Instruction: Limited egress bandwidth environment: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Limited egress bandwidth environment

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Simulate staging of data within an isolated lab, capturing file access and process telemetry.

Step 3: Validate blue-team detection of suspicious data aggregation and unusual outbound patterns.

Step 4: Plan mock impact exercises that demonstrate potential business impacts without destructive actions.

Defender detection notes:

  - Large sequential file reads from atypical accounts or hosts.

  - Anomalous outbound connections to unknown external endpoints or DNS tunneling patterns.

Mitigations & hardening:

  - Enforce DLP rules for sensitive file access and restrict direct outbound connections from critical hosts.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Need to simulate ransomware-style impact: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Need to simulate ransomware-style impact

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Simulate staging of data within an isolated lab, capturing file access and process telemetry.

Step 3: Plan mock impact exercises that demonstrate potential business impacts without destructive actions.

Step 4: Validate blue-team detection of suspicious data aggregation and unusual outbound patterns.

Defender detection notes:

  - Large sequential file reads from atypical accounts or hosts.

  - Anomalous outbound connections to unknown external endpoints or DNS tunneling patterns.

Mitigations & hardening:

  - Enforce DLP rules for sensitive file access and restrict direct outbound connections from critical hosts.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Need to simulate ransomware-style impact: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Need to simulate ransomware-style impact

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan mock impact exercises that demonstrate potential business impacts without destructive actions.

Step 3: Validate blue-team detection of suspicious data aggregation and unusual outbound patterns.

Step 4: Simulate staging of data within an isolated lab, capturing file access and process telemetry.

Defender detection notes:

  - Large sequential file reads from atypical accounts or hosts.

  - Anomalous outbound connections to unknown external endpoints or DNS tunneling patterns.

Mitigations & hardening:

  - Enforce DLP rules for sensitive file access and restrict direct outbound connections from critical hosts.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Limited egress bandwidth environment: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Limited egress bandwidth environment

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate blue-team detection of suspicious data aggregation and unusual outbound patterns.

Step 3: Plan mock impact exercises that demonstrate potential business impacts without destructive actions.

Step 4: Simulate staging of data within an isolated lab, capturing file access and process telemetry.

Defender detection notes:

  - Large sequential file reads from atypical accounts or hosts.

  - Anomalous outbound connections to unknown external endpoints or DNS tunneling patterns.

Mitigations & hardening:

  - Enforce DLP rules for sensitive file access and restrict direct outbound connections from critical hosts.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Need to simulate ransomware-style impact: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Need to simulate ransomware-style impact

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan mock impact exercises that demonstrate potential business impacts without destructive actions.

Step 3: Validate blue-team detection of suspicious data aggregation and unusual outbound patterns.

Step 4: Simulate staging of data within an isolated lab, capturing file access and process telemetry.

Defender detection notes:

  - Large sequential file reads from atypical accounts or hosts.

  - Anomalous outbound connections to unknown external endpoints or DNS tunneling patterns.

Mitigations & hardening:

  - Enforce DLP rules for sensitive file access and restrict direct outbound connections from critical hosts.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Large sensitive dataset present on fileshare: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Large sensitive dataset present on fileshare

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate blue-team detection of suspicious data aggregation and unusual outbound patterns.

Step 3: Plan mock impact exercises that demonstrate potential business impacts without destructive actions.

Step 4: Simulate staging of data within an isolated lab, capturing file access and process telemetry.

Defender detection notes:

  - Large sequential file reads from atypical accounts or hosts.

  - Anomalous outbound connections to unknown external endpoints or DNS tunneling patterns.

Mitigations & hardening:

  - Enforce DLP rules for sensitive file access and restrict direct outbound connections from critical hosts.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Limited egress bandwidth environment: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Limited egress bandwidth environment

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan mock impact exercises that demonstrate potential business impacts without destructive actions.

Step 3: Simulate staging of data within an isolated lab, capturing file access and process telemetry.

Step 4: Validate blue-team detection of suspicious data aggregation and unusual outbound patterns.

Defender detection notes:

  - Large sequential file reads from atypical accounts or hosts.

  - Anomalous outbound connections to unknown external endpoints or DNS tunneling patterns.

Mitigations & hardening:

  - Enforce DLP rules for sensitive file access and restrict direct outbound connections from critical hosts.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Limited egress bandwidth environment: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Limited egress bandwidth environment

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate blue-team detection of suspicious data aggregation and unusual outbound patterns.

Step 3: Plan mock impact exercises that demonstrate potential business impacts without destructive actions.

Step 4: Simulate staging of data within an isolated lab, capturing file access and process telemetry.

Defender detection notes:

  - Large sequential file reads from atypical accounts or hosts.

  - Anomalous outbound connections to unknown external endpoints or DNS tunneling patterns.

Mitigations & hardening:

  - Enforce DLP rules for sensitive file access and restrict direct outbound connections from critical hosts.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Large sensitive dataset present on fileshare: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Large sensitive dataset present on fileshare

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan mock impact exercises that demonstrate potential business impacts without destructive actions.

Step 3: Validate blue-team detection of suspicious data aggregation and unusual outbound patterns.

Step 4: Simulate staging of data within an isolated lab, capturing file access and process telemetry.

Defender detection notes:

  - Large sequential file reads from atypical accounts or hosts.

  - Anomalous outbound connections to unknown external endpoints or DNS tunneling patterns.

Mitigations & hardening:

  - Enforce DLP rules for sensitive file access and restrict direct outbound connections from critical hosts.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Azure AD Connect server present: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Azure AD Connect server present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate multi-factor and conditional access coverage for high-risk accounts.

Step 3: Enumerate identity and application configuration in a read-only manner.

Step 4: Plan lab-based OAuth/consent simulations to help defenders tune detections.

Defender detection notes:

  - Unusual token issuance or refresh patterns in identity logs.

Mitigations & hardening:

  - Harden app consent policies, require admin consent for high-privilege scopes, and monitor identity logs.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: M365 tenant with many apps and OAuth consents: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: M365 tenant with many apps and OAuth consents

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate multi-factor and conditional access coverage for high-risk accounts.

