🔴 Assume Breach

Assume Breach Scenarios

Structured red team exercises for Indian organisations — each scenario includes starting conditions, objectives, attack phases with detection opportunities, and Blue Team scoring criteria.

Endpoint Foothold — Privilege Escalation to Domain Admin
⏱ Duration: 4–8 hours 📊 Difficulty: Intermediate 🎯 Target: Any Indian enterprise with Windows AD
Starting Conditions
Single compromised workstation (assume initial access already achieved)
Objectives
Gain Domain Admin access from a standard user workstation
Achieve persistence that survives a reboot
Exfiltrate a sample of sensitive data from a file server
Access at least one additional host via lateral movement

Attack Phases with Detection Opportunities

  • Phase 1
    Phase 1 — Local Situational Awareness
    Enumerate local system: running processes, installed software, network interfaces, current user context, local admin check.
    🔍 Detection opportunity: Detection opportunity: whoami /all, systeminfo, ipconfig — unusual enumeration commands from standard user account.
  • Phase 2
    Phase 2 — Credential Access
    Attempt LSASS dump or credential extraction. Check for stored credentials (Windows Credential Manager, browser credentials).
    🔍 Detection opportunity: Detection: Sysmon EID 10 (ProcessAccess to lsass.exe). EID 4673 (sensitive privilege use). MDE alert on credential dump.
  • Phase 3
    Phase 3 — Domain Enumeration
    BloodHound/SharpHound collection. Identify path to Domain Admin. Find Kerberoastable accounts.
    🔍 Detection opportunity: Detection: High-volume LDAP queries. SharpHound process creation. Kerberoasting: EID 4769 with RC4 encryption.
  • Phase 4
    Phase 4 — Privilege Escalation
    Kerberoast high-value service accounts. Crack offline. Or exploit ACL misconfigurations found via BloodHound.
    🔍 Detection opportunity: Detection: EID 4769 spike (Kerberoasting). Account used from unexpected workstation after cracking.
  • Phase 5
    Phase 5 — Lateral Movement
    Move to a server using compromised credentials. Pivot to additional hosts.
    🔍 Detection opportunity: Detection: EID 4624 Type 3 from unexpected source. New login from compromised account to server.
  • Phase 6
    Phase 6 — Domain Admin & Persistence
    DCSync to get all hashes. Create persistence (hidden admin account, scheduled task, Golden Ticket).
    🔍 Detection opportunity: Detection: EID 4662 (DCSync). EID 4720 (new account created). EID 4698 (scheduled task created).
  • Phase 7
    Phase 7 — Data Exfiltration (simulated)
    Access file server, identify sensitive data, simulate exfiltration (record what you would have taken — do not actually exfiltrate in test).
    🔍 Detection opportunity: Detection: Unusual SMB access patterns. Large data transfers. File access by non-standard accounts.
Blue Team Scoring Criteria
Time to detect first malicious action (target: <30 minutes)
Alert generated on LSASS access
Lateral movement detected before Domain Admin achieved
Persistence mechanism detected within 24 hours
Cloud Credential Compromise — AWS Account Takeover
⏱ Duration: 3–6 hours 📊 Difficulty: Intermediate 🎯 Target: Indian IT/SaaS companies on AWS
Starting Conditions
Compromised AWS IAM access key (low-privilege developer key)
Objectives
Enumerate account and identify privilege escalation paths
Achieve Administrator-level access via IAM privilege escalation
Access at least one sensitive S3 bucket
Establish persistence mechanism in the AWS account

Attack Phases with Detection Opportunities

  • Phase 1
    Phase 1 — Initial Enumeration
    Identify caller identity. Enumerate IAM permissions. Map attached policies.
    🔍 Detection opportunity: Detection: GetCallerIdentity, ListRoles, ListPolicies calls from unusual IP or outside business hours.
  • Phase 2
    Phase 2 — IAM Privilege Escalation
    Identify escalation path (PassRole, CreatePolicyVersion, etc.). Execute escalation.
    🔍 Detection opportunity: Detection: IAM privilege escalation CloudTrail events. GuardDuty: PrivilegeEscalation:IAMUser findings.
  • Phase 3
    Phase 3 — Account-Wide Enumeration
    With elevated access, enumerate EC2, RDS, S3, Secrets Manager. Identify high-value targets.
    🔍 Detection opportunity: Detection: Bulk enumeration calls (describe-instances, list-buckets, etc.) in rapid succession.
  • Phase 4
    Phase 4 — Data Access
    Access sensitive S3 buckets. Check Secrets Manager for stored credentials.
    🔍 Detection opportunity: Detection: GetObject on sensitive buckets. GetSecretValue calls. GuardDuty S3 protection alerts.
  • Phase 5
    Phase 5 — Persistence
    Create new IAM user or access key. Modify trust policy of existing role. Add MFA device to admin account.
    🔍 Detection opportunity: Detection: CreateUser, CreateAccessKey, UpdateAssumeRolePolicy CloudTrail events.
Blue Team Scoring Criteria
GuardDuty alert generated
IAM escalation detected in CloudTrail alerts
Unusual enumeration triggers security alert
Persistence mechanism identified during review
Insider Threat — Privileged User Data Theft
⏱ Duration: 2–4 hours 📊 Difficulty: Intermediate 🎯 Target: Indian BFSI, Healthcare, or IT organisations
Starting Conditions
Valid credentials of a privileged IT administrator (database admin role)
Objectives
Access and exfiltrate customer/patient PII without triggering alerts
Cover tracks by modifying or clearing logs
Access systems outside normal job function
Simulate data sale (document what data was accessible)

