Attack playbook

One address touched every machine on the estate in under a minute. Read the capture, tell a half-open scan from a real connection, list what actually answered, and say which finding matters most.

Find what is listening before touching anything.

Target: Any workstation · Every server on the subnet

1. 1.Addresses sweptdiscovery · T1018ICMP, Echo (ping) request
2. 2.Ports probeddiscovery · T1046[SYN], [RST, ACK], Win=1024
   alerts
3. 3.Versions grabbed off what answereddiscovery · T1046SSH-2.0-OpenSSH, Microsoft SQL Server, Kubernetes API server
4. 4.Scanner containedremediation · T1046

Someone uploaded a file to the estate's FTP server. Read the capture, recover the account and password the transfer used, name the file that landed, and close the clear-text path without stopping the business transfer.

A clear-text upload hands over an account name and password on the wire.

Target: File transfer server

1. 1.Control session openedinitial-access · T1071.002220 (vsFTPd 3.0.5), USER, PASS
2. 2.File pushed to the servercollection · T1105STOR, payroll-export.csv, 226 Transfer complete
   alerts
3. 3.Clear-text path closedremediation · T1071.002

An ordinary account bound to the directory over LDAP and walked the whole tree. Read the capture, name the account and the distinguished name it bound with, work out what it read, and cut anonymous and over-broad reads without breaking sign-in.

A plain directory bind reads the whole staff list, groups and service accounts.

Target: Domain controller · Directory server

1. 1.Simple bind on port 389credential-access · T1040bindRequest, simple, CN=Users
   alerts
2. 2.Whole subtree readdiscovery · T1087.002wholeSubtree, searchResEntry, servicePrincipalName
   alerts
3. 3.Reads narrowed and signing requiredremediation · T1087.002

A workstation mounted a finance share it should never have reached. Read the capture, name the account in the session setup, work out how it found the share, and tighten the permissions without cutting off the team that needs it.

Shares reachable by the wrong group are the quietest way in.

Target: File server

1. 1.Session set up on the file serverlateral-movement · T1021.002NTLMSSP_AUTH, Session Setup, 445
2. 2.Shares listed over IPC$discovery · T1135IPC$, NetShareEnumAll, ADMIN$
   alerts
3. 3.Finance share mounted and readcollection · T1039Tree Connect, Finance, Budget FY26.xlsx
   alerts
4. 4.Permissions tightenedremediation · T1039

A remote desktop session was opened to a server that should never accept one. Read the capture, pull the user name out of the connection request, decide whether the session succeeded, and close remote desktop down to the jump host only.

The remote desktop handshake names the user before anyone signs in.

Target: Remote access server · Jump host

1. 1.Connection request seenlateral-movement · T1021.001mstshash=, TPKT, 3389
   alerts
2. 2.Session establishedlateral-movement · T1021.001X.224 Connection Confirm, CredSSP
3. 3.Remote desktop narrowedremediation · T1021.001

A service account has a short password. Ask the KDC for its ticket, crack it offline, then use the recovered password to reach a database — and prove a golden ticket forged before the fix stops working once krbtgt is rolled a second time.

Service accounts with short passwords give them up from a ticket.

Target: Domain controller · Database server · Web server

1. 1.Service principal names enumerateddiscovery · T1558.003svc-sql
2. 2.TGS cracked offlinecredential-access · T1558.003
3. 3.krbtgt rolled, golden ticket diesremediation · T1558.001

A VPN rollout cloned a certificate template and left it open: any domain user may enroll, the requester names the subject, and nobody approves it. Ask the authority for a certificate in a domain administrator's name, log on with it, then work out which single setting made it possible.

An open template issues a certificate in an administrator's name.

Target: Certificate authority

1. 1.Ordinary domain accountinitial-access · T1078.002
2. 2.Published templates enumerateddiscovery · T1087.002ForgeVPNUser
   alerts
3. 3.Certificate requested for another accountprivilege-escalation · T1649Event 4887, ForgeVPNUser
   alerts
4. 4.Logon with the issued certificatelateral-movement · T1550
   alerts
5. 5.Template closedremediation · T1649

Request a service ticket, crack the service account out of it, then use the account to impersonate a user on the application server. Finish by pushing the estate's Kerberos risk score out of the red.

A cracked service account becomes an impersonated session.

Target: Domain controller · Application server

1. 1.Service accounts enumerateddiscovery · T1558.003servicePrincipalName, MSSQLSvc
2. 2.Ticket cracked offlinecredential-access · T1558.003RC4-HMAC, svc-sql
   alerts
3. 3.Impersonation on the application serverlateral-movement · T1550.003svc-sql, FinanceDW
   alerts
4. 4.Risk score driven downremediation · T1558.003

A helpdesk account carries the DS-Replication-Get-Changes-All right by mistake. Replicate the krbtgt secret out of the directory, then remove the right and prove the same request now refuses.

