Remember, it wasn't that long ago—maybe five or six years—when what we called a penetration test was mostly about pointing a scanner (Nessus, OpenVAS, or whatever was around) at a corporate network, turning those 'high' and 'critical' findings into a nice PDF, and dropping it on the client's desk. We’d say, 'Look, your SSL version is ancient, you should disable that,' sip our coffee, and head back to the office. But nowadays, nobody is just hunting for 'unpatched servers' anymore. Attackers have realized that instead of trying to kick the door down, it's much more effective to act like they're already inside—Assume Breach—and move quietly.
Today, when I hit the field as a Red Team Lead at a large organization like testCompany, the biggest difference I see is this: We aren't just hunting for vulnerabilities; we are living out a scenario. The trend has shifted from 'who left the door open' to 'how did the person who entered through that door manage to reach the most sensitive corners of the system.'
Why 'Assumed Breach' Became the New Standard
You wake up one morning and see some strange traffic on your most critical server. An attacker got in somehow—maybe through a phishing email that compromised an employee's workstation, or maybe they guessed a VPN password using a spray attack. This is where a modern pentest begins. We call this 'Assumed Breach.' In other words, we are looking for the answer to the question: 'The attacker is already inside; now what can they do?'
This approach is priceless for measuring an organization’s Detection & Response capacity. We aren't just looking at the strength of the external perimeter wall anymore; we are measuring whether the sensors inside the house are working and how long it takes the security team (the Blue Team) to notice that uninvited guest.
Lateral Movement: Quietly Slipping Into the Next Room
Once an attacker is inside (let’s say, on a standard user's computer), their first move is Privilege Escalation and moving sideways through the network—Lateral Movement. In the old days, people used tools like psexec quite noisily, but today, EDR (Endpoint Detection and Response) solutions will jump on you in a heartbeat if you try that.
These days, on the Red Team side, we mostly use what we call 'Living off the Land' (LotL) techniques. This means we try to stay under the radar by using tools that already exist on the system (PowerShell, WMI, Certutil, etc.).
Let's look at a scenario: You are a low-privileged user on the testCompany network. Your goal isn't necessarily to become Domain Admin; you just want to access a specific file server in the finance department. Let’s see if the Blue Team notices this simple but effective command:
# Defanged/Harmless Example
# Our goal: Instead of dumping credentials directly from memory (LSASS),
# we quietly list the service accounts registered on the system.
Get-WmiObject -Class Win32_Service | Where-Object {$_.StartName -ne 'LocalSystem'} | Select-Object Name, StartName, PathName | Export-Csv -Path "C:\Users\Public\Documents\service_inventory.csv"
In this case, the attacker didn't actually run any 'malware.' They simply used WMI to list the services on the system. If one of these services has an Unquoted Service Path or weak folder permissions, it’s an easy win for the attacker to escalate privileges without triggering traditional antivirus alerts. This is exactly why we simulate these moves—to help defenders build better detection logic for the tools already sitting on their servers.