Quiet Operator

A purple-team field manual for staying stealthy on the host and on the wire.

Tradecraft for authorized red team operations, paired page-for-page with the detection telemetry defenders use to catch it. Linux-first. Every offensive page ends with the exact log source, event ID, and hunt query that catches it.

Authorized engagements only. Read DISCLAIMER before anything else. Use this material only with written scope (ROE/SOW), in your own lab, or in a CTF.

Who this is for

Red Team Operator

Start with Foundations then your target OS. Use OPSEC notes to pick the quiet variant. Use the Detection section to know your blast radius.

Blue Teamer / SOC

Go straight to Detection Mapping. Every technique is indexed by log source, event ID, and hunt query. The base64 telemetry page is written for you.

Purple Team

Start with Threat Model & Telemetry for a shared vocabulary of what each technique looks like to the SOC.

The thesis

27
Technique pages
8
Linux pages
6
Data transfer
50+
ATT&CK IDs mapped

Every action has a cost paid in artifacts: a disk write, a spawned process, an outbound connection, an auth event, a log line. Good tradecraft is choosing the cheapest path in artifacts that still gets the job done - and knowing exactly who is collecting each one.

Three rules the whole repo is built on:

  1. Avoid generating the artifact - do not try to delete it. In a world of central SIEM and log forwarding, local deletion is near-useless and is itself a screaming IOC.
  2. Native and expected beats novel and dropped - but command-line and behavioral telemetry still capture you. Living off the land defeats AV signatures, not EDR lineage.
  3. Regularity and volume are the meta-tells. Fixed intervals and fixed sizes get you caught long after the payload was “undetectable.”

The base64 lesson

Operators reach for base64 constantly. It is worth being direct about what it costs:

  • It is encoding, not encryption. Any analyst decodes it in one command.
  • ... | base64 -d | sh is one of the most-signatured patterns in existence. auditd, Falco, Sigma, and commercial EDR all fire on it. Windows certutil -decode and PowerShell -EncodedCommand are the direct equivalents - and Script Block Log EID 4104 records the decoded content.
  • On the wire, long base64 strings in HTTP bodies, URLs, and DNS labels are matched by Suricata content rules and proxy DLP by default.

Full treatment: Encoding, Compression & Encryption and the dedicated deep-dive base64 & Encoding Telemetry.

Want to practice on real boxes?

Apply these techniques against HackTheBox machines - a legal, controlled environment with real operating systems and real defenses.

HTB Writeups - momenbasel.github.io/htb-writeups

Quick start 

1. Read DISCLAIMER - confirm you have written authorization in scope.
2. Read docs/00-foundations/ - OPSEC model, ROE, defender threat model.
3. Open the page for your task. Read it bottom-up:
   - "Detection & telemetry" first  -> know what you are about to generate.
   - "OPSEC notes"                  -> pick the quiet variant.
   - "Technique"                    -> the how.
4. Cross-check docs/detection-mapping/ to see how a SOC would catch you.