This is an assumed breach engagement: two VMs, one rule, don’t get caught. We exploited a single overlooked UDP port, tunnelled in via WireGuard, and pulled the thread. Cleartext credentials in a shared folder. A password spray. 30+ compromised accounts. Pass-the-hash took care of the rest.
By the end, we were using the monitoring team’s own account to dig around.
They never noticed.
Still in there.
The assumed breach setup
The client had locked both VMs down. Settings unavailable. Consoles disabled. Dangerous domains blocked. IP restrictions in place. Standard hardening.
But one thing slipped through the net on the Linux VM: outgoing unsupervised UDP connections were enabled.
That’s all we needed.
In practice: WireGuard client installed. SSH tunnel established through our WireGuard VPN. Direct access secured.
From this point forward, we uploaded every tool we needed through SSH over the WireGuard tunnel. No dropped connections, alerts or emails to the security team.
Just silence.
We set up Responder in analysis mode, watching network traffic for deprecated protocols. Nothing suspicious appeared. Just legitimate traffic.
Time to get creative. So we went looking.
The one who was forgotten
We grabbed the list of users from the LDAP server using credentials from the Windows VM account. The account was valid, so we started sneaking into shared folders with read permissions across the same subnet.
Then we hit it: a shared folder with the kind of name IT staff use when they think no one’s looking.
Inside? A low-level account with credentials in clear text.
The password was embarrassingly simple. Too simple to be sitting in a text file on a network share. But there it was.
Here’s why it matters: we took a calculated risk, a password spray attack using LDAP protocol against every active user we’d collected.
The results? Over thirty accounts using the same password.
Add to that, an account operator with local admin access to multiple workstations in the same subnet.
The pattern
With admin access now secured, we enumerated every workstation in the subnet and started extracting SAM and LSA from multiple machines.
A pattern emerged immediately: the same local administrator hash. Everywhere.
They’d cloned the operating system across workstations and made no other changes. Same hash, same passwords, same access.
Worse, we ran a pass-the-hash attack using the local administrator hash. Nearly every device in the subnet fell.
On top of which, we had account operator permissions, server operator permissions, and local admin access across dozens of workstations. All through the same WireGuard tunnel that kept us completely under the radar.
No domain admin access yet, but we didn’t need it. Workstations were wide open. Juicy information was ours for the taking.
And still, not a single alert.
The irony
At this point, we could have stopped. Instead, we kept digging.
Here’s the catch: this time, we used the account that’s supposed to be used by the third-party monitoring team.
The same team tasked with detecting intrusions.
The same team that still hasn’t noticed we’re in there.
The downstream effect: we’re poking around and collecting, still completely invisible.
The reality check
The punchline? If your monitoring doesn’t catch a patient attacker using your own tools and accounts, it’s not monitoring. It’s theatre.
The consequence is straightforward: subnet-wide admin rights plus a compromised monitoring account is the point where a real intrusion stops being detectable. That’s what an assumed breach test is built to surface, the access a real attacker would use for ransomware deployment or mass data exfiltration before anyone notices.
This engagement exposed critical failures:
- Cleartext credentials stored in shared folders accessible to low-level accounts.
- Identical passwords across dozens of user accounts, including privileged roles.
- Cloned systems with identical local administrator hashes across the entire subnet.
- Zero detection of lateral movement, credential abuse, or unusual account behaviour.
The “don’t get caught” constraint wasn’t a challenge. It was a reality check.
The single move that compounds: the client is now rewriting credential hygiene policies, auditing and locking down shared folders, rebuilding system images with unique local administrator passwords, and extending monitoring to include accounts used by their own security tools.
As their CISO put it:
“We thought our monitoring was comprehensive. Turns out it was just watching the front door while someone walked around the back, picked the lock, and made themselves at home.”
Assumed breach scenarios aren’t theoretical exercises. They’re the reality of modern attacks. Attackers don’t announce themselves. They move slowly, use your own tools, and blend into normal traffic.
If your security operations can’t catch quiet, patient movement across accounts they don’t own, you’re not secure. You just haven’t caught anyone yet.
Want to see what’s hiding in your blind spots?
Contact CovertSwarm and let us show you what your monitoring misses.