How aditya160803/kerberos-ad-red-team-defense-lab works
This repository documents an isolated Active Directory lab and a Kerberos-focused attack-to-defense assessment lifecycle; it does not contain lab automation or runtime application code in the sampled material. The principal workflow runs from lab setup and reconnaissance through attack simulation, persistence checks, evidence analysis, and remediation. The graph follows the lifecycle documented in the README and maps major capabilities to their documentation paths. Source-code wiring could not be assessed because no runtime source was provided.
Main entry points: phase-10-final-assessment.md Final assessment · phase-09-validation-analysis.md Evidence analysis · index.md Lab setup · phase-01-reconnaissance.md Reconnaissance
Components 23
Lab Context
- Lab setup
docs/lab-setup/index.md - Kerberos fundamentals
docs/kerberos/fundamentals.md - Project overview
docs/project/introduction.md
Attack Simulation
- Reconnaissance
docs/attack-simulation/phase-01-reconnaissance.md - AS-REP roasting
docs/attack-simulation/phase-02-asrep-roasting.md - Kerberoasting
docs/attack-simulation/phase-03-kerberoasting.md - Privilege assessment
docs/attack-simulation/phase-04-privilege-escalation.md - Defense evasion
docs/attack-simulation/phase-05-defense-evasion.md - Defender testing
docs/attack-simulation/phase-06-defender-testing.md - Lateral movement
docs/attack-simulation/phase-07-lateral-movement.md - Persistence verification
docs/attack-simulation/phase-08-detection-evidence.md
Evidence Analysis
- Evidence analysis
docs/attack-simulation/phase-09-validation-analysis.md - Detection evidence
docs/detection-evidence/index.md - Evidence index
docs/appendix/evidence-index.md
Assessment & Defense
- Attack-chain synthesis
docs/attack-chain/overview.md - Attack path
docs/attack-chain/attack-path.md - ATT&CK coverage
docs/attack-chain/techniques-coverage.md - Final assessment
docs/attack-simulation/phase-10-final-assessment.md - Risk assessment
docs/assessment/risk-assessment.md - Security findings
docs/assessment/security-findings.md - Defense remediation
docs/defense-remediation/index.md - Project limitations
docs/project/limitations.md
Other components
- Lab operator
Connections 21
- Lab operator → Lab setup: prepares lab
- Lab setup → Kerberos fundamentals: provides context
- Lab operator → Reconnaissance: performs assessment
- Reconnaissance → AS-REP roasting: progresses to
- AS-REP roasting → Kerberoasting: progresses to
- Kerberoasting → Privilege assessment: progresses to
- Privilege assessment → Defense evasion: progresses to
- Defense evasion → Defender testing: progresses to
- Defender testing → Lateral movement: progresses to
- Lateral movement → Persistence verification: progresses to
- Persistence verification → Evidence analysis: followed by
- Evidence analysis → Final assessment: informs
- Evidence analysis → Detection evidence: analyzes
- Evidence analysis → Evidence index: indexes evidence
- Final assessment → Attack-chain synthesis: synthesizes
- Final assessment → Attack path: documents
- Final assessment → ATT&CK coverage: maps techniques
- Final assessment → Risk assessment: classifies risk
- Final assessment → Security findings: records findings
- Final assessment → Defense remediation: guides
- Final assessment → Project limitations: states limits