StatusISOLATED LAB
Phase03_INITIAL_ACCESS
EgressBLOCKED?
Resume Session
TRACK 02

Red Team Ops

Ten phases against the environment you built. Every action is journaled, every technique is scored, everything stays inside 10.10.10.0/24.

PHASE 010%

Reconnaissance

Passive and active discovery of the isolated /24. Map hosts, ports, and services without triggering alerts.

T1595T1590T1046
PHASE 020%

External Enumeration

Probe SMB, LDAP, Kerberos, and DNS to enumerate users, groups, shares, and policies.

T1087T1069T1201T1018
PHASE 030%

Initial Access

Obtain the first foothold. In-lab this simulates a phishing payload landing on WIN01 as a domain user.

T1566.001T1204.002T1059.001
PHASE 040%

Command & Control

Shape traffic so the beacon looks like normal HTTPS. Add persistence at the right integrity level.

T1071.001T1573T1547.001
PHASE 050%

Privilege Escalation

Move from standard user to local admin on WIN01 by abusing the weaknesses seeded in Week 7.

T1068T1055T1078
PHASE 060%

AD Enumeration

With a foothold, map the domain: users, groups, ACLs, sessions. Feed the graph to BloodHound.

T1087.002T1482T1069.002
PHASE 070%

Lateral Movement

Pivot from WIN01 to FS01 using stolen credentials or ticket material. Do not touch DC01 yet.

T1021.002T1550.002T1075
PHASE 080%

Domain Dominance

Escalate to DA in the isolated lab. Practice restraint: no golden ticket without a clear rollback plan.

T1003.001T1558.001T1207
PHASE 090%

Detection Review

Swap chairs. Walk through what the blue-team pipeline caught, missed, or fired late.

DS0009DS0022DS0026
PHASE 100%

Remediation & Retest

Fix the specific weaknesses the operation exploited. Restore snapshots. Run the same kill chain again.

M1026M1027M1041