red-team
2026-03Internal Network Reconnaissance & SMB/LDAP Enumeration Lab
Documented offensive enumeration workflows across SMB, LDAP, and RPC services while capturing corresponding network signatures in Wireshark and Suricata.
Attack: Unauthenticated LDAP reconnaissance, SMB null session enumeration, and relay-vulnerable host discovery.
Detection: Inspected SMB2 tree connect spikes and high-volume LDAP search requests over TCP/389 in Suricata.
Mitigation: Documented remediation checklists enforcing SMB signing, disabling NTLMv1, and restricting anonymous directory queries.