Adversarial Tradecraft in Cybersecurity (Dan Borges) (z-library.sk, 1lib.sk, z-lib.sk)

【One-Line Pitch】 A strategy-first field manual for red and blue teams who want to win live cyber conflict—not just run tools—by understanding why attacks and defenses succeed, fail, and evolve. Best for intermediate practitioners preparing for attack/defense competitions or real incident response. 【Book Arc】 - **Opening (~0%–10%)**: Frames the book as a study of real-time offense versus defense, introduces the author's competition background, and sets expectations for intermediate readers. - **Early (~10%–35%)**: Lays theoretical groundwork—CIAAAN attributes, game theory concepts like reaction correspondence and Nash equilibrium, and seven principles of computer conflict—then moves into preparation: communications, planning, tooling, and KPIs for both sides. - **Middle (~35%–60%)**: Escalating technical chapters cover operating in memory (process injection and detection), blending in (persistence, LOLbins, DLL hijacking, covert C2 channels), and active manipulation (log clearing, rootkits, deception and honeypots). - **Late (~60%–75%)**: Shifts to real-time conflict and the research advantage—situational awareness, abusing Docker, keylogging, credential theft, plus research/automation topics like supply chain attacks, threat modeling, and attribution. - **Ending (~75%–100%)**: Closes with "clearing the field"—ending the conflict, scoping and containing intrusions, remediation, post-mortem analysis, and forward-looking activities. (Excerpts do not detail the final chapter's full contents beyond the table of contents.) 【Key Takeaways】 - **Conflict is human-on-human, not tool-on-tool** (Early): The book treats security as adversarial strategy aided by technology, so understanding intent and reaction matters more than memorizing exploits. - **CIAAAN gives you a scoreboard** (Early): Confidentiality, integrity, availability, authentication, authorization, and non-repudiation are used throughout to evaluate which side gains or loses advantage. - **Game theory explains why strategies shift** (Early): Reaction correspondence and dominant strategies show how an optimal move becomes suboptimal once the opponent adapts—central to reading both offense and defense. - **Preparation decides the fight** (Early): Communications, long-term planning, tooling, and KPIs differ sharply between red and blue teams; the book insists both sides build infrastructure before conflict. - **Stealth is a layered contest** (Middle): Memory-only operations, persistence tricks, and covert C2 channels are paired with detection guidance, reinforcing that every offensive technique has a defensive counter. - **Deception is a weapon for both sides** (Middle): Honey tokens, honeypots, log manipulation, and rootkits show how each team can mislead the other rather than only block or detect. - **Research time creates durable advantage** (Late): Studying supply chain attacks, threat modeling, and attribution during downtime is framed as a strategic investment, not idle study. - **Ending well matters as much as winning** (Ending): Scoping, containment, remediation, and post-mortem analysis determine whether an attacker truly loses access. 【Reading Tips】 - Deep-read Chapters 1–2 for the theory and preparation frameworks; they anchor every later technique. - Skim code-heavy sections unless you plan to lab them—set up VirtualBox with Kali and Metasploitable 3 as the author suggests. - Read each technique chapter twice: once from the offensive perspective, once from the defensive detection section, to internalize the reaction-correspondence loop. - Expect assumed knowledge (network recon, C2 basics, Python/Ruby/Go); keep references handy rather than expecting full explanations. - Treat the book as a competition and incident-response playbook; extract checklists for your own team's KPIs and post-mortem process. 【Coverage Limits】 Excerpts are heavily front-loaded (front matter, table of contents, and early theory), so later technical chapters are summarized from contents and brief mentions rather than detailed content.