Instruction: Network foothold with standard user rights: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Network foothold with standard user rights

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prioritize targets that are likely to yield credentials or privileged access.

Step 3: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 4: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to a multi-share file server: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Access to a multi-share file server

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Prioritize targets that are likely to yield credentials or privileged access.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Network foothold with standard user rights: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Network foothold with standard user rights

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 3: Prioritize targets that are likely to yield credentials or privileged access.

Step 4: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Read-only view into asset inventory/CMDB: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Read-only view into asset inventory/CMDB

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prioritize targets that are likely to yield credentials or privileged access.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain-joined VM with read access to DC info: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Domain-joined VM with read access to DC info

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prioritize targets that are likely to yield credentials or privileged access.

Step 3: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 4: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain-joined VM with read access to DC info: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Domain-joined VM with read access to DC info

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 3: Prioritize targets that are likely to yield credentials or privileged access.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain-joined VM with read access to DC info: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Domain-joined VM with read access to DC info

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prioritize targets that are likely to yield credentials or privileged access.

Step 3: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain-joined VM with read access to DC info: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Domain-joined VM with read access to DC info

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 3: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 4: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain-joined VM with read access to DC info: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Domain-joined VM with read access to DC info

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 3: Prioritize targets that are likely to yield credentials or privileged access.

Step 4: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain-joined VM with read access to DC info: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Domain-joined VM with read access to DC info

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prioritize targets that are likely to yield credentials or privileged access.

Step 3: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 4: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to a multi-share file server: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Access to a multi-share file server

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prioritize targets that are likely to yield credentials or privileged access.

Step 3: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 4: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Read-only view into asset inventory/CMDB: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Read-only view into asset inventory/CMDB

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Read-only view into asset inventory/CMDB: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Read-only view into asset inventory/CMDB

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 3: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 4: Prioritize targets that are likely to yield credentials or privileged access.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Read-only view into asset inventory/CMDB: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Read-only view into asset inventory/CMDB

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 3: Prioritize targets that are likely to yield credentials or privileged access.

Step 4: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Ability to perform internal DNS queries: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Ability to perform internal DNS queries

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prioritize targets that are likely to yield credentials or privileged access.

Step 3: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Ability to perform internal DNS queries: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Ability to perform internal DNS queries

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prioritize targets that are likely to yield credentials or privileged access.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Read-only view into asset inventory/CMDB: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Read-only view into asset inventory/CMDB

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 4: Prioritize targets that are likely to yield credentials or privileged access.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Network foothold with standard user rights: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Network foothold with standard user rights

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prioritize targets that are likely to yield credentials or privileged access.

Step 3: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: DPAPI masterkeys located for certain profiles: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: DPAPI masterkeys located for certain profiles

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Avoid live testing against production services; validate techniques in a replica environment.

Step 3: Correlate artifacts with logs to determine timeline and scope.

Step 4: Document detection opportunities and recommend telemetry to capture similar activity.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: DPAPI masterkeys located for certain profiles: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: DPAPI masterkeys located for certain profiles

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Avoid live testing against production services; validate techniques in a replica environment.

Step 3: Correlate artifacts with logs to determine timeline and scope.

Step 4: Document detection opportunities and recommend telemetry to capture similar activity.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Browser tokens present in user profile: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Browser tokens present in user profile

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Avoid live testing against production services; validate techniques in a replica environment.

Step 3: Preserve artifacts and copy them for offline analysis in a lab.

Step 4: Correlate artifacts with logs to determine timeline and scope.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Potential LSASS artifacts on host: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Potential LSASS artifacts on host

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Preserve artifacts and copy them for offline analysis in a lab.

Step 3: Correlate artifacts with logs to determine timeline and scope.

Step 4: Document detection opportunities and recommend telemetry to capture similar activity.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Potential LSASS artifacts on host: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Potential LSASS artifacts on host

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Preserve artifacts and copy them for offline analysis in a lab.

Step 3: Document detection opportunities and recommend telemetry to capture similar activity.

