[{"_1":2,"_66":-5,"_67":-5},"loaderData",{"_3":4,"_10":11,"_64":-5,"_65":-5},"root",{"_5":-5,"_6":-5,"_7":-5,"_8":9},"user","shoppingCartId","toast","locale","en","routes/_store+/_readers+/email_author.$slug/route",{"_12":13,"_63":-5},"book",{"_14":15,"_16":17,"_18":19,"_20":21,"_22":23,"_24":25},"id","Z2lkOi8vbGVhbnB1Yi9TdG9yZTo6Qm9va1Byb2R1Y3QvNjQwNDI","title","Red Teaming and Blue Teaming with Microsoft Defender XDR - Lab Guide","state","published","contactAuthorMethod","email","aboutText","

Organizations are constantly threatened by increasingly sophisticated adversaries in the modern cybersecurity landscape. Microsoft Defender XDR is one of the most powerful tools available to help protect, detect, and respond to these threats across your digital estate. But how do you genuinely know your defenses are working?

Red Teaming and Blue Teaming with Microsoft Defender XDR is a practical, hands-on guide written for IT professionals seeking to level up their cybersecurity skills. Whether you're a sysadmin, SOC analyst, or security engineer, this book will walk you through the entire lifecycle of building a secure cyber range, safely simulating attacks, and validating your Defender XDR configurations against real-world threats.

Designed for accessibility and impact, this book shows you how to set up your own controlled, internal lab using free tools—no expensive gear or third-party licenses. You'll learn how to deploy an end-to-end Red Team lab environment and use popular open-source offensive security tools like:

Covenant C2 Framework – for command and control post-exploitation testing
Evil-WinRM – to simulate compromised privileged access
Mimikatz – for credential harvesting and testing credential guard configurations
CommandoVM – the ultimate offensive Windows pentesting virtual machine
Rubeus – for Kerberos ticket abuse and golden ticket testing
BloodHound – for Active Directory attack path analysis
…and more.

Each chapter balances Red and Blue perspectives: how the attack works, how it manifests inside Microsoft Defender XDR, and most importantly, how to detect, alert, and respond effectively. You'll gain a deep understanding of how Defender XDR correlates data across Microsoft 365 Defender, Microsoft Defender for Endpoint, Identity, Cloud Apps, and Email, allowing you to build real-world detections and incident response workflows.

What you’ll learn:

How to safely set up a cyber range in a lab or virtualized environment
Best practices for configuring Microsoft Defender XDR and its integrated components
Red Team tactics, techniques, and procedures (TTPs) mapped to MITRE ATT&CK
Realistic attack simulation scenarios using well-known adversary emulation tools
How to craft custom detections, alerts, and remediation workflows
Defensive tuning and hardening based on the telemetry and behavior of simulated attacks

⚠️ Disclaimer: This book is intended strictly for educational and defensive security research purposes. All tools and techniques demonstrated must be used only in isolated, internal environments you own and control. The authors accept no responsibility for misuse or malicious application of any content described in this book. You are solely responsible for ensuring you remain compliant with all applicable laws, policies, and ethical standards.

Whether you're new to Red Teaming or looking to sharpen your detection engineering chops, Red Teaming and Blue Teaming with Microsoft Defender XDR deliver the real-world guidance needed to improve your organization's security posture before the real attackers show up.

","authors",[26,39,45,51,57],{"_14":27,"_28":29,"_5":30},"Z2lkOi8vbGVhbnB1Yi9TdG9yZTo6UHJvZHVjdEF1dGhvci82Nzg5OA","name","Dave Kawula",{"_31":32},"avatar",{"_33":34,"_35":36,"_37":38},"url","https://d308did4coypzi.cloudfront.net/avatars/963034/medium/Dave.jpg?1516320504","styleName","medium","exists",true,{"_14":40,"_28":41,"_5":42},"Z2lkOi8vbGVhbnB1Yi9TdG9yZTo6UHJvZHVjdEF1dGhvci82Nzg5OQ","Emile Cabot",{"_31":43},{"_33":44,"_35":36,"_37":38},"https://d308did4coypzi.cloudfront.net/avatars/1238027/medium/LinkedIn-Emile.png?1516367035",{"_14":46,"_28":47,"_5":48},"Z2lkOi8vbGVhbnB1Yi9TdG9yZTo6UHJvZHVjdEF1dGhvci82NzkwMA","John O'Neill Sr.",{"_31":49},{"_33":50,"_35":36,"_37":38},"https://d308did4coypzi.cloudfront.net/avatars/1520448/medium/John_Sr._Bio_Photo__3.jpg?1557795081",{"_14":52,"_28":53,"_5":54},"Z2lkOi8vbGVhbnB1Yi9TdG9yZTo6UHJvZHVjdEF1dGhvci82NzkwMQ","Cary Sun",{"_31":55},{"_33":56,"_35":36,"_37":38},"https://d308did4coypzi.cloudfront.net/avatars/1237714/medium/rsz_cary.png?1516388592",{"_14":58,"_28":59,"_5":60},"Z2lkOi8vbGVhbnB1Yi9TdG9yZTo6UHJvZHVjdEF1dGhvci82NzkwMg","Cristal Kawula",{"_31":61},{"_33":62,"_35":36,"_37":38},"https://d308did4coypzi.cloudfront.net/avatars/1260011/medium/SC1.jpg?1518548970","currentUser","routes/_store+/_layout","routes/_store+/_readers+/_layout","actionData","errors"]

Email the authors