With replication rights, every secret in the directory comes out at once.

Target: Domain controller

1. 1.Delegation surveyeddiscovery · T1069.002
2. 2.GetNCChanges acceptedcredential-access · T1003.006krbtgt, DRSUAPI
   alerts
3. 3.Right removed and krbtgt rolledremediation · T1003.006

The shop cluster runs six workloads across two worker nodes. Read the capture, follow a request from the front end through to the cache, work out which container is running privileged, and say what an escape from it would reach.

The container estate is a second network with its own accounts.

Target: Cluster control plane · Worker nodes · Image registry

1. 1.Nodes report in to the control planediscovery · T16136443, 10250, PATCH /api/v1/nodes
2. 2.Container to container inside the overlaydiscovery · T1613VXLAN, 10.244.0.0/16, orders.shop.svc.cluster.local
3. 3.A privileged workload on a worker nodeprivilege-escalation · T1611privileged, ops, batch-runner
   alerts
4. 4.Image pulled with a shared registry logincollection · T1552.007Authorization: Basic, registry-01, regcred

Someone with an ordinary cluster identity listed every secret the estate holds — database connection strings, a live API key, the registry login and a service-account token — and the same sweep picked up a management card still on its factory password. Work out what they could reach, then close it.

Secrets scattered across layers reuse the same passwords.

Target: Cluster control plane · Vault · Management card

1. 1.Unauthenticated probe of the API serverdiscovery · T1133system:anonymous, 6443, GET /version
   alerts
2. 2.Every secret listed at oncecredential-access · T1552.007SecretList, payments-db, stripe-live
   alerts
3. 3.Credentials reused off the clusterlateral-movement · T1078svc-sql, builder, 1433
4. 4.Secrets sealed and bindings scopedremediation · T1552.007

A partner forest trusts yours with SID filtering switched off. Forge a ticket in the partner realm carrying Enterprise Admins in SID history, land as an administrator in your forest, then turn SID filtering on and prove the same ticket is dropped at the trust boundary.

A trust with filtering off carries borrowed privilege across forests.

Target: Domain controller · Partner forest controller

1. 1.Trust surveyeddiscovery · T1482
2. 2.Foreign ticket presentedlateral-movement · T1550.003
   alerts
3. 3.SID filtering enforcedremediation · T1482

A partner forest trusts yours, and filtering is off. Use the trust to land in the home realm carrying borrowed privilege, spot it in the logs, then turn filtering back on and prove the same move now fails.

The same route, walked end to end, then closed.

Target: Partner forest controller · Federation server

1. 1.Trusts mappeddiscovery · T1482nltest /domain_trusts, TDO
2. 2.Borrowed privilege carried acrosslateral-movement · T1134.005S-1-5-21-…-519, SID history
   alerts
3. 3.Filtering restoredremediation · T1482

Request a certificate through the risky VPN template, revoke a legitimate certificate to break somebody's login, then close the abuse path, restore the revoked user, and drive the authority's live risk score down to a workable number.

Whoever reaches the authority can revoke everyone else's certificates.

Target: Certificate authority

1. 1.Risk score readdiscovery · T1654
2. 2.Certificate issued and one revokedprivilege-escalation · T1649
   alerts
3. 3.Authority closed and score fallsremediation · T1649

Nobody was phished and nothing was guessed. The intruder walked in through the public portal using a flaw in the management path, then read every saved password on the box. Trace the first request, isolate the edge, and close the path before the credentials get used inside.

Most intrusions start at an internet-facing service, not an inbox.

Target: Public portal · Edge appliance

1. 1.Find the first request that workedinitial-access · T1190/manage/, path traversal, 443
   alerts
2. 2.Follow the credential theftcredential-access · T1555.003Login Data, config, service account
   alerts
3. 3.Isolate the edgecontainment · T1190isolate, web-01
4. 4.Patch, rotate and rebuildrecovery · T1555patch, rotate, rebuild

Your remote-access gateway answers a management request that carries no session at all — the flaw the national catalog lists as actively exploited. Somebody used it an hour ago. Work back from the gateway logs to the script they ran and the service they left behind, then stop the run before the file servers start turning over.

Authored from the live known-exploited catalog: an edge authentication bypass, a shell payload and a service left behind.