Step 4: Avoid live testing against production services; validate techniques in a replica environment.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: DPAPI masterkeys located for certain profiles: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: DPAPI masterkeys located for certain profiles

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Correlate artifacts with logs to determine timeline and scope.

Step 3: Preserve artifacts and copy them for offline analysis in a lab.

Step 4: Avoid live testing against production services; validate techniques in a replica environment.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Config files referencing service credentials: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Config files referencing service credentials

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Preserve artifacts and copy them for offline analysis in a lab.

Step 3: Avoid live testing against production services; validate techniques in a replica environment.

Step 4: Document detection opportunities and recommend telemetry to capture similar activity.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Config files referencing service credentials: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Config files referencing service credentials

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Avoid live testing against production services; validate techniques in a replica environment.

Step 3: Correlate artifacts with logs to determine timeline and scope.

Step 4: Preserve artifacts and copy them for offline analysis in a lab.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Backups containing sensitive account data: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Backups containing sensitive account data

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Preserve artifacts and copy them for offline analysis in a lab.

Step 3: Document detection opportunities and recommend telemetry to capture similar activity.

Step 4: Correlate artifacts with logs to determine timeline and scope.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Potential LSASS artifacts on host: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Potential LSASS artifacts on host

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Preserve artifacts and copy them for offline analysis in a lab.

Step 3: Correlate artifacts with logs to determine timeline and scope.

Step 4: Avoid live testing against production services; validate techniques in a replica environment.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Config files referencing service credentials: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Config files referencing service credentials

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Correlate artifacts with logs to determine timeline and scope.

Step 3: Preserve artifacts and copy them for offline analysis in a lab.

Step 4: Avoid live testing against production services; validate techniques in a replica environment.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Potential LSASS artifacts on host: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Potential LSASS artifacts on host

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Avoid live testing against production services; validate techniques in a replica environment.

Step 3: Document detection opportunities and recommend telemetry to capture similar activity.

Step 4: Preserve artifacts and copy them for offline analysis in a lab.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Backups containing sensitive account data: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Backups containing sensitive account data

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Avoid live testing against production services; validate techniques in a replica environment.

Step 3: Document detection opportunities and recommend telemetry to capture similar activity.

Step 4: Correlate artifacts with logs to determine timeline and scope.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Browser tokens present in user profile: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Browser tokens present in user profile

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Avoid live testing against production services; validate techniques in a replica environment.

Step 3: Preserve artifacts and copy them for offline analysis in a lab.

Step 4: Correlate artifacts with logs to determine timeline and scope.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Config files referencing service credentials: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Config files referencing service credentials

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document detection opportunities and recommend telemetry to capture similar activity.

Step 3: Correlate artifacts with logs to determine timeline and scope.

Step 4: Avoid live testing against production services; validate techniques in a replica environment.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: DPAPI masterkeys located for certain profiles: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: DPAPI masterkeys located for certain profiles

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Correlate artifacts with logs to determine timeline and scope.

Step 3: Avoid live testing against production services; validate techniques in a replica environment.

Step 4: Document detection opportunities and recommend telemetry to capture similar activity.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Backups containing sensitive account data: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Backups containing sensitive account data

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document detection opportunities and recommend telemetry to capture similar activity.

Step 3: Correlate artifacts with logs to determine timeline and scope.

Step 4: Avoid live testing against production services; validate techniques in a replica environment.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Backups containing sensitive account data: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Backups containing sensitive account data

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Avoid live testing against production services; validate techniques in a replica environment.

Step 3: Preserve artifacts and copy them for offline analysis in a lab.

Step 4: Document detection opportunities and recommend telemetry to capture similar activity.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Browser tokens present in user profile: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Browser tokens present in user profile

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Correlate artifacts with logs to determine timeline and scope.

Step 3: Document detection opportunities and recommend telemetry to capture similar activity.

Step 4: Avoid live testing against production services; validate techniques in a replica environment.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Browser tokens present in user profile: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Browser tokens present in user profile

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document detection opportunities and recommend telemetry to capture similar activity.

Step 3: Correlate artifacts with logs to determine timeline and scope.

Step 4: Preserve artifacts and copy them for offline analysis in a lab.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Config files referencing service credentials: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Config files referencing service credentials

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Avoid live testing against production services; validate techniques in a replica environment.

