StatusISOLATED LAB
Phase03_INITIAL_ACCESS
EgressBLOCKED?
Resume Session
RED TEAM OPS // PHASE 03

Initial Access

Obtain the first foothold. In-lab this simulates a phishing payload landing on WIN01 as a domain user.

Objectives

  1. 01Deliver a controlled payload to a lab user session on WIN01.
  2. 02Establish a stable callback to the LINUX01 C2 listener.
  3. 03Verify integrity level and current user context.

ATT&CK techniques

T1566.001T1204.002T1059.001

Operator Checklist

operator@linux01 ~ /ops/access
[*] Session 1 opened: WIN01\jsmith (Medium)
sliver (WIN01) > shell whoami /all
USER INFORMATION: lab\jsmith
PRIVILEGES: SeShutdownPrivilege, SeChangeNotifyPrivilege ...
$

Command Reference

← PHASE 02 External EnumerationPHASE 04 Command & Control →