Instruction: Local admin on one host available: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Local admin on one host available

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 3: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 4: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Valid low-priv domain user credentials present: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Valid low-priv domain user credentials present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 3: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 4: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Valid low-priv domain user credentials present: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Valid low-priv domain user credentials present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 3: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 4: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Local admin on one host available: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Local admin on one host available

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 3: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 4: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Valid low-priv domain user credentials present: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Valid low-priv domain user credentials present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 3: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 4: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Local admin on one host available: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Local admin on one host available

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 3: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 4: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Valid low-priv domain user credentials present: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Valid low-priv domain user credentials present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 3: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 4: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to an internal web application that can act as pivot: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Access to an internal web application that can act as pivot

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 3: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 4: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to an internal web application that can act as pivot: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Access to an internal web application that can act as pivot

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 3: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 4: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to an internal web application that can act as pivot: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Access to an internal web application that can act as pivot

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 3: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 4: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Local admin on one host available: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Local admin on one host available

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 3: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 4: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Local admin on one host available: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Local admin on one host available

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 3: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 4: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Local admin on one host available: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Local admin on one host available

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 3: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 4: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to an internal web application that can act as pivot: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Access to an internal web application that can act as pivot

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 3: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 4: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Local admin on one host available: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Local admin on one host available

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 3: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 4: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Local admin on one host available: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Local admin on one host available

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 3: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 4: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to an internal web application that can act as pivot: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Access to an internal web application that can act as pivot

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 3: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 4: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to an internal web application that can act as pivot: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Access to an internal web application that can act as pivot

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 3: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 4: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Valid low-priv domain user credentials present: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Valid low-priv domain user credentials present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 3: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 4: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Valid low-priv domain user credentials present: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Valid low-priv domain user credentials present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 3: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 4: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Local admin on one host available: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Local admin on one host available

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 3: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 4: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to an internal web application that can act as pivot: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Access to an internal web application that can act as pivot

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 3: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 4: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Valid low-priv domain user credentials present: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Valid low-priv domain user credentials present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 3: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 4: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to an internal web application that can act as pivot: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Access to an internal web application that can act as pivot

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 3: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 4: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Valid low-priv domain user credentials present: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Valid low-priv domain user credentials present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 3: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 4: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Valid low-priv domain user credentials present: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Valid low-priv domain user credentials present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Step 3: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 4: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Local admin on one host available: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Local admin on one host available

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Inventory reachable hosts and identify administrative interfaces and services used for administration.

Step 3: Ensure defenders capture relevant telemetry (authentication events, process creation, network flows).

Step 4: Plan low-noise lateral attempts in a lab before exercising any live action in production.

Defender detection notes:

  - Unusual remote process execution patterns across multiple hosts.

  - Authentication events from uncommon source hosts for user accounts.

Mitigations & hardening:

  - Restrict legacy administrative protocols and enforce modern authentication.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain admin compromise confirmed for lab simulation: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Domain admin compromise confirmed for lab simulation

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Step 3: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Step 4: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain admin compromise confirmed for lab simulation: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Domain admin compromise confirmed for lab simulation

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Step 3: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Step 4: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: GPO modification rights discovered for some accounts: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: GPO modification rights discovered for some accounts

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Step 3: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Step 4: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain admin compromise confirmed for lab simulation: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Domain admin compromise confirmed for lab simulation

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Step 3: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Step 4: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain admin compromise confirmed for lab simulation: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Domain admin compromise confirmed for lab simulation

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Step 3: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Step 4: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain admin compromise confirmed for lab simulation: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Domain admin compromise confirmed for lab simulation

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Step 3: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Step 4: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain admin compromise confirmed for lab simulation: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Domain admin compromise confirmed for lab simulation

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Step 3: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Step 4: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: GPO modification rights discovered for some accounts: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: GPO modification rights discovered for some accounts

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Step 3: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Step 4: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: GPO modification rights discovered for some accounts: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: GPO modification rights discovered for some accounts

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Step 3: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Step 4: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: GPO modification rights discovered for some accounts: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: GPO modification rights discovered for some accounts

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Step 3: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Step 4: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: GPO modification rights discovered for some accounts: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: GPO modification rights discovered for some accounts

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Step 3: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Step 4: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Long-lived service account available for assessment: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Long-lived service account available for assessment

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Step 3: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Step 4: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Long-lived service account available for assessment: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Long-lived service account available for assessment