Step 3: Correlate artifacts with logs to determine timeline and scope.

Step 4: Document detection opportunities and recommend telemetry to capture similar activity.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Browser tokens present in user profile: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Browser tokens present in user profile

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Avoid live testing against production services; validate techniques in a replica environment.

Step 3: Document detection opportunities and recommend telemetry to capture similar activity.

Step 4: Preserve artifacts and copy them for offline analysis in a lab.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Backups containing sensitive account data: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Backups containing sensitive account data

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Preserve artifacts and copy them for offline analysis in a lab.

Step 3: Document detection opportunities and recommend telemetry to capture similar activity.

Step 4: Correlate artifacts with logs to determine timeline and scope.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Config files referencing service credentials: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Config files referencing service credentials

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Correlate artifacts with logs to determine timeline and scope.

Step 3: Avoid live testing against production services; validate techniques in a replica environment.

Step 4: Document detection opportunities and recommend telemetry to capture similar activity.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Config files referencing service credentials: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Config files referencing service credentials

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Preserve artifacts and copy them for offline analysis in a lab.

Step 3: Document detection opportunities and recommend telemetry to capture similar activity.

Step 4: Correlate artifacts with logs to determine timeline and scope.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: DPAPI masterkeys located for certain profiles: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: DPAPI masterkeys located for certain profiles

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Correlate artifacts with logs to determine timeline and scope.

Step 3: Document detection opportunities and recommend telemetry to capture similar activity.

Step 4: Avoid live testing against production services; validate techniques in a replica environment.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Config files referencing service credentials: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Config files referencing service credentials

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Avoid live testing against production services; validate techniques in a replica environment.

Step 3: Correlate artifacts with logs to determine timeline and scope.

Step 4: Document detection opportunities and recommend telemetry to capture similar activity.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Browser tokens present in user profile: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Browser tokens present in user profile

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document detection opportunities and recommend telemetry to capture similar activity.

Step 3: Correlate artifacts with logs to determine timeline and scope.

Step 4: Avoid live testing against production services; validate techniques in a replica environment.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Browser tokens present in user profile: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Browser tokens present in user profile

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Preserve artifacts and copy them for offline analysis in a lab.

Step 3: Avoid live testing against production services; validate techniques in a replica environment.

Step 4: Document detection opportunities and recommend telemetry to capture similar activity.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Browser tokens present in user profile: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Browser tokens present in user profile

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Correlate artifacts with logs to determine timeline and scope.

Step 3: Preserve artifacts and copy them for offline analysis in a lab.

Step 4: Avoid live testing against production services; validate techniques in a replica environment.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Config files referencing service credentials: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Config files referencing service credentials

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Avoid live testing against production services; validate techniques in a replica environment.

Step 3: Preserve artifacts and copy them for offline analysis in a lab.

Step 4: Document detection opportunities and recommend telemetry to capture similar activity.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Browser tokens present in user profile: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Browser tokens present in user profile

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Avoid live testing against production services; validate techniques in a replica environment.

Step 3: Preserve artifacts and copy them for offline analysis in a lab.

Step 4: Correlate artifacts with logs to determine timeline and scope.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Potential LSASS artifacts on host: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Potential LSASS artifacts on host

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Correlate artifacts with logs to determine timeline and scope.

Step 3: Document detection opportunities and recommend telemetry to capture similar activity.

Step 4: Preserve artifacts and copy them for offline analysis in a lab.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Potential LSASS artifacts on host: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Potential LSASS artifacts on host

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Avoid live testing against production services; validate techniques in a replica environment.

Step 3: Document detection opportunities and recommend telemetry to capture similar activity.

Step 4: Preserve artifacts and copy them for offline analysis in a lab.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Config files referencing service credentials: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Config files referencing service credentials

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Preserve artifacts and copy them for offline analysis in a lab.

Step 3: Avoid live testing against production services; validate techniques in a replica environment.

Step 4: Correlate artifacts with logs to determine timeline and scope.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Config files referencing service credentials: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Config files referencing service credentials

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document detection opportunities and recommend telemetry to capture similar activity.