Step 3: Plan lab-based OAuth/consent simulations to help defenders tune detections.

Step 4: Enumerate identity and application configuration in a read-only manner.

Defender detection notes:

  - Unusual token issuance or refresh patterns in identity logs.

Mitigations & hardening:

  - Harden app consent policies, require admin consent for high-privilege scopes, and monitor identity logs.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: M365 tenant with many apps and OAuth consents: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: M365 tenant with many apps and OAuth consents

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate identity and application configuration in a read-only manner.

Step 3: Plan lab-based OAuth/consent simulations to help defenders tune detections.

Step 4: Validate multi-factor and conditional access coverage for high-risk accounts.

Defender detection notes:

  - Unusual token issuance or refresh patterns in identity logs.

Mitigations & hardening:

  - Harden app consent policies, require admin consent for high-privilege scopes, and monitor identity logs.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: M365 tenant with many apps and OAuth consents: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: M365 tenant with many apps and OAuth consents

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate multi-factor and conditional access coverage for high-risk accounts.

Step 3: Enumerate identity and application configuration in a read-only manner.

Step 4: Plan lab-based OAuth/consent simulations to help defenders tune detections.

Defender detection notes:

  - Unusual token issuance or refresh patterns in identity logs.

Mitigations & hardening:

  - Harden app consent policies, require admin consent for high-privilege scopes, and monitor identity logs.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: M365 tenant with many apps and OAuth consents: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: M365 tenant with many apps and OAuth consents

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan lab-based OAuth/consent simulations to help defenders tune detections.

Step 3: Enumerate identity and application configuration in a read-only manner.

Step 4: Validate multi-factor and conditional access coverage for high-risk accounts.

Defender detection notes:

  - Unusual token issuance or refresh patterns in identity logs.

Mitigations & hardening:

  - Harden app consent policies, require admin consent for high-privilege scopes, and monitor identity logs.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Azure AD tenant with conditional access: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Azure AD tenant with conditional access

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan lab-based OAuth/consent simulations to help defenders tune detections.

Step 3: Enumerate identity and application configuration in a read-only manner.

Step 4: Validate multi-factor and conditional access coverage for high-risk accounts.

Defender detection notes:

  - Unusual token issuance or refresh patterns in identity logs.

Mitigations & hardening:

  - Harden app consent policies, require admin consent for high-privilege scopes, and monitor identity logs.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Azure AD tenant with conditional access: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Azure AD tenant with conditional access

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate multi-factor and conditional access coverage for high-risk accounts.

Step 3: Plan lab-based OAuth/consent simulations to help defenders tune detections.

Step 4: Enumerate identity and application configuration in a read-only manner.

Defender detection notes:

  - Unusual token issuance or refresh patterns in identity logs.

Mitigations & hardening:

  - Harden app consent policies, require admin consent for high-privilege scopes, and monitor identity logs.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Azure AD tenant with conditional access: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Azure AD tenant with conditional access

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate identity and application configuration in a read-only manner.

Step 3: Plan lab-based OAuth/consent simulations to help defenders tune detections.

Step 4: Validate multi-factor and conditional access coverage for high-risk accounts.

Defender detection notes:

  - Unusual token issuance or refresh patterns in identity logs.

Mitigations & hardening:

  - Harden app consent policies, require admin consent for high-privilege scopes, and monitor identity logs.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Azure AD Connect server present: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Azure AD Connect server present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate multi-factor and conditional access coverage for high-risk accounts.

Step 3: Plan lab-based OAuth/consent simulations to help defenders tune detections.

Step 4: Enumerate identity and application configuration in a read-only manner.

Defender detection notes:

  - Unusual token issuance or refresh patterns in identity logs.

Mitigations & hardening:

  - Harden app consent policies, require admin consent for high-privilege scopes, and monitor identity logs.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Azure AD Connect server present: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Azure AD Connect server present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate multi-factor and conditional access coverage for high-risk accounts.

Step 3: Enumerate identity and application configuration in a read-only manner.

Step 4: Plan lab-based OAuth/consent simulations to help defenders tune detections.

Defender detection notes:

  - Unusual token issuance or refresh patterns in identity logs.

Mitigations & hardening:

  - Harden app consent policies, require admin consent for high-privilege scopes, and monitor identity logs.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: M365 tenant with many apps and OAuth consents: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: M365 tenant with many apps and OAuth consents

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate identity and application configuration in a read-only manner.

Step 3: Plan lab-based OAuth/consent simulations to help defenders tune detections.

Step 4: Validate multi-factor and conditional access coverage for high-risk accounts.

Defender detection notes:

  - Unusual token issuance or refresh patterns in identity logs.

Mitigations & hardening:

  - Harden app consent policies, require admin consent for high-privilege scopes, and monitor identity logs.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Azure AD Connect server present: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Azure AD Connect server present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate identity and application configuration in a read-only manner.

Step 3: Validate multi-factor and conditional access coverage for high-risk accounts.

Step 4: Plan lab-based OAuth/consent simulations to help defenders tune detections.

Defender detection notes:

  - Unusual token issuance or refresh patterns in identity logs.

Mitigations & hardening:

  - Harden app consent policies, require admin consent for high-privilege scopes, and monitor identity logs.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Azure AD tenant with conditional access: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Azure AD tenant with conditional access

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate multi-factor and conditional access coverage for high-risk accounts.

Step 3: Enumerate identity and application configuration in a read-only manner.

Step 4: Plan lab-based OAuth/consent simulations to help defenders tune detections.

Defender detection notes:

  - Unusual token issuance or refresh patterns in identity logs.

Mitigations & hardening:

  - Harden app consent policies, require admin consent for high-privilege scopes, and monitor identity logs.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Azure AD Connect server present: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Azure AD Connect server present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan lab-based OAuth/consent simulations to help defenders tune detections.

Step 3: Enumerate identity and application configuration in a read-only manner.

Step 4: Validate multi-factor and conditional access coverage for high-risk accounts.

Defender detection notes:

  - Unusual token issuance or refresh patterns in identity logs.

