Everybody who watched the final video of the module we're gonna be talking about completing the assessment
or feedback loop and working with the blue team.
Now to complete the loop we've gone through all of the stages we've gotten our approvals we found out
what we're going to be attacking we got our scope done.
We've notified everybody we did our recon we attacked the machine we escalated privileges we move laterally
we built the report got our mediations and we and we spilled out the report to the correct people.
And we've done our meetings.
So at that point you might think OK we're done.
Off to the next one but no you never want to just pass the report over and walk away.
You want to take that second after everything now is done.
Go to the blue team find out what detections and what commands.
Maybe you did some weird commands that weren't throwing in detections your way or maybe the entire attack
scenario that you were working with did not provide any detection.
So you want to work with the blue team to identify those detections.
How can they see that this is happening in the future.
Maybe sit down for an hour or two and go through the whole attack scenario again redoing the attack
to see what they can build detections on and have them do a few testing.
Building some detections then rerun the scenario see if things are caught.
So you always want to take that extra step and make sure that the defenses are matching what you're
doing on the offensive side.
Because if you keep blasting out new and unique ways on the offensive side you're never going to have
the defensive side catch back up.
So and in a real in a real situation an attacker if they know that they can get away with doing one
or two third one two or three things to bypass something or they can come up with a new unique way to
do it they're going to use the simple ways first especially if they're not being detected.
So there's you don't want your red team to continue to evolve to the point to where you're finding new
and zero day based things without ever having the original detections of the simple stuff out of the
way.