This entry is part 17 of 29 in the series Red Team Engagements

Table of Contents

Full Kill Chain Simulation + Splunk Detection Dashboard

Operation Silent Ledger | Northbridge Financial APT Simulation
Purple Team Playbook: ART Execution → Splunk Detection → Custom Dashboard

🗺️ Kill Chain Map — Techniques We’ll Simulate

Kill Chain Phase	MITRE Technique	ART Test
Reconnaissance	T1082 – System Info Discovery	`Invoke-AtomicTest T1082`
Initial Access	T1566.001 – Spearphishing Attachment	Manual / T1204
Execution	T1059.001 – PowerShell	`Invoke-AtomicTest T1059.001`
Persistence	T1547.001 – Registry Run Keys	`Invoke-AtomicTest T1547.001`
Privilege Escalation	T1055 – Process Injection	`Invoke-AtomicTest T1055`
Defense Evasion	T1112 – Modify Registry	`Invoke-AtomicTest T1112`
Credential Access	T1003.001 – LSASS Dump	`Invoke-AtomicTest T1003.001`
Discovery	T1018 – Remote System Discovery	`Invoke-AtomicTest T1018`
Lateral Movement	T1021.001 – RDP	`Invoke-AtomicTest T1021.001`
Collection	T1005 – Local Data from System	`Invoke-AtomicTest T1005`
Exfiltration	T1041 – Exfil over C2 Channel	`Invoke-AtomicTest T1041`

Phase 1 — Prepare the Windows Target

1.1 Install Atomic Red Team

Open PowerShell as Administrator on your Windows target (Northbridge domain machine):

# Bypass execution policy
Set-ExecutionPolicy Bypass -Scope CurrentUser -Force

# Install the Invoke-AtomicRedTeam framework
IEX (IWR 'https://raw.githubusercontent.com/redcanaryco/invoke-atomicredteam/master/install-atomicredteam.ps1' -UseBasicParsing)

# Install with atomics folder
Install-AtomicRedTeam -getAtomics -Force

# Import the module
Import-Module "C:\AtomicRedTeam\invoke-atomicredteam\Invoke-AtomicRedTeam.psd1" -Force

1.2 Verify Splunk UF is Forwarding Windows Logs

On the Windows target, confirm your Splunk Universal Forwarder is shipping these sources:

# Check UF status
& "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe" status

# Confirm inputs.conf is monitoring the right channels
Get-Content "C:\Program Files\SplunkUniversalForwarder\etc\system\local\inputs.conf"

Your inputs.conf should have at minimum:

[WinEventLog://Security]
index = windows
disabled = false
start_from = oldest
current_only = false
checkpointInterval = 5

[WinEventLog://System]
index = windows
disabled = false

[WinEventLog://Application]
index = windows
disabled = false

[WinEventLog://Microsoft-Windows-Sysmon/Operational]
index = sysmon
disabled = false
renderXml = false

Phase 2 — Execute the Full Kill Chain

Run this as a single campaign script on the Windows target. Each block maps to a kill chain phase:

# ============================================================
# OPERATION SILENT LEDGER — ART Full Kill Chain Execution
# Northbridge Financial APT Simulation
# ============================================================

Import-Module "C:\AtomicRedTeam\invoke-atomicredteam\Invoke-AtomicRedTeam.psd1" -Force

Write-Host "[*] Starting Kill Chain Simulation..." -ForegroundColor Cyan

# --- PHASE 1: RECONNAISSANCE ---
Write-Host "[*] Phase 1: Reconnaissance" -ForegroundColor Yellow
Invoke-AtomicTest T1082 -TestNumbers 1    # System Information Discovery
Invoke-AtomicTest T1033 -TestNumbers 1    # System Owner/User Discovery
Invoke-AtomicTest T1057 -TestNumbers 1    # Process Discovery
Start-Sleep -Seconds 5

# --- PHASE 2: EXECUTION ---
Write-Host "[*] Phase 2: Execution - PowerShell" -ForegroundColor Yellow
Invoke-AtomicTest T1059.001 -TestNumbers 1   # PowerShell execution
Invoke-AtomicTest T1059.001 -TestNumbers 2   # Encoded PowerShell command
Start-Sleep -Seconds 5

# --- PHASE 3: PERSISTENCE ---
Write-Host "[*] Phase 3: Persistence" -ForegroundColor Yellow
Invoke-AtomicTest T1547.001 -TestNumbers 1   # Registry Run Key persistence
Invoke-AtomicTest T1053.005 -TestNumbers 1   # Scheduled Task creation
Start-Sleep -Seconds 5

# --- PHASE 4: PRIVILEGE ESCALATION ---
Write-Host "[*] Phase 4: Privilege Escalation" -ForegroundColor Yellow
Invoke-AtomicTest T1055 -TestNumbers 1       # Process Injection
Invoke-AtomicTest T1134 -TestNumbers 1       # Access Token Manipulation
Start-Sleep -Seconds 5

