This week the discussion moves from the passive recon towards the more active attacks where the organisation may be able to detect the attack, assuming they have the relevant resources looking at the logs and other data.   Having at least a basic understanding of what a active attack might look like will help in both defending and responding.