Chapter 67 — Project 4: emulate an intrusion, detect every stage, run the IR

Brief

Run a full, multi-stage adversary emulation against your own lab — spanning initial access through impact, crossing cloud, cluster, and application layers — build and live-validate a detection for every single stage before you consider the exercise complete, then execute a real incident-response drill against your own simulated intrusion including cloud/container-specific containment and a destructive (ransomware-style) final stage, ending with the Part 9 program artifacts a real organisation would produce afterward.

Tasks

   1. PLAN THE KILL CHAIN (Part 1 Ch 2, Part 8 Ch 53) -- map a full,
      plausible chain using techniques from EARLIER PARTS of this guide,
      e.g.:
        initial access:   a web app bug from Part 6 (an SSRF or an OAuth
                           flaw) or a phished CI token (Part 3 Ch 12)
        execution:        RCE via one of Part 6's classes
        privilege esc.:   Part 4's RBAC escalation or Part 2's IAM
                           privesc
        lateral movement: Part 5's east-west abuse (if a service is
                           reachable and under-authorized) or Part 4's
                           node-to-cluster escape
        persistence:      a new IAM key / admission webhook / OAuth grant
                           (pick per Part 8 Ch 54's persistence list)
        collection/exfil: Part 2/7's data-plane access, or a Part 7 KMS
                           misuse
        impact:           a RANSOMWARE-STYLE destructive stage (Part 8
                           Ch 56) -- e.g. simulated mass file
                           modification/backup-service-stop, NOT actual
                           encryption of anything you need.

   2. EMULATE (Part 1 Ch 2, Part 8 Ch 53) -- execute each stage for
      real using Atomic Red Team / Stratus Red Team / your own lab
      reproductions from earlier Parts, recording PREVENTED/DETECTED/
      LOGGED/MISSED for every stage.

   3. DETECT EVERY STAGE (Part 8 Ch 51/54) -- for any stage that comes
      back MISSED, build the full-lifecycle detection (hypothesis, Sigma
      rule, unit test, live re-validation) BEFORE moving on. The
      exercise is not complete until every stage is at least DETECTED.

   4. RUN THE IR DRILL (Part 8 Ch 55, G1 Ch 51) -- once detections are in
      place, re-run the ENTIRE chain from the start, this time as a
      "surprise" drill for whoever is on call (even if that's you,
      time-boxed and journaled as if it were a real page):
      [ ] declare, assign an IC, start the timeline.
      [ ] ISOLATE using the cloud/container mechanics from Part 8 Ch 55
          (explicit-deny, cordon-don't-terminate) at the appropriate
          stage.
      [ ] use ENCRYPTION CONTEXT (Part 7 Ch 44) to scope exactly what the
          simulated intrusion could have accessed.
      [ ] ERADICATE and REBUILD from known-good IaC (Part 3), not a
          "cleaned" component.
      [ ] write the blameless post-incident review (G1 Ch 51) with at
          least one ARCHITECTURAL (policy-as-code, Part 3 Ch 11) action
          item, not just a detection-rule fix.

   5. PRODUCE THE PROGRAM ARTIFACTS (Part 9)
      [ ] add every gap found to your Ch 59 vulnerability/detection
          backlog, prioritised.
      [ ] update your ATT&CK coverage heat map (Part 8 Ch 57).
      [ ] write the one-paragraph board-level summary (Part 9 Ch 62) of
          this exercise: what was tested, what was found, what's the
          resourcing ask (if any) to close remaining gaps.

Deliverable

~/sec-lab/adv/projects/p4-intrusion/report.md: the planned kill chain, the prevent/detect/log/miss grid per stage, every detection built during the exercise with its live-validation evidence, the full IR drill timeline and blameless post-incident review, the updated backlog and coverage heat map, and the board-level summary paragraph.

Definition of done

• A realistic, multi-stage kill chain spanning at least three of this guide's earlier Parts, fully emulated.
• Every stage detected (built live if it was initially missed), each with live-validation evidence.
• A complete IR drill using the cloud/container-specific containment mechanics, encryption-context scoping, and rebuild-from-IaC eradication.
• A blameless post-incident review with at least one architectural action item.
• Updated backlog, coverage heat map, and a board-level summary paragraph.

Rubric (/100)

   Kill chain: realistic, multi-stage, cross-Part ........ 15
   Full emulation with prevent/detect/log/miss grid ...... 15
   Every stage detected, live-validated ................... 25
   IR drill: correct containment/eradication mechanics .... 20
   Blameless review with an architectural action item ..... 15
   Program artifacts (backlog, heat map, board summary) ... 10