Attack Phases with Detection Opportunities

  • Phase 1
    Phase 1 — Authorised Activity Baseline
    Begin with normal job function activities. Establish baseline before deviating.
    🔍 Detection opportunity: Detection: Baseline normal activity before insider anomaly monitoring.
  • Phase 2
    Phase 2 — Scope Expansion
    Access systems not normally accessed — customer database, HR system, financial records.
    🔍 Detection opportunity: Detection: UEBA anomaly — access to systems outside normal peer group. Time-based anomalies (after hours).
  • Phase 3
    Phase 3 — Bulk Data Access
    Query customer database for bulk records. Download large files. Bulk export.
    🔍 Detection opportunity: Detection: DLP alerts on bulk download. UEBA: data volume anomaly. Database audit log: full-table scans.
  • Phase 4
    Phase 4 — Exfiltration Attempt
    Attempt data transfer: personal email, USB, cloud storage (SharePoint to personal OneDrive, etc.).
    🔍 Detection opportunity: Detection: DLP block or alert on email attachment. USB insertion event. Unauthorised cloud app access.
  • Phase 5
    Phase 5 — Log Tampering
    Attempt to clear or modify audit logs covering actions.
    🔍 Detection opportunity: Detection: EID 1102 (audit log cleared). Database audit log modification. SIEM: gap in expected log stream.
Blue Team Scoring Criteria
Anomalous access detected by UEBA
DLP alert on bulk data movement
Log tampering attempt detected
CERT-In notification triggered (if actual breach)
Ransomware Simulation — Assume Breach Ransomware
⏱ Duration: 6–12 hours 📊 Difficulty: Advanced 🎯 Target: Any Indian enterprise — especially manufacturing, healthcare, logistics
Starting Conditions
Domain Admin access (assume AD compromise achieved)
Objectives
Achieve complete domain compromise (if not already given)
Disable backup systems
Deploy simulated ransomware marker files (NOT actual encryption)
Simulate data exfiltration before encryption (double extortion)
Test incident response and RBI/CERT-In notification process

Attack Phases with Detection Opportunities

  • Phase 1
    Phase 1 — Pre-Ransomware Reconnaissance
    Map all servers, backup systems, DR infrastructure. Identify Crown Jewels.
    🔍 Detection opportunity: Detection: SMB enumeration across network. Backup server access. Net view / network discovery.
  • Phase 2
    Phase 2 — Backup System Attack
    Disable or access backup infrastructure (Veeam, Windows Backup, cloud backups).
    🔍 Detection opportunity: Detection: Backup admin console access from unusual account. Backup job deletion or disablement.
  • Phase 3
    Phase 3 — EDR/AV Disablement (simulated)
    Simulate disabling endpoint protection (log the attempt — do not actually disable in test).
    🔍 Detection opportunity: Detection: Attempt to modify security software settings. Service stop commands on AV services.
  • Phase 4
    Phase 4 — Pre-Encryption Exfiltration (simulated)
    Identify high-value data directories. Simulate staging (do not actually exfiltrate).
    🔍 Detection opportunity: Detection: Bulk file access. Staging directory creation. Unusual compression operations.
  • Phase 5
    Phase 5 — Ransomware Marker Deployment
    Deploy marker files (zero-byte files named ENCRYPTED_[originalname]) across file shares to simulate encryption scope.
    🔍 Detection opportunity: Detection: Unusual file rename/write operations across multiple servers simultaneously. File extension change patterns.
  • Phase 6
    Phase 6 — Impact Assessment
    Document: How many systems affected? What data accessible? How long did detection take?
    🔍 Detection opportunity: Key metric: Time from first action to detection. Did CERT-In notification process activate?
Blue Team Scoring Criteria
Backup system access detected
EDR disablement attempt alerted
Unusual file operations detected (simulated encryption)
IR process triggered correctly
CERT-In 6-hour notification process tested
BFSI — Payment System Attack
⏱ Duration: 8–16 hours 📊 Difficulty: Advanced 🎯 Target: Indian banks, NBFCs, payment aggregators — RBI regulated entities
Starting Conditions
Compromised internal workstation on bank/NBFC network
Objectives
Access core banking system or payment processing infrastructure
Identify payment data storage locations (validate RBI data localisation compliance)
Simulate fraudulent transaction capability (do not execute)
Test SWIFT/payment rail isolation controls
Validate CERT-In 6-hour notification trigger