# --- PHASE 5: DEFENSE EVASION ---
Write-Host "[*] Phase 5: Defense Evasion" -ForegroundColor Yellow
Invoke-AtomicTest T1112 -TestNumbers 1       # Modify Registry
Invoke-AtomicTest T1562.001 -TestNumbers 1   # Disable/Modify Security Tools
Invoke-AtomicTest T1070.001 -TestNumbers 1   # Clear Windows Event Logs
Start-Sleep -Seconds 5

# --- PHASE 6: CREDENTIAL ACCESS ---
Write-Host "[*] Phase 6: Credential Access" -ForegroundColor Yellow
Invoke-AtomicTest T1003.001 -TestNumbers 1   # LSASS Memory dump
Invoke-AtomicTest T1110.001 -TestNumbers 1   # Password Brute Force
Start-Sleep -Seconds 5

# --- PHASE 7: DISCOVERY ---
Write-Host "[*] Phase 7: Discovery" -ForegroundColor Yellow
Invoke-AtomicTest T1018 -TestNumbers 1       # Remote System Discovery
Invoke-AtomicTest T1049 -TestNumbers 1       # System Network Connections
Invoke-AtomicTest T1016 -TestNumbers 1       # System Network Config Discovery
Start-Sleep -Seconds 5

# --- PHASE 8: LATERAL MOVEMENT ---
Write-Host "[*] Phase 8: Lateral Movement" -ForegroundColor Yellow
Invoke-AtomicTest T1021.001 -TestNumbers 1   # Remote Desktop Protocol
Invoke-AtomicTest T1570 -TestNumbers 1       # Lateral Tool Transfer
Start-Sleep -Seconds 5

# --- PHASE 9: COLLECTION ---
Write-Host "[*] Phase 9: Collection" -ForegroundColor Yellow
Invoke-AtomicTest T1005 -TestNumbers 1       # Data from Local System
Invoke-AtomicTest T1560.001 -TestNumbers 1   # Archive via Utility (zip)
Start-Sleep -Seconds 5

# --- PHASE 10: EXFILTRATION ---
Write-Host "[*] Phase 10: Exfiltration" -ForegroundColor Yellow
Invoke-AtomicTest T1041 -TestNumbers 1       # Exfil over C2 channel
Invoke-AtomicTest T1048 -TestNumbers 1       # Exfil over alternative protocol

Write-Host "[+] Kill Chain Simulation Complete!" -ForegroundColor Green

Cleanup After Simulation

Run separately after reviewing detections:

# Cleanup all tests
Invoke-AtomicTest T1547.001 -Cleanup
Invoke-AtomicTest T1053.005 -Cleanup
Invoke-AtomicTest T1562.001 -Cleanup
# Repeat for each technique used

Phase 3 — Splunk Detection Searches (SPL)

Run these in Search & Reporting first to validate data is flowing before building the dashboard.

🔍 Search 1 — Reconnaissance (Discovery Commands)

index=sysmon OR index=windows EventCode=4688 OR EventCode=1
(CommandLine="*whoami*" OR CommandLine="*systeminfo*" OR CommandLine="*hostname*" 
 OR CommandLine="*net user*" OR CommandLine="*net localgroup*" OR CommandLine="*tasklist*"
 OR CommandLine="*ipconfig*" OR CommandLine="*arp -a*")
| eval Phase="1 - Reconnaissance"
| table _time, host, User, ParentImage, Image, CommandLine, Phase
| sort _time

🔍 Search 2 — Execution (PowerShell Abuse)

index=sysmon EventCode=1
(Image="*powershell.exe*" OR Image="*pwsh.exe*")
(CommandLine="*-EncodedCommand*" OR CommandLine="*-enc*" OR CommandLine="*IEX*" 
 OR CommandLine="*Invoke-Expression*" OR CommandLine="*DownloadString*"
 OR CommandLine="*bypass*" OR CommandLine="*-nop*" OR CommandLine="*hidden*")
| eval Phase="2 - Execution"
| eval Risk=case(
    like(CommandLine,"%EncodedCommand%"),"HIGH",
    like(CommandLine,"%IEX%"),"HIGH",
    like(CommandLine,"%bypass%"),"MEDIUM",
    true(),"LOW")
| table _time, host, User, CommandLine, Risk, Phase
| sort -Risk

🔍 Search 3 — Persistence (Registry & Scheduled Tasks)

index=sysmon (EventCode=13 OR EventCode=1)
(TargetObject="*\\CurrentVersion\\Run*" OR TargetObject="*\\CurrentVersion\\RunOnce*"
 OR CommandLine="*schtasks*" OR CommandLine="*at.exe*" OR CommandLine="*New-ScheduledTask*")
| eval Phase="3 - Persistence"
| eval Technique=case(
    like(TargetObject,"%Run%"),"T1547.001 - Registry Run Keys",
    like(CommandLine,"%schtasks%"),"T1053.005 - Scheduled Task",
    true(),"Unknown")
| table _time, host, User, Technique, TargetObject, CommandLine, Phase
| sort _time

