Skip to main content

Attack–Defense Simulation Framework

Status: Scaffold — content in progress

Each simulation scenario ties together the lab environment (Section 03), attack techniques (Section 04), and detection rules (Section 05) into a full attack–defense exercise.

Scenario Format​

Every scenario includes:

  • Scenario Name
  • Lab Required: which lab environment(s) needed
  • ATT&CK Techniques Covered: technique IDs
  • Difficulty: Beginner / Intermediate / Advanced
  • Estimated Time: setup + execution

Narrative​

A realistic threat scenario context (threat actor archetype, initial access method, objective).

Pre-Exercise Checklist​

  • Lab state verification (clean snapshot)
  • Logging verification (audit policies, Sysmon, SIEM connectivity)
  • Attack tool availability on attacker machine

Attacker Steps​

Numbered, ordered steps with exact commands. Each step annotated with:

  • ATT&CK technique
  • Expected log evidence

Defender Monitoring Checklist​

What the defender should see in the SIEM at each step. Links to the relevant detection page.

Expected Detection Triggers​

Table of: Attack Step → Expected Alert → Log Source → Detection Rule Reference

After-Action Review​

  • Was each attack step detected? (DRL-level honest assessment)
  • Which steps had detection gaps?
  • What telemetry was missing?
  • Recommendations for coverage improvement

Lab Requirements Summary​

ScenarioLabKey Attacks
Domain Compromise ChainAD LabKerberoasting → PtH → DCSync → Golden Ticket
Cloud Identity TakeoverEntra ID LabDevice code phishing → token persistence → privilege escalation
Hybrid Golden SAMLAD + Entra IDOn-prem ADFS compromise → Golden SAML → cloud access
Certificate EscalationAD Lab (ADCS)ESC1 → Domain Admin certificate → persistent auth
TopicLink
Lab Architecturelab-architecture
Detection Frameworkdetection-framework