Andrew Lemon - Where the #$@! am I? Preparing to Take the Shot

Red Team Scope and Mindset

Andrew Lemon of Alias Security walks through a full external red-team engagement to domain admin—aimed at newcomers who hear tool names but rarely see end-to-end tradecraft. Scope required initial compromise from outside, user and host access, privilege escalation, and an APT-style impact demonstration such as ransomware deployment while staying stealthy enough to give the SOC partial wins.

Reconnaissance and Initial Access

Lemon emphasizes scoping documents as the engagement lifeblood. He describes credential harvesting, VPN identification via DNS dumpster and Shodan, and testing both Windows and Linux VPN clients to establish internal network presence without triggering unnecessary alerts.

Internal Mapping

Once inside, he locates domain controllers using patient DNS techniques—adding customer resolvers, guessing predictable hostnames like dc01.domain.com, and leveraging nltest and WS-Management from non-domain-joined systems via RunAs token creation with compromised credentials.

Escalation Path

The narrative progresses to SharpHound collection for BloodHound analysis, acknowledging some steps are intentionally loud. Lemon's core message: real engagements chain mundane recon, credential reuse, and Active Directory mapping—not only exotic exploits.