A Ludus-based lab environment for TTP testing and security research.
ThruntOps exists to provide a controlled environment for testing attack techniques and procedures (TTPs). The design philosophy is breadth over depth: rather than optimizing for a single attack scenario, the lab grows by adding technologies — each one introducing new attack surfaces, protocols, and vectors to test against.
All 9 atomized profiles are validated on Ludus 2: Elastic, Wazuh, and Splunk, each in base, dual, and adcs form (also available in 2025/2019 AD DC Windows Server variants).
Validation completed via a from-scratch deploy (destroy + deploy) of every profile: range deploy succeeds, domain authentication works, SIEM services are reachable, and every endpoint enrolls.
Deployed on Proxmox via Ludus. The validated profiles run on VLAN 20 (10.<range>.20.0/24). Each SIEM has three atomic profiles, in three AD DC Windows Server versions, deployed via the unified siem.sh deploy <elastic|wazuh|splunk> <2019|2022|2025> <base|dual|adcs> command:
| Profile | Config | SIEM | VMs | Validation |
|---|---|---|---|---|
| Elastic | elk-{base,dual,adcs}-{2019,2022,2025}.yml |
Elastic Stack + Fleet | 3 / 5 / 4 VMs | Passed on Ludus 2 — base, dual, adcs |
| Wazuh | wazuh-{base,dual,adcs}-{2019,2022,2025}.yml |
Wazuh all-in-one | 3 / 5 / 4 VMs | Passed on Ludus 2 — base, dual, adcs |
| Splunk | splunk-{base,dual,adcs}-{2019,2022,2025}.yml |
Splunk Enterprise | 3 / 5 / 4 VMs | Passed on Ludus 2 — base, dual, adcs |
base is a single AD domain + 1 workstation, dual adds a second AD domain + workstation (the validated profile above), and adcs swaps the second domain for a dedicated ADCS VM on the single domain. All profiles share the same AD forest naming (thruntops.domain [+ secondary.thruntops.domain on dual]) and only provision Ludus's default accounts. Fase 2 will add MSSQL and OPS infrastructure.
See the Users reference for the full credentials reference.
See the Vulnerabilities matrix for the full attack surface reference.
See the Installation guide for full setup instructions.
- MSSQL as a standalone vulnerability vector (xp_cmdshell, NTLM capture, DBA → sysadmin escalation) — see MSSQL TTPs
- Reduce resource requirements to support lower-spec hosts (target: 32 GB RAM)