> For the complete documentation index, see [llms.txt](https://blog.r00t-hunter.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.r00t-hunter.com/ad-lab-built-with-purpose/wrap-up.md). # Wrap-Up #### That's a Wrap on CorpSim If you made it this far genuinely, thank you. This is a long post and I know it. I did not write it to be short. I wrote it to be complete, because the labs I learned the most from were the ones that did not skip the hard parts. The hard parts are the Kerberos clock skew at 1am. The hard parts are Elasticsearch dying during `so-setup` for the third time because the heap is too high and you keep forgetting to fix it before restarting. The hard parts are realm join failing with a package error that is not in any documentation and you spend 45 minutes on it before realising you just needed to install one extra package first. That is the actual lab experience and I wanted this post to reflect that honestly. *** **What's Next for CorpSim** This is version one. The lab is not finished no lab ever really is. Things I am planning to add or explore next: * ADCS (Active Directory Certificate Services) abuse paths ESC1 through ESC8 are a whole separate rabbit hole I have not touched yet * RBCD (Resource-Based Constrained Delegation) attack paths partially configured but not fully documented * Improving the detection stack moving toward a more stable Wazuh-only setup on constrained hardware instead of full Security Onion * Adding intentional dead-end paths to make BloodHound enumeration less clean and more realistic * Eventually a small Entra ID hybrid sync component, once I understand it well enough to build it honestly * Expanding the documentation to include detailed attack-path analysis, detection engineering, SOC investigation workflows, log analysis, IOC identification, MITRE ATT\&CK mapping, and defensive recommendations for every technique covered in the lab. I will document each addition as a follow-up post in the same series. No timelines promised. This lab gets updated when it gets updated. *** **Questions, Corrections, and Feedback** This post is a point-in-time record of what I understood when I built this. I am not an expert. I am someone who built a thing, documented it, and published it because I wish more people did that instead of only posting the clean success stories. If something in this post is technically wrong tell me. I will correct it and credit you. If you built something similar and solved a problem I described tell me. I will link it. If you have a question about any part of the setup, the detection logic, the networking, or anything else ask. I will answer what I can and tell you honestly when I do not know. You can reach me at: * **Blog:** blog.hunterlabs.in * **Handle:** r00t-hunter * **Twitter/X:** @ro0thunter *(or wherever I am by the time you read this)* * **Email:** *** > *The best labs are the ones that break. The best write-ups are the ones that say so.* *— r00t-hunter //* [*blog.r00t-hunter.com*](https://r00t-hunter.com/) *Lab Series · 2026* --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://blog.r00t-hunter.com/ad-lab-built-with-purpose/wrap-up.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.