Mitigations & hardening:

  - Harden app consent policies, require admin consent for high-privilege scopes, and monitor identity logs.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Azure AD Connect server present: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Azure AD Connect server present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan lab-based OAuth/consent simulations to help defenders tune detections.

Step 3: Validate multi-factor and conditional access coverage for high-risk accounts.

Step 4: Enumerate identity and application configuration in a read-only manner.

Defender detection notes:

  - Unusual token issuance or refresh patterns in identity logs.

Mitigations & hardening:

  - Harden app consent policies, require admin consent for high-privilege scopes, and monitor identity logs.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: M365 tenant with many apps and OAuth consents: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: M365 tenant with many apps and OAuth consents

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate multi-factor and conditional access coverage for high-risk accounts.

Step 3: Enumerate identity and application configuration in a read-only manner.

Step 4: Plan lab-based OAuth/consent simulations to help defenders tune detections.

Defender detection notes:

  - Unusual token issuance or refresh patterns in identity logs.

Mitigations & hardening:

  - Harden app consent policies, require admin consent for high-privilege scopes, and monitor identity logs.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Azure AD Connect server present: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Azure AD Connect server present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan lab-based OAuth/consent simulations to help defenders tune detections.

Step 3: Validate multi-factor and conditional access coverage for high-risk accounts.

Step 4: Enumerate identity and application configuration in a read-only manner.

Defender detection notes:

  - Unusual token issuance or refresh patterns in identity logs.

Mitigations & hardening:

  - Harden app consent policies, require admin consent for high-privilege scopes, and monitor identity logs.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: M365 tenant with many apps and OAuth consents: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: M365 tenant with many apps and OAuth consents

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate identity and application configuration in a read-only manner.

Step 3: Validate multi-factor and conditional access coverage for high-risk accounts.

Step 4: Plan lab-based OAuth/consent simulations to help defenders tune detections.

Defender detection notes:

  - Unusual token issuance or refresh patterns in identity logs.

Mitigations & hardening:

  - Harden app consent policies, require admin consent for high-privilege scopes, and monitor identity logs.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: M365 tenant with many apps and OAuth consents: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: M365 tenant with many apps and OAuth consents

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate identity and application configuration in a read-only manner.

Step 3: Plan lab-based OAuth/consent simulations to help defenders tune detections.

Step 4: Validate multi-factor and conditional access coverage for high-risk accounts.

Defender detection notes:

  - Unusual token issuance or refresh patterns in identity logs.

Mitigations & hardening:

  - Harden app consent policies, require admin consent for high-privilege scopes, and monitor identity logs.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Azure AD Connect server present: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Azure AD Connect server present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate multi-factor and conditional access coverage for high-risk accounts.

Step 3: Enumerate identity and application configuration in a read-only manner.

Step 4: Plan lab-based OAuth/consent simulations to help defenders tune detections.

Defender detection notes:

  - Unusual token issuance or refresh patterns in identity logs.

Mitigations & hardening:

  - Harden app consent policies, require admin consent for high-privilege scopes, and monitor identity logs.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: M365 tenant with many apps and OAuth consents: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: M365 tenant with many apps and OAuth consents

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate identity and application configuration in a read-only manner.

Step 3: Plan lab-based OAuth/consent simulations to help defenders tune detections.

Step 4: Validate multi-factor and conditional access coverage for high-risk accounts.

Defender detection notes:

  - Unusual token issuance or refresh patterns in identity logs.

Mitigations & hardening:

  - Harden app consent policies, require admin consent for high-privilege scopes, and monitor identity logs.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Azure AD Connect server present: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Azure AD Connect server present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate identity and application configuration in a read-only manner.

Step 3: Validate multi-factor and conditional access coverage for high-risk accounts.

Step 4: Plan lab-based OAuth/consent simulations to help defenders tune detections.

Defender detection notes:

  - Unusual token issuance or refresh patterns in identity logs.

Mitigations & hardening:

  - Harden app consent policies, require admin consent for high-privilege scopes, and monitor identity logs.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Azure AD tenant with conditional access: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Azure AD tenant with conditional access

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate multi-factor and conditional access coverage for high-risk accounts.

Step 3: Plan lab-based OAuth/consent simulations to help defenders tune detections.

Step 4: Enumerate identity and application configuration in a read-only manner.

Defender detection notes:

  - Unusual token issuance or refresh patterns in identity logs.

Mitigations & hardening:

  - Harden app consent policies, require admin consent for high-privilege scopes, and monitor identity logs.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: M365 tenant with many apps and OAuth consents: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: M365 tenant with many apps and OAuth consents

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan lab-based OAuth/consent simulations to help defenders tune detections.

Step 3: Enumerate identity and application configuration in a read-only manner.

Step 4: Validate multi-factor and conditional access coverage for high-risk accounts.

Defender detection notes:

  - Unusual token issuance or refresh patterns in identity logs.

Mitigations & hardening:

  - Harden app consent policies, require admin consent for high-privilege scopes, and monitor identity logs.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: M365 tenant with many apps and OAuth consents: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: M365 tenant with many apps and OAuth consents

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan lab-based OAuth/consent simulations to help defenders tune detections.

Step 3: Enumerate identity and application configuration in a read-only manner.

Step 4: Validate multi-factor and conditional access coverage for high-risk accounts.

Defender detection notes:

  - Unusual token issuance or refresh patterns in identity logs.

Mitigations & hardening:

  - Harden app consent policies, require admin consent for high-privilege scopes, and monitor identity logs.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: M365 tenant with many apps and OAuth consents: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: M365 tenant with many apps and OAuth consents

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate multi-factor and conditional access coverage for high-risk accounts.

Step 3: Plan lab-based OAuth/consent simulations to help defenders tune detections.

Step 4: Enumerate identity and application configuration in a read-only manner.

Defender detection notes:

  - Unusual token issuance or refresh patterns in identity logs.

Mitigations & hardening:

  - Harden app consent policies, require admin consent for high-privilege scopes, and monitor identity logs.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Azure AD Connect server present: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Azure AD Connect server present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan lab-based OAuth/consent simulations to help defenders tune detections.

Step 3: Validate multi-factor and conditional access coverage for high-risk accounts.