🔍 Search 4 — Privilege Escalation (Token & Process Injection)

index=sysmon (EventCode=8 OR EventCode=10)
| eval Phase="4 - Privilege Escalation"
| eval Technique=case(
    EventCode=8,"T1055 - Process Injection (CreateRemoteThread)",
    EventCode=10,"T1055 - Process Injection (OpenProcess)",
    true(),"Unknown")
| table _time, host, SourceImage, TargetImage, EventCode, Technique, Phase
| sort _time

🔍 Search 5 — Defense Evasion (Log Clearing)

index=windows (EventCode=1102 OR EventCode=104 OR EventCode=4688)
(Message="*audit log was cleared*" OR CommandLine="*wevtutil cl*" 
 OR CommandLine="*Clear-EventLog*" OR CommandLine="*auditpol*")
| eval Phase="5 - Defense Evasion"
| eval Severity="CRITICAL"
| table _time, host, User, EventCode, Message, CommandLine, Severity, Phase
| sort _time

🔍 Search 6 — Credential Access (LSASS Dump)

index=sysmon (EventCode=10 OR EventCode=1)
(TargetImage="*lsass.exe*" 
 OR CommandLine="*sekurlsa*" OR CommandLine="*mimikatz*" 
 OR CommandLine="*procdump*" OR CommandLine="*lsass*"
 OR CommandLine="*comsvcs*")
| eval Phase="6 - Credential Access"
| eval Severity="CRITICAL"
| table _time, host, User, SourceImage, TargetImage, CommandLine, Severity, Phase
| sort _time

🔍 Search 7 — Discovery (Network Enumeration)

index=sysmon EventCode=1
(CommandLine="*net view*" OR CommandLine="*nmap*" OR CommandLine="*ping*" 
 OR CommandLine="*netstat*" OR CommandLine="*arp*" OR CommandLine="*nslookup*"
 OR CommandLine="*nltest*" OR CommandLine="*dsquery*")
| eval Phase="7 - Discovery"
| table _time, host, User, Image, CommandLine, Phase
| sort _time

🔍 Search 8 — Lateral Movement (RDP & SMB)

index=windows (EventCode=4624 OR EventCode=4648 OR EventCode=4625)
(LogonType=10 OR LogonType=3)
NOT (User="*$" OR SourceNetworkAddress="127.0.0.1" OR SourceNetworkAddress="-")
| eval Phase="8 - Lateral Movement"
| eval Technique=case(
    LogonType=10,"T1021.001 - RDP",
    LogonType=3,"T1021.002 - SMB/Admin Shares",
    true(),"Unknown")
| table _time, host, User, SourceNetworkAddress, LogonType, Technique, Phase
| sort _time

🔍 Search 9 — Collection & Staging

index=sysmon EventCode=1
(CommandLine="*compress*" OR CommandLine="*zip*" OR CommandLine="*7z*" 
 OR CommandLine="*Compress-Archive*" OR CommandLine="*rar*"
 OR CommandLine="*xcopy*" OR CommandLine="*robocopy*")
| eval Phase="9 - Collection"
| table _time, host, User, Image, CommandLine, Phase
| sort _time

🔍 Search 10 — Exfiltration

index=sysmon (EventCode=3 OR EventCode=1)
(CommandLine="*curl*" OR CommandLine="*wget*" OR CommandLine="*Invoke-WebRequest*"
 OR CommandLine="*ftp*" OR CommandLine="*scp*" OR CommandLine="*certutil*"
 OR DestinationPort=443 OR DestinationPort=80 OR DestinationPort=21)
NOT (DestinationIp="10.*" OR DestinationIp="192.168.*" OR DestinationIp="172.*")
| eval Phase="10 - Exfiltration"
| table _time, host, User, Image, CommandLine, DestinationIp, DestinationPort, Phase
| sort _time

Phase 4 — Build the Splunk Dashboard

4.1 Create the Dashboard

In Splunk: Dashboards → Create New Dashboard

Name: Operation Silent Ledger — Kill Chain Monitor
Description: ART Adversary Simulation — Full Kill Chain Detection
Switch to Source view and paste the XML below.

<dashboard version="1.1" theme="dark">
  <label>🎯 Operation Silent Ledger — Kill Chain Monitor</label>
  <description>Atomic Red Team Full Kill Chain Detection | Northbridge Financial APT Simulation</description>

