Counter moves¶

A small, rumpled creature, somewhere between a badger and a tired analyst, in a dim recording engineer's booth at the end of a long shift. Striped face, faded waistcoat over a creased shirt, sleeves rolled, headphones half on around the neck. At a worn mixing console with rows of faders...

Attacker techniques, defender’s view. What to harden, what to detect, what to hunt for, what to do when it triggers.

Closing the doors just walked through
- Reducing phishing exposure
- Email delivery controls
- Inbound email filtering
- MFA hardening
- Controlling cloud storage and OAuth exposure
- Social engineering and identity hunting
The machine at the point of impact
- Reducing endpoint attack surface
- Detecting endpoint attacks
- Gaps in endpoint controls
- Endpoint detection and response
Traffic patterns as evidence
- Reducing network attack surface
- Detecting network attacks
- Correlating control-plane signals
- Network hunting
Inter-domain routing as a target
- Reducing the inter-domain attack surface
- Detecting inter-domain attacks
- Posture for the long game
The surface designed to be accessible
- Reduce API attack surface
- Detect API recon and abuse
- API threat hunting
The application layer as a target
- Reducing web application attack surface
- Detecting web application attacks
- Supply chain hardening
- Gaps in web security controls
- Web application hunting
Infrastructure you defend but do not own
- Reduce cloud attack surface
- Detect cloud recon and initial access
- OAuth scopes as blast radius
- Cloud infrastructure hunting
Where the container meets the host
- Container and Kubernetes hardening
- Container and Kubernetes detection
- Container and cluster hunting
Systems that were never meant to be networked
- Reducing OT attack surface
- Detecting OT attacks
- OT environment hunting
The domain as an attack graph
- Active Directory attack paths
- Detecting AD attack paths
- Domain threat hunting
The gap between access and authority
- Linux and container privilege escalation
- Windows privilege escalation
- Privilege escalation hunting
Harvesting stored secrets
- OS credential stores and memory extraction
- Password spraying, stuffing, and brute force
- Credential theft hunting
Surviving the reboot
- Trends and defender context
- Hidden persistence checklist
- Persistence hunting
From target to target
- Lateral movement techniques
- Detecting lateral movement
- Lateral movement hunting
Plausibility as cover
- Evasion trends: defensive perspective
- Behavioural detection
- Deception technology
- Network-level detection of evasion
- C2 framework signatures
- Hardening against evasion
- Serverless and cloud-native evasion
- Containers and Kubernetes evasion
- Long-window detection
- Evasion technique coverage matrix
- Evasion detection and hunting
Memory corruption and its limits
- Memory corruption mitigations
- Detecting memory corruption exploitation
- Crash triage and memory forensics
Watching data being gathered
- Collection: defender context
- Detecting collection activity
- UEBA calibration
- Collection activity hunting
Watching the exits
- Exfiltration: defender context
- Detecting exfiltration
- Steganography
- ML-based steganalysis
- Detecting AI-generated steganography
- Network and behavioural detection
- The data egress hunt
Limiting the blast radius
- Impact: defender context
- When the network is the target
- When the yard is someone else’s
- When nothing breaks but everything lies
- When nothing breaks and the secret is already gone
- When the lock is on your side of the door
- When geography is the wall
- When your own posture is the threat
- Responding to impact events
- Responding to active impact runbooks
Operational cost of security controls
- MFA fatigue
- Detection false positive economics
- HVCI and performance overhead
- Application control exclusion creep
- CASB and DLP latency
- Patch windows and the downtime tax
- Segmentation and the rules that rot
- Least privilege and the cost of asking
- Log volume and the blind spots you bought
- Backups are cheap, restores are not
- Measuring and trimming the cost

More moves?