> For the complete documentation index, see [llms.txt](https://blog.r00t-hunter.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.r00t-hunter.com/ad-lab-built-with-purpose.md).

# AD Lab Built With Purpose

#### CorpSim : Constrained-Resource Multi-Domain AD Identity Attack and Detection Validation Lab

`Active Directory, Detection Engineering, Identity Security, Homelab, Multi-Domain`

## What This Lab Actually Is

Let me be direct about scope before anything else, because overstating a homelab's capabilities is a credibility problem I want to avoid upfront.

**CorpSim is a constrained-resource, multi-domain Active Directory identity attack-and-detection validation lab.** Two AD forests  `usa.corp.local` and `india.corp.local` connected by an OpenVPN site-to-site tunnel and a bidirectional external forest trust. A management segment carries a lightweight detection stack and an attack platform.

It is not a cyber range. It is not an enterprise simulation. It is not a SOC training environment. What it is: a controlled platform for studying multi-domain AD trust authentication paths, DACL-based privilege escalation, and the correlation of network-layer telemetry against host-layer telemetry for well-defined identity attack events.

**Hardware reality:** Two physical machines totalling 14 GB RAM running 19 VMs. Those VMs cannot all run simultaneously this is a hard constraint, not a design choice, and the entire lab architecture is built around it. Every section below is written with that constraint honestly in mind.

**What the lab covers well:**

* Multi-domain AD trust relationships and Kerberos referral paths
* DACL-based privilege escalation and BloodHound graph interpretation
* Network-vs-host telemetry correlation for DCSync, Kerberoasting, PtH, and LSASS access
* Detection logic construction and tuning against known attack events
* What the actual Event Log fields and values look like not the blog-post description of them

**What it explicitly does not cover:**

* EDR evasion against any commercial product (Defender is partially configured)
* Cloud identity paths, Entra ID, hybrid sync, OAuth abuse, or Conditional Access
* Certificate services, Exchange, SCCM, or SQL-backed attack paths
* Realistic attacker OPSEC friction, broken pivots, or stale credential conditions
* The accumulated configuration entropy of a production environment

The on-premises AD focus is a deliberate scope constraint, not a claim that modern enterprises are purely on-prem. In 2026, any pure on-prem AD lab reflects a historically weighted identity model. That is appropriate for studying foundational AD identity mechanics. It is not appropriate as a proxy for a current enterprise's full attack surface.

### **Disclaimer**

This lab is intentionally insecure. SMB signing is disabled, weak passwords are present, access control lists (ACLs) are over-permissioned, and delegation settings are intentionally misconfigured to create realistic attack paths. The environment exists for attack simulation, detection validation, and defensive research not as a model for production deployment.

All systems should remain isolated on host-only or otherwise controlled laboratory networks. Do not expose these virtual machines to the public Internet or any network you do not fully control.

> *“An expert is someone who has made all the mistakes that can be made in a very narrow field.”     — Niels Bohr*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://blog.r00t-hunter.com/ad-lab-built-with-purpose.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.