We’ve released our new Active Directory Purple Teaming Lab, designed and developed by Cyber Helmets and powered by CYBER RANGES.
The lab provides a simulated Active Directory environment where participants can explore exploitation, detection, and remediation through hands-on scenarios. It is available as part of our instructor-led Active Directory Purple Teaming training.
The lab focuses on common Active Directory security risks, including misconfigurations, excessive permissions, weak certificate template settings, and delegation features that introduce unintended privilege escalation paths.
Participants can explore how these weaknesses are exploited, what traces they leave behind, and how to address them.
From misconfiguration to remediation
The lab follows five operational phases:
- Misconfiguration: Identify structural weaknesses in Active Directory, from insecure account properties to excessive object permissions and vulnerable certificate configurations.
- Enumeration: Map directory relationships, privilege boundaries, service associations, and potential attack paths to understand how individual weaknesses can be chained together.
- Exploitation: Validate the security impact of identified misconfigurations through controlled, directory-focused attack scenarios.
- Detection: Investigate the telemetry generated by these techniques and identify opportunities to improve monitoring, alerting, and detection engineering.
- Remediation: Address the underlying weaknesses through permission auditing, privilege restriction, configuration hardening, and least-privilege enforcement.
The workflow connects offensive techniques with defensive analysis, allowing participants to examine why an attack works, how it can be detected, and how the underlying weakness can be addressed.
What does the lab cover?
The lab covers a range of Active Directory attack surfaces, including:
- Kerberos attacks: AS-REP roasting, Kerberoasting, and delegation abuse.
- Active Directory Certificate Services (AD CS): Vulnerable certificate templates, enrollment permissions, and certificate authority access controls.
- DACL abuse: Password-reset rights, excessive object control, group membership manipulation, shadow credentials, and resource-based constrained delegation.
- Group Policy and directory replication abuse: Weak script permissions, replication rights, and their implications for privileged credential exposure.
- Credential exposure: Insecure storage and other weaknesses that can turn seemingly minor oversights into significant security risks.
These scenarios demonstrate how isolated configuration issues can combine to create paths toward higher privileges and broader domain compromise.
Connecting offensive and defensive security
The lab brings offensive validation and defensive investigation into the same workflow.
By working through configuration weaknesses, exploitation paths, observable activity, and remediation, participants can practice identifying attack paths, investigating their impact, and improving the security controls designed to prevent them.
Explore the Active Directory Purple Teaming Lab
Our Active Directory Purple Teaming Lab is listed on the CYBER RANGES platform and is available exclusively as part of Cyber Helmets’ instructor-led training.
Create your free CYBER RANGES account to view the lab’s details, objectives, and prerequisites, or learn more about our training to find out how you can participate.
Explore the Training
Active Directory Purple Teaming Training →
Explore the Lab on CYBER RANGES
