Instruction: Service Principal Names (SPNs) enumerated: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Service Principal Names (SPNs) enumerated

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 3: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 4: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Constrained delegation entries present: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Constrained delegation entries present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 3: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 4: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Constrained delegation entries present: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Constrained delegation entries present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 3: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 4: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Service Principal Names (SPNs) enumerated: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Service Principal Names (SPNs) enumerated

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 3: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 4: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Cross-forest trust relationships exist: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Cross-forest trust relationships exist

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 3: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 4: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Accounts flagged with no-preauth: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Accounts flagged with no-preauth

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 3: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 4: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Cross-forest trust relationships exist: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Cross-forest trust relationships exist

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 3: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 4: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Service Principal Names (SPNs) enumerated: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Service Principal Names (SPNs) enumerated

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 3: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 4: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Cross-forest trust relationships exist: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Cross-forest trust relationships exist

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 3: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 4: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Constrained delegation entries present: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Constrained delegation entries present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 3: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 4: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Cross-forest trust relationships exist: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Cross-forest trust relationships exist

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 3: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 4: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Constrained delegation entries present: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Constrained delegation entries present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 3: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 4: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Accounts flagged with no-preauth: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Accounts flagged with no-preauth

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 3: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 4: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Service Principal Names (SPNs) enumerated: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Service Principal Names (SPNs) enumerated

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 3: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 4: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Constrained delegation entries present: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Constrained delegation entries present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 3: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 4: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Cross-forest trust relationships exist: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Cross-forest trust relationships exist

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 3: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 4: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Service Principal Names (SPNs) enumerated: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Service Principal Names (SPNs) enumerated

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 3: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 4: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Cross-forest trust relationships exist: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Cross-forest trust relationships exist

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 3: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 4: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Constrained delegation entries present: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Constrained delegation entries present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 3: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 4: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Constrained delegation entries present: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Constrained delegation entries present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 3: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 4: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Cross-forest trust relationships exist: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Cross-forest trust relationships exist

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 3: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 4: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Constrained delegation entries present: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Constrained delegation entries present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 3: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 4: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Cross-forest trust relationships exist: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Cross-forest trust relationships exist

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 3: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 4: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Constrained delegation entries present: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Constrained delegation entries present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 3: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 4: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Constrained delegation entries present: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Constrained delegation entries present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 3: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 4: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Constrained delegation entries present: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Constrained delegation entries present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 3: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 4: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Service Principal Names (SPNs) enumerated: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Service Principal Names (SPNs) enumerated

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 3: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 4: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Accounts flagged with no-preauth: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Accounts flagged with no-preauth

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 3: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 4: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Service Principal Names (SPNs) enumerated: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Service Principal Names (SPNs) enumerated

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 3: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 4: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Service Principal Names (SPNs) enumerated: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Service Principal Names (SPNs) enumerated

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 3: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 4: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Service Principal Names (SPNs) enumerated: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Service Principal Names (SPNs) enumerated

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 3: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 4: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Accounts flagged with no-preauth: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Accounts flagged with no-preauth

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 3: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 4: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Cross-forest trust relationships exist: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Cross-forest trust relationships exist

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 3: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 4: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Accounts flagged with no-preauth: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Accounts flagged with no-preauth

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 3: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 4: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Constrained delegation entries present: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Constrained delegation entries present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 3: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 4: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Constrained delegation entries present: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Constrained delegation entries present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 3: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 4: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Service runs as SYSTEM with writable components: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Service runs as SYSTEM with writable components

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Step 3: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 4: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Service runs as SYSTEM with writable components: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Service runs as SYSTEM with writable components

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 3: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Step 4: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Service runs as SYSTEM with writable components: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Service runs as SYSTEM with writable components

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 3: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Step 4: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Legacy Unix SUID misconfigurations present: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Legacy Unix SUID misconfigurations present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 3: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Step 4: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Legacy Unix SUID misconfigurations present: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Legacy Unix SUID misconfigurations present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 3: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Step 4: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Legacy Unix SUID misconfigurations present: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Legacy Unix SUID misconfigurations present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 3: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 4: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Unquoted service path suspected on host: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Unquoted service path suspected on host

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Step 3: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 4: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Legacy Unix SUID misconfigurations present: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Legacy Unix SUID misconfigurations present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 3: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 4: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Unquoted service path suspected on host: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Unquoted service path suspected on host

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Step 3: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 4: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Legacy Unix SUID misconfigurations present: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Legacy Unix SUID misconfigurations present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 3: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Step 4: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Service runs as SYSTEM with writable components: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Service runs as SYSTEM with writable components

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 3: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Step 4: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Unquoted service path suspected on host: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Unquoted service path suspected on host

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 3: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Step 4: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Group Policy object references embedded credentials: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Group Policy object references embedded credentials

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 3: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Step 4: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Group Policy object references embedded credentials: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Group Policy object references embedded credentials

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 3: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 4: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Group Policy object references embedded credentials: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Group Policy object references embedded credentials

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 3: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 4: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Service runs as SYSTEM with writable components: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Service runs as SYSTEM with writable components

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 3: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 4: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Unquoted service path suspected on host: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Unquoted service path suspected on host

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 3: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 4: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Group Policy object references embedded credentials: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Group Policy object references embedded credentials

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 3: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 4: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Legacy Unix SUID misconfigurations present: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Legacy Unix SUID misconfigurations present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 3: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 4: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Group Policy object references embedded credentials: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Group Policy object references embedded credentials

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 3: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 4: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Service runs as SYSTEM with writable components: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Service runs as SYSTEM with writable components