Step 4: Enumerate identity and application configuration in a read-only manner.

Defender detection notes:

  - Unusual token issuance or refresh patterns in identity logs.

Mitigations & hardening:

  - Harden app consent policies, require admin consent for high-privilege scopes, and monitor identity logs.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: M365 tenant with many apps and OAuth consents: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: M365 tenant with many apps and OAuth consents

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate multi-factor and conditional access coverage for high-risk accounts.

Step 3: Enumerate identity and application configuration in a read-only manner.

Step 4: Plan lab-based OAuth/consent simulations to help defenders tune detections.

Defender detection notes:

  - Unusual token issuance or refresh patterns in identity logs.

Mitigations & hardening:

  - Harden app consent policies, require admin consent for high-privilege scopes, and monitor identity logs.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Azure AD tenant with conditional access: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Azure AD tenant with conditional access

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate identity and application configuration in a read-only manner.

Step 3: Validate multi-factor and conditional access coverage for high-risk accounts.

Step 4: Plan lab-based OAuth/consent simulations to help defenders tune detections.

Defender detection notes:

  - Unusual token issuance or refresh patterns in identity logs.

Mitigations & hardening:

  - Harden app consent policies, require admin consent for high-privilege scopes, and monitor identity logs.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Azure AD Connect server present: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Azure AD Connect server present

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Plan lab-based OAuth/consent simulations to help defenders tune detections.

Step 3: Validate multi-factor and conditional access coverage for high-risk accounts.

Step 4: Enumerate identity and application configuration in a read-only manner.

Defender detection notes:

  - Unusual token issuance or refresh patterns in identity logs.

Mitigations & hardening:

  - Harden app consent policies, require admin consent for high-privilege scopes, and monitor identity logs.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: SCCM site with many distribution points: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: SCCM site with many distribution points

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Inventory SCCM roles and distribution point capabilities and document secrets exposure possibilities.

Step 3: Simulate client push or package deployment workflows in lab to validate detection and access controls.

Defender detection notes:

  - Unexpected package deployments or changes in SCCM job logs.

Mitigations & hardening:

  - Restrict access to SCCM roles and harden distribution point permissions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: SCCM admin console reachable: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: SCCM admin console reachable

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Inventory SCCM roles and distribution point capabilities and document secrets exposure possibilities.

Step 3: Simulate client push or package deployment workflows in lab to validate detection and access controls.

Defender detection notes:

  - Unexpected package deployments or changes in SCCM job logs.

Mitigations & hardening:

  - Restrict access to SCCM roles and harden distribution point permissions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: SCCM site with many distribution points: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: SCCM site with many distribution points

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Inventory SCCM roles and distribution point capabilities and document secrets exposure possibilities.

Step 3: Simulate client push or package deployment workflows in lab to validate detection and access controls.

Defender detection notes:

  - Unexpected package deployments or changes in SCCM job logs.

Mitigations & hardening:

  - Restrict access to SCCM roles and harden distribution point permissions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: SCCM admin console reachable: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: SCCM admin console reachable

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Simulate client push or package deployment workflows in lab to validate detection and access controls.

Step 3: Inventory SCCM roles and distribution point capabilities and document secrets exposure possibilities.

Defender detection notes:

  - Unexpected package deployments or changes in SCCM job logs.

Mitigations & hardening:

  - Restrict access to SCCM roles and harden distribution point permissions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: SCCM site with many distribution points: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: SCCM site with many distribution points

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Simulate client push or package deployment workflows in lab to validate detection and access controls.

Step 3: Inventory SCCM roles and distribution point capabilities and document secrets exposure possibilities.

Defender detection notes:

  - Unexpected package deployments or changes in SCCM job logs.

Mitigations & hardening:

  - Restrict access to SCCM roles and harden distribution point permissions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: SCCM admin console reachable: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: SCCM admin console reachable

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Simulate client push or package deployment workflows in lab to validate detection and access controls.

Step 3: Inventory SCCM roles and distribution point capabilities and document secrets exposure possibilities.

Defender detection notes:

  - Unexpected package deployments or changes in SCCM job logs.

Mitigations & hardening:

  - Restrict access to SCCM roles and harden distribution point permissions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: SCCM admin console reachable: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: SCCM admin console reachable

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Inventory SCCM roles and distribution point capabilities and document secrets exposure possibilities.

Step 3: Simulate client push or package deployment workflows in lab to validate detection and access controls.

Defender detection notes:

  - Unexpected package deployments or changes in SCCM job logs.

Mitigations & hardening:

  - Restrict access to SCCM roles and harden distribution point permissions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: SCCM admin console reachable: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: SCCM admin console reachable

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Inventory SCCM roles and distribution point capabilities and document secrets exposure possibilities.

Step 3: Simulate client push or package deployment workflows in lab to validate detection and access controls.

Defender detection notes:

  - Unexpected package deployments or changes in SCCM job logs.

Mitigations & hardening:

  - Restrict access to SCCM roles and harden distribution point permissions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: SCCM admin console reachable: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: SCCM admin console reachable

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Inventory SCCM roles and distribution point capabilities and document secrets exposure possibilities.

Step 3: Simulate client push or package deployment workflows in lab to validate detection and access controls.

Defender detection notes:

  - Unexpected package deployments or changes in SCCM job logs.

Mitigations & hardening:

  - Restrict access to SCCM roles and harden distribution point permissions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: SCCM site with many distribution points: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: SCCM site with many distribution points

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Simulate client push or package deployment workflows in lab to validate detection and access controls.

Step 3: Inventory SCCM roles and distribution point capabilities and document secrets exposure possibilities.

Defender detection notes:

  - Unexpected package deployments or changes in SCCM job logs.

Mitigations & hardening:

  - Restrict access to SCCM roles and harden distribution point permissions.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Enterprise CA present with many templates: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Enterprise CA present with many templates

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate who has enrollment rights and whether those rights are excessive.

Step 3: Enumerate CA templates and identify which allow client auth or on-behalf-of enrollment.

Defender detection notes:

  - Unusual certificate issuance or renewal outside of maintenance windows.

