Isolated range
Kali, Windows/AD and vulnerable Linux targets on a hard-coded lab network. Review the plan before anything runs.
SCOPE GUARD · PREVIEW → RUN
NOW // DETECTION LAB V5 · 6 CHANNELS · 13 RULES →
RANGE//ZERO
ISOLATED CYBER RANGE // BLUE TEAM LAB // LOCAL ONLY
We don’t build fake
breaches. We build a range
where real attacks become evidence.
breaches. We build a range
where real attacks become evidence.
Kali → Windows/AD and vulnerable Linux targets on an isolated 10.10.10.0/24. Curated scenarios, hard scope guard, real telemetry and reports that keep their receipts.
6LIVE TELEMETRY CHANNELS
13DETECTION RULES
55/55LOCAL TESTS PASSING
100%LOCAL · NO TELEMETRY
01 // LATEST EVIDENCE LIVE
NOW SHIPPINGDetection isn’t a feature.
Detection isn’t a feature.
It’s the operating model.
Six telemetry channels. A versioned rule pack. High signals sorted above noise. Every alert links back to a real event — not a decorative demo.
READ THE DETECTION PROOF →EVENTS1,000
ALERTS233
HIGH26
RULE PACK2026.11.06
Windows Security · System · PowerShell · Kali journal · Suricata · wired Sysmon
02 // TELEMETRYSIX CHANNELS · ONE TIMELINE
Every source.
One evidence window.
Windows Security, System and PowerShell. Kali journal. Suricata IDS. A wired Sysmon channel. Detection Lab normalizes them, preserves source health and sorts high signals above noise.
Windows Security465 storedLIVE
Windows System109 storedLIVE
PowerShell Operational80 storedLIVE
Kali journal240 storedLIVE
Suricata IDS12 storedLIVE
Sysmonnot installedWIRED
DETECTION LAB // READOUT
1,000EVENT CAP
233ALERTS
26HIGH
4769 KERBEROAST4624 WINRM7045 SERVICE4104 POWERSHELLSYSMONSURICATA
High signals stay above older medium noise. Every alert points back to the source event and its rule.
03 // CAPABILITIESREAL SYSTEMS, REAL LIMITS
Detection Lab
Windows Security/System/PowerShell, Kali journal and Suricata IDS in one evidence timeline. Versioned rules, real source health.
6 CHANNELS · 13 RULESShield
Evidence-backed posture across app, privacy, host, network and lab. Reversible hardening previews and cited playbooks.
POSTURE HISTORY · PLAYBOOKSReports
Live assets, NIST/CIS/ISO control mappings with honest gaps, detection evidence and JSON/Markdown export.
15 ASSETS · 10 CONTROLS04 // SYSTEMSFOUR SYSTEMS · ONE RANGE
Built as systems.
Not demos.
Each surface is measured, tested and limited. Open one and the evidence is already attached.
01
Isolated range
Eight curated scenarios against Kali, Windows/AD and vulnerable Linux targets. Preview every command, scope every IP, keep every transcript.
2/2STEPS VERIFIED
↗02
Detection Lab
Windows Security/System/PowerShell, Kali journal and Suricata in one evidence timeline. High signals above noise, source health beside them.
26HIGH SIGNALS
↗03
Shield
Posture across app, privacy, host, network and lab. Reversible hardening previews, cited playbooks and a local trend — never a guarantee.
89POSTURE / 100
↗04
Reports & assets
Live asset inventory, NIST/CIS/ISO mappings with honest gaps, detection evidence and JSON/Markdown export. Evidence, not a certification.
7/10CONTROLS COVERED
↗05 // THE LOOPONE RANGE · FOUR MOVES
Attack. Detect.
Prove. Report.
The port is not the point. The proof is. Every scenario is reviewed before it runs, verified while it runs and kept after the terminal closes.
01
Attack
Curated Kali → Windows/AD scenarios. Plan preview, scope guard, real SSH command, live output.
KALI → DC2 / WIN1102
Detect
Security, System, PowerShell, journal and Suricata evidence normalized into one alert timeline.
6 CHANNELS · 13 RULES03
Prove
Ticket material, parsed ports, scope result and raw transcripts are attached to the run.
EVIDENCE, NOT A SCORE04
Report
Assets, control mappings and detection evidence export locally as JSON and Markdown.
NIST · CIS · ISO06 // PROOFEVERY ARC = REAL EVENT
Attack. Detect.
Prove. Report.
When the Kerberoast scenario runs, the Attack Board arc, the $krb5tgs$ evidence and the detection alert all come from the same isolated lab. The app shows the scope result and the raw transcript.
2/2STEPS VERIFIED
T1558.003KERBEROAST
PASSSCOPE GUARD
07 // WHAT IT IS NOTNO HYPE. NO GUARANTEES.
Not untraceable
No anonymity guarantee. The lab is isolated and local; identity safety is a separate, verified lane.
Not a public exploit service
Practice only against the isolated lab or systems with written authorization.
Not a full SIEM/EDR
Detection Lab v5 is real but narrow. Wazuh/ELK and endpoint sensors are future work.
Not production-ready
No accounts/MFA, multi-tenancy, SLA or external audit yet. This is a private pilot.
08 // CORE KERNELWHAT WE OPTIMIZE FOR
The rules behind
the range.
These are not slogans. They decide what ships, what is refused and what the evidence must show.
01Evidence > theater
If it did not run in the lab and leave a trace, it does not go on the board.
02Local > cloud
The range stays on this machine. No telemetry, no third-party asset, no silent upload.
03Limits > claims
Every score names its scope, every rule names its gap. No untraceability promise.
04Proof > memory
Tests, manifests and transcripts outlive the person who ran the scenario.
09 // STACKWHAT THE RANGE RUNS
The stack,
named.
Local services and real lab tooling. If it is not here, the page does not claim it.
01libvirt / KVMisolated VMskali · dc2 · win11 · targets
02Windows Securitywevtutil / WinRM4624 · 4769 · 7045 · 4104
03Suricata 8eth1 IDSSMB · WinRM · Kerberos rules
04Shieldlocal posturehistory · playbooks · controls
05Nmap + CVE mappingvulnerability v1allowlisted targets only
06Electron + Three.jsnative desktoplocal app · no CDN
07Scope guardhard boundary10.10.10.0/24 + loopback
08Local reportsJSON · Markdownassets · controls · detections
OFF-RANGE PRIORITIES
LOCAL ONLYNO TELEMETRYNO CLOUD SYNCNO UNTRACEABILITY CLAIMWRITTEN AUTHORIZATION ONLY
10 // CONNECTINVITE-ONLY PILOT
High-signal
connections only.
The public pilot is invite-only. The waitlist opens after the owner approves the privacy and pilot terms; no email is collected here. Practice stays in the isolated lab or systems with written authorization.
BACK TO THE RANGE →NO DATA COLLECTION · NO PAYMENT