About The AD Lab

E Corp AD Detection Lab

A deliberately vulnerable Active Directory environment, themed after Mr. Robot, built to practice the full attack-to-detection loop. Every attack in this lab is run by hand, the telemetry it generates is captured, and a detection is written and tuned against it in Wazuh — or, for network-level attacks, captured with a network sensor.

The point of this lab is not the attacks. The point is catching them.

Lab use only. This domain ships with weak passwords and intentional misconfigurations. It is built to be attacked in an isolated environment. Do not run any of this on a network that touches real assets.

On the build scripts

The OU structure and user population in Setup/ were generated with the help of an AI assistant to save time on boilerplate, the same way you might use BadBlood or a New-ADUser loop.

The story

E Corp is the target. fsociety are the attackers, so they have no domain accounts; they break in from outside. The attacks below walk a single coherent kill chain, the same climb the show is about: start with one low-level employee account and end up owning the entire domain.

  Password spray a shared employee password    (foothold)
        -> roast service accounts offline        (more creds)
              -> poison name resolution           (steal hashes off the wire)
              -> abuse a delegated ACL            (Helpdesk -> Wellick)
                    -> reach Domain Admins         (escalation)
                          -> move laterally via hash reuse  (spread)
                          -> DCSync the domain      (own krbtgt + Phillip Price = own E Corp)

The attacks

Seven attack-to-detection slices covering the full kill chain, from initial access through domain dominance. Each attack has its own writeup on my website, hunterweygandt.com, and each ships with a custom detection, because the stock tooling does not flag any of these by default.

Host-based detections (Wazuh custom rules)

Six attacks detected via custom Wazuh rules on the DC or workstations. The stock Wazuh ruleset does not flag any of these by default.

Network-based detection (packet capture)

One attack detected with a network sensor, because host-based agents cannot see it. This is the one slice that required full network isolation before execution.

What each detection demonstrates

• Single-event rules (1, 2) match one anomalous event: an RC4 service ticket, or a pre-auth-disabled TGT request.
• Stateful correlation (3) fires on a pattern no single event reveals, a burst of failed logons across many accounts from one source, using Wazuh's frequency and timeframe logic.
• Network-level detection (4) uses a packet capture to see an attack that is invisible to host-based agents, demonstrating the host-vs-network detection split.
• Context-scoped rules (5) avoid alert fatigue by firing only on changes to privileged groups, not every routine group change.
• Successful-logon anomaly (6) fires on a successful logon that is suspicious by pattern (NTLM network logon with a local account between workstations), not on any failure.
• Exclusion-based rules (7) separate the attack from legitimate lookalike traffic, alerting on directory replication only when it comes from a non-DC account, since real domain controllers replicate constantly.

Detection stack

Host-based: Wazuh agents on the DC and workstations read the Windows Security event channel and ship events to a central manager. Custom rules in local_rules.xml surface the attacks the stock ruleset misses.

Network-based: Packet capture (tcpdump) on the isolated lab segment captures name-resolution poisoning that host agents cannot see. This is the one attack class where a network sensor is required.

A recurring theme: the stock Wazuh ruleset does not detect any of the host-based attacks out of the box. It labels the underlying events as low-severity noise. Each part's real work is tracing the event end to end and writing the custom rule (or deploying the right sensor) that surfaces it. DCSync is the sharpest example, its 4662 events arrive at the manager but produce no default alert, so one of the most severe AD attacks is invisible until a custom rule is built.

Infrastructure

• Proxmox host running the full lab
• DC-VULN (Windows Server 2022) — ecorp.local domain controller
• WS01, WS02 (Windows 11) — domain-joined workstations
• Kali — attacker box + network sensor
• OPNsense — firewall and VLAN gateway
• Wazuh manager — central detection platform
• VLAN 60 (10.60.60.0/24) — isolated lab segment with a single pinhole to Wazuh for continued agent reporting

Build order

1. Setup/01-Install-DomainController.ps1 on a clean Windows Server. Promotes the ecorp.local forest, reboots automatically.
2. Setup/02-Build-Environment.ps1 as ECORP\Administrator after reboot. Creates the OUs, users, groups, service accounts, and audit policy.
3. Deploy Wazuh agents to the DC and workstations, confirm events land.
4. Add the custom rules from the writeups to /var/ossec/etc/rules/local_rules.xml.
5. Isolate the lab (VLAN 60 + OPNsense firewall rules) before running Responder.
6. Work each slice: plant the misconfiguration, run the attack, confirm the detection fires, document.

Repository layout

Vulnerable-AD-DC-Project---Hunter-Weygandt/
        ├── README.md
        ├── Setup/
        │   ├── 01-Install-DomainController.ps1   (forest promotion)
        │   └── 02-Build-Environment.ps1          (population + audit policy)
        ├── Logs/
        │   ├── ACL Abuse - Wazuh Log
        │   ├── ASREP - Wazuh Log
        │   ├── DCSync - Wazuh Log
        │   ├── Kerberoasting - Wazuh Log
        │   ├── Pass-the-Hash - Wazuh Log
        │   └── Password Spraying - Wazuh Log
        └── Wazuh Rules/
            ├── ACL Abuse Rule
            ├── ASREP Rule
            ├── DCSync Rule
            ├── Kerberoasting Rule
            ├── Pass-the-Hash Rule
            └── Password Spraying Rule

        hunterweygandt.com/posts/vulnerable-ad-lab/
        ├── about
        ├── building-the-lab
        ├── kerberoasting
        ├── asrep
        ├── password-spray
        ├── llmnr-poisoning
        ├── acl-abuse
        ├── pass-the-hash
        └── dcsync