Step 3: Correlate artifacts with logs to determine timeline and scope.

Step 4: Preserve artifacts and copy them for offline analysis in a lab.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Potential LSASS artifacts on host: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Potential LSASS artifacts on host

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document detection opportunities and recommend telemetry to capture similar activity.

Step 3: Preserve artifacts and copy them for offline analysis in a lab.

Step 4: Avoid live testing against production services; validate techniques in a replica environment.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Config files referencing service credentials: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Config files referencing service credentials

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Preserve artifacts and copy them for offline analysis in a lab.

Step 3: Avoid live testing against production services; validate techniques in a replica environment.

Step 4: Document detection opportunities and recommend telemetry to capture similar activity.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: DPAPI masterkeys located for certain profiles: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: DPAPI masterkeys located for certain profiles

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Avoid live testing against production services; validate techniques in a replica environment.

Step 3: Preserve artifacts and copy them for offline analysis in a lab.

Step 4: Document detection opportunities and recommend telemetry to capture similar activity.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Potential LSASS artifacts on host: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Potential LSASS artifacts on host

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document detection opportunities and recommend telemetry to capture similar activity.

Step 3: Avoid live testing against production services; validate techniques in a replica environment.

Step 4: Preserve artifacts and copy them for offline analysis in a lab.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Backups containing sensitive account data: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Backups containing sensitive account data

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document detection opportunities and recommend telemetry to capture similar activity.

Step 3: Correlate artifacts with logs to determine timeline and scope.

Step 4: Avoid live testing against production services; validate techniques in a replica environment.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Backups containing sensitive account data: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Backups containing sensitive account data

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Avoid live testing against production services; validate techniques in a replica environment.

Step 3: Document detection opportunities and recommend telemetry to capture similar activity.

Step 4: Preserve artifacts and copy them for offline analysis in a lab.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Backups containing sensitive account data: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Backups containing sensitive account data

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Preserve artifacts and copy them for offline analysis in a lab.

Step 3: Document detection opportunities and recommend telemetry to capture similar activity.

Step 4: Avoid live testing against production services; validate techniques in a replica environment.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Browser tokens present in user profile: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Browser tokens present in user profile

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Preserve artifacts and copy them for offline analysis in a lab.

Step 3: Document detection opportunities and recommend telemetry to capture similar activity.

Step 4: Avoid live testing against production services; validate techniques in a replica environment.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: DPAPI masterkeys located for certain profiles: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: DPAPI masterkeys located for certain profiles

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Preserve artifacts and copy them for offline analysis in a lab.

Step 3: Document detection opportunities and recommend telemetry to capture similar activity.

Step 4: Avoid live testing against production services; validate techniques in a replica environment.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Config files referencing service credentials: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Config files referencing service credentials

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document detection opportunities and recommend telemetry to capture similar activity.

Step 3: Correlate artifacts with logs to determine timeline and scope.

Step 4: Preserve artifacts and copy them for offline analysis in a lab.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: DPAPI masterkeys located for certain profiles: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: DPAPI masterkeys located for certain profiles

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Avoid live testing against production services; validate techniques in a replica environment.

Step 3: Document detection opportunities and recommend telemetry to capture similar activity.

Step 4: Correlate artifacts with logs to determine timeline and scope.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Potential LSASS artifacts on host: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Potential LSASS artifacts on host

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Correlate artifacts with logs to determine timeline and scope.

Step 3: Document detection opportunities and recommend telemetry to capture similar activity.

Step 4: Preserve artifacts and copy them for offline analysis in a lab.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Config files referencing service credentials: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Config files referencing service credentials

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Correlate artifacts with logs to determine timeline and scope.

Step 3: Avoid live testing against production services; validate techniques in a replica environment.

Step 4: Preserve artifacts and copy them for offline analysis in a lab.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Browser tokens present in user profile: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Browser tokens present in user profile

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Preserve artifacts and copy them for offline analysis in a lab.

Step 3: Document detection opportunities and recommend telemetry to capture similar activity.