  <!-- ============================================================ -->
  <!-- ROW 0: HEADER METRICS -->
  <!-- ============================================================ -->
  <row>
    <panel>
      <title>Total Events Detected</title>
      <single>
        <search>
          <query>
            (index=sysmon OR index=windows) earliest=-24h
            | stats count
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="colorMode">block</option>
        <option name="rangeColors">["0x53A051","0xF8BE34","0xDC4E41"]</option>
        <option name="underLabel">Events (24h)</option>
      </single>
    </panel>
    <panel>
      <title>Kill Chain Phases Detected</title>
      <single>
        <search>
          <query>
            (index=sysmon OR index=windows) earliest=-24h
            (CommandLine="*whoami*" OR CommandLine="*systeminfo*" 
             OR CommandLine="*EncodedCommand*" OR CommandLine="*IEX*"
             OR TargetObject="*\\CurrentVersion\\Run*" 
             OR CommandLine="*schtasks*"
             OR TargetImage="*lsass.exe*"
             OR EventCode=1102 OR EventCode=104
             OR CommandLine="*net view*" OR CommandLine="*nltest*"
             OR (LogonType=10 AND EventCode=4624)
             OR CommandLine="*Compress-Archive*"
             OR CommandLine="*Invoke-WebRequest*")
            | eval Phase=case(
                match(CommandLine,"whoami|systeminfo|hostname|tasklist"),"Reconnaissance",
                match(CommandLine,"EncodedCommand|IEX|DownloadString|bypass"),"Execution",
                match(CommandLine,"schtasks|RunOnce") OR match(TargetObject,"CurrentVersion.Run"),"Persistence",
                match(TargetImage,"lsass.exe") OR match(CommandLine,"mimikatz|sekurlsa"),"Credential Access",
                EventCode=1102 OR match(CommandLine,"wevtutil|Clear-EventLog"),"Defense Evasion",
                match(CommandLine,"net view|nltest|nmap|netstat"),"Discovery",
                LogonType=10,"Lateral Movement",
                match(CommandLine,"Compress-Archive|7z|zip"),"Collection",
                match(CommandLine,"Invoke-WebRequest|curl|wget"),"Exfiltration",
                true(),"Other")
            | where Phase!="Other"
            | stats dc(Phase) as UniquePhases
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="colorMode">block</option>
        <option name="underLabel">/ 10 Phases</option>
        <option name="rangeColors">["0xDC4E41","0xF8BE34","0x53A051"]</option>
        <option name="ranges">[0,4,7,10]</option>
      </single>
    </panel>
    <panel>
      <title>Critical Severity Alerts</title>
      <single>
        <search>
          <query>
            (index=sysmon OR index=windows) earliest=-24h
            (TargetImage="*lsass.exe*" OR EventCode=1102 OR EventCode=104
             OR CommandLine="*mimikatz*" OR CommandLine="*sekurlsa*")
            | stats count
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="colorMode">block</option>
        <option name="underLabel">Critical Alerts</option>
        <option name="rangeColors">["0x53A051","0xF8BE34","0xDC4E41"]</option>
        <option name="ranges">[0,1,5]</option>
      </single>
    </panel>
    <panel>
      <title>Unique Hosts Affected</title>
      <single>
        <search>
          <query>
            (index=sysmon OR index=windows) earliest=-24h
            | stats dc(host) as UniqueHosts
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="colorMode">block</option>
        <option name="underLabel">Hosts</option>
        <option name="rangeColors">["0x53A051","0xF8BE34","0xDC4E41"]</option>
        <option name="ranges">[0,2,5]</option>
      </single>
    </panel>
    <panel>
      <title>Unique Attacking Users</title>
      <single>
        <search>
          <query>
            index=sysmon earliest=-24h EventCode=1
            | stats dc(User) as UniqueUsers
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="colorMode">block</option>
        <option name="underLabel">Users</option>
      </single>
    </panel>
  </row>

  <!-- ============================================================ -->
  <!-- ROW 1: KILL CHAIN HEATMAP + TIMELINE -->
  <!-- ============================================================ -->
  <row>
    <panel>
      <title>📊 Kill Chain Phase Detection Heatmap</title>
      <chart>
        <search>
          <query>
            (index=sysmon OR index=windows) earliest=-24h
            | eval Phase=case(
                match(CommandLine,"whoami|systeminfo|hostname|net user|tasklist|ipconfig"),"1-Reconnaissance",
                match(CommandLine,"EncodedCommand|IEX|DownloadString|Invoke-Expression|-enc |-nop "),"2-Execution",
                match(CommandLine,"schtasks|New-ScheduledTask") OR match(TargetObject,"CurrentVersion.Run"),"3-Persistence",
                (EventCode=8 OR EventCode=10) AND NOT match(TargetImage,"lsass.exe"),"4-Priv Escalation",
                EventCode=1102 OR EventCode=104 OR match(CommandLine,"wevtutil|Clear-EventLog|auditpol"),"5-Defense Evasion",
                match(TargetImage,"lsass.exe") OR match(CommandLine,"mimikatz|sekurlsa|procdump|comsvcs"),"6-Credential Access",
                match(CommandLine,"net view|nmap|nltest|dsquery|netstat|arp "),"7-Discovery",
                (EventCode=4624 AND (LogonType=10 OR LogonType=3)),"8-Lateral Movement",
                match(CommandLine,"Compress-Archive|7z.exe|zip|robocopy|xcopy"),"9-Collection",
                match(CommandLine,"Invoke-WebRequest|curl|wget|ftp|certutil"),"10-Exfiltration",
                true(),"Other")
            | where Phase!="Other"
            | stats count by Phase
            | sort Phase
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">bar</option>
        <option name="charting.chart.orientation">horizontal</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.seriesColors">["0xDC4E41"]</option>
        <option name="charting.axisTitleX.text">Event Count</option>
        <option name="charting.axisTitleY.text">Kill Chain Phase</option>
      </chart>
    </panel>
    <panel>
      <title>⏱️ Attack Timeline — Events Over Time</title>
      <chart>
        <search>
          <query>
            (index=sysmon OR index=windows) earliest=-24h
            | eval Phase=case(
                match(CommandLine,"whoami|systeminfo|hostname|tasklist"),"Recon",
                match(CommandLine,"EncodedCommand|IEX|bypass|-nop"),"Execution",
                match(CommandLine,"schtasks") OR match(TargetObject,"CurrentVersion.Run"),"Persistence",
                EventCode=1102 OR match(CommandLine,"wevtutil|Clear-EventLog"),"Defense Evasion",
                match(TargetImage,"lsass.exe") OR match(CommandLine,"mimikatz"),"Cred Access",
                match(CommandLine,"net view|nltest|netstat"),"Discovery",
                (EventCode=4624 AND LogonType=10),"Lateral Movement",
                match(CommandLine,"Compress-Archive|7z"),"Collection",
                match(CommandLine,"Invoke-WebRequest|curl|wget"),"Exfiltration",
                true(),"Other")
            | where Phase!="Other"
            | timechart span=5m count by Phase
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">area</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.legend.placement">bottom</option>
      </chart>
    </panel>
  </row>

