StatusISOLATED LAB
Phase03_INITIAL_ACCESS
EgressBLOCKED?
Resume Session
RED TEAM OPS // PHASE 10

Remediation & Retest

Fix the specific weaknesses the operation exploited. Restore snapshots. Run the same kill chain again.

Objectives

  1. 01Rotate krbtgt twice with a rest window.
  2. 02Convert svc_web to a gMSA and remove the SPN from the weak account.
  3. 03Purge the GPP file and re-run Week-7 checklist.
  4. 04Retest: verify the previous path now fails.

ATT&CK techniques

M1026M1027M1041

Operator Checklist

operator@linux01 ~ /ops/remediate
[+] krbtgt password reset (attempt 1 of 2)
[+] Install-ADServiceAccount OK on FS01
$

Command Reference

← PHASE 09 Detection Review