Purple team lab · 2026

Active Directory Purple Team Lab

An isolated Active Directory lab connecting attack emulation with telemetry analysis and defensive recommendations.

Recorded lab study · 2026 Source reviewed:

Based on the public repository and the original technical write-up. These are recorded lab observations, not a new attack run.

View source codeRead the original write-up

Overview

Case-study summary

Problem
Trace an intrusion from initial access to domain compromise and assess the available telemetry.
Architecture
Isolated Windows Server 2022 domain, member workstation and Kali attacker.
My contribution
Built the lab, reproduced the attack chain and documented defensive findings.
Tests
Controlled credential abuse, lateral movement, DCSync, Golden Ticket and SCP scenarios.
Outcome
Recorded Windows Security, Sysmon and OpenSSH evidence across the attack chain.
Limitations
Observed events alone do not prove detections; reconnaissance needs network-level telemetry.

Detection engineering