Phase 00 — Lab 02 — OPSEC Risk Scorer + Deconfliction Log

Concept: OPSEC, indicators, deconfliction. WARMUP: Chapters 7–9.

The problem

Before an operator runs an action, two questions decide whether to proceed: "how loud is this, and what will it leave behind?" (OPSEC) and "does the client's SOC need to know this is me before I do it?" (deconfliction). Get the first wrong and you burn a technique or trip an alert you meant to study; get the second wrong and the SOC spins up a real incident-response over your activity — wasting their night and possibly triggering a containment that breaks the engagement.

This lab makes both decisions explicit and deterministic. It scores an action's OPSEC risk from a transparent weighted sum of its attributes, enumerates the indicators it will emit on the host, network, and identity planes, decides whether it must be pre-deconflicted, and keeps the deconfliction log that lets the SOC later answer "was that you?" for any time window without halting their response.

A red team action you cannot describe the telemetry of is exactly the action the SOC cannot deconflict — and the action that teaches the blue team nothing. Naming the indicators is the whole point: it is what turns offensive activity into a defensible, hireable, detection-paired asset.

What you build (lab.py)

  • score_action(action) -> int — weighted sum over noise, novelty, blast_radius, time_of_day, irreversibility (weights in WEIGHTS).
  • risk_band(action) -> str — map the score to low / medium / high / critical (BANDS).
  • indicators(action) -> {host, network, identity} — the telemetry the method characteristically leaves, from INDICATOR_CATALOG.
  • requires_deconfliction(action) -> bool — true at/above DECONFLICTION_THRESHOLD.
  • assess(action) -> dict — bundle score, band, indicators, and the deconfliction decision.
  • DeconflictionLog with record(action, operator, note), lookup(ts_start, ts_end), and was_this_us(ts_start, ts_end) — the SOC's "was that you?" query, kept sorted for determinism.

Attack/abuse cases the tests cover

  • High-noise scores higher — louder/novel/wide-blast/off-hours/irreversible actions score up.
  • Bands and boundaries — score < 4 is low; the band thresholds are exact and tested.
  • Indicators enumerated by plane — lateral movement leaves host and network and identity indicators; recon is network-heavy with little on the host; an unknown method yields empty planes.
  • Deconfliction required above threshold — a loud lateral move requires pre-deconfliction; quiet recon does not; the boundary (exactly at the threshold) is inclusive.
  • Log lookup by window — given a SOC alert time, lookup returns exactly the actions in that window; outside the window is empty; the log carries indicators for SOC cleanup.
  • Determinism — scoring, indicators, assessment, and lookups are reproducible; the log is kept sorted by (timestamp, name) so lookups are stable regardless of insertion order.

Run

pip install -r requirements.txt
LAB_MODULE=solution pytest -q   # reference passes
pytest -q                        # your implementation after the TODOs

Hardening / detection (the detection pairing)

The INDICATOR_CATALOG is the detection pairing: every method maps to the telemetry a defender would use to catch it. Carry it forward:

  • For each indicator, name the Sysmon/ETW event id or Sigma rule that fires on it (several are annotated already, e.g. Kerberoasting → EID 4769, process creation → Sysmon EID 1). Phase 07 turns this into a full telemetry-gap map.
  • The deconfliction log is the operator side of the contract; the evidence manifest (templates/evidence-manifest.md) and the tooling-IOC handoff are the client side. Together they let the SOC distinguish your beacon from a real one at 3 a.m.

Extensions (build in your own isolated range)

  • Replace the flat weights with a calibrated model tuned to the client's detection maturity.
  • Join indicators() to a real Sigma rule pack and report, per action, which rules should fire.
  • Persist the log as a signed, hash-chained record (tamper-evident) in the evidence store.
  • Add a noise budget: cap the cumulative OPSEC score per host/day and deny actions over budget.

Interview / resume

"Built an OPSEC risk scorer and deconfliction log: a weighted-sum risk band over an action's noise, novelty, blast radius, time-of-day, and reversibility; a per-method indicator catalog across the host/network/identity planes; a deconfliction threshold; and a time-windowed 'was that you?' log so the client SOC can confirm red team activity without launching a real incident response."

Limitations: the weights and threshold are a defensible default, not a calibrated model (exposed as constants so a reviewer sees exactly what drives a decision). Indicators are a representative catalog, not an exhaustive telemetry map. The log is in-memory and append-only; signing and persistence are extensions (see the HITCHHIKER guide).