Step 4: Avoid live testing against production services; validate techniques in a replica environment.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Browser tokens present in user profile: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Browser tokens present in user profile

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Avoid live testing against production services; validate techniques in a replica environment.

Step 3: Correlate artifacts with logs to determine timeline and scope.

Step 4: Preserve artifacts and copy them for offline analysis in a lab.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Config files referencing service credentials: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Config files referencing service credentials

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Avoid live testing against production services; validate techniques in a replica environment.

Step 3: Document detection opportunities and recommend telemetry to capture similar activity.

Step 4: Correlate artifacts with logs to determine timeline and scope.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Browser tokens present in user profile: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Browser tokens present in user profile

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document detection opportunities and recommend telemetry to capture similar activity.

Step 3: Correlate artifacts with logs to determine timeline and scope.

Step 4: Preserve artifacts and copy them for offline analysis in a lab.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Backups containing sensitive account data: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Backups containing sensitive account data

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document detection opportunities and recommend telemetry to capture similar activity.

Step 3: Avoid live testing against production services; validate techniques in a replica environment.

Step 4: Correlate artifacts with logs to determine timeline and scope.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Backups containing sensitive account data: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Backups containing sensitive account data

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Preserve artifacts and copy them for offline analysis in a lab.

Step 3: Document detection opportunities and recommend telemetry to capture similar activity.

Step 4: Avoid live testing against production services; validate techniques in a replica environment.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Backups containing sensitive account data: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Backups containing sensitive account data

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Preserve artifacts and copy them for offline analysis in a lab.

Step 3: Avoid live testing against production services; validate techniques in a replica environment.

Step 4: Correlate artifacts with logs to determine timeline and scope.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Backups containing sensitive account data: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Backups containing sensitive account data

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Correlate artifacts with logs to determine timeline and scope.

Step 3: Document detection opportunities and recommend telemetry to capture similar activity.

Step 4: Avoid live testing against production services; validate techniques in a replica environment.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Browser tokens present in user profile: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Browser tokens present in user profile

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document detection opportunities and recommend telemetry to capture similar activity.

Step 3: Avoid live testing against production services; validate techniques in a replica environment.

Step 4: Correlate artifacts with logs to determine timeline and scope.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Potential LSASS artifacts on host: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Potential LSASS artifacts on host

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Avoid live testing against production services; validate techniques in a replica environment.

Step 3: Correlate artifacts with logs to determine timeline and scope.

Step 4: Document detection opportunities and recommend telemetry to capture similar activity.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Browser tokens present in user profile: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Browser tokens present in user profile

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Preserve artifacts and copy them for offline analysis in a lab.

Step 3: Document detection opportunities and recommend telemetry to capture similar activity.

Step 4: Correlate artifacts with logs to determine timeline and scope.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Config files referencing service credentials: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Config files referencing service credentials

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document detection opportunities and recommend telemetry to capture similar activity.

Step 3: Correlate artifacts with logs to determine timeline and scope.

Step 4: Avoid live testing against production services; validate techniques in a replica environment.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Backups containing sensitive account data: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Backups containing sensitive account data

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document detection opportunities and recommend telemetry to capture similar activity.

Step 3: Preserve artifacts and copy them for offline analysis in a lab.

Step 4: Correlate artifacts with logs to determine timeline and scope.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Browser tokens present in user profile: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Browser tokens present in user profile

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Preserve artifacts and copy them for offline analysis in a lab.

Step 3: Correlate artifacts with logs to determine timeline and scope.

Step 4: Document detection opportunities and recommend telemetry to capture similar activity.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Backups containing sensitive account data: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Backups containing sensitive account data

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document detection opportunities and recommend telemetry to capture similar activity.

Step 3: Preserve artifacts and copy them for offline analysis in a lab.

Step 4: Avoid live testing against production services; validate techniques in a replica environment.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Backups containing sensitive account data: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Backups containing sensitive account data

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document detection opportunities and recommend telemetry to capture similar activity.

Step 3: Avoid live testing against production services; validate techniques in a replica environment.

Step 4: Correlate artifacts with logs to determine timeline and scope.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Potential LSASS artifacts on host: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Potential LSASS artifacts on host

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Avoid live testing against production services; validate techniques in a replica environment.

