🚧 Full write-up coming soon. Detailed documentation, attack chain diagrams, and detection rule breakdowns are being written up.
Overview
This lab executes 5 complete adversarial attack chains across 13 MITRE ATT&CK techniques, with each attack paired with engineered KQL detection rules in Microsoft Sentinel and a coverage gap analysis.
Attack Chains
| Chain | Technique | ATT&CK ID |
|---|---|---|
| Phishing-to-Domain Compromise | Spearphishing, Credential Dumping | T1566, T1003 |
| Entra ID Identity Attacks | Pass-the-PRT, Token Theft | T1528, T1550 |
| Cloud Misconfiguration Exfil | Abuse Elevation Control Mechanism | T1548 |
| On-Prem to Cloud Lateral Movement | PRT Abuse via AADInternals | T1550.001 |
| Backdoor Service Principal | Persistence via Application | T1098.001 |
Stack
Azure Terraform Microsoft Sentinel KQL Containerlab Sysmon Mimikatz Impacket AADInternals ROADtools Python PowerShell
Status
- Attack chains designed and executed
- KQL detection rules written
- Coverage gap analysis completed
- Full write-up in progress