« Red Team Engineer

Phase 03 — Network Attacks, Protocols & Pivoting

Operation Cedar Lattice, Phase 03. Phase 01 turned CTI on FIN-LATTICE into an ATT&CK-mapped emulation plan; Phase 02 built the toolkit. Now the engagement against Meridian Freight International moves onto the wire. This phase is the bridge from plan to foothold to internal map: you do external reconnaissance of Meridian's perimeter, land a foothold behind a field-office VPN, and build the internal pivot map — the reachability graph the rest of the engagement walks. And because this is a red team track, every step ends in the network telemetry that catches it: the netflow shape of a pivot, the entropy of a DNS tunnel, the proxy log of a beacon, the Zeek/Suricata signature of the scan.

The deliverable a real engagement produces here is not "we got a shell." It is an attack-path / pivot map of the internal network, the segmentation and egress controls that would have broken it, and the network detections the SOC should have fired — the artifact the privilege-escalation (P04) and Active Directory (P05) phases build on.

Safety. Authorized-lab only. Every lab in this phase is an analyzer / planner / graph-solver / detection-mapper over synthetic metadata — network graphs, firewall rules, flow records. There are no live targets, no scanning of real hosts, no tunneling tools, no weaponization. The labs are planners and policy-analyzers; every offensive concept ends in its detection / segmentation control. This is the same boundary as the security track's offensive-methodology-mastery/ (and directly extends its network-pivot-planner lab).

Why this phase exists

Every later phase assumes you can already move around a network. Privilege escalation (P04) needs a host to escalate on; the AD attack (P05) needs a path to the domain controller; the C2 phase (P08) needs an egress channel out. None of that is possible without the network layer: knowing what a protocol reveals, how reconnaissance maps an environment, how a pivot turns one foothold into reachability across a whole segment, and — critically — what each of those actions looks like to a network sensor.

This phase is also where the red teamer and the network defender become the same person. An attack-path planner and a segmentation-planning tool are the same graph algorithm. An egress allow-list is both the control that stops a beacon and the audit that finds the hole. The most valuable thing you take from Phase 03 is the habit of seeing every offensive network move and its detection at the same time — which is exactly what makes the knowledge hireable rather than merely dangerous.

Learning Objectives

By the end of this phase you can, without notes:

1. Read the OSI / TCP-IP model and say, for each layer, what an attacker learns and what telemetry that layer produces (Ethernet/ARP, IP/ICMP, TCP/UDP, TLS, HTTP/DNS/SMB).
2. Explain DNS end to end — recursion, record types, the resolver path — and how DNS is used three ways: as reconnaissance, as a covert channel (tunneling / C2), and as a detection surface (volume, entropy, NXDOMAIN bursts, query length).
3. Describe the SMB / NTLM / Kerberos transports at the protocol level — enough to know what a relay, a coerced authentication, or a Kerberoast looks like on the wire and in the logs.
4. Draw the line between passive and active reconnaissance, and state the legal/authorization boundary that separates research from an offense.
5. Explain scanning theory: TCP state machine, why a SYN scan, the rate-vs-stealth tradeoff, and how a scan appears in netflow and IDS telemetry.
6. Model pivoting and tunneling — SOCKS proxies, local / remote / dynamic port-forwarding, chisel/ligolo concepts — as reachability over a graph, and compute the path, the cost, and the choke point.
7. Design network segmentation (VLANs, ACLs, zero-trust, microsegmentation) and egress filtering / allow-listing, and prove a policy blocks a given lateral path.
8. Map each offensive network behavior to the telemetry that detects it — netflow shape, DNS volume/entropy, proxy logs, Zeek / Suricata — and write the detection.

The network layers and what each reveals (read the WARMUP for depth)

L7  HTTP/DNS/SMB    application intent       "who talks to whom, and what for?"   → proxy/DNS/Zeek logs
L4  TCP/UDP         ports, sessions, state   "what services, what sessions?"      → netflow, conn logs
L3  IP/ICMP         addressing, routing      "what hosts, what topology?"         → flow records, routes
L2  Ethernet/ARP    local adjacency          "what is on my segment?"             → ARP/switch telemetry

Each layer is an attacker's information source and a defender's sensor. The skill is holding both views at once.

Concepts

Labs

The two labs compose: Lab 01 finds the lateral path and the choke point; Lab 02 decides whether the segmentation policy blocks that path and turns the choke point into a firewall rule and an egress allow-list. Together they are the attacker's planner and the defender's control over the same graph.

Each lab follows LAB-STANDARD.md: lab.py (TODOs), a complete solution.py, adversarial test_lab.py, README.md, requirements.txt — pure Python (stdlib + pytest), offline, deterministic, with the detection pairing built in.

cd lab-01-pivot-attack-path-planner
LAB_MODULE=solution pytest -q   # reference passes (17 tests)
pytest -q                        # your implementation after the TODOs

cd ../lab-02-segmentation-egress-analyzer
LAB_MODULE=solution pytest -q   # reference passes (20 tests)

Deliverables

• A pivot / attack-path planner that, given Meridian's internal reachability graph and a foothold, computes the set of reachable hosts, the cheapest (quietest) path to a crown jewel, and the choke points whose removal disconnects the foothold from the target.
• A segmentation & egress analyzer that evaluates flows against a firewall ruleset, flags over-permissive and broad-egress (likely-C2) rules, proves whether a proposed segmentation policy blocks a lateral path, and emits egress-allow-list recommendations.
• The Operation Cedar Lattice Phase 03 artifact: the internal pivot map (foothold → crown jewels), the choke-point list, the segmentation + egress policy that breaks the path, and the network detections (netflow, DNS-entropy, proxy, Zeek/Suricata) that should have fired — all over synthetic metadata.
• The fluency to explain DNS, SMB/NTLM/Kerberos transports, scanning theory, and pivoting in an interview, and to pair every network attack with its telemetry and control.

