Instruction: Stolen VPN credential allowing remote access: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Stolen VPN credential allowing remote access

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Search non-destructively for credential material in user profiles and browser stores.

Step 3: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 4: Map the local network perspective and identify what domain resources are reachable.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Public-facing web app with possible misconfiguration: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Public-facing web app with possible misconfiguration

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Map the local network perspective and identify what domain resources are reachable.

Step 3: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 4: Search non-destructively for credential material in user profiles and browser stores.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: User opened document with embedded macro: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: User opened document with embedded macro

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Map the local network perspective and identify what domain resources are reachable.

Step 3: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 4: Assess potential for lateral movement from this host and prioritize targets accordingly.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Supplier/third-party compromise suspected: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Supplier/third-party compromise suspected

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 3: Map the local network perspective and identify what domain resources are reachable.

Step 4: Search non-destructively for credential material in user profiles and browser stores.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Supplier/third-party compromise suspected: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Supplier/third-party compromise suspected

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 3: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 4: Map the local network perspective and identify what domain resources are reachable.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: OAuth app consent token acquired: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: OAuth app consent token acquired

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Search non-destructively for credential material in user profiles and browser stores.

Step 3: Map the local network perspective and identify what domain resources are reachable.

Step 4: Assess potential for lateral movement from this host and prioritize targets accordingly.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: User opened document with embedded macro: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: User opened document with embedded macro

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Search non-destructively for credential material in user profiles and browser stores.

Step 3: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 4: Map the local network perspective and identify what domain resources are reachable.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Compromised webmail session token obtained: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Compromised webmail session token obtained

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Map the local network perspective and identify what domain resources are reachable.

Step 3: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 4: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Compromised webmail session token obtained: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Compromised webmail session token obtained

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 3: Search non-destructively for credential material in user profiles and browser stores.

Step 4: Map the local network perspective and identify what domain resources are reachable.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: OAuth app consent token acquired: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: OAuth app consent token acquired

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Map the local network perspective and identify what domain resources are reachable.

Step 3: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 4: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Exposed remote management interface reachable: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Exposed remote management interface reachable

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 3: Search non-destructively for credential material in user profiles and browser stores.

Step 4: Assess potential for lateral movement from this host and prioritize targets accordingly.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Supplier/third-party compromise suspected: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Supplier/third-party compromise suspected

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Map the local network perspective and identify what domain resources are reachable.

Step 3: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 4: Search non-destructively for credential material in user profiles and browser stores.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Supplier/third-party compromise suspected: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Supplier/third-party compromise suspected

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Map the local network perspective and identify what domain resources are reachable.

Step 3: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 4: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: User opened document with embedded macro: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: User opened document with embedded macro

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 3: Search non-destructively for credential material in user profiles and browser stores.

Step 4: Map the local network perspective and identify what domain resources are reachable.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Compromised webmail session token obtained: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Compromised webmail session token obtained

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 3: Search non-destructively for credential material in user profiles and browser stores.

Step 4: Assess potential for lateral movement from this host and prioritize targets accordingly.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Stolen VPN credential allowing remote access: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Stolen VPN credential allowing remote access

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 3: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 4: Map the local network perspective and identify what domain resources are reachable.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: OAuth app consent token acquired: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: OAuth app consent token acquired

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Search non-destructively for credential material in user profiles and browser stores.

Step 3: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 4: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Compromised webmail session token obtained: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Compromised webmail session token obtained

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 3: Map the local network perspective and identify what domain resources are reachable.

Step 4: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: User opened document with embedded macro: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: User opened document with embedded macro

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Map the local network perspective and identify what domain resources are reachable.

Step 3: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 4: Search non-destructively for credential material in user profiles and browser stores.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Compromised webmail session token obtained: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Compromised webmail session token obtained

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 3: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 4: Search non-destructively for credential material in user profiles and browser stores.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: OAuth app consent token acquired: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: OAuth app consent token acquired

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Search non-destructively for credential material in user profiles and browser stores.

Step 3: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 4: Map the local network perspective and identify what domain resources are reachable.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Exposed remote management interface reachable: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Exposed remote management interface reachable

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 3: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 4: Search non-destructively for credential material in user profiles and browser stores.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: User opened document with embedded macro: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: User opened document with embedded macro

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 3: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 4: Search non-destructively for credential material in user profiles and browser stores.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: OAuth app consent token acquired: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: OAuth app consent token acquired

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Map the local network perspective and identify what domain resources are reachable.