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 3: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Step 4: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Service runs as SYSTEM with writable components: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Service runs as SYSTEM with writable components

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Step 3: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 4: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Service runs as SYSTEM with writable components: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Service runs as SYSTEM with writable components

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Step 3: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 4: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Group Policy object references embedded credentials: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Group Policy object references embedded credentials

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Step 3: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 4: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Unquoted service path suspected on host: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Unquoted service path suspected on host

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Step 3: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 4: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Service runs as SYSTEM with writable components: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Service runs as SYSTEM with writable components

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Step 3: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 4: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Legacy Unix SUID misconfigurations present: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Legacy Unix SUID misconfigurations present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 3: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Step 4: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Legacy Unix SUID misconfigurations present: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Legacy Unix SUID misconfigurations present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Step 3: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 4: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Legacy Unix SUID misconfigurations present: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Legacy Unix SUID misconfigurations present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Step 3: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 4: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Group Policy object references embedded credentials: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Group Policy object references embedded credentials

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 3: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 4: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Service runs as SYSTEM with writable components: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Service runs as SYSTEM with writable components

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 3: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 4: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Group Policy object references embedded credentials: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Group Policy object references embedded credentials

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 3: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 4: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Legacy Unix SUID misconfigurations present: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Legacy Unix SUID misconfigurations present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Step 3: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 4: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Unquoted service path suspected on host: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Unquoted service path suspected on host

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 3: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Step 4: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Group Policy object references embedded credentials: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Group Policy object references embedded credentials

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Step 3: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 4: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Service runs as SYSTEM with writable components: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Service runs as SYSTEM with writable components

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Step 3: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 4: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Unquoted service path suspected on host: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Unquoted service path suspected on host

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 3: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 4: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Unquoted service path suspected on host: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Unquoted service path suspected on host

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 3: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 4: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Unquoted service path suspected on host: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Unquoted service path suspected on host

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 3: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Step 4: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Legacy Unix SUID misconfigurations present: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Legacy Unix SUID misconfigurations present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 3: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Step 4: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Group Policy object references embedded credentials: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Group Policy object references embedded credentials

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 3: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Step 4: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Group Policy object references embedded credentials: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Group Policy object references embedded credentials

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 3: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Step 4: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Service runs as SYSTEM with writable components: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Service runs as SYSTEM with writable components

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 3: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Step 4: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Unquoted service path suspected on host: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Unquoted service path suspected on host

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Step 3: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 4: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Legacy Unix SUID misconfigurations present: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Legacy Unix SUID misconfigurations present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 3: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 4: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Unquoted service path suspected on host: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Unquoted service path suspected on host

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 3: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 4: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Unquoted service path suspected on host: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Unquoted service path suspected on host

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 3: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 4: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Service runs as SYSTEM with writable components: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Service runs as SYSTEM with writable components

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 3: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 4: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Unquoted service path suspected on host: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Unquoted service path suspected on host

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 3: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 4: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Legacy Unix SUID misconfigurations present: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Legacy Unix SUID misconfigurations present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Reproduce the condition in a controlled lab to validate any escalation vector safely.

Step 3: Assess service and file ownerships and whether non-privileged users can alter execution paths.

Step 4: Coordinate with patching and configuration owners to plan remediation for misconfiguration findings.

Defender detection notes:

  - Unusual modifications to service binaries or creation of new scheduled tasks.

Mitigations & hardening:

  - Apply least-privilege to services, fix unquoted paths, and enforce code signing.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Valid low-priv domain user credentials present: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Valid low-priv domain user credentials present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 3: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 4: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Local admin on one host available: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Local admin on one host available

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 3: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 4: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Local admin on one host available: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Local admin on one host available

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 3: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 4: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to an internal web application that can act as pivot: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Access to an internal web application that can act as pivot

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 3: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 4: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Local admin on one host available: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Local admin on one host available

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 3: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 4: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to an internal web application that can act as pivot: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Access to an internal web application that can act as pivot

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 3: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 4: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Valid low-priv domain user credentials present: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Valid low-priv domain user credentials present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 3: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 4: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to an internal web application that can act as pivot: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Access to an internal web application that can act as pivot

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 3: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 4: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Local admin on one host available: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Local admin on one host available

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 3: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 4: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to an internal web application that can act as pivot: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Access to an internal web application that can act as pivot

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 3: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 4: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to an internal web application that can act as pivot: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Access to an internal web application that can act as pivot

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 3: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 4: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Local admin on one host available: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Local admin on one host available

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 3: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 4: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to an internal web application that can act as pivot: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Access to an internal web application that can act as pivot

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 3: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 4: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to an internal web application that can act as pivot: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Access to an internal web application that can act as pivot

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 3: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 4: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Local admin on one host available: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Local admin on one host available

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 3: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 4: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to an internal web application that can act as pivot: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Access to an internal web application that can act as pivot

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 3: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 4: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to an internal web application that can act as pivot: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Access to an internal web application that can act as pivot

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 3: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 4: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Local admin on one host available: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Local admin on one host available

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 3: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 4: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to an internal web application that can act as pivot: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Access to an internal web application that can act as pivot

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 3: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 4: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to an internal web application that can act as pivot: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Access to an internal web application that can act as pivot

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 3: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 4: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to an internal web application that can act as pivot: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Access to an internal web application that can act as pivot

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 3: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 4: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to an internal web application that can act as pivot: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Access to an internal web application that can act as pivot

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 3: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 4: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Valid low-priv domain user credentials present: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Valid low-priv domain user credentials present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 3: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 4: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.