iwantcoding.com
🔥 Daily 👥 Rooms 🏆 Top Log in Sign up

Exercises

By · Reviewed & last updated · Part of Ethical Hacking Tutorial

Defensive view: three short exercises - threat-model a small app, write one Sigma rule, run an Atomic Red Team test.

Three defender drills

EXAMPLE
# 1. Threat model a small app

Pick an app you know (your todo app, your blog). Spend 30 minutes:

- Draw a 1-page architecture diagram (boxes + arrows)
- Identify trust boundaries (where data crosses an authz domain)
- For each element, apply STRIDE:
  - Spoofing       - who can pretend to be the user/service?
  - Tampering      - what can be modified at rest or in transit?
  - Repudiation    - can actions be denied without proof?
  - Info disclosure- what sensitive data is exposed?
  - DoS            - what is exhaustible?
  - Elevation      - where can a low-privilege actor escalate?
- For each finding, write one sentence describing a mitigation

Deliverable: a 2-page Markdown doc with diagram (Mermaid OK).


# 2. Write one Sigma rule

Pick a TTP you understand (e.g. T1059.001 PowerShell). Write a Sigma rule:

title: Suspicious PowerShell -EncodedCommand
status: experimental
logsource: { category: process_creation, product: windows }
detection:
  selection:
    Image|endswith: '\\powershell.exe'
    CommandLine|contains: '-EncodedCommand'
  filter_admin:
    User|contains: 'Administrator'
  condition: selection and not filter_admin
level: medium
falsepositives:
  - Some admin scripts use -EncodedCommand
references:
  - https://attack.mitre.org/techniques/T1059/001

Test it against a Sysmon log sample or an EDR sandbox.


# 3. Run an Atomic Red Team test in a lab

# Install on a Windows VM:
Set-ExecutionPolicy Bypass -Scope Process -Force
Install-Module -Name invoke-atomicredteam -Scope CurrentUser -Force
Import-Module invoke-atomicredteam

# Run a known technique
Invoke-AtomicTest T1059.001 -ShowDetails
Invoke-AtomicTest T1059.001 -TestNumbers 1

# Watch your SIEM
# - Did your detection fire?
# - What was missing? Tune.
# - Add to your coverage matrix.

# Clean up
Invoke-AtomicTest T1059.001 -TestNumbers 1 -Cleanup


# Stretch
- Repeat in a Linux lab with linux-atomic-red-team and auditbeat / falco
- Add Sigma rule to CI so it lints on every PR (sigma-cli)
- Tabletop: run #1 with a colleague playing the attacker

Why it matters

Threat model + Sigma rule + Atomic Red Team is the daily loop of detection engineering. Each exercise produces a tangible artefact. Repeat weekly and your coverage matrix grows visibly.

Tip: Tweak the snippet with Try it Yourself », then sit the quiz at the bottom of the page.

Example

Example
# Fill in: get the ____ in writing before any active testing.   (RoE)
Try it Yourself »

Discussion

Loading…