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Step 3: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Step 4: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Long-lived service account available for assessment: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Long-lived service account available for assessment

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Step 3: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Step 4: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain admin compromise confirmed for lab simulation: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Domain admin compromise confirmed for lab simulation

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Step 3: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Step 4: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: GPO modification rights discovered for some accounts: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: GPO modification rights discovered for some accounts

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Step 3: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Step 4: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain admin compromise confirmed for lab simulation: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Domain admin compromise confirmed for lab simulation

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Step 3: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Step 4: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Long-lived service account available for assessment: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Long-lived service account available for assessment

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Step 3: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Step 4: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Long-lived service account available for assessment: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Long-lived service account available for assessment

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Step 3: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Step 4: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Long-lived service account available for assessment: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Long-lived service account available for assessment

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Step 3: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Step 4: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Long-lived service account available for assessment: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Long-lived service account available for assessment

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Step 3: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Step 4: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain admin compromise confirmed for lab simulation: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Domain admin compromise confirmed for lab simulation

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Step 3: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Step 4: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Long-lived service account available for assessment: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Long-lived service account available for assessment

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Step 3: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Step 4: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Long-lived service account available for assessment: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Long-lived service account available for assessment

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Step 3: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Step 4: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain admin compromise confirmed for lab simulation: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Domain admin compromise confirmed for lab simulation

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Step 3: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Step 4: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Long-lived service account available for assessment: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Long-lived service account available for assessment

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Step 3: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Step 4: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Long-lived service account available for assessment: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Long-lived service account available for assessment

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Step 3: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Step 4: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: GPO modification rights discovered for some accounts: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: GPO modification rights discovered for some accounts

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Step 3: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Step 4: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: GPO modification rights discovered for some accounts: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: GPO modification rights discovered for some accounts

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Step 3: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Step 4: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: GPO modification rights discovered for some accounts: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: GPO modification rights discovered for some accounts

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Step 3: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Step 4: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: GPO modification rights discovered for some accounts: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: GPO modification rights discovered for some accounts

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Step 3: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Step 4: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain admin compromise confirmed for lab simulation: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Domain admin compromise confirmed for lab simulation

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Step 3: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Step 4: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain admin compromise confirmed for lab simulation: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Domain admin compromise confirmed for lab simulation

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Step 3: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Step 4: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Long-lived service account available for assessment: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Long-lived service account available for assessment

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Step 3: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Step 4: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Long-lived service account available for assessment: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Long-lived service account available for assessment

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Step 3: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Step 4: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: GPO modification rights discovered for some accounts: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: GPO modification rights discovered for some accounts

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Step 3: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Step 4: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain admin compromise confirmed for lab simulation: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Domain admin compromise confirmed for lab simulation

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Step 3: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Step 4: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: GPO modification rights discovered for some accounts: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: GPO modification rights discovered for some accounts

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Step 3: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Step 4: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Long-lived service account available for assessment: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Long-lived service account available for assessment

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Step 3: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Step 4: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: GPO modification rights discovered for some accounts: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: GPO modification rights discovered for some accounts

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Catalog potential persistence mechanisms and evaluate forensic artifacts each creates.

Step 3: Document removal steps and test clean-up procedures to verify defenders can restore systems.

Step 4: Simulate persistence in an isolated lab and ensure the blue-team can detect the artifacts.

Defender detection notes:

  - Changes to group policies, replication anomalies, or strange certificate issuance events.

Mitigations & hardening:

  - Harden GPO authorizations, monitor for unauthorized changes, and enforce change control on privileged actions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: EDR product blocking common tooling: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: EDR product blocking common tooling

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess which telemetry sources are capturing blocking events and identify false positives for tuning.

Step 3: Plan lab-based experiments to evaluate stealth approaches without bypassing protections in production.

Step 4: Work with defenders to understand detection logic and provide labeled samples for rule refinement.

Defender detection notes:

  - Alerts for script blocking or process termination logged by EDR.

Mitigations & hardening:

  - Keep endpoint protections up to date; use allowlisting and strong application control policies.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Host-level script execution control enabled: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Host-level script execution control enabled

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Work with defenders to understand detection logic and provide labeled samples for rule refinement.

Step 3: Plan lab-based experiments to evaluate stealth approaches without bypassing protections in production.

Step 4: Assess which telemetry sources are capturing blocking events and identify false positives for tuning.

Defender detection notes:

  - Alerts for script blocking or process termination logged by EDR.