  <!-- ============================================================ -->
  <!-- ROW 2: RECONNAISSANCE + EXECUTION -->
  <!-- ============================================================ -->
  <row>
    <panel>
      <title>🔭 Phase 1 — Reconnaissance Commands</title>
      <table>
        <search>
          <query>
            index=sysmon earliest=-24h EventCode=1
            (CommandLine="*whoami*" OR CommandLine="*systeminfo*" OR CommandLine="*hostname*" 
             OR CommandLine="*net user*" OR CommandLine="*net localgroup*" OR CommandLine="*tasklist*"
             OR CommandLine="*ipconfig*" OR CommandLine="*arp -a*")
            | eval Phase="Reconnaissance"
            | table _time, host, User, Image, CommandLine
            | sort -_time
            | head 20
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <option name="rowNumbers">true</option>
      </table>
    </panel>
    <panel>
      <title>⚡ Phase 2 — Malicious PowerShell Execution</title>
      <table>
        <search>
          <query>
            index=sysmon earliest=-24h EventCode=1
            (Image="*powershell.exe*" OR Image="*pwsh.exe*")
            (CommandLine="*-EncodedCommand*" OR CommandLine="*-enc *" OR CommandLine="*IEX*" 
             OR CommandLine="*Invoke-Expression*" OR CommandLine="*DownloadString*"
             OR CommandLine="*bypass*" OR CommandLine="*-nop *" OR CommandLine="*hidden*")
            | eval Risk=case(
                like(CommandLine,"%EncodedCommand%") OR like(CommandLine,"%-enc %"),"🔴 HIGH",
                like(CommandLine,"%IEX%") OR like(CommandLine,"%DownloadString%"),"🔴 HIGH",
                like(CommandLine,"%bypass%"),"🟡 MEDIUM",
                true(),"🟢 LOW")
            | table _time, host, User, Risk, CommandLine
            | sort -_time
            | head 20
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <option name="rowNumbers">true</option>
      </table>
    </panel>
  </row>

  <!-- ============================================================ -->
  <!-- ROW 3: PERSISTENCE + PRIVILEGE ESCALATION -->
  <!-- ============================================================ -->
  <row>
    <panel>
      <title>🔒 Phase 3 — Persistence Mechanisms</title>
      <table>
        <search>
          <query>
            index=sysmon earliest=-24h (EventCode=13 OR EventCode=1)
            (TargetObject="*\\CurrentVersion\\Run*" OR TargetObject="*\\CurrentVersion\\RunOnce*"
             OR CommandLine="*schtasks*" OR CommandLine="*New-ScheduledTask*")
            | eval Technique=case(
                like(TargetObject,"%Run%"),"T1547.001 - Registry Run Keys",
                like(CommandLine,"%schtasks%"),"T1053.005 - Scheduled Task",
                true(),"Unknown")
            | table _time, host, User, Technique, TargetObject, CommandLine
            | sort -_time
            | head 20
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
      </table>
    </panel>
    <panel>
      <title>⬆️ Phase 4 — Process Injection Events</title>
      <table>
        <search>
          <query>
            index=sysmon earliest=-24h (EventCode=8 OR EventCode=10)
            | eval Technique=case(
                EventCode=8,"T1055 - CreateRemoteThread",
                EventCode=10,"T1055 - OpenProcess Access",
                true(),"Unknown")
            | table _time, host, SourceImage, TargetImage, GrantedAccess, Technique
            | sort -_time
            | head 20
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
      </table>
    </panel>
  </row>

