Attack scenarios (select 10-15 techniques across tactics)

- Initial access (phishing, exploit public app, supply chain) - Execution (PowerShell, WMI, scheduled task, container escape) - Persistence (registry, service, WMI subscription, OAuth app) - Privilege escalation (kerberoasting, token impersonation, AD CS) - Defense evasion (process injection, signing, obfuscation) - Credential access (LSASS, NTDS, keychain, browser) - Discovery (BloodHound, SharpHound, network scanning) - Lateral movement (PsExec, WMI, RDP, pass-the-hash) - Collection (data staging, exfiltration channels) - Exfiltration (DNS, HTTPS, cloud storage) - Impact (ransomware simulation, data destruction - simulated)