Step 3: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 4: Assess potential for lateral movement from this host and prioritize targets accordingly.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Public-facing web app with possible misconfiguration: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Public-facing web app with possible misconfiguration

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 3: Map the local network perspective and identify what domain resources are reachable.

Step 4: Enumerate visible services and shares without altering state to avoid noisy detection.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: User opened document with embedded macro: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: User opened document with embedded macro

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 3: Search non-destructively for credential material in user profiles and browser stores.

Step 4: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Phishing foothold on user workstation: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Phishing foothold on user workstation

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Map the local network perspective and identify what domain resources are reachable.

Step 3: Search non-destructively for credential material in user profiles and browser stores.

Step 4: Assess potential for lateral movement from this host and prioritize targets accordingly.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Compromised webmail session token obtained: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Compromised webmail session token obtained

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Search non-destructively for credential material in user profiles and browser stores.

Step 3: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 4: Map the local network perspective and identify what domain resources are reachable.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: OAuth app consent token acquired: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: OAuth app consent token acquired

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Search non-destructively for credential material in user profiles and browser stores.

Step 3: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 4: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Stolen VPN credential allowing remote access: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Stolen VPN credential allowing remote access

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Search non-destructively for credential material in user profiles and browser stores.

Step 3: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 4: Map the local network perspective and identify what domain resources are reachable.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Compromised webmail session token obtained: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Compromised webmail session token obtained

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 3: Map the local network perspective and identify what domain resources are reachable.

Step 4: Search non-destructively for credential material in user profiles and browser stores.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Compromised webmail session token obtained: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Compromised webmail session token obtained

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Map the local network perspective and identify what domain resources are reachable.

Step 3: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 4: Enumerate visible services and shares without altering state to avoid noisy detection.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Exposed remote management interface reachable: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Exposed remote management interface reachable

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Map the local network perspective and identify what domain resources are reachable.

Step 3: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 4: Search non-destructively for credential material in user profiles and browser stores.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Stolen VPN credential allowing remote access: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Stolen VPN credential allowing remote access

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 3: Map the local network perspective and identify what domain resources are reachable.

Step 4: Search non-destructively for credential material in user profiles and browser stores.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Public-facing web app with possible misconfiguration: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Public-facing web app with possible misconfiguration

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 3: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 4: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: User opened document with embedded macro: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: User opened document with embedded macro

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 3: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 4: Search non-destructively for credential material in user profiles and browser stores.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Exposed remote management interface reachable: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Exposed remote management interface reachable

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Search non-destructively for credential material in user profiles and browser stores.

Step 3: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 4: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: OAuth app consent token acquired: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: OAuth app consent token acquired

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 3: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 4: Map the local network perspective and identify what domain resources are reachable.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Compromised webmail session token obtained: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Compromised webmail session token obtained

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 3: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 4: Search non-destructively for credential material in user profiles and browser stores.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Supplier/third-party compromise suspected: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Supplier/third-party compromise suspected

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Map the local network perspective and identify what domain resources are reachable.

Step 3: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 4: Assess potential for lateral movement from this host and prioritize targets accordingly.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Stolen VPN credential allowing remote access: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Stolen VPN credential allowing remote access

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Search non-destructively for credential material in user profiles and browser stores.

Step 3: Map the local network perspective and identify what domain resources are reachable.

Step 4: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Supplier/third-party compromise suspected: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Supplier/third-party compromise suspected

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 3: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 4: Search non-destructively for credential material in user profiles and browser stores.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Public-facing web app with possible misconfiguration: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Public-facing web app with possible misconfiguration

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 3: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 4: Map the local network perspective and identify what domain resources are reachable.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: OAuth app consent token acquired: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: OAuth app consent token acquired

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 3: Map the local network perspective and identify what domain resources are reachable.

Step 4: Assess potential for lateral movement from this host and prioritize targets accordingly.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: User opened document with embedded macro: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: User opened document with embedded macro

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 3: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 4: Enumerate visible services and shares without altering state to avoid noisy detection.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Phishing foothold on user workstation: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Phishing foothold on user workstation

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Map the local network perspective and identify what domain resources are reachable.