  <!-- ============================================================ -->
  <!-- ROW 4: DEFENSE EVASION + CREDENTIAL ACCESS -->
  <!-- ============================================================ -->
  <row>
    <panel>
      <title>🛡️ Phase 5 — Defense Evasion (Log Clearing) 🚨</title>
      <table>
        <search>
          <query>
            (index=windows OR index=sysmon) earliest=-24h
            (EventCode=1102 OR EventCode=104 OR EventCode=4688)
            (Message="*audit log was cleared*" OR Message="*log was cleared*"
             OR CommandLine="*wevtutil cl*" OR CommandLine="*Clear-EventLog*" OR CommandLine="*auditpol*")
            | eval Severity="🔴 CRITICAL"
            | table _time, host, User, EventCode, Severity, Message, CommandLine
            | sort -_time
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
      </table>
    </panel>
    <panel>
      <title>🔑 Phase 6 — Credential Access (LSASS) 🚨</title>
      <table>
        <search>
          <query>
            index=sysmon earliest=-24h (EventCode=10 OR EventCode=1)
            (TargetImage="*lsass.exe*" OR CommandLine="*sekurlsa*" OR CommandLine="*mimikatz*" 
             OR CommandLine="*procdump*" OR CommandLine="*comsvcs*")
            | eval Severity="🔴 CRITICAL"
            | eval Technique="T1003.001 - LSASS Memory"
            | table _time, host, User, SourceImage, TargetImage, CommandLine, Severity, Technique
            | sort -_time
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
      </table>
    </panel>
  </row>

  <!-- ============================================================ -->
  <!-- ROW 5: DISCOVERY + LATERAL MOVEMENT -->
  <!-- ============================================================ -->
  <row>
    <panel>
      <title>🔍 Phase 7 — Network Discovery</title>
      <table>
        <search>
          <query>
            index=sysmon earliest=-24h EventCode=1
            (CommandLine="*net view*" OR CommandLine="*nmap*" OR CommandLine="*ping *" 
             OR CommandLine="*netstat*" OR CommandLine="*nltest*" OR CommandLine="*dsquery*"
             OR CommandLine="*nslookup*" OR CommandLine="*arp -a*")
            | table _time, host, User, Image, CommandLine
            | sort -_time
            | head 20
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
      </table>
    </panel>
    <panel>
      <title>🔀 Phase 8 — Lateral Movement (RDP/SMB)</title>
      <table>
        <search>
          <query>
            index=windows earliest=-24h (EventCode=4624 OR EventCode=4648 OR EventCode=4625)
            (LogonType=10 OR LogonType=3)
            NOT (User="*$" OR SourceNetworkAddress="127.0.0.1" OR SourceNetworkAddress="-")
            | eval Technique=case(
                LogonType=10,"T1021.001 - RDP",
                LogonType=3,"T1021.002 - SMB",
                true(),"Unknown")
            | eval Status=case(EventCode=4624,"✅ Success",EventCode=4625,"❌ Failed",true(),"Unknown")
            | table _time, host, User, SourceNetworkAddress, LogonType, Technique, Status
            | sort -_time
            | head 20
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
      </table>
    </panel>
  </row>

  <!-- ============================================================ -->
  <!-- ROW 6: COLLECTION + EXFILTRATION -->
  <!-- ============================================================ -->
  <row>
    <panel>
      <title>📦 Phase 9 — Data Collection and Staging</title>
      <table>
        <search>
          <query>
            index=sysmon earliest=-24h EventCode=1
            (CommandLine="*compress*" OR CommandLine="*zip*" OR CommandLine="*7z*" 
             OR CommandLine="*Compress-Archive*" OR CommandLine="*rar*"
             OR CommandLine="*xcopy*" OR CommandLine="*robocopy*")
            | table _time, host, User, Image, CommandLine
            | sort -_time
            | head 20
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
      </table>
    </panel>
    <panel>
      <title>📤 Phase 10 — Exfiltration Attempts 🚨</title>
      <table>
        <search>
          <query>
            index=sysmon earliest=-24h (EventCode=3 OR EventCode=1)
            (CommandLine="*curl*" OR CommandLine="*wget*" OR CommandLine="*Invoke-WebRequest*"
             OR CommandLine="*ftp*" OR CommandLine="*certutil*" OR CommandLine="*bitsadmin*")
            NOT (DestinationIp="10.*" OR DestinationIp="192.168.*" OR DestinationIp="172.*"
                 OR DestinationIp="" OR DestinationIp="-")
            | eval Severity="🔴 HIGH"
            | table _time, host, User, Image, DestinationIp, DestinationPort, CommandLine, Severity
            | sort -_time
            | head 20
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
      </table>
    </panel>
  </row>