Mitigations & hardening:

  - Keep endpoint protections up to date; use allowlisting and strong application control policies.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Host-level script execution control enabled: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Host-level script execution control enabled

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan lab-based experiments to evaluate stealth approaches without bypassing protections in production.

Step 3: Work with defenders to understand detection logic and provide labeled samples for rule refinement.

Step 4: Assess which telemetry sources are capturing blocking events and identify false positives for tuning.

Defender detection notes:

  - Alerts for script blocking or process termination logged by EDR.

Mitigations & hardening:

  - Keep endpoint protections up to date; use allowlisting and strong application control policies.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Host-level script execution control enabled: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Host-level script execution control enabled

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Work with defenders to understand detection logic and provide labeled samples for rule refinement.

Step 3: Assess which telemetry sources are capturing blocking events and identify false positives for tuning.

Step 4: Plan lab-based experiments to evaluate stealth approaches without bypassing protections in production.

Defender detection notes:

  - Alerts for script blocking or process termination logged by EDR.

Mitigations & hardening:

  - Keep endpoint protections up to date; use allowlisting and strong application control policies.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Host-level script execution control enabled: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Host-level script execution control enabled

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess which telemetry sources are capturing blocking events and identify false positives for tuning.

Step 3: Work with defenders to understand detection logic and provide labeled samples for rule refinement.

Step 4: Plan lab-based experiments to evaluate stealth approaches without bypassing protections in production.

Defender detection notes:

  - Alerts for script blocking or process termination logged by EDR.

Mitigations & hardening:

  - Keep endpoint protections up to date; use allowlisting and strong application control policies.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: EDR product blocking common tooling: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: EDR product blocking common tooling

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess which telemetry sources are capturing blocking events and identify false positives for tuning.

Step 3: Plan lab-based experiments to evaluate stealth approaches without bypassing protections in production.

Step 4: Work with defenders to understand detection logic and provide labeled samples for rule refinement.

Defender detection notes:

  - Alerts for script blocking or process termination logged by EDR.

Mitigations & hardening:

  - Keep endpoint protections up to date; use allowlisting and strong application control policies.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Network IDS with strict thresholds: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Network IDS with strict thresholds

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess which telemetry sources are capturing blocking events and identify false positives for tuning.

Step 3: Work with defenders to understand detection logic and provide labeled samples for rule refinement.

Step 4: Plan lab-based experiments to evaluate stealth approaches without bypassing protections in production.

Defender detection notes:

  - Alerts for script blocking or process termination logged by EDR.

Mitigations & hardening:

  - Keep endpoint protections up to date; use allowlisting and strong application control policies.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Network IDS with strict thresholds: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Network IDS with strict thresholds

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Work with defenders to understand detection logic and provide labeled samples for rule refinement.

Step 3: Plan lab-based experiments to evaluate stealth approaches without bypassing protections in production.

Step 4: Assess which telemetry sources are capturing blocking events and identify false positives for tuning.

Defender detection notes:

  - Alerts for script blocking or process termination logged by EDR.

Mitigations & hardening:

  - Keep endpoint protections up to date; use allowlisting and strong application control policies.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Network IDS with strict thresholds: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Network IDS with strict thresholds

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess which telemetry sources are capturing blocking events and identify false positives for tuning.

Step 3: Work with defenders to understand detection logic and provide labeled samples for rule refinement.

Step 4: Plan lab-based experiments to evaluate stealth approaches without bypassing protections in production.

Defender detection notes:

  - Alerts for script blocking or process termination logged by EDR.

Mitigations & hardening:

  - Keep endpoint protections up to date; use allowlisting and strong application control policies.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Host-level script execution control enabled: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Host-level script execution control enabled

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan lab-based experiments to evaluate stealth approaches without bypassing protections in production.

Step 3: Work with defenders to understand detection logic and provide labeled samples for rule refinement.

Step 4: Assess which telemetry sources are capturing blocking events and identify false positives for tuning.

Defender detection notes:

  - Alerts for script blocking or process termination logged by EDR.

Mitigations & hardening:

  - Keep endpoint protections up to date; use allowlisting and strong application control policies.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: EDR product blocking common tooling: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: EDR product blocking common tooling

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Work with defenders to understand detection logic and provide labeled samples for rule refinement.

Step 3: Assess which telemetry sources are capturing blocking events and identify false positives for tuning.

Step 4: Plan lab-based experiments to evaluate stealth approaches without bypassing protections in production.

Defender detection notes:

  - Alerts for script blocking or process termination logged by EDR.