Mitigations & hardening:

  - Harden CA role membership, restrict template edit/issue rights, and audit certificate issuance.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Web enrollment services available: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Web enrollment services available

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate CA templates and identify which allow client auth or on-behalf-of enrollment.

Step 3: Validate who has enrollment rights and whether those rights are excessive.

Defender detection notes:

  - Unusual certificate issuance or renewal outside of maintenance windows.

Mitigations & hardening:

  - Harden CA role membership, restrict template edit/issue rights, and audit certificate issuance.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Web enrollment services available: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Web enrollment services available

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate who has enrollment rights and whether those rights are excessive.

Step 3: Enumerate CA templates and identify which allow client auth or on-behalf-of enrollment.

Defender detection notes:

  - Unusual certificate issuance or renewal outside of maintenance windows.

Mitigations & hardening:

  - Harden CA role membership, restrict template edit/issue rights, and audit certificate issuance.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Web enrollment services available: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Web enrollment services available

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate CA templates and identify which allow client auth or on-behalf-of enrollment.

Step 3: Validate who has enrollment rights and whether those rights are excessive.

Defender detection notes:

  - Unusual certificate issuance or renewal outside of maintenance windows.

Mitigations & hardening:

  - Harden CA role membership, restrict template edit/issue rights, and audit certificate issuance.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Web enrollment services available: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Web enrollment services available

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate CA templates and identify which allow client auth or on-behalf-of enrollment.

Step 3: Validate who has enrollment rights and whether those rights are excessive.

Defender detection notes:

  - Unusual certificate issuance or renewal outside of maintenance windows.

Mitigations & hardening:

  - Harden CA role membership, restrict template edit/issue rights, and audit certificate issuance.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Enterprise CA present with many templates: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Enterprise CA present with many templates

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate CA templates and identify which allow client auth or on-behalf-of enrollment.

Step 3: Validate who has enrollment rights and whether those rights are excessive.

Defender detection notes:

  - Unusual certificate issuance or renewal outside of maintenance windows.

Mitigations & hardening:

  - Harden CA role membership, restrict template edit/issue rights, and audit certificate issuance.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Enterprise CA present with many templates: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Enterprise CA present with many templates

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate who has enrollment rights and whether those rights are excessive.

Step 3: Enumerate CA templates and identify which allow client auth or on-behalf-of enrollment.

Defender detection notes:

  - Unusual certificate issuance or renewal outside of maintenance windows.

Mitigations & hardening:

  - Harden CA role membership, restrict template edit/issue rights, and audit certificate issuance.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Web enrollment services available: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Web enrollment services available

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Enumerate CA templates and identify which allow client auth or on-behalf-of enrollment.

Step 3: Validate who has enrollment rights and whether those rights are excessive.

Defender detection notes:

  - Unusual certificate issuance or renewal outside of maintenance windows.

Mitigations & hardening:

  - Harden CA role membership, restrict template edit/issue rights, and audit certificate issuance.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Web enrollment services available: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Web enrollment services available

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate who has enrollment rights and whether those rights are excessive.

Step 3: Enumerate CA templates and identify which allow client auth or on-behalf-of enrollment.

Defender detection notes:

  - Unusual certificate issuance or renewal outside of maintenance windows.

Mitigations & hardening:

  - Harden CA role membership, restrict template edit/issue rights, and audit certificate issuance.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Enterprise CA present with many templates: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Enterprise CA present with many templates

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Validate who has enrollment rights and whether those rights are excessive.

Step 3: Enumerate CA templates and identify which allow client auth or on-behalf-of enrollment.

Defender detection notes:

  - Unusual certificate issuance or renewal outside of maintenance windows.

Mitigations & hardening:

  - Harden CA role membership, restrict template edit/issue rights, and audit certificate issuance.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Large-scale LDAP brute force attempts detected in logs: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Large-scale LDAP brute force attempts detected in logs

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Triage the affected logs and extract indicators (source IP, account, timing) for hunting.

Step 3: Tune detection rules with labeled data from lab reproductions to reduce false positives.

Step 4: Correlate across telemetry (network, EDR, authentication logs) to determine scope.

Defender detection notes:

  - Recurring patterns of similar failed authentication across many accounts.

Mitigations & hardening:

  - Implement cross-source correlation, logging retention, and analytic playbooks for common attack flows.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Unexpected use of administrative utilities across many hosts: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Unexpected use of administrative utilities across many hosts

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Tune detection rules with labeled data from lab reproductions to reduce false positives.

Step 3: Triage the affected logs and extract indicators (source IP, account, timing) for hunting.

Step 4: Correlate across telemetry (network, EDR, authentication logs) to determine scope.

Defender detection notes:

  - Recurring patterns of similar failed authentication across many accounts.

Mitigations & hardening:

  - Implement cross-source correlation, logging retention, and analytic playbooks for common attack flows.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Anomalous certificate issuance logs: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Anomalous certificate issuance logs

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Correlate across telemetry (network, EDR, authentication logs) to determine scope.

Step 3: Tune detection rules with labeled data from lab reproductions to reduce false positives.

Step 4: Triage the affected logs and extract indicators (source IP, account, timing) for hunting.

Defender detection notes:

  - Recurring patterns of similar failed authentication across many accounts.

Mitigations & hardening:

  - Implement cross-source correlation, logging retention, and analytic playbooks for common attack flows.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Anomalous certificate issuance logs: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Anomalous certificate issuance logs

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Triage the affected logs and extract indicators (source IP, account, timing) for hunting.

Step 3: Tune detection rules with labeled data from lab reproductions to reduce false positives.

Step 4: Correlate across telemetry (network, EDR, authentication logs) to determine scope.

Defender detection notes:

  - Recurring patterns of similar failed authentication across many accounts.

Mitigations & hardening:

  - Implement cross-source correlation, logging retention, and analytic playbooks for common attack flows.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Large-scale LDAP brute force attempts detected in logs: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Large-scale LDAP brute force attempts detected in logs

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Tune detection rules with labeled data from lab reproductions to reduce false positives.

Step 3: Correlate across telemetry (network, EDR, authentication logs) to determine scope.

