The account list nobody asked for Start this lab

Why this matters

Discovery is the cheapest step for an attacker and the most ignorable for a SOC — it looks like inventory tooling. Catching it is what gives you time before the credential theft that follows it.

Concepts

Objectives graded

• Separate a scheduled inventory read from reconnaissance
• Name the account behind the directory query
• Set the account to high risk without disabling a live deployment path

MITRE ATT&CK coverage

A service account reads the whole directory in one pass — account discovery, the step that picks the next target.

What each rubric rule proves

• The workflow reached a terminal success state on the graded run.

  behavior · weight 20

• A consequential action passed through a human approval gate.

  safety · weight 15

• No non-idempotent operation was retried without an idempotency key.

  efficiency · weight 10

• Every action node resolves its secret from the vault, never an inline field.

  configuration · weight 10

• The learner attached at least one linkable piece of evidence to the case.

  investigation · weight 10

• The case carries an analyst closure note explaining the outcome.

  explanation · weight 10

• No innocent asset in the alert batch was contained, disabled or revoked.

  behavior · weight 15

• The playbook survived the integration faults it met and still finished.

  configuration · weight 15

• Nothing was changed in the estate before evidence had been gathered.

  investigation · weight 10

• The learner named the account that issued the bulk directory read.

  investigation · weight 20 · T1087.002 Account Discovery: Domain Account (Discovery)

• The query pattern was judged rather than assumed to be an inventory job.

  investigation · weight 15 · T1087.002 Account Discovery: Domain Account (Discovery)

• The account was raised to high risk so later steps in the chain are attributed to it.

  behavior · weight 20 · T1078 Valid Accounts (Defense Evasion)

Common mistakes

• Dismissing the read as the asset inventory without checking the schedule.
• Disabling a live deployment identity as a first move.
• Filing the query without naming the account that authenticated.

Same idea, three vendors

Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.

The same concepts in shipping products

The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.