PurpleForest

Most AD labs teach one half of the job. Offensive labs hand you a broken domain and a list of attacks; detection labs hand you a SIEM full of sample data. PurpleForest builds both sides in one place, and every exercise follows the same loop: run the attack, find it in the logs, write the rule, watch it fire, then work out how to evade it.

Four VMs, fully automated with Vagrant and Ansible: a Windows Server 2022 domain controller and a domain-joined Windows 10/11 workstation, a Graylog + OpenSearch SIEM, and Kali as both attacker and Ansible control node. Sysmon, Security and PowerShell script-block logs ship through Vector, with a disk buffer so the SIEM can go down mid-attack without losing events.

• The domain builds clean. Each exercise switches on only the flaw it needs (Kerberoasting, AS-REP roasting, password spraying, ACL abuse, delegation, NTLM relay), so you never attack a domain broken twelve ways at once.
• Audit policy is automated. Windows doesn't log most of what AD detections need out of the box, which is the biggest reason home-lab rules silently never fire.
• Reproducible. Snapshots and vagrant destroy && vagrant up get you back to a known state.
• Isolated by design. The Windows hosts have no internet route, and the credentials are deliberately weak. Never expose it to a network you value.

Needs around 32 GB of host RAM (24 GB workable), ~150 GB of disk and VMware Workstation Pro. MIT licensed.