Situational Awareness

Situational awareness

The shell is blinking. You're in. Now sit on your hands for sixty seconds.

The first mistake most operators make is whoami && ipconfig && net user && systeminfo in rapid fire — while Sysmon logs every process, the EDR watches, and the night-shift analyst gets a very interesting alert. Assess before you act, and assess quietly. Every command is a potential detection.

When to Use

• Assess a foothold within an operation's noise budget.
• Use only within explicit authorization and the stated rules of engagement.

When NOT to Use

• Do not treat this skill as permission to access, test, or change a target.
• Do not convert missing evidence into a clean result or a stronger claim.

The five questions

Answer these before you escalate, dump, or move:

1. Who am I? user, privileges, groups
2. Where am I? host, network, domain
3. What's here? software, data, services
4. What's watching me? security tools, logging, alerting — answer this early, because it changes how you answer the rest
5. What's around me? other systems, connections, trust relationships

Classify the noise before you run it

shCopy code
uv run {baseDir}/scripts/classify_enum.py plan.json

Classifies each planned command by the signal it generates and fails a stealth-required plan that contains a loud or unclassified command.

• silent — local host read, zero packets (whoami, arp -a, netstat, cat /proc/...)
• blend — looks like normal administration (ldapsearch to the DC, one DNS lookup, net view)
• loud — anomalous: scans, sweeps, Responder. A stealth plan rejects these.

Unknown commands fail closed; a monitored channel (PowerShell, WMI) is blend but flagged, because "it ran" is not "it was unseen". See references/noise-levels.md.

Prefer what's already there (living off the land)

The quietest enumeration sends no new packets and uses no dropped tools:

• ARP cache — arp -a or /proc/net/arp lists hosts this box already talked to. Active targets, zero new traffic.
• Passive capture — sit on an interface with a native sniffer; broadcast, mDNS, LLMNR and DHCP reveal hostnames and services without a probe.
• Ask the directory, don't scan it — one LDAP query to the DC returns every computer and SPN. That is inventory without a port scan, and it looks like normal admin traffic.
• Native loops over dropped scanners — a slow Test-NetConnection or /dev/tcp check reads as background admin noise; a port scanner reads as an attacker.

Rationalizations to reject

References

• Noise levels — silent / blend / loud, the monitored-channel flag, and how the classifier decides