MENTOR TRACK // M03
Make Labs Harder Over Time
Beginner to Advanced by removing help, not by adding tools.
Progression
| Level | Marker |
|---|---|
| Beginner | One host, one obvious flaw, tool suggests the answer. |
| Advanced beginner | Two hosts, requires enumeration, minor cleanup. |
| Intermediate | Full AD, multiple paths, defensive logging, time pressure. |
| Advanced | Realistic policies, patched hosts, decoys, restricted tooling, no internet. |
Levers you can turn
- Remove obvious clues; add realistic noise and false positives.
- Add hosts, users, service accounts, misconfigurations, multiple attack paths.
- Remove internet access; reduce your operator privileges.
- Add Sysmon, Winlogbeat, AppLocker in enforce, LAPS, tiered admin.
- Patch things: force you to find a chain instead of a single CVE.
Force reasoning, not tool usage
A lab that a single tool solves is a tutorial. Delete the tool. If you can still solve it, the lab was teaching reasoning; if not, you were leaning on the tool.