No credentials, no map of the network. No privileged access.
Just a rogue device placed inside the corporate network, and five days to see how far it could go.
And then what? By Friday afternoon, we had Domain Admin.
Getting a signal out
The objective: find out whether the organisation could detect and respond to an unauthorised device on their own network.
Here’s the catch: the organisation restricted outbound connections. Its network blocked the obvious routes. So before anything else, we needed a way to communicate at all.
We found one. In practice, that meant traffic left the network looking like nothing worth investigating. Nothing that would stand out on a network monitor.
No alerts. No detections. Not for the device, not for the channel, not for anything that followed.
The consequence: just a comforting silence.
Monday to Thursday
Four days of observation. Mapping what was reachable, watching how authentication moved across the network, and noting where it placed too much trust in itself.
Add to that: we captured dozens of credentials across the week. Junior staff through to senior leadership and project managers. We cracked enough to open internal shared folders and sensitive data.
No starting credentials. No inside knowledge. A device on the network, listening. That was enough.
Friday
On Friday, a vulnerability surfaced in a core part of the organisation’s authentication infrastructure. The kind of weakness that exists quietly in certain environments, well documented, rarely acted on.
The first attempt to exploit it didn’t land cleanly. But real environments have a way of disrupting clean attack paths.
So we stepped back. Remapped the path. Chose a different technique.
A different route to the same destination. By the end of Friday, we had gone from a rogue device with nothing to full domain-level compromise.
Which meant nobody raised a flag all week.
What five days of silence actually means
This wasn’t about sophisticated exploits. It was about patience, observation, and using the network’s own trust against it.
Their security tools missed the device and missed the outbound channel. On top of which, the credential captures slipped through unnoticed. We reached Domain Admin before the long weekend.
Here’s why: most detection tooling is tuned to catch anomalies, unauthenticated logins, unusual traffic spikes, activity that breaks a pattern. Patient activity that looks authenticated and legitimate doesn’t trip those alarms. That gap is what a week of quiet observation exploited.
Worse, Domain Admin access at this level typically means an attacker can deploy ransomware across every connected system, pull data from anywhere on the network, and impersonate any user, including executives. None of that needs new access. It only needs time inside the perimeter.
If an unauthorised device could sit quietly on your network for a week, move through your authentication layer, and reach full domain control without triggering a single alert, would your team notice?
The next move was to stay quiet and map exposure to high-value systems.
Test whether your own detection stack would catch this pattern. Contact CovertSwarm to run a Constant Cyber Attack™ engagement built to find out.