Mitigations & hardening:

  - Keep endpoint protections up to date; use allowlisting and strong application control policies.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Network IDS with strict thresholds: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Network IDS with strict thresholds

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess which telemetry sources are capturing blocking events and identify false positives for tuning.

Step 3: Work with defenders to understand detection logic and provide labeled samples for rule refinement.

Step 4: Plan lab-based experiments to evaluate stealth approaches without bypassing protections in production.

Defender detection notes:

  - Alerts for script blocking or process termination logged by EDR.

Mitigations & hardening:

  - Keep endpoint protections up to date; use allowlisting and strong application control policies.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Network IDS with strict thresholds: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Network IDS with strict thresholds

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess which telemetry sources are capturing blocking events and identify false positives for tuning.

Step 3: Plan lab-based experiments to evaluate stealth approaches without bypassing protections in production.

Step 4: Work with defenders to understand detection logic and provide labeled samples for rule refinement.

Defender detection notes:

  - Alerts for script blocking or process termination logged by EDR.

Mitigations & hardening:

  - Keep endpoint protections up to date; use allowlisting and strong application control policies.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Network IDS with strict thresholds: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Network IDS with strict thresholds

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan lab-based experiments to evaluate stealth approaches without bypassing protections in production.

Step 3: Assess which telemetry sources are capturing blocking events and identify false positives for tuning.

Step 4: Work with defenders to understand detection logic and provide labeled samples for rule refinement.

Defender detection notes:

  - Alerts for script blocking or process termination logged by EDR.

Mitigations & hardening:

  - Keep endpoint protections up to date; use allowlisting and strong application control policies.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: EDR product blocking common tooling: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: EDR product blocking common tooling

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Work with defenders to understand detection logic and provide labeled samples for rule refinement.

Step 3: Plan lab-based experiments to evaluate stealth approaches without bypassing protections in production.

Step 4: Assess which telemetry sources are capturing blocking events and identify false positives for tuning.

Defender detection notes:

  - Alerts for script blocking or process termination logged by EDR.

Mitigations & hardening:

  - Keep endpoint protections up to date; use allowlisting and strong application control policies.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Host-level script execution control enabled: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Host-level script execution control enabled

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Work with defenders to understand detection logic and provide labeled samples for rule refinement.

Step 3: Assess which telemetry sources are capturing blocking events and identify false positives for tuning.

Step 4: Plan lab-based experiments to evaluate stealth approaches without bypassing protections in production.

Defender detection notes:

  - Alerts for script blocking or process termination logged by EDR.

Mitigations & hardening:

  - Keep endpoint protections up to date; use allowlisting and strong application control policies.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Host-level script execution control enabled: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Host-level script execution control enabled

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess which telemetry sources are capturing blocking events and identify false positives for tuning.

Step 3: Work with defenders to understand detection logic and provide labeled samples for rule refinement.

Step 4: Plan lab-based experiments to evaluate stealth approaches without bypassing protections in production.

Defender detection notes:

  - Alerts for script blocking or process termination logged by EDR.

Mitigations & hardening:

  - Keep endpoint protections up to date; use allowlisting and strong application control policies.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Host-level script execution control enabled: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Host-level script execution control enabled

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess which telemetry sources are capturing blocking events and identify false positives for tuning.

Step 3: Work with defenders to understand detection logic and provide labeled samples for rule refinement.

Step 4: Plan lab-based experiments to evaluate stealth approaches without bypassing protections in production.

Defender detection notes:

  - Alerts for script blocking or process termination logged by EDR.

Mitigations & hardening:

  - Keep endpoint protections up to date; use allowlisting and strong application control policies.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Host-level script execution control enabled: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Host-level script execution control enabled

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan lab-based experiments to evaluate stealth approaches without bypassing protections in production.

Step 3: Assess which telemetry sources are capturing blocking events and identify false positives for tuning.

Step 4: Work with defenders to understand detection logic and provide labeled samples for rule refinement.

Defender detection notes:

  - Alerts for script blocking or process termination logged by EDR.

Mitigations & hardening:

  - Keep endpoint protections up to date; use allowlisting and strong application control policies.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Host-level script execution control enabled: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Host-level script execution control enabled

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess which telemetry sources are capturing blocking events and identify false positives for tuning.

Step 3: Plan lab-based experiments to evaluate stealth approaches without bypassing protections in production.

Step 4: Work with defenders to understand detection logic and provide labeled samples for rule refinement.