Step 3: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 4: Enumerate visible services and shares without altering state to avoid noisy detection.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Compromised webmail session token obtained: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Compromised webmail session token obtained

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 3: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 4: Map the local network perspective and identify what domain resources are reachable.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: OAuth app consent token acquired: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: OAuth app consent token acquired

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 3: Enumerate visible services and shares without altering state to avoid noisy detection.

Step 4: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: OAuth app consent token acquired: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: OAuth app consent token acquired

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Map the local network perspective and identify what domain resources are reachable.

Step 3: Assess potential for lateral movement from this host and prioritize targets accordingly.

Step 4: Search non-destructively for credential material in user profiles and browser stores.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Stolen VPN credential allowing remote access: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Stolen VPN credential allowing remote access

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Coordinate with defenders to capture telemetry for each test to validate detection capabilities.

Step 3: Map the local network perspective and identify what domain resources are reachable.

Step 4: Assess potential for lateral movement from this host and prioritize targets accordingly.

Defender detection notes:

  - Unusual inbound/external sessions, new device profiles in VPN logs.

  - EDR alerts on document macro execution or unknown process creation.

Mitigations & hardening:

  - Enforce phishing-resistant MFA and stricter session controls.

  - Harden endpoints and restrict execution of macros from untrusted sources.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain-joined VM with read access to DC info: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Domain-joined VM with read access to DC info

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prioritize targets that are likely to yield credentials or privileged access.

Step 3: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 4: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain-joined VM with read access to DC info: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Domain-joined VM with read access to DC info

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Prioritize targets that are likely to yield credentials or privileged access.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Network foothold with standard user rights: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Network foothold with standard user rights

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 3: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 4: Prioritize targets that are likely to yield credentials or privileged access.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Read-only view into asset inventory/CMDB: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Read-only view into asset inventory/CMDB

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prioritize targets that are likely to yield credentials or privileged access.

Step 3: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 4: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Ability to perform internal DNS queries: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Ability to perform internal DNS queries

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Prioritize targets that are likely to yield credentials or privileged access.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Ability to perform internal DNS queries: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Ability to perform internal DNS queries

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to a multi-share file server: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Access to a multi-share file server

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 3: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 4: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain-joined VM with read access to DC info: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Domain-joined VM with read access to DC info

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Prioritize targets that are likely to yield credentials or privileged access.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Read-only view into asset inventory/CMDB: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Read-only view into asset inventory/CMDB

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to a multi-share file server: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Access to a multi-share file server

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prioritize targets that are likely to yield credentials or privileged access.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Ability to perform internal DNS queries: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Ability to perform internal DNS queries

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 3: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Read-only view into asset inventory/CMDB: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Read-only view into asset inventory/CMDB

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 3: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 4: Prioritize targets that are likely to yield credentials or privileged access.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Network foothold with standard user rights: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Network foothold with standard user rights

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prioritize targets that are likely to yield credentials or privileged access.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Network foothold with standard user rights: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Network foothold with standard user rights

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Prioritize targets that are likely to yield credentials or privileged access.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain-joined VM with read access to DC info: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Domain-joined VM with read access to DC info

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Prioritize targets that are likely to yield credentials or privileged access.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Ability to perform internal DNS queries: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Ability to perform internal DNS queries

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prioritize targets that are likely to yield credentials or privileged access.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to a multi-share file server: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Access to a multi-share file server

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Network foothold with standard user rights: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Network foothold with standard user rights

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 3: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 4: Prioritize targets that are likely to yield credentials or privileged access.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to a multi-share file server: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Access to a multi-share file server

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 3: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 4: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Ability to perform internal DNS queries: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Ability to perform internal DNS queries

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 3: Prioritize targets that are likely to yield credentials or privileged access.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Ability to perform internal DNS queries: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Ability to perform internal DNS queries

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Ability to perform internal DNS queries: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Ability to perform internal DNS queries

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 4: Prioritize targets that are likely to yield credentials or privileged access.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Ability to perform internal DNS queries: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Ability to perform internal DNS queries

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prioritize targets that are likely to yield credentials or privileged access.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to a multi-share file server: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Access to a multi-share file server

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Prioritize targets that are likely to yield credentials or privileged access.

