Turning threat reporting into a test plan

Pull out the sequence first

Start with the operation described in the reporting: where the actor began, what they were trying to reach, and which transitions mattered. Mark what the source directly observed and what it inferred. Technique labels are helpful indexing, but a flat list loses order and can make weakly supported behaviours look equal to well-supported ones.

Attack Flow is useful at this stage because it records sequence and branching. Keep the diagram small. If a transition cannot be explained in a sentence, it is not ready to become a test step.

Write the intent before choosing a tool

“Obtain another route to authenticate” is an intent. A particular command or utility is only one implementation. Writing the intent first makes it easier to pick an action that fits the estate and carries less risk while still exercising the same control.

For each step, list the identity, platform, trust relationship, telemetry and privilege it needs. Mark those prerequisites confirmed, absent or unknown. An absent prerequisite is a valid finding about relevance. Replacing it quietly with a different condition changes the exercise.

• Which sentence in the source supports this behaviour?
• Which local control should see or stop it?
• What is the least invasive implementation that preserves the intent?
• What observation would show the assumption is wrong?

Run a short link before a campaign

A small test of one transition is a good way to check that the environment, telemetry and rule behave as expected. It also establishes timing and field names before a longer exercise makes diagnosis harder.

Join steps only when their order matters to the question. A long chain with several unknown prerequisites creates an impressive timeline and a weak conclusion. Two well-instrumented transitions often tell the defender more.

Put omissions in the plan

The plan should state which behaviours were left out and why: not relevant, not supported by the reporting, unavailable in the environment or unsafe under the current rules. Record allowed writes, request volume, cleanup and stop conditions alongside the procedure.

That record prevents an operator from treating a new idea as existing permission. It also lets the sponsor revise the exercise later without pretending that the original plan covered more than it did.