Evaluris

Scenario

Internal Network

The breach point is rarely where the damage ends.

Assess your internal network and Active Directory from an attacker's perspective. Lateral movement, privilege escalation, and path to domain controller - with verified attack paths, operator-authorized execution gates, and prioritized remediation.

Outcomes

What you get

Internal network discovery from a designated scope (VLAN, segment, or host list)
Active Directory and identity assessment: misconfigurations, weak policies
Lateral movement and privilege escalation path identification
Path-to-domain-controller and crown-jewel mapping
High-risk actions - lateral movement, privilege escalation, credential use, and payload delivery - require explicit operator authorization before execution. Every approval is logged, timestamped, and immutable.
Optional lightweight agent or network-based deployment per your policy
Findings verified with evidence; MITRE ATT&CK and remediation guidance
Reports suitable for red-team follow-up and remediation prioritization

Scope

What we assess

Internal hosts, services, and roles (e.g. DC, file servers, critical apps)
AD structure, GPOs, trust relationships, and Kerberos
Credential and ticket exposure (e.g. Kerberoasting, AS-REP roast)
Network segmentation and choke points
Vulnerable services and missing patches on internal assets
Attack paths from initial access to domain compromise

Attack path

Internal AD chain

From a low-priv foothold to domain impact - with operator-gated steps.

  1. Foothold

    workstation

  2. AD enum

    Kerberos / LDAP

  3. Credential

    relay / spray

  4. Lateral

    operator gate

  5. Domain Admin

    impact proven

Demonstration

Live mission output

Multi-step chains with real CVE correlation, MITRE ATT&CK / ATLAS mapping, and verified proof-of-concept evidence - as SPECTER surfaces them in a mission.

SPECTER: internal network & AD
_

Demo output (English)

Illustrative validated chains from staging engagements. CVE identifiers map to real-world threat intelligence (CISA KEV, vendor advisories). Destructive or high-impact steps (e.g. DCSync, LDAPNightmare exploitation) are shown as detected, operator-gated, or not executed where applicable.

Capabilities

Coverage at a glance

CapabilityIncluded
Internal discovery
AD / identity assessment
Lateral movement paths
Path-to-DC mapping
Agent or network-based
MITRE ATT&CK mapping
Operator approval gates (lateral movement / privesc / credential use)

Scope this scenario in your environment with verified attack paths and compliance-ready evidence from day one.

Deploy Your First MissionSee full solution