Step 4: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to a multi-share file server: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Access to a multi-share file server

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 3: Prioritize targets that are likely to yield credentials or privileged access.

Step 4: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Read-only view into asset inventory/CMDB: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Read-only view into asset inventory/CMDB

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 4: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Network foothold with standard user rights: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Network foothold with standard user rights

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Network foothold with standard user rights: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Network foothold with standard user rights

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prioritize targets that are likely to yield credentials or privileged access.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain-joined VM with read access to DC info: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Domain-joined VM with read access to DC info

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 3: Prioritize targets that are likely to yield credentials or privileged access.

Step 4: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain-joined VM with read access to DC info: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Domain-joined VM with read access to DC info

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 3: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 4: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Ability to perform internal DNS queries: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Ability to perform internal DNS queries

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 4: Prioritize targets that are likely to yield credentials or privileged access.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Read-only view into asset inventory/CMDB: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Read-only view into asset inventory/CMDB

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 3: Prioritize targets that are likely to yield credentials or privileged access.

Step 4: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Ability to perform internal DNS queries: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Ability to perform internal DNS queries

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 3: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 4: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Read-only view into asset inventory/CMDB: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Read-only view into asset inventory/CMDB

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 3: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Ability to perform internal DNS queries: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Ability to perform internal DNS queries

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prioritize targets that are likely to yield credentials or privileged access.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Network foothold with standard user rights: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Network foothold with standard user rights

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 3: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Network foothold with standard user rights: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Network foothold with standard user rights

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prioritize targets that are likely to yield credentials or privileged access.

Step 3: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 4: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Read-only view into asset inventory/CMDB: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Read-only view into asset inventory/CMDB

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 4: Prioritize targets that are likely to yield credentials or privileged access.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Ability to perform internal DNS queries: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Ability to perform internal DNS queries

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prioritize targets that are likely to yield credentials or privileged access.

Step 3: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 4: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Ability to perform internal DNS queries: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Ability to perform internal DNS queries

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to a multi-share file server: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Access to a multi-share file server

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to a multi-share file server: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Access to a multi-share file server

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prioritize targets that are likely to yield credentials or privileged access.

Step 3: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 4: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Ability to perform internal DNS queries: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Ability to perform internal DNS queries

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 3: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 4: Prioritize targets that are likely to yield credentials or privileged access.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Read-only view into asset inventory/CMDB: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Read-only view into asset inventory/CMDB

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Prioritize targets that are likely to yield credentials or privileged access.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Read-only view into asset inventory/CMDB: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Read-only view into asset inventory/CMDB

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 4: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain-joined VM with read access to DC info: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Domain-joined VM with read access to DC info

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 3: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 4: Prioritize targets that are likely to yield credentials or privileged access.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Read-only view into asset inventory/CMDB: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Read-only view into asset inventory/CMDB

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 3: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 4: Prioritize targets that are likely to yield credentials or privileged access.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain-joined VM with read access to DC info: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Domain-joined VM with read access to DC info

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 4: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Network foothold with standard user rights: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Network foothold with standard user rights

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Step 3: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 4: Prioritize targets that are likely to yield credentials or privileged access.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Domain-joined VM with read access to DC info: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Domain-joined VM with read access to DC info

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 3: Prioritize targets that are likely to yield credentials or privileged access.

Step 4: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Access to a multi-share file server: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Access to a multi-share file server

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prioritize targets that are likely to yield credentials or privileged access.

Step 3: Enumerate directory objects that are accessible and capture LDAP responses for analysis.

Step 4: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Read-only view into asset inventory/CMDB: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Read-only view into asset inventory/CMDB

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prioritize targets that are likely to yield credentials or privileged access.

Step 3: Use passive discovery sources first (DNS, ARP, CMDB) to map the environment.

Step 4: Identify critical hosts (DCs, CAs, backup servers) and plan lab-focused follow-ups.

Defender detection notes:

  - Increased LDAP or DNS query patterns from an atypical host.

  - Access to internal inventory systems from non-standard accounts.

Mitigations & hardening:

  - Restrict directory query capabilities and monitor access to inventory systems.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.