Step 4: Triage the affected logs and extract indicators (source IP, account, timing) for hunting.

Defender detection notes:

  - Recurring patterns of similar failed authentication across many accounts.

Mitigations & hardening:

  - Implement cross-source correlation, logging retention, and analytic playbooks for common attack flows.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Large-scale LDAP brute force attempts detected in logs: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Large-scale LDAP brute force attempts detected in logs

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Triage the affected logs and extract indicators (source IP, account, timing) for hunting.

Step 3: Tune detection rules with labeled data from lab reproductions to reduce false positives.

Step 4: Correlate across telemetry (network, EDR, authentication logs) to determine scope.

Defender detection notes:

  - Recurring patterns of similar failed authentication across many accounts.

Mitigations & hardening:

  - Implement cross-source correlation, logging retention, and analytic playbooks for common attack flows.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Unexpected use of administrative utilities across many hosts: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Unexpected use of administrative utilities across many hosts

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Triage the affected logs and extract indicators (source IP, account, timing) for hunting.

Step 3: Tune detection rules with labeled data from lab reproductions to reduce false positives.

Step 4: Correlate across telemetry (network, EDR, authentication logs) to determine scope.

Defender detection notes:

  - Recurring patterns of similar failed authentication across many accounts.

Mitigations & hardening:

  - Implement cross-source correlation, logging retention, and analytic playbooks for common attack flows.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Anomalous certificate issuance logs: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Anomalous certificate issuance logs

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Triage the affected logs and extract indicators (source IP, account, timing) for hunting.

Step 3: Correlate across telemetry (network, EDR, authentication logs) to determine scope.

Step 4: Tune detection rules with labeled data from lab reproductions to reduce false positives.

Defender detection notes:

  - Recurring patterns of similar failed authentication across many accounts.

Mitigations & hardening:

  - Implement cross-source correlation, logging retention, and analytic playbooks for common attack flows.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Anomalous certificate issuance logs: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Anomalous certificate issuance logs

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Tune detection rules with labeled data from lab reproductions to reduce false positives.

Step 3: Correlate across telemetry (network, EDR, authentication logs) to determine scope.

Step 4: Triage the affected logs and extract indicators (source IP, account, timing) for hunting.

Defender detection notes:

  - Recurring patterns of similar failed authentication across many accounts.

Mitigations & hardening:

  - Implement cross-source correlation, logging retention, and analytic playbooks for common attack flows.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Large-scale LDAP brute force attempts detected in logs: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Large-scale LDAP brute force attempts detected in logs

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Correlate across telemetry (network, EDR, authentication logs) to determine scope.

Step 3: Triage the affected logs and extract indicators (source IP, account, timing) for hunting.

Step 4: Tune detection rules with labeled data from lab reproductions to reduce false positives.

Defender detection notes:

  - Recurring patterns of similar failed authentication across many accounts.

Mitigations & hardening:

  - Implement cross-source correlation, logging retention, and analytic playbooks for common attack flows.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Large-scale LDAP brute force attempts detected in logs: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Large-scale LDAP brute force attempts detected in logs

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Correlate across telemetry (network, EDR, authentication logs) to determine scope.

Step 3: Triage the affected logs and extract indicators (source IP, account, timing) for hunting.

Step 4: Tune detection rules with labeled data from lab reproductions to reduce false positives.

Defender detection notes:

  - Recurring patterns of similar failed authentication across many accounts.

Mitigations & hardening:

  - Implement cross-source correlation, logging retention, and analytic playbooks for common attack flows.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Large-scale LDAP brute force attempts detected in logs: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Large-scale LDAP brute force attempts detected in logs

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Correlate across telemetry (network, EDR, authentication logs) to determine scope.

Step 3: Tune detection rules with labeled data from lab reproductions to reduce false positives.

Step 4: Triage the affected logs and extract indicators (source IP, account, timing) for hunting.

Defender detection notes:

  - Recurring patterns of similar failed authentication across many accounts.

Mitigations & hardening:

  - Implement cross-source correlation, logging retention, and analytic playbooks for common attack flows.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Unexpected use of administrative utilities across many hosts: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Unexpected use of administrative utilities across many hosts

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Correlate across telemetry (network, EDR, authentication logs) to determine scope.

Step 3: Triage the affected logs and extract indicators (source IP, account, timing) for hunting.

Step 4: Tune detection rules with labeled data from lab reproductions to reduce false positives.

Defender detection notes:

  - Recurring patterns of similar failed authentication across many accounts.

Mitigations & hardening:

  - Implement cross-source correlation, logging retention, and analytic playbooks for common attack flows.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Anomalous certificate issuance logs: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Anomalous certificate issuance logs

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Correlate across telemetry (network, EDR, authentication logs) to determine scope.

Step 3: Tune detection rules with labeled data from lab reproductions to reduce false positives.

Step 4: Triage the affected logs and extract indicators (source IP, account, timing) for hunting.

Defender detection notes:

  - Recurring patterns of similar failed authentication across many accounts.

Mitigations & hardening:

  - Implement cross-source correlation, logging retention, and analytic playbooks for common attack flows.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Anomalous certificate issuance logs: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Anomalous certificate issuance logs

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Triage the affected logs and extract indicators (source IP, account, timing) for hunting.

Step 3: Tune detection rules with labeled data from lab reproductions to reduce false positives.

Step 4: Correlate across telemetry (network, EDR, authentication logs) to determine scope.

Defender detection notes:

  - Recurring patterns of similar failed authentication across many accounts.

Mitigations & hardening:

  - Implement cross-source correlation, logging retention, and analytic playbooks for common attack flows.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Unexpected use of administrative utilities across many hosts: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Unexpected use of administrative utilities across many hosts

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Tune detection rules with labeled data from lab reproductions to reduce false positives.

Step 3: Triage the affected logs and extract indicators (source IP, account, timing) for hunting.

Step 4: Correlate across telemetry (network, EDR, authentication logs) to determine scope.

Defender detection notes:

  - Recurring patterns of similar failed authentication across many accounts.