Target: Remote-access gateway · File server

1. 1.Prove the bypass from the gateway loginitial-access · T1190gw-01, 443, no session
   alerts
2. 2.Follow the shell that ran nextexecution · T1059.004update.sh, cdn.updates-cache.example, nsroot
   alerts
3. 3.Find the service left behindpersistence · T1543.002estate-telemetry.service, systemctl enable, persistence
   alerts
4. 4.Isolate the gateway and block the operatorcontainment · T1190isolate, gw-01, block
5. 5.Patch, rebuild and prove it tookrecovery · T1543.002patch, rebuild, restore

One workstation is checking in with someone every sixty seconds, and it looks exactly like a content delivery network. When you close the web route it moves the same conversation into DNS lookups. Find the beacon in ordinary traffic, prove it, and cut both channels.

A beacon hides in ordinary web traffic and falls back to DNS when the web route closes.

Target: Workstation · Proxy · Resolver

1. 1.Find the rhythm in the web trafficcommand-and-control · T1071.001cdn.updates-cache.example, 443, 60s interval
   alerts
2. 2.Follow the fallback into DNScommand-and-control · T1071.004TXT, tun.updates-cache.example, 53
   alerts
3. 3.Isolate the workstationcontainment · T1562isolate, wks-09
4. 4.Close both routes and restorerecovery · T1071block, sinkhole, restore

Nothing looks wrong. The traffic is all protocols this estate uses every day, to destinations that resolve, on ports that are meant to be open. An operator is inside anyway. Find them in the ordinary traffic and confirm what you have before you pull a single machine off the network — this rep scores the detection, not the cleanup.

Everything the operator touches is allowed traffic; the room is scored on detecting and confirming it before containment.

Target: Workstation · Proxy · File share

1. 1.Compare the host against its own baselinediscovery · T1082wks-14, baseline, drift
   alerts
2. 2.Find the rhythm inside ordinary web trafficcommand-and-control · T1071.001interval, constant size, 443
   alerts
3. 3.State the finding on the recorddetection · T1071confirm, incident-confirmed, evidence
   alerts
4. 4.Then contain, in the right ordercontainment · T1041isolate, block, wks-14

The endpoint console shows nothing but Microsoft-signed processes, and the machine is still calling out every few minutes. The payload never ran under its own name — a trusted Windows binary was asked to load it. Work out which signed process is carrying it, prove the module it loaded, and cut the run before the operator moves on.

The payload never runs under its own name: a signed Windows binary loads it, so the process tree looks clean.

Target: Workstation · Proxy

1. 1.Find the signed process that is doing the talkingdefense-evasion · T1218.011rundll32.exe, update.dll, wks-22
   alerts
2. 2.Prove the module, not the processexecution · T1218.011unsigned, C:\Users\Public, image load
   alerts
3. 3.Tie the callback to the same processcommand-and-control · T1071.001cdn.telemetry-sync.example, 443, beacon
   alerts
4. 4.Isolate the machine and block the destinationcontainment · T1218.011isolate, wks-22, block
5. 5.Clean and prove it tookrecovery · T1218.011rebuild, restore, clean

The endpoint agent on a server stopped reporting and the security log has a gap. Nothing alerted, because the thing that alerts was turned off first. Work the absence: prove the tampering from what is left, isolate the machine and get your visibility back.

The agent is stopped and the log cleared before anything worth alerting on happens.

Target: Member server · Log collector · Endpoint console

1. 1.Notice the machine went silentdetection · T1562.001app-02, missing heartbeat, silent host
   alerts
2. 2.Prove the tampering from what is leftdefense-evasion · T1070.006svcctl, EvtClearLog, 1102
   alerts
3. 3.Isolate before the next machinecontainment · T1021isolate, app-02
4. 4.Restore visibility and alert on the gaprecovery · T1562restore, heartbeat, tamper protection

A helpful-looking productivity app asked one person in Finance for permission, and they gave it. No password was stolen and nobody logged in from a strange country. Since then the app has been reading channels, messages and attached files across the whole workspace on its own token. Find the grant, measure what it read, and take the access away without breaking the twelve legitimate apps sitting beside it.

Authored from the live watch: a consented application holds its own token, so no password is ever stolen.

Target: Collaboration workspace · Identity tenant

1. 1.Find the grant behind the readingcredential-access · T1528workspace-insights, files.read.all, chat.read.all
   alerts
2. 2.Measure what the token actually readcollection · T1213app token, paging, 84 channels
   alerts
3. 3.Separate this application from the approved onesdiscovery · T1213approved apps, admin consent, scope
4. 4.Revoke the grant and kill the tokencontainment · T1528revoke, service principal, refresh token
5. 5.Close the door that let one person open the tenantrecovery · T1528consent policy, admin consent, verified publisher

A token from a workstation is being used against the company's cloud storage from somewhere else entirely. No server was touched and nothing on the estate broke — the data simply left. Spot the token in use, cut it, and prove what was taken.