Step 3: Document detection opportunities and recommend telemetry to capture similar activity.

Step 4: Preserve artifacts and copy them for offline analysis in a lab.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Browser tokens present in user profile: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Browser tokens present in user profile

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Document detection opportunities and recommend telemetry to capture similar activity.

Step 3: Preserve artifacts and copy them for offline analysis in a lab.

Step 4: Avoid live testing against production services; validate techniques in a replica environment.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Backups containing sensitive account data: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Backups containing sensitive account data

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Correlate artifacts with logs to determine timeline and scope.

Step 3: Document detection opportunities and recommend telemetry to capture similar activity.

Step 4: Preserve artifacts and copy them for offline analysis in a lab.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Backups containing sensitive account data: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Backups containing sensitive account data

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Preserve artifacts and copy them for offline analysis in a lab.

Step 3: Document detection opportunities and recommend telemetry to capture similar activity.

Step 4: Avoid live testing against production services; validate techniques in a replica environment.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Config files referencing service credentials: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Config files referencing service credentials

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Correlate artifacts with logs to determine timeline and scope.

Step 3: Document detection opportunities and recommend telemetry to capture similar activity.

Step 4: Avoid live testing against production services; validate techniques in a replica environment.

Defender detection notes:

  - Unusual process memory access or credential-dump related telemetry.

  - Unexpected access to backup or config repositories.

Mitigations & hardening:

  - Apply Credential Guard, limit backup access, and harden DPAPI storage.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Constrained delegation entries present: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Constrained delegation entries present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 3: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 4: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Cross-forest trust relationships exist: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Cross-forest trust relationships exist

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 3: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 4: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Service Principal Names (SPNs) enumerated: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Service Principal Names (SPNs) enumerated

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 3: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 4: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Constrained delegation entries present: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Constrained delegation entries present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 3: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 4: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Service Principal Names (SPNs) enumerated: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Service Principal Names (SPNs) enumerated

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 3: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 4: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Constrained delegation entries present: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Constrained delegation entries present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 3: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 4: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Constrained delegation entries present: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Constrained delegation entries present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 3: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 4: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Service Principal Names (SPNs) enumerated: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Service Principal Names (SPNs) enumerated

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 3: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 4: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Cross-forest trust relationships exist: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Cross-forest trust relationships exist

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 3: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 4: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Accounts flagged with no-preauth: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Accounts flagged with no-preauth

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 3: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 4: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Cross-forest trust relationships exist: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Cross-forest trust relationships exist

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 3: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 4: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Service Principal Names (SPNs) enumerated: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Service Principal Names (SPNs) enumerated

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 3: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 4: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Cross-forest trust relationships exist: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Cross-forest trust relationships exist

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 3: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 4: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Constrained delegation entries present: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Constrained delegation entries present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 3: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 4: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Cross-forest trust relationships exist: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Cross-forest trust relationships exist

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 3: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 4: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Constrained delegation entries present: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Constrained delegation entries present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 3: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 4: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Accounts flagged with no-preauth: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Accounts flagged with no-preauth

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 3: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 4: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Service Principal Names (SPNs) enumerated: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Service Principal Names (SPNs) enumerated

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 3: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 4: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Constrained delegation entries present: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Constrained delegation entries present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 3: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 4: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Cross-forest trust relationships exist: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Cross-forest trust relationships exist

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 3: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 4: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Service Principal Names (SPNs) enumerated: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Service Principal Names (SPNs) enumerated

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 3: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 4: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Cross-forest trust relationships exist: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Cross-forest trust relationships exist

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 3: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Step 4: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Constrained delegation entries present: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Constrained delegation entries present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate ticket lifetime policies and monitor for abnormal ticket requests.

Step 3: Catalogue accounts and SPNs to estimate risk and likely attack surface.

Step 4: Use lab simulations to test detection of Kerberos anomalies without exploiting live systems.

Defender detection notes:

  - Abnormal increases in ticket requests or requests for uncommon services.

Mitigations & hardening:

  - Enable pre-auth where feasible and enforce short ticket lifetimes.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.