Team.