Defender detection notes:

  - Alerts for script blocking or process termination logged by EDR.

Mitigations & hardening:

  - Keep endpoint protections up to date; use allowlisting and strong application control policies.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Host-level script execution control enabled: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Host-level script execution control enabled

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan lab-based experiments to evaluate stealth approaches without bypassing protections in production.

Step 3: Assess which telemetry sources are capturing blocking events and identify false positives for tuning.

Step 4: Work with defenders to understand detection logic and provide labeled samples for rule refinement.

Defender detection notes:

  - Alerts for script blocking or process termination logged by EDR.

Mitigations & hardening:

  - Keep endpoint protections up to date; use allowlisting and strong application control policies.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Network IDS with strict thresholds: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Network IDS with strict thresholds

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess which telemetry sources are capturing blocking events and identify false positives for tuning.

Step 3: Work with defenders to understand detection logic and provide labeled samples for rule refinement.

Step 4: Plan lab-based experiments to evaluate stealth approaches without bypassing protections in production.

Defender detection notes:

  - Alerts for script blocking or process termination logged by EDR.

Mitigations & hardening:

  - Keep endpoint protections up to date; use allowlisting and strong application control policies.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Network IDS with strict thresholds: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Network IDS with strict thresholds

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan lab-based experiments to evaluate stealth approaches without bypassing protections in production.

Step 3: Work with defenders to understand detection logic and provide labeled samples for rule refinement.

Step 4: Assess which telemetry sources are capturing blocking events and identify false positives for tuning.

Defender detection notes:

  - Alerts for script blocking or process termination logged by EDR.

Mitigations & hardening:

  - Keep endpoint protections up to date; use allowlisting and strong application control policies.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Network IDS with strict thresholds: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Network IDS with strict thresholds

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess which telemetry sources are capturing blocking events and identify false positives for tuning.

Step 3: Plan lab-based experiments to evaluate stealth approaches without bypassing protections in production.

Step 4: Work with defenders to understand detection logic and provide labeled samples for rule refinement.

Defender detection notes:

  - Alerts for script blocking or process termination logged by EDR.

Mitigations & hardening:

  - Keep endpoint protections up to date; use allowlisting and strong application control policies.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Host-level script execution control enabled: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Host-level script execution control enabled

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan lab-based experiments to evaluate stealth approaches without bypassing protections in production.

Step 3: Assess which telemetry sources are capturing blocking events and identify false positives for tuning.

Step 4: Work with defenders to understand detection logic and provide labeled samples for rule refinement.

Defender detection notes:

  - Alerts for script blocking or process termination logged by EDR.

Mitigations & hardening:

  - Keep endpoint protections up to date; use allowlisting and strong application control policies.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Host-level script execution control enabled: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Host-level script execution control enabled

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess which telemetry sources are capturing blocking events and identify false positives for tuning.

Step 3: Plan lab-based experiments to evaluate stealth approaches without bypassing protections in production.

Step 4: Work with defenders to understand detection logic and provide labeled samples for rule refinement.

Defender detection notes:

  - Alerts for script blocking or process termination logged by EDR.

Mitigations & hardening:

  - Keep endpoint protections up to date; use allowlisting and strong application control policies.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Network IDS with strict thresholds: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Network IDS with strict thresholds

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan lab-based experiments to evaluate stealth approaches without bypassing protections in production.

Step 3: Work with defenders to understand detection logic and provide labeled samples for rule refinement.

Step 4: Assess which telemetry sources are capturing blocking events and identify false positives for tuning.

Defender detection notes:

  - Alerts for script blocking or process termination logged by EDR.

Mitigations & hardening:

  - Keep endpoint protections up to date; use allowlisting and strong application control policies.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: EDR product blocking common tooling: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: EDR product blocking common tooling

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess which telemetry sources are capturing blocking events and identify false positives for tuning.

Step 3: Plan lab-based experiments to evaluate stealth approaches without bypassing protections in production.

Step 4: Work with defenders to understand detection logic and provide labeled samples for rule refinement.

Defender detection notes:

  - Alerts for script blocking or process termination logged by EDR.

Mitigations & hardening:

  - Keep endpoint protections up to date; use allowlisting and strong application control policies.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Host-level script execution control enabled: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Host-level script execution control enabled

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess which telemetry sources are capturing blocking events and identify false positives for tuning.

Step 3: Work with defenders to understand detection logic and provide labeled samples for rule refinement.

