Think Like a Defender

The most valuable offensive testers understand defense deeply. When you know what the security team sees, you can tell a client not just “we got in” but “here is exactly where your detection failed, and here is the log line that would have caught it.” That’s the difference between a pentest and a purple team engagement.

Where your activity shows up

Your action	Where defenders see it
Port scanning	Firewall logs, IDS alerts (Suricata, Zeek), NetFlow
Web testing	WAF logs, web server access logs, application logs
Password guessing	Authentication logs: Windows event 4625, Linux auth.log
Running commands on a host	EDR telemetry, Sysmon event 1 (process creation), shell history
Logins with valid credentials	Windows events 4624 and 4648, VPN and SSO logs
Cloud API calls	AWS CloudTrail, Azure Activity Log, GCP Audit Logs

A lesson that surprises many people: valid credentials are the quietest attack. Defenders often detect exploits well and struggle to tell a stolen login from a real one. That’s why MFA, conditional access, and anomaly detection matter so much, and why you should test them.

Speak ATT&CK

MITRE ATT&CK is the shared vocabulary between red and blue teams. Every technique has an ID, such as T1046 for network service discovery or T1078 for valid accounts.

Mapping your findings to ATT&CK IDs in reports does two things:

1. Defenders can map them directly to their detection coverage and find the gaps.
2. Your report plugs straight into the client’s threat models and tooling.

The free ATT&CK Navigator lets you shade the techniques you used during an engagement. Hand that layer to the client as a coverage map.

Read a detection rule

Sigma is a vendor-neutral format for detection logic. Here’s a simplified rule that flags discovery commands run in quick succession, a pattern common right after initial access:

title: Burst of Discovery Commands
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith:
      - '\whoami.exe'
      - '\net.exe'
      - '\nltest.exe'
      - '\systeminfo.exe'
  condition: selection | count() by ParentProcessId > 3
timeframe: 5m
level: medium

Reading rules like this teaches you how defenders think. They rarely look for one “evil” command. They look for behavior and sequences that ordinary users don’t produce.

Practice the other side

• Blue Team Labs Online and CyberDefenders give you real log data and packet captures from simulated incidents.
• Point your own lab at a free SIEM, such as Wazuh or the Elastic stack, then attack your lab machines and see what shows up. Seeing your own scan light up a dashboard teaches more than any lecture.
• Install Sysmon on a Windows lab VM with a community configuration and study the events your tools generate.

Purple teaming in practice

In a purple team exercise, red and blue sit together:

1. Red runs one technique, for example T1046 network scanning.
2. Blue checks whether it was logged, alerted on, and triaged.
3. Together they fix the gap and run it again.
4. Repeat for the next technique.

It’s the most efficient way to improve an organization’s real security, and the skill set is increasingly in demand.

Takeaway

Every finding in your report should answer two questions: how did I get in, and why didn’t anyone notice? The second answer is often worth more to the client than the first.