  <!-- ============================================================ -->
  <!-- ROW 7: MITRE TECHNIQUE COVERAGE + TOP OFFENDERS -->
  <!-- ============================================================ -->
  <row>
    <panel>
      <title>🗺️ MITRE ATT&amp;CK Technique Frequency</title>
      <chart>
        <search>
          <query>
            (index=sysmon OR index=windows) earliest=-24h
            | eval MITRE_Technique=case(
                match(CommandLine,"whoami|systeminfo|hostname"),"T1082/T1033 - Discovery",
                match(CommandLine,"EncodedCommand|IEX|-enc "),"T1059.001 - PowerShell",
                match(CommandLine,"schtasks") OR match(TargetObject,"CurrentVersion.Run"),"T1547.001/T1053.005 - Persistence",
                EventCode=8 OR EventCode=10,"T1055 - Process Injection",
                EventCode=1102 OR EventCode=104,"T1070 - Log Clearing",
                match(TargetImage,"lsass.exe") OR match(CommandLine,"mimikatz"),"T1003.001 - LSASS Dump",
                match(CommandLine,"net view|nltest|netstat"),"T1018/T1049 - Network Discovery",
                (EventCode=4624 AND LogonType=10),"T1021.001 - RDP",
                match(CommandLine,"Compress-Archive|7z|zip"),"T1560 - Archive",
                match(CommandLine,"Invoke-WebRequest|curl|wget"),"T1041/T1048 - Exfiltration",
                true(),"Other")
            | where MITRE_Technique!="Other"
            | stats count by MITRE_Technique
            | sort -count
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">pie</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.legend.placement">right</option>
      </chart>
    </panel>
    <panel>
      <title>👤 Top Suspicious Users</title>
      <chart>
        <search>
          <query>
            index=sysmon earliest=-24h EventCode=1
            (CommandLine="*whoami*" OR CommandLine="*EncodedCommand*" OR CommandLine="*IEX*"
             OR CommandLine="*schtasks*" OR CommandLine="*mimikatz*" OR CommandLine="*net view*")
            NOT User="-"
            | stats count by User
            | sort -count
            | head 10
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">bar</option>
        <option name="charting.seriesColors">["0xDC4E41"]</option>
      </chart>
    </panel>
    <panel>
      <title>💻 Top Affected Hosts</title>
      <chart>
        <search>
          <query>
            (index=sysmon OR index=windows) earliest=-24h
            (CommandLine="*whoami*" OR CommandLine="*EncodedCommand*" 
             OR EventCode=1102 OR TargetImage="*lsass.exe*")
            | stats count by host
            | sort -count
            | head 10
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">bar</option>
        <option name="charting.seriesColors">["0xF8BE34"]</option>
      </chart>
    </panel>
  </row>

  <!-- ============================================================ -->
  <!-- ROW 8: LIVE EVENT FEED -->
  <!-- ============================================================ -->
  <row>
    <panel>
      <title>📋 Live Event Feed — All Kill Chain Events</title>
      <table>
        <search>
          <query>
            (index=sysmon OR index=windows) earliest=-24h
            (CommandLine="*whoami*" OR CommandLine="*systeminfo*"
             OR CommandLine="*EncodedCommand*" OR CommandLine="*IEX*" OR CommandLine="*bypass*"
             OR TargetObject="*CurrentVersion\\Run*" OR CommandLine="*schtasks*"
             OR EventCode=8 OR EventCode=10
             OR EventCode=1102 OR EventCode=104
             OR TargetImage="*lsass.exe*" OR CommandLine="*mimikatz*"
             OR CommandLine="*net view*" OR CommandLine="*nltest*"
             OR (EventCode=4624 AND LogonType=10)
             OR CommandLine="*Compress-Archive*"
             OR CommandLine="*Invoke-WebRequest*" OR CommandLine="*curl*")
            | eval KillChainPhase=case(
                match(CommandLine,"whoami|systeminfo|tasklist|hostname"),"🔭 Recon",
                match(CommandLine,"EncodedCommand|IEX|bypass|-nop"),"⚡ Execution",
                match(CommandLine,"schtasks") OR match(TargetObject,"CurrentVersion.Run"),"🔒 Persistence",
                (EventCode=8 OR EventCode=10) AND NOT match(TargetImage,"lsass.exe"),"⬆️ Priv Esc",
                EventCode=1102 OR EventCode=104 OR match(CommandLine,"wevtutil|Clear-EventLog"),"🛡️ Def Evasion",
                match(TargetImage,"lsass.exe") OR match(CommandLine,"mimikatz"),"🔑 Cred Access",
                match(CommandLine,"net view|nltest|netstat|nmap"),"🔍 Discovery",
                EventCode=4624 AND LogonType=10,"🔀 Lateral Move",
                match(CommandLine,"Compress-Archive|7z|zip"),"📦 Collection",
                match(CommandLine,"Invoke-WebRequest|curl|wget"),"📤 Exfiltration",
                true(),"ℹ️ Other")
            | table _time, host, User, KillChainPhase, EventCode, Image, CommandLine
            | sort -_time
            | head 50
          </query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">cell</option>
        <option name="rowNumbers">true</option>
        <option name="wrap">false</option>
      </table>
    </panel>
  </row>

</dashboard>

Phase 5 — Create Splunk Alerts for Critical Phases

Navigate to Alerts → Create Alert for each of the following.

