Write the attack narrative from your own engagement log

short · 55 min · Objective 5.2

Task

Turn the activity logs and evidence from your own lab engagement into an attack narrative — the story from first access to objective, in order, each step tied to evidence a client could verify — so that a chain of individually-minor findings shows its real combined impact.

Steps

  1. Gather the artifacts from your own earlier labs: the activity log, captures, the cleanup list, and each finding's evidence — all from hosts you built.
  2. Write /tmp/narrative.md as an ordered story: first access, each step, and how one led to the next, from foothold to objective.
  3. Tie each step to evidence: a command and its output, a capture, a log line — so the client can verify the step, not just believe it.
  4. Show the chain: where two individually-low findings combined into the path, so a single low finding's real impact lands.
  5. Record where the client's detection did and did not fire, from the logs you read along the way.
  6. Write it so someone else could re-run it — the narrative is reproducible, not a story only you can tell.

Verify

grep -cE "^step [0-9]:" /tmp/narrative.md
grep -ciE "evidence|log line|capture|output" /tmp/narrative.md
grep -ciE "chain|combined|low finding|detection.*fire" /tmp/narrative.md

The first count must be at least 3 — the narrative is an ordered sequence of steps. The second must be non-zero: each step ties to evidence a client can verify, which is what separates a narrative from a story. The third must be non-zero: you showed the chain and where detection did or did not fire, which is the point — the combined impact and the defender's blind spots.

Notes

The attack narrative is what turns a list of findings into the real risk a client faces: a single low finding's impact lands only when the chain shows what it led to. Tie each step to evidence so it can be verified, and record where detection did and did not fire — a detection gap is a finding at least as important as the technical one. Everything drew on your own lab engagement.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.