Mitigations & hardening:

  - Implement cross-source correlation, logging retention, and analytic playbooks for common attack flows.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Large-scale LDAP brute force attempts detected in logs: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Large-scale LDAP brute force attempts detected in logs

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Tune detection rules with labeled data from lab reproductions to reduce false positives.

Step 3: Triage the affected logs and extract indicators (source IP, account, timing) for hunting.

Step 4: Correlate across telemetry (network, EDR, authentication logs) to determine scope.

Defender detection notes:

  - Recurring patterns of similar failed authentication across many accounts.

Mitigations & hardening:

  - Implement cross-source correlation, logging retention, and analytic playbooks for common attack flows.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Large-scale LDAP brute force attempts detected in logs: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Large-scale LDAP brute force attempts detected in logs

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Correlate across telemetry (network, EDR, authentication logs) to determine scope.

Step 3: Triage the affected logs and extract indicators (source IP, account, timing) for hunting.

Step 4: Tune detection rules with labeled data from lab reproductions to reduce false positives.

Defender detection notes:

  - Recurring patterns of similar failed authentication across many accounts.

Mitigations & hardening:

  - Implement cross-source correlation, logging retention, and analytic playbooks for common attack flows.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Large-scale LDAP brute force attempts detected in logs: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Large-scale LDAP brute force attempts detected in logs

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Triage the affected logs and extract indicators (source IP, account, timing) for hunting.

Step 3: Correlate across telemetry (network, EDR, authentication logs) to determine scope.

Step 4: Tune detection rules with labeled data from lab reproductions to reduce false positives.

Defender detection notes:

  - Recurring patterns of similar failed authentication across many accounts.

Mitigations & hardening:

  - Implement cross-source correlation, logging retention, and analytic playbooks for common attack flows.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Anomalous certificate issuance logs: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Anomalous certificate issuance logs

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Tune detection rules with labeled data from lab reproductions to reduce false positives.

Step 3: Triage the affected logs and extract indicators (source IP, account, timing) for hunting.

Step 4: Correlate across telemetry (network, EDR, authentication logs) to determine scope.

Defender detection notes:

  - Recurring patterns of similar failed authentication across many accounts.

Mitigations & hardening:

  - Implement cross-source correlation, logging retention, and analytic playbooks for common attack flows.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Large-scale LDAP brute force attempts detected in logs: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Large-scale LDAP brute force attempts detected in logs

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Correlate across telemetry (network, EDR, authentication logs) to determine scope.

Step 3: Tune detection rules with labeled data from lab reproductions to reduce false positives.

Step 4: Triage the affected logs and extract indicators (source IP, account, timing) for hunting.

Defender detection notes:

  - Recurring patterns of similar failed authentication across many accounts.

Mitigations & hardening:

  - Implement cross-source correlation, logging retention, and analytic playbooks for common attack flows.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Unexpected use of administrative utilities across many hosts: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Unexpected use of administrative utilities across many hosts

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Tune detection rules with labeled data from lab reproductions to reduce false positives.

Step 3: Correlate across telemetry (network, EDR, authentication logs) to determine scope.

Step 4: Triage the affected logs and extract indicators (source IP, account, timing) for hunting.

Defender detection notes:

  - Recurring patterns of similar failed authentication across many accounts.

Mitigations & hardening:

  - Implement cross-source correlation, logging retention, and analytic playbooks for common attack flows.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Unexpected use of administrative utilities across many hosts: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Unexpected use of administrative utilities across many hosts

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Tune detection rules with labeled data from lab reproductions to reduce false positives.

Step 3: Correlate across telemetry (network, EDR, authentication logs) to determine scope.

Step 4: Triage the affected logs and extract indicators (source IP, account, timing) for hunting.

Defender detection notes:

  - Recurring patterns of similar failed authentication across many accounts.

Mitigations & hardening:

  - Implement cross-source correlation, logging retention, and analytic playbooks for common attack flows.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Large-scale LDAP brute force attempts detected in logs: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Large-scale LDAP brute force attempts detected in logs

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Correlate across telemetry (network, EDR, authentication logs) to determine scope.

Step 3: Tune detection rules with labeled data from lab reproductions to reduce false positives.

Step 4: Triage the affected logs and extract indicators (source IP, account, timing) for hunting.

Defender detection notes:

  - Recurring patterns of similar failed authentication across many accounts.

Mitigations & hardening:

  - Implement cross-source correlation, logging retention, and analytic playbooks for common attack flows.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Unexpected use of administrative utilities across many hosts: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Unexpected use of administrative utilities across many hosts

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Correlate across telemetry (network, EDR, authentication logs) to determine scope.

Step 3: Triage the affected logs and extract indicators (source IP, account, timing) for hunting.

Step 4: Tune detection rules with labeled data from lab reproductions to reduce false positives.

Defender detection notes:

  - Recurring patterns of similar failed authentication across many accounts.

Mitigations & hardening:

  - Implement cross-source correlation, logging retention, and analytic playbooks for common attack flows.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Anomalous certificate issuance logs: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Anomalous certificate issuance logs

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Triage the affected logs and extract indicators (source IP, account, timing) for hunting.

Step 3: Correlate across telemetry (network, EDR, authentication logs) to determine scope.

Step 4: Tune detection rules with labeled data from lab reproductions to reduce false positives.

Defender detection notes:

  - Recurring patterns of similar failed authentication across many accounts.

Mitigations & hardening:

  - Implement cross-source correlation, logging retention, and analytic playbooks for common attack flows.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Unexpected use of administrative utilities across many hosts: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Unexpected use of administrative utilities across many hosts

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Triage the affected logs and extract indicators (source IP, account, timing) for hunting.

Step 3: Correlate across telemetry (network, EDR, authentication logs) to determine scope.

Step 4: Tune detection rules with labeled data from lab reproductions to reduce false positives.

Defender detection notes:

  - Recurring patterns of similar failed authentication across many accounts.

Mitigations & hardening:

  - Implement cross-source correlation, logging retention, and analytic playbooks for common attack flows.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Unexpected use of administrative utilities across many hosts: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Unexpected use of administrative utilities across many hosts

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Triage the affected logs and extract indicators (source IP, account, timing) for hunting.

