Hybrid Exploitation Campaign with a Living Threat Model

You're running a six-week security assessment for Summit Trails Resort Group — a US boutique resort operator with six wellness properties and a central Azure platform — and the surface is hybrid: cloud, on-prem, and ISP-managed transit between them.

The discipline skills: running an exploitation campaign across cloud and on-prem in concert; treating the threat model as a living document that updates during the engagement, with three versioned models shipped as deliverables; designing a hybrid detection strategy with quantitative targets across both paradigms; and mapping findings coherently across PCI DSS, CIS Azure Benchmarks, and NIST CSF at once.

The AI-direction lesson: cross-paradigm work needs a context architecture that crosses paradigms, and the engagement is long enough that the context lifecycle is the discipline. Nine scoped agents — cloud-architecture, property-architecture, cloud-exploitation, on-prem-exploitation, threat-model-update, hybrid-detection, remediation, executive-report, technical-report — each get the context their phase needs and nothing else. The assumption-based plan from week one is archived before the post-discovery model runs. And the cross-paradigm judgment calls — which surface to prioritize after a model update, how to frame a finding that touches how property staff work, what the engagement can and can't say about a year-old credit-card incident — those don't delegate.

Your Role

You're the assessor. The engagement approach, the campaign plan, the three threat-model versions, the hybrid detection strategy, the cross-paradigm SIEM architecture, the PCI DSS + CIS Azure + NIST CSF compliance mapping, the remediation program with its documented exceptions, the executive board report in guest-trust voice — yours.

Scaffolding is thin across the engagement. No exploitation-campaign template for hybrid surfaces, no living-threat-model rubric, no PCI-to-CIS-Azure-to-NIST-CSF crosswalk, no shared-credential-remediation flow, no executive-report voice guide. The first contact is a Slack thread — six scattered messages from Margaret Larsen at 11:32 PM, typed on her phone. No review beats are staged; a senior colleague is on-demand if you need a sounding board, but they won't volunteer — the campaign is yours to drive.

The campaign is bounded — you stop at "this finding demonstrates the risk," not at "maximum compromise achieved." TTPs are selected to test whether the hybrid detection strategy works, not to maximize the finding count. Some judgments are explicitly yours: the surface-prioritization calls after each threat-model update, the diplomatic framing of any finding that touches how property staff work, any conversation with third-party vendors, the acknowledgment that a year-old credit-card incident may not be definitively answerable from this engagement.

What's New

Last time, the assessment was cloud-only — one corporate Azure tenant with three subscriptions, methodology was the new terrain, and the cloud surface itself was a guided experience.

Hybrid scope. Cloud and on-prem run together in one campaign, distributed across six remote properties connected by ISP-managed transit. Cross-property lateral movement — property to central platform to another property — is a single attack path the campaign documents end-to-end. Neither a cloud-only nor an on-prem-only assessment would surface it.

A living threat model. Three versions land in the deliverables: v1 written at engagement start from assumptions; v2 after the hidden constraints surface in discovery; v3 after exploitation reveals threats the earlier models didn't anticipate. The diff between v1 and v3 is itself part of the assessment narrative.

Scope creep mid-engagement. Margaret asks about a seventh property — an Oregon oceanfront acquisition that closed last month. The decision is yours: in scope, out of scope, or in scope under a defined boundary.

No staged colleague review. P17 ran without one too; P18 continues the pattern. The cloud terrain is familiar enough that you drive the campaign without scaffolding on it — a senior colleague is reachable on-demand for a hybrid-campaign or threat-model question, but they won't volunteer and no review beat is authored.

The hard part: the threat model moves under your feet and AI doesn't notice. Without an explicit framing, AI runs the whole campaign against the week-one assumption model and produces something that looks comprehensive and misses the point. Margaret reads in guest-trust language; findings in compliance-audit-speak glaze her over. When discovery turns up a practice at the properties that looks like a staff failing, it needs diplomatic handling — the question is how the architecture shapes the workflow, not whether her staff are doing their jobs.

Tools

• Claude Code, Codex CLI — driving the nine scoped hybrid agents across the engagement and the explicit "do not delegate" boundaries for the cross-paradigm and diplomatic judgments.
• Summit Trails hybrid lab (Docker + Azure fixtures) — six property infrastructures (PMS server, POS, Wi-Fi, guest-room automation, front-desk terminals), the central Azure platform, the Montana ISP-managed WAN transit, per-property PMS and front-desk state, and the cross-property lateral-movement paths.
• Azure CLI in dry-run / fixture-replay mode — familiar. Authentic syntax, authentic response shapes, no real subscription.
• Microsoft Defender for Cloud (simulated) — familiar. Pre- and post-remediation posture snapshots that you compose against the exploit re-test result.
• Sigma + Loki + Grafana + Wazuh + Suricata + osquery — defender stack carried forward from P11-P17. P18 integrates Azure Activity Log alongside per-property forwarders and authors Sigma rules spanning on-prem, cloud, and cross-paradigm correlation.
• Living-threat-model authoring — three versioned models as engagement deliverables; v2 supersedes v1, v3 supersedes v2, each referencing its predecessor so the diff is auditable.
• PCI DSS v4.0, CIS Azure Benchmarks v2, NIST CSF v2.0 — PCI DSS is new at this depth in the track. PCI DSS for the credit-card scope, CIS Azure for the central platform, NIST CSF for the executive narrative.
• ATT&CK Enterprise + ATT&CK Cloud Matrix — used together; the gap analysis between the two matrices is part of the hybrid-coverage heatmap.
• Engagement-memory infrastructure — engagement-memory/ with the engagement approach, the three threat-model versions, the campaign plan, the detection strategy, the SIEM architecture, the remediation program, and the per-phase scoped-agent specs. CLAUDE.md and AGENTS.md carry forward.
• Python, Markdown, YAML, Mermaid, GitHub — assessment and compliance reports, remediation program, threat-model diffs, heatmaps, diagrams, the executive board report.

Materials

• First-contact Slack thread (first-contact.md) — Margaret's six scattered late-night messages. Read the cadence as carefully as the content.
• Summit Trails hybrid lab (hybrid-lab/) — Docker compositions for six properties, Azure fixtures for the central platform, the Montana ISP transit fixture, per-property PMS and front-desk fixtures, and the cross-property lateral-movement paths.
• Regulatory-context brief (regulatory-context.md) — PCI DSS v4.0 scope-and-mapping primer, CIS Azure Benchmarks v2 reference, NIST CSF v2.0 reference.
• Engagement-memory templates (engagement-memory/) — engagement-approach, threat-model, campaign-plan, detection-strategy, remediation-program, and exception templates, plus per-phase scoped-agent specs (engagement-memory/agents/).
• Detection-rule templates (detection-rules/sigma-templates/) — on-prem, cloud, and cross-paradigm correlation templates.
• AGENTS.md and CLAUDE.md — carried forward. CLAUDE.md carries P18's verification targets (three threat-model versions referenced in sequence, campaign plan names stopping criteria per TTP, detection strategy carries quantitative targets, remediation program documents exceptions consciously).

Everything else — the engagement approach, the living-threat-model framing for Margaret, the campaign design, the surface-prioritization calls, the seventh-property scope decision, the executive report voice — is yours.