Field notes
The RedTeam Security blog
How engagements actually run, what UAE regulators are asking for, and the parts of this work nobody puts in a brochure. Written by the people who run the engagements.
More articles
RSS
What to detect during a social engineering test
What email, identity, endpoint, phone and badge logs should record during a social engineering test, with a worked timeline and UAE evidence notes.
Joel Aviad OssiRed Team Lead, RedTeam Security
Indirect prompt injection: how fetched content hijacks an AI agent's tool calls
A malicious instruction hidden in a fetched document can make an AI agent exfiltrate conversation data. What organisations in Dubai and Abu Dhabi need to know.
Joel Aviad OssiRed Team Lead, RedTeam Security
How an assumed-breach engagement is scoped: foothold, objectives and bounds
Choose the right foothold, set testable objectives and define rules of engagement for an assumed-breach exercise that produces findings you can act on.
Joel Aviad OssiRed Team Lead, RedTeam Security
LSASS memory dumping: from local admin to domain credentials
How LSASS memory dumping converts local admin rights into NTLM hashes and Kerberos tickets, enabling lateral movement without cracking a single password.
Joel Aviad OssiRed Team Lead, RedTeam Security
The UAE rules that apply to social engineering testing
CBUAE, DESC, NESA and ADHICS each address social engineering testing differently. Know which regime applies to your sector and what evidence it asks for.
Joel Aviad OssiRed Team Lead, RedTeam Security
Phishing without a fake login page: OAuth device code abuse
How OAuth device code phishing captures tokens without a fake login page, why MFA does not block it, and what an attacker holds after the victim approves.
Joel Aviad OssiRed Team Lead, RedTeam Security
How to buy an assumed-breach exercise in the UAE
Scope, proposal checklist and vendor evaluation criteria for an assumed-breach engagement in the UAE. What to pay, what to challenge and what to reject.
Joel Aviad OssiRed Team Lead, RedTeam Security
What your SIEM should catch during an assumed-breach exercise
An assumed-breach exercise measures detection coverage. These are the endpoint, identity and network signals your SIEM must surface during the test.
Joel Aviad OssiRed Team Lead, RedTeam Security
What your AI application must log to detect prompt injection and tool abuse
Instrument your LLM application to catch prompt injection, tool abuse and jailbreak attempts. The log fields and alert conditions a security team needs.
Joel Aviad OssiRed Team Lead, RedTeam Security
Cloud token theft in an assumed-breach exercise: from endpoint to tenant
How an assumed-breach operator reads cached cloud CLI tokens from a compromised workstation and authenticates to AWS, Azure or GCP without a password.
Joel Aviad OssiRed Team Lead, RedTeam Security
How an AI and LLM pentest is run: the phases, test cases and what the report has to show
Learn how an AI and LLM pentest is structured: the phases, core test cases for prompt injection and agent abuse, and what each finding must record.
Joel Aviad OssiRed Team Lead, RedTeam Security
The UAE rules that apply to AI and LLM systems: what security testing they ask for
CBUAE, DESC, NESA and ADHICS each name controls that apply to AI and LLM systems. Here is what each regime asks for and what testing evidences it.
Joel Aviad OssiRed Team Lead, RedTeam SecurityLet's talk about your security
Tell us the objective you want tested. We will come back with a scope, a timeline and a quote.
Email [email protected]Nadd Hessa, Dubai Silicon Oasis
Dubai, United Arab Emirates