Catching your internal red team is a checkpoint, not a trophy. The goal is to build signal-rich detections that catch real adversaries—without flooding ops or gaming the test.
“We found the red team” can feel good—but it’s not the mission. If detection logic only trips on your red team’s constraints, you didn’t harden the org; you optimized for the test.
Anti-patterns: blocking all traffic to a budget cloud provider because red’s C2 is there; alerting on a specific commercial C2 brand string because that’s what red can afford. These don’t translate to real-world adversaries and they waste everyone’s time.
Great detections focus on behaviors and invariants that adversaries can’t easily change, not vendor names or hosting ASNs that they can swap in minutes.
Red is your R&D lab. Collaborate to design tests that pressure the right seams and produce reusable signals. Ask for variants: different cloud providers, payload packers, signed binaries, staging paths, and opsec levels.
Ask red for: a matrix of scenarios (low/no-budget → well-resourced), technique toggles (e.g., C2 family swap), and operating constraints that mimic real threats—not just the easiest to detect.
Celebrate learning, not gotchas. If a rule exists only to rack up “caught red” points, call it out. Redirect to detections that generalize to real intrusions and improve incident flow.
Drop these: blanket “anything to DigitalOcean” blocks, “alert on Cobalt Strike string” without behavior context. They stall engagements and don’t map to real adversaries.
Shift from “we caught red” to metrics that reflect real security outcomes:
Team pledge: We’ll tune for adversary behaviors, not internal constraints. We win together when detections catch what real attackers do.