Step 4: Plan lab-based experiments to evaluate stealth approaches without bypassing protections in production.

Defender detection notes:

  - Alerts for script blocking or process termination logged by EDR.

Mitigations & hardening:

  - Keep endpoint protections up to date; use allowlisting and strong application control policies.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Host-level script execution control enabled: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Host-level script execution control enabled

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan lab-based experiments to evaluate stealth approaches without bypassing protections in production.

Step 3: Assess which telemetry sources are capturing blocking events and identify false positives for tuning.

Step 4: Work with defenders to understand detection logic and provide labeled samples for rule refinement.

Defender detection notes:

  - Alerts for script blocking or process termination logged by EDR.

Mitigations & hardening:

  - Keep endpoint protections up to date; use allowlisting and strong application control policies.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Limited egress bandwidth environment: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Limited egress bandwidth environment

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate blue-team detection of suspicious data aggregation and unusual outbound patterns.

Step 3: Plan mock impact exercises that demonstrate potential business impacts without destructive actions.

Step 4: Simulate staging of data within an isolated lab, capturing file access and process telemetry.

Defender detection notes:

  - Large sequential file reads from atypical accounts or hosts.

  - Anomalous outbound connections to unknown external endpoints or DNS tunneling patterns.

Mitigations & hardening:

  - Enforce DLP rules for sensitive file access and restrict direct outbound connections from critical hosts.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Limited egress bandwidth environment: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Limited egress bandwidth environment

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Simulate staging of data within an isolated lab, capturing file access and process telemetry.

Step 3: Validate blue-team detection of suspicious data aggregation and unusual outbound patterns.

Step 4: Plan mock impact exercises that demonstrate potential business impacts without destructive actions.

Defender detection notes:

  - Large sequential file reads from atypical accounts or hosts.

  - Anomalous outbound connections to unknown external endpoints or DNS tunneling patterns.

Mitigations & hardening:

  - Enforce DLP rules for sensitive file access and restrict direct outbound connections from critical hosts.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Large sensitive dataset present on fileshare: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Large sensitive dataset present on fileshare

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan mock impact exercises that demonstrate potential business impacts without destructive actions.

Step 3: Validate blue-team detection of suspicious data aggregation and unusual outbound patterns.

Step 4: Simulate staging of data within an isolated lab, capturing file access and process telemetry.

Defender detection notes:

  - Large sequential file reads from atypical accounts or hosts.

  - Anomalous outbound connections to unknown external endpoints or DNS tunneling patterns.

Mitigations & hardening:

  - Enforce DLP rules for sensitive file access and restrict direct outbound connections from critical hosts.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Large sensitive dataset present on fileshare: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Large sensitive dataset present on fileshare

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate blue-team detection of suspicious data aggregation and unusual outbound patterns.

Step 3: Plan mock impact exercises that demonstrate potential business impacts without destructive actions.

Step 4: Simulate staging of data within an isolated lab, capturing file access and process telemetry.

Defender detection notes:

  - Large sequential file reads from atypical accounts or hosts.

  - Anomalous outbound connections to unknown external endpoints or DNS tunneling patterns.

Mitigations & hardening:

  - Enforce DLP rules for sensitive file access and restrict direct outbound connections from critical hosts.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Need to simulate ransomware-style impact: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Need to simulate ransomware-style impact

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Simulate staging of data within an isolated lab, capturing file access and process telemetry.

Step 3: Validate blue-team detection of suspicious data aggregation and unusual outbound patterns.

Step 4: Plan mock impact exercises that demonstrate potential business impacts without destructive actions.

Defender detection notes:

  - Large sequential file reads from atypical accounts or hosts.

  - Anomalous outbound connections to unknown external endpoints or DNS tunneling patterns.

Mitigations & hardening:

  - Enforce DLP rules for sensitive file access and restrict direct outbound connections from critical hosts.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Limited egress bandwidth environment: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Limited egress bandwidth environment

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate blue-team detection of suspicious data aggregation and unusual outbound patterns.

Step 3: Plan mock impact exercises that demonstrate potential business impacts without destructive actions.

Step 4: Simulate staging of data within an isolated lab, capturing file access and process telemetry.

Defender detection notes:

  - Large sequential file reads from atypical accounts or hosts.

  - Anomalous outbound connections to unknown external endpoints or DNS tunneling patterns.

Mitigations & hardening:

  - Enforce DLP rules for sensitive file access and restrict direct outbound connections from critical hosts.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.