Readings (primary sources)

• The TCP/IP Guide (Kozierok) — the protocol reference for this phase.
• RFC 1034 / 1035 (DNS concepts + implementation), RFC 9293 (TCP), RFC 826 (ARP), RFC 9110 (HTTP semantics), RFC 4120 (Kerberos), RFC 1928 (SOCKS5).
• MITRE ATT&CK network techniques: Network Service Discovery (T1046), Remote System Discovery (T1018), Remote Services (T1021), Internal/External Proxy (T1090), Protocol Tunneling (T1572), Application-Layer Protocol C2 (T1071), Non-Standard Port (T1571), Exfiltration Over C2 (T1041), DNS (T1071.004), Adversary-in-the-Middle / LLMNR-NBT-NS / ARP (T1557).
• Zeek documentation (conn, dns, http, ssl, notice logs) and Suricata rules docs.
• MITRE D3FEND for the defensive mapping; NIST SP 800-207 (Zero Trust Architecture).
• Conference talks on DNS tunneling detection and netflow-based lateral-movement hunting.

Common Mistakes

• Treating reachability as a list, not a graph. "These hosts are reachable" misses the path, the cost, and — crucially — the choke point. The graph is the deliverable (Lab 01).
• Optimizing for fewest hops instead of least noise. The shortest path is often the loudest. The cheapest path (Dijkstra over detection-risk) is the one an operator takes and the one to instrument.
• Scanning at full rate "to be fast." Aggressive scans light up every IDS. Rate-vs-stealth is a deliberate OPSEC choice, and the scan's netflow signature is a detection (WARMUP Ch. 5, 10).
• Forgetting that a pivot is loud. A SOCKS proxy through a jump host produces an east-west netflow fan-out and many short multiplexed connections from one source — a textbook detection.
• Allowing broad egress. any-any outbound and odd-port internet egress are how beacons get home. Deny-by-default egress + an allow-list + a proxy is the single highest-leverage network control.
• Mapping an attack but never the detection. A pivot map without its netflow/DNS/proxy/Zeek detection is half the work — and fails this track's detection-pairing bar.
• Crossing the authorization line in recon. Passive OSINT is not active scanning. Never test a host because it is reachable; the boundary is written authorization (WARMUP Ch. 4).

Interview Questions

1. Walk the TCP three-way handshake and the TCP state machine. Why does a SYN scan work, what does it leave half-open, and how does a defender detect it?
2. Explain DNS resolution end to end. How is DNS used for reconnaissance, as a covert C2/tunnel, and as a detection surface — and what exactly do you measure to catch a tunnel?
3. What is a pivot? Compare local, remote, and dynamic (SOCKS) port-forwarding, and explain why a pivot is "just reachability over a graph." How does each appear in netflow?
4. Given a foothold and a target, how do you find the quietest path, and how does a defender find the choke point? Why are those the same algorithm?
5. Design the network segmentation and egress filtering that would stop a lateral path from a VPN foothold to a database. What does deny-by-default egress + an allow-list actually buy you?
6. What does SMB/NTLM authentication look like on the wire and in the logs, and what makes an NTLM relay or a coerced authentication detectable?
7. You suspect C2 in a netflow + DNS + proxy dataset but have no malware sample. What signals do you hunt — beacon periodicity, JA3/JA4, DNS entropy, long connections to rare destinations — and which costs the adversary the most to evade (Pyramid of Pain)?
8. What is the difference between passive and active reconnaissance, and where exactly is the legal/ authorization line?

(Full principal-level answers are in WARMUP.md.)

Portfolio artifact

The Operation Cedar Lattice Phase 03 network package: the internal pivot map (Lab 01 output — foothold → reachable hosts → cheapest path to the ERP database and the domain controller, with the choke-point list); the segmentation + egress policy (Lab 02 output — the firewall ruleset that blocks the path, the over-permissive findings, and the egress allow-list); and the network-detection matrix pairing each offensive step (recon, scan, pivot, DNS tunnel, beacon) with the netflow / DNS / proxy / Zeek / Suricata telemetry that catches it — all over synthetic metadata, no real targets, no weaponization. This is 03-network-and-pivoting/ in the capstone portfolio.

Guides

• WARMUP.md — the from-zero deep dive: the OSI/TCP-IP model, DNS, SMB/NTLM/Kerberos transports, recon and the legal line, scanning theory, pivoting & tunneling as graph reachability, segmentation, egress filtering, and the network telemetry that detects each.
• HITCHHIKERS-GUIDE.md — the operator's range walkthrough: on an owned isolated range, map the topology, build a pivot through a multi-homed host, stand up a SOCKS proxy, observe the netflow/DNS it generates, then add a segmentation ACL + egress allow-list that breaks it, and write the Zeek/Suricata detection.