Targeting the blue team
A list of proposed operations would not be complete without discussing possible operations that target the company's defenders themselves. Quite often, the blue team itself is off limits during operations.
An adversary might attempt to blind, deceive, or even leverage the blue team to strengthen their foothold and persistence. Hence, ensuring that security controls, detections, monitoring, and alerting are in place for the blue team themselves is crucial for the successful operation of an SOC.
This should include regular phishing exercises and directly scanning blue team machines for exposed ports and unpatched software, as well as attempts to gain physical access to machines and infrastructure.
More advanced scenarios include modifying detection rules. Sometimes, detections are configuration files or source code that can be modified by an adversary.
Some of these scenarios fundamentally circumvent blue team capabilities. Hence, extreme...
