Windows Workstation Purple Team Attack & Detection Lab

A hands-on Purple Team lab simulating Windows reconnaissance, initial access, privilege-escalation assessment, detection, remediation, and verification in an isolated virtual environment.

Overview

This project involved building and assessing an isolated Windows workstation environment using Kali Linux as the attacker and Windows 10 as the target. The assessment followed a Purple Team workflow combining offensive security techniques with defensive detection, investigation, remediation, and verification.

Objectives

• Perform network reconnaissance against a Windows workstation
• Identify exposed services and attack surface
• Establish a controlled low-privilege remote session
• Assess a potential privilege-escalation path
• Analyze Windows Security Event Logs
• Analyze network traffic using Wireshark
• Remediate an insecure service file-permission configuration
• Verify that the remediation was effective

Lab Architecture

Tools & Technologies

What I Practiced

• Network and service reconnaissance
• SMB authentication testing
• RDP remote access
• Low-privilege Windows enumeration
• Windows service security assessment
• File and directory permission analysis
• Windows Security Event investigation
• Network traffic analysis
• Security remediation
• Post-remediation verification

Key Finding

The assessment identified a Windows service configured to run as LocalSystem while executing a file that was writable by lower-privileged users. This created a potential privilege-escalation path through insecure file permissions.

The excessive permissions were removed and the remediation was verified by confirming that the low-privilege account could no longer modify the service payload.