Attack Phases with Detection Opportunities

  • Phase 1
    Phase 1 — Network Segmentation Assessment
    Map network zones. Identify if payment processing network is properly segmented from corporate network.
    🔍 Detection opportunity: Detection: Network scan crossing zone boundaries. Firewall logs showing cross-zone traffic.
  • Phase 2
    Phase 2 — Core Banking System Enumeration
    Identify CBS (Finacle, Temenos, Flexcube, BaNCS) servers. Attempt access.
    🔍 Detection opportunity: Detection: Connection attempts to CBS server IPs from non-CBS workstations. Unusual Telnet/SSH to mainframe.
  • Phase 3
    Phase 3 — Payment Data Location
    Identify where payment data (UPI, IMPS, RTGS records) is stored. Validate it is in India-only infrastructure.
    🔍 Detection opportunity: Detection: Database queries against payment tables from unusual sources.
  • Phase 4
    Phase 4 — Privileged Access to Payment Systems
    Attempt to gain privileged access to payment processing accounts (RTGS operator, SWIFT operator).
    🔍 Detection opportunity: Detection: Unusual login to payment system consoles. MFA challenge for privileged accounts.
  • Phase 5
    Phase 5 — Transaction Fraud Simulation
    Document the theoretical steps to create a fraudulent transaction — do not execute. Identify controls that would prevent it.
    🔍 Detection opportunity: Key metric: Are 4-eyes (dual authorisation) controls in place? Is amount threshold authorisation enforced?
  • Phase 6
    Phase 6 — Regulatory Reporting Test
    Test whether the incident triggers the CERT-In 6-hour notification process and RBI incident reporting.
    🔍 Detection opportunity: Key metric: Does the IR team know the RBI reporting obligation? Is the process documented and rehearsed?
Blue Team Scoring Criteria
Network segmentation detected cross-zone attempt
CBS access attempt alerted
Privileged payment system account protection held
4-eyes controls validated
CERT-In notification process triggered correctly
Supply Chain Compromise — Third-Party Access Attack
⏱ Duration: 4–8 hours 📊 Difficulty: Advanced 🎯 Target: Any Indian enterprise using managed services or third-party IT vendors
Starting Conditions
Access equivalent to a trusted third-party vendor (IT support, auditor, software vendor)
Objectives
Access internal systems using third-party access credentials
Escalate from vendor access to internal production systems
Demonstrate lateral movement from vendor segment to corporate segment
Access data beyond vendor's authorised scope
Test third-party access monitoring and review controls

Attack Phases with Detection Opportunities

  • Phase 1
    Phase 1 — Vendor Footprint Mapping
    Identify all systems the vendor has access to. Map the vendor network segment or jump server.
    🔍 Detection opportunity: Detection: Vendor account login enumeration. Access pattern analysis vs baseline.
  • Phase 2
    Phase 2 — Scope Boundary Testing
    Test whether vendor access is restricted to authorised systems only.
    🔍 Detection opportunity: Detection: Vendor account accessing systems outside authorised list. Firewall rule violations.
  • Phase 3
    Phase 3 — Lateral Movement from Vendor Zone
    From vendor access, attempt to reach corporate network segment.
    🔍 Detection opportunity: Detection: Cross-segment network connections from vendor zone. Failed authentication to non-vendor systems.
  • Phase 4
    Phase 4 — Privilege Escalation via Vendor Tools
    Use vendor's management tools (RMM software, monitoring agents) to execute commands on managed systems.
    🔍 Detection opportunity: Detection: Unusual commands via RMM tool. RMM agent used outside normal maintenance window.
  • Phase 5
    Phase 5 — Data Access Assessment
    Identify data accessible with vendor credentials — does it exceed authorised scope?
    🔍 Detection opportunity: Detection: Data access audit. DLP alerts. Unusual query patterns from vendor account.
Blue Team Scoring Criteria
Vendor access restriction controls detected out-of-scope access
Cross-segment movement detected
Vendor activity monitoring alerted on unusual access
Quarterly vendor access review process validated