Execute Attack Techniques

Halberd makes it incredibly simple to execute sophisticated cloud attack techniques through its intuitive interface. Each technique is pre-configured with smart defaults while maintaining full customization capabilities.

Quick Start Guide

1. Navigate to the Attack view in the Halberd UI
2. Select your target cloud platform from the available tabs:
   • EntraID (Microsoft Entra ID)
   • M365 (Microsoft 365)
   • AWS (Amazon Web Services)
   • Azure (Microsoft Azure)
3. Choose an attack tactic from the dropdown menu, such as:
   • Initial Access
   • Privilege Escalation
   • Defense Evasion
   • Credential Access
   • And more...
4. Select a technique from the available options under your chosen tactic
   • Each technique shows a clear, descriptive name
   • Techniques are automatically filtered based on the selected cloud platform and tactic

Configuring & Executing Techniques

Required vs Optional Parameters

Required parameters are marked with an asterisk (*) Optional parameters display default values in light text Default values are carefully chosen based on common attack scenarios

Parameter Types

Halberd supports multiple input types:

• Text fields - For strings, identifiers, names
• Toggle switches - For boolean options
• File uploads - For files like wordlists or scripts
• Password fields - For sensitive inputs

Execution Steps

1. Fill in the required parameters (marked with *)
2. Optionally modify any default values
3. Click the "Execute Technique" button
4. Monitor the Response window for:
   • Real-time execution status
   • Detailed output
   • Next steps or additional instructions

Checking Access Status

Before executing techniques (except Initial Access), verify your cloud access:

1. Click the "Access" button at the top of the Attack view
2. Review your current access status:
   • EntraID/M365: Active token and permissions
   • AWS: Active session and assumed role
   • Azure: Active subscription and credentials

The access button provides visual feedback:

• Green: Valid access available
• Red: No active access
• Shows active identity/session info

Reviewing Results

Results are displayed in multiple ways:

1. Immediate Feedback

   • Real-time execution status
   • Structured output in the Response window
   • Success/failure notifications

2. Historical Analysis

   • Click "View Attack History" to see all executions
   • Filter and search past attempts
   • Download execution logs for analysis

Adding to Playbooks

Techniques can be saved as part of automated playbooks:

1. Click "+ Add to Playbook" after configuring a technique
2. Select or create a playbook
3. Optionally specify:
   • Step number in sequence
   • Wait time between steps

Example: Password Spray Attack

Here's a complete example of executing a password spray attack against Entra ID:

1. Select "EntraID" tab
2. Choose "Credential Access" tactic
3. Select "Password Spray" technique
4. Configure:

Username File: users.txt (upload)
Password: Spring2024!
Wait: 3 (default)
Stop at First Match: true (default)

5. Click "Execute Technique"
6. Monitor results in real-time

Tips for Success

• Start with Initial Access techniques to establish valid sessions
• Use the default parameters when first learning a technique
• Review technique information (right pane) for detailed descriptions and MITRE mappings
• Monitor the access button status to ensure valid credentials
• Use the Attack History view to learn from previous executions

Halberd's interface is designed to make complex attack techniques accessible while providing full control when needed. The standardized execution flow works consistently across all cloud platforms and technique types.