Step 3: Correlate across telemetry (network, EDR, authentication logs) to determine scope.

Step 4: Tune detection rules with labeled data from lab reproductions to reduce false positives.

Defender detection notes:

  - Recurring patterns of similar failed authentication across many accounts.

Mitigations & hardening:

  - Implement cross-source correlation, logging retention, and analytic playbooks for common attack flows.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Unexpected use of administrative utilities across many hosts: What step-by-step, lab-first actions and telemetry should a red-team and blue-team collect in an authorized test?

Input: Unexpected use of administrative utilities across many hosts

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Tune detection rules with labeled data from lab reproductions to reduce false positives.

Step 3: Correlate across telemetry (network, EDR, authentication logs) to determine scope.

Step 4: Triage the affected logs and extract indicators (source IP, account, timing) for hunting.

Defender detection notes:

  - Recurring patterns of similar failed authentication across many accounts.

Mitigations & hardening:

  - Implement cross-source correlation, logging retention, and analytic playbooks for common attack flows.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Large-scale LDAP brute force attempts detected in logs: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Large-scale LDAP brute force attempts detected in logs

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Correlate across telemetry (network, EDR, authentication logs) to determine scope.

Step 3: Triage the affected logs and extract indicators (source IP, account, timing) for hunting.

Step 4: Tune detection rules with labeled data from lab reproductions to reduce false positives.

Defender detection notes:

  - Recurring patterns of similar failed authentication across many accounts.

Mitigations & hardening:

  - Implement cross-source correlation, logging retention, and analytic playbooks for common attack flows.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Coordinating blue-team telemetry collection: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Coordinating blue-team telemetry collection

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prepare lab-based rehearsal that mirrors production for high-risk actions.

Step 3: Define clear scope, rules of engagement, and escalation contacts.

Step 4: Establish emergency stop procedures and communication channels.

Defender detection notes:

  - Ensure logging/configuration is preserved for post-exercise analysis.

Mitigations & hardening:

  - Document and obtain written authorizations before activities.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Red-team exercise kickoff: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Red-team exercise kickoff

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Define clear scope, rules of engagement, and escalation contacts.

Step 3: Prepare lab-based rehearsal that mirrors production for high-risk actions.

Step 4: Establish emergency stop procedures and communication channels.

Defender detection notes:

  - Ensure logging/configuration is preserved for post-exercise analysis.

Mitigations & hardening:

  - Document and obtain written authorizations before activities.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Red-team exercise kickoff: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Red-team exercise kickoff

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Define clear scope, rules of engagement, and escalation contacts.

Step 3: Prepare lab-based rehearsal that mirrors production for high-risk actions.

Step 4: Establish emergency stop procedures and communication channels.

Defender detection notes:

  - Ensure logging/configuration is preserved for post-exercise analysis.

Mitigations & hardening:

  - Document and obtain written authorizations before activities.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Red-team exercise kickoff: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Red-team exercise kickoff

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prepare lab-based rehearsal that mirrors production for high-risk actions.

Step 3: Establish emergency stop procedures and communication channels.

Step 4: Define clear scope, rules of engagement, and escalation contacts.

Defender detection notes:

  - Ensure logging/configuration is preserved for post-exercise analysis.

Mitigations & hardening:

  - Document and obtain written authorizations before activities.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Red-team exercise kickoff: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Red-team exercise kickoff

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prepare lab-based rehearsal that mirrors production for high-risk actions.

Step 3: Establish emergency stop procedures and communication channels.

Step 4: Define clear scope, rules of engagement, and escalation contacts.

Defender detection notes:

  - Ensure logging/configuration is preserved for post-exercise analysis.

Mitigations & hardening:

  - Document and obtain written authorizations before activities.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Red-team exercise kickoff: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Red-team exercise kickoff

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prepare lab-based rehearsal that mirrors production for high-risk actions.

Step 3: Establish emergency stop procedures and communication channels.

Step 4: Define clear scope, rules of engagement, and escalation contacts.

Defender detection notes:

  - Ensure logging/configuration is preserved for post-exercise analysis.

Mitigations & hardening:

  - Document and obtain written authorizations before activities.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Red-team exercise kickoff: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Red-team exercise kickoff

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prepare lab-based rehearsal that mirrors production for high-risk actions.

Step 3: Establish emergency stop procedures and communication channels.

Step 4: Define clear scope, rules of engagement, and escalation contacts.

Defender detection notes:

  - Ensure logging/configuration is preserved for post-exercise analysis.

Mitigations & hardening:

  - Document and obtain written authorizations before activities.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Red-team exercise kickoff: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Red-team exercise kickoff

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prepare lab-based rehearsal that mirrors production for high-risk actions.

Step 3: Establish emergency stop procedures and communication channels.

Step 4: Define clear scope, rules of engagement, and escalation contacts.

Defender detection notes:

  - Ensure logging/configuration is preserved for post-exercise analysis.

Mitigations & hardening:

  - Document and obtain written authorizations before activities.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Red-team exercise kickoff: In an authorized assessment, outline step-by-step lab-first evaluation and defender validation.

Input: Red-team exercise kickoff

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prepare lab-based rehearsal that mirrors production for high-risk actions.

Step 3: Define clear scope, rules of engagement, and escalation contacts.

Step 4: Establish emergency stop procedures and communication channels.

Defender detection notes:

  - Ensure logging/configuration is preserved for post-exercise analysis.

Mitigations & hardening:

  - Document and obtain written authorizations before activities.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.


Instruction: Red-team exercise kickoff: Provide a detailed step-by-step red-team assessment plan (lab-first) and detection guidance for defenders.

Input: Red-team exercise kickoff

Output:
Step 1: Confirm authorization and scope before proceeding.

Step 2: Prepare lab-based rehearsal that mirrors production for high-risk actions.

Step 3: Establish emergency stop procedures and communication channels.

Step 4: Define clear scope, rules of engagement, and escalation contacts.

Defender detection notes:

  - Ensure logging/configuration is preserved for post-exercise analysis.

Mitigations & hardening:

  - Document and obtain written authorizations before activities.

Note: High-level, non-actionable guidance intended for authorized lab assessments and defender tuning.