Common Red Team Techniques vs Blue Team Controls Infographic

Scott Sutherland offers tips for prioritizing detective control gaps found through adversarial simulation with MITRE ATT&CK, helping blue teams triage findings and build a detection baseline.

Describes how attackers can submit phishing domains to web content filter categorization services so corporate filters whitelist the sites, improving success rates in phishing engagements.

Shows how DDL, DML, and logon triggers in SQL Server can be abused for persistence, provides a lab and detection guidance, and adds Get-SQLPersistTriggerDDL to PowerUpSQL.

Explains why SQL Server is an overlooked persistence layer, covering startup stored procedures that execute at service start, their detection, code review, removal, and PowerUpSQL automation.

Shows how stolen Exchange credentials can be weaponized through malicious Outlook rules that sync via Exchange and trigger a Start Application action, executing payloads without workstation access.

ClickOnce deployment, built for easy Windows app installs, doubles as a phishing vector: one click can grant a malicious payload temporary admin privileges, controlled by registry trust settings.