Alert 1 — LSASS Dump Detected

Name:     CRITICAL - LSASS Credential Dump Detected
Search:   index=sysmon (EventCode=10 OR EventCode=1)
          (TargetImage="*lsass.exe*" OR CommandLine="*sekurlsa*" OR CommandLine="*mimikatz*")
Schedule: Real-time
Trigger:  Number of results > 0
Severity: Critical
Action:   Send email / Add to triggered alerts

Alert 2 — Event Log Clearing

Name:     CRITICAL - Security Event Log Cleared
Search:   index=windows (EventCode=1102 OR EventCode=104)
Schedule: Real-time
Trigger:  Number of results > 0
Severity: Critical

Alert 3 — Encoded PowerShell

Name:     HIGH - Encoded PowerShell Execution
Search:   index=sysmon EventCode=1 Image="*powershell.exe*"
          (CommandLine="*-EncodedCommand*" OR CommandLine="*-enc *")
Schedule: Every 5 minutes
Trigger:  Number of results > 0
Severity: High

Phase 6 — Verification Checklist

After running the simulation, use this checklist to confirm your detection coverage:

Kill Chain Coverage Checklist
═══════════════════════════════════════════════════════════

Phase 1  - Reconnaissance      [ ] Events in Sysmon EventCode=1
Phase 2  - Execution           [ ] PowerShell cmdlines captured
Phase 3  - Persistence         [ ] Registry (EventCode=13) + Schtasks
Phase 4  - Priv Escalation     [ ] EventCode=8/10 showing injection
Phase 5  - Defense Evasion     [ ] EventCode=1102/104 log clearing
Phase 6  - Cred Access         [ ] LSASS TargetImage captured
Phase 7  - Discovery           [ ] Net/nltest commands in logs
Phase 8  - Lateral Movement    [ ] EventCode=4624 LogonType=10
Phase 9  - Collection          [ ] Compress-Archive in cmdline
Phase 10 - Exfiltration        [ ] Outbound connection EventCode=3

Detection Score: ___ / 10 phases detected

Quick Reference

Action	Command
Run full campaign	`.\KillChain-Campaign.ps1`
Inspect a specific test	`Invoke-AtomicTest T1003.001 -ShowDetails`
Dry run (no execution)	`Invoke-AtomicTest T1059.001 -CheckPrereqs`
Cleanup a test	`Invoke-AtomicTest T1547.001 -Cleanup`
Verify data in Splunk	`index=sysmon earliest=-1h \| stats count by EventCode`

Atomic Red Team — Adversary Simulation and Detection

Full Kill Chain Simulation + Splunk Detection Dashboard

🗺️ Kill Chain Map — Techniques We’ll Simulate

Phase 1 — Prepare the Windows Target

1.1 Install Atomic Red Team

1.2 Verify Splunk UF is Forwarding Windows Logs

Phase 2 — Execute the Full Kill Chain

Cleanup After Simulation

Phase 3 — Splunk Detection Searches (SPL)

🔍 Search 1 — Reconnaissance (Discovery Commands)

🔍 Search 2 — Execution (PowerShell Abuse)

🔍 Search 3 — Persistence (Registry & Scheduled Tasks)

🔍 Search 4 — Privilege Escalation (Token & Process Injection)

🔍 Search 5 — Defense Evasion (Log Clearing)

🔍 Search 6 — Credential Access (LSASS Dump)

🔍 Search 7 — Discovery (Network Enumeration)

🔍 Search 8 — Lateral Movement (RDP & SMB)

🔍 Search 9 — Collection & Staging

🔍 Search 10 — Exfiltration

Phase 4 — Build the Splunk Dashboard

4.1 Create the Dashboard

Phase 5 — Create Splunk Alerts for Critical Phases

Alert 1 — LSASS Dump Detected

Alert 2 — Event Log Clearing

Alert 3 — Encoded PowerShell

Phase 6 — Verification Checklist

Quick Reference

Red Team Engagements

Like this:

Related

Full Kill Chain Simulation + Splunk Detection Dashboard

🗺️ Kill Chain Map — Techniques We’ll Simulate

Phase 1 — Prepare the Windows Target

1.1 Install Atomic Red Team

1.2 Verify Splunk UF is Forwarding Windows Logs

Phase 2 — Execute the Full Kill Chain

Cleanup After Simulation

Phase 3 — Splunk Detection Searches (SPL)

🔍 Search 1 — Reconnaissance (Discovery Commands)

🔍 Search 2 — Execution (PowerShell Abuse)

🔍 Search 3 — Persistence (Registry & Scheduled Tasks)

🔍 Search 4 — Privilege Escalation (Token & Process Injection)

🔍 Search 5 — Defense Evasion (Log Clearing)

🔍 Search 6 — Credential Access (LSASS Dump)

🔍 Search 7 — Discovery (Network Enumeration)

🔍 Search 8 — Lateral Movement (RDP & SMB)

🔍 Search 9 — Collection & Staging

🔍 Search 10 — Exfiltration

Phase 4 — Build the Splunk Dashboard

4.1 Create the Dashboard

Phase 5 — Create Splunk Alerts for Critical Phases

Alert 1 — LSASS Dump Detected

Alert 2 — Event Log Clearing

Alert 3 — Encoded PowerShell

Phase 6 — Verification Checklist

Quick Reference

Red Team Engagements

Share this:

Like this:

Related