Context Matters: Tailoring Tradecraft to the Operational Environment

Fletcher Davis, a senior red team consultant, argues that offensive operations should be shaped by the specific environment being targeted rather than by a standard penetration testing routine. He opens with a set of foundational principles from a book on network operations, including humanity, access, economy, knowledge, awareness, innovation, precaution, operational security and program security. The core idea is that human habits, biases and business processes create the patterns an operator has to work within.

The middle of the talk covers planning. Davis describes building a target package that maps the host, network, cloud, DevOps and business layers of an organization, then modeling who has access to a sensitive objective such as customer data. One example traced an exposed Spring actuator to internal web applications, a vulnerable Jenkins server and eventually cloud credentials. He then presents a framework for understanding normality, which builds a baseline of benign process behavior from Windows event tracing telemetry so that malicious activity can resemble what a host normally does.

He closes with lean host-based reconnaissance, targeting less monitored systems such as wikis and collaboration platforms, and avoiding unnecessary lateral movement. His takeaways for practitioners are to challenge assumptions, understand the people who run the environment, and treat defensive telemetry as something an operator can also use.