A stolen token takes the data straight out of the cloud; no estate server is touched.

Target: Workstation · Cloud object store

1. 1.Match the token to the machinecredential-access · T1552.001wks-11, token, credential store
   alerts
2. 2.Catch the bulk readcollection · T1530storage.cloud.example, 443, 184 MB
   alerts
3. 3.Revoke and isolatecontainment · T1078.004revoke, isolate, wks-11
4. 4.Prove what left and shorten the tokensrecovery · T1567.002access log, short-lived token, restore

An intruder on a single workstation is working its way towards a domain controller, one remote session at a time. Each hop is small and ordinary-looking. Follow the chain, cut it at the right machine and stop it reaching the controller.

A live intruder hops machine to machine while the room tries to cut the chain.

Target: Workstations · Member servers · Domain controller

1. 1.Put the hops in orderdiscovery · T1018wks-12, 3389, 445
   alerts
2. 2.Catch the remote session between two machineslateral-movement · T1021.001mstshash, 3389, new pair
   alerts
3. 3.Stop it before the controllercontainment · T1562isolate, block, wks-12
4. 4.Prove the chain is deadrecovery · T1562refused, baseline, drift

Nothing breaks, nothing locks, nothing alarms. An intruder is reading shares, collecting them into one archive and uploading it a chunk at a time. Find the collection before the upload finishes, isolate the staging machine and block the route out.

Quiet collection and a chunked upload — damage without anything breaking.

Target: Workstation · File shares · Outbound edge

1. 1.Find the machine reading everythingcollection · T1039wks-07, 445, share reads
   alerts
2. 2.Find the staged archivecollection · T1074.001staging, .7z, write bursts
3. 3.Catch the uploadexfiltration · T1567443, outbound, chunked upload
   alerts
4. 4.Isolate and block the route outcontainment · T1562isolate, block, wks-07

A ransomware crew is already inside and heading for the backups. You have the time between the first share read and the first encrypted file: find the machine it holds, isolate it, block it and get the estate back before the note lands.

Backups go first, encryption second; the gap between them is the whole rep.

Target: File server · Backup server

1. 1.Compare the file server to its recordingdiscovery · T1083fs-01, 445, baseline drift
   alerts
2. 2.Catch the backup deletionimpact · T1490vssadmin, shadow copy, backup share
   alerts
3. 3.Isolate the machine the crew holdscontainment · T1562isolate, fs-01
4. 4.Block the crew and restorerecovery · T1562block, restore, offline backup

An attacker is already on a jump host and working outward while you watch. Catch the breach in the capture, isolate the machine it holds, block it at the edge and show the estate back at its recorded baseline before the run ends.

Catch a live attacker mid-run, isolate it and prove the estate is back to baseline.

Target: Jump host · File server · Domain controller

1. 1.Read the recorded baselinediscovery · T1046baseline, expected ports, packets per second
2. 2.Spot the ports the jump host never spokediscovery · T1046jump-01, 389, 445
   alerts
3. 3.Isolate the machine the attacker holdscontainment · T1562isolate, jump-01, containment
4. 4.Block the attacker and restore the baselinerecovery · T1562block, restore, drift

Someone used the certificate authority the way it was configured to be used, and walked out as a domain administrator. You have the issuance log, the directory and the logon records. Find the request, name the account it was really for, and scope who else could have done the same.

Spot the issued certificate in the log after the fact.

Target: Certificate authority

1. 1.Suspicious privileged logoninitial-access · T1550
   alerts
2. 2.Issuance log revieweddiscovery · T1654request 1043
   alerts
3. 3.Template exposure scopeddiscovery · T1087.002
   alerts
4. 4.Certificate revoked and account containedremediation · T1649

The certificate authority is open in more than one way: a template anybody may enroll against, an enrollment agent anybody may become, a template ordinary users may edit, a flag that overrides every template, and web enrollment over plain HTTP. Close each one, prove the enrollment is refused afterwards, and keep the estate's real certificates working.

Shut every abuse route without breaking sign-in.

Target: Certificate authority

1. 1.Authority revieweddiscovery · T1654EDITF_ATTRIBUTESUBJECTALTNAME2
   alerts
2. 2.Open templates scoped downremediation · T1649
3. 3.Authority flag clearedremediation · T1649
4. 4.Web enrollment securedremediation · T1187
   alerts
5. 5.Path proved deadremediation · T1649