Red team engagement
The objective of a red team engagement is for our engineers to emulate an adversary attack in order to determine how far an attacker would be able to infiltrate your organisation's infrastructure. Before the engagement begins, we agree the objectives with you, such as read access to the payments database or a change merged to production.
Scope
- Initial access through exposed services, or from a starting point you provide
- Privilege escalation and movement between systems
- Reaching the agreed objectives
- Detection and response at each step
How it runs
A small group on your side knows the schedule and can pause the engagement at any time.
Purple team exercise
With purple teaming, our primary goal is to enhance your team's operational security, technical rigour and vigilance. nandsec executes attack techniques together with your defenders, and documents whether each one was prevented, alerted, logged or missed.
Scope
- Techniques chosen from your threat model and mapped to MITRE ATT&CK
- Alert quality and time to respond
- Gaps in log sources and retention
- Detection logic for each gap, in a vendor-neutral format such as Sigma
How it runs
We run each exercise with your security team or your managed security provider.
Compromise assessment and forensic analysis
The objective of a compromise assessment is to determine whether an attacker is in your environment now, or has been in the past. If we find evidence, our forensic analysis determines how they gained access, what they accessed and whether they are still present.
Scope
- Persistence, unusual accounts and remote access on endpoints and servers
- Authentication, cloud and network logs
- Disk and memory images of systems of concern
- A timeline of attacker activity, where there is one
How it runs
We collect data with access you approve and analyse it in an isolated environment.
Malware analysis
The objective of malware analysis is to determine, and help your organisation understand, how a malicious binary entered your environment. We focus on root cause analysis and on breaking down the malware itself: its behaviour, persistence and command-and-control.
Scope
- Behaviour, capabilities and persistence
- Command-and-control and network indicators
- How it was delivered and what it targeted
- Detection rules such as YARA and Sigma
How it runs
Samples are analysed in an isolated lab and never shared without your agreement.