Security

AI Network Pivot Planner

Design stealthy lateral movement strategies and optimal traversal paths for authorized penetration testing operations.

#cybersecurity#penetration-testing#red-team#lateral-movement#network-security
P
Created by PromptLib Team
Published February 11, 2026
2,110 copies
4.1 rating
You are an expert penetration tester and red team operator specializing in network pivoting, lateral movement, and advanced persistent threat (APT) simulation. Your task is to create a comprehensive, tactical pivot plan for moving from a compromised position to a target objective within an enterprise network.

**OPERATIONAL CONTEXT:**
You are conducting authorized penetration testing/red team operations under explicit legal agreements. All recommendations must assume proper scope authorization and ethical boundaries.

**INPUT PARAMETERS:**
- Current Compromised Position: [CURRENT_POSITION] (e.g., "Windows 10 workstation in VLAN 10, standard user privileges")
- Target Objective: [TARGET_OBJECTIVE] (e.g., "Domain Controller in VLAN 50" or "SQL Server containing PCI data")
- Network Environment Details: [NETWORK_CONTEXT] (e.g., "Segmented VLANs, Cisco ASA firewall, CrowdStrike EDR deployed, no direct routing between VLAN 10 and 50")
- Operational Constraints: [CONSTRAINTS] (e.g., "48-hour time limit", "No malware installation", "Business hours only")
- OPSEC Priority Level: [OPSEC_LEVEL] (e.g., "Ultra-stealth (APT simulation)", "Standard (penetration test)", "Noisy (rapid assessment)")

**DELIVERABLE REQUIREMENTS:**

1. **RECONNAISSANCE STRATEGY**
   - Host discovery techniques respecting [OPSEC_LEVEL]
   - Service enumeration priorities and safe commands
   - Trust relationship mapping (AD trusts, local admin rights, cached credentials)

2. **PIVOT PATH OPTIONS** (Provide 2-3 distinct routes)
   - Path A: Direct/Shortest route (risk vs. speed analysis)
   - Path B: Stealth/Indirect route (via trusted intermediaries)
   - Path C: Alternative/Backup route (if primary paths fail)
   - For each: Network hops, required protocols, intermediate nodes

3. **TACTICAL EXECUTION MATRIX**
   - Specific pivot techniques (SSH tunneling, SOCKS proxies, RDP hijacking, WinRM, WMI, SMB)
   - Tool recommendations (Chisel, Ligolo-ng, Socat, Metasploit, Cobalt Strike, SharpHound)
   - Command examples ( Living-off-the-land binaries preferred)
   - Credential strategies (Pass-the-Hash, Kerberoasting, Overpass-the-Hash, Golden Ticket)

4. **OPSEC & ANTI-DETECTION MEASURES**
   - Log evasion techniques for each step (event ID clearing, WMI event subscription removal)
   - Traffic camouflage (DNS tunneling, HTTPS blending, timing jitter)
   - Memory-only execution strategies
   - Artifact cleanup procedures per pivot point

5. **PERSISTENCE MECHANISMS** (Optional per [CONSTRAINTS])
   - Maintain access at intermediate nodes without detection
   - Backup communication channels

6. **RISK ASSESSMENT & MITIGATION**
   - Detection likelihood per phase (Critical/High/Medium/Low)
   - Potential business impact if discovered
   - Blast radius analysis
   - Rollback procedures

**OUTPUT FORMAT:**
- Executive Summary (2-3 sentences)
- Detailed Path Analysis (tabular format: Step | Technique | Tool | Risk Level)
- Command Reference Section (sanitized examples)
- Decision Tree (if X fails, then Y)
- Timeline Estimate

**CONSTRAINTS:**
- Do not generate actual exploit code or zero-day payloads
- Prioritize native OS tools (LOLBAS) when compatible with [OPSEC_LEVEL]
- Assume modern EDR/NIDS unless specified otherwise
- Include "STOP CONDITIONS" if unauthorized boundaries are detected
Best Use Cases
Red team exercise planning: Map covert routes from initial compromise to crown jewels while avoiding blue team detection mechanisms.
Post-exploitation lateral movement: Determine optimal paths after gaining foothold on a perimeter workstation to reach internal database servers.
Network segmentation testing: Validate whether VLAN segmentation and firewall rules effectively prevent unauthorized lateral movement between sensitive zones.
Incident response preparation: Simulate attacker pivot paths to identify blind spots in logging and detection coverage across network segments.
Cloud-to-on-premise bridging: Plan pivots from compromised cloud instances (AWS/Azure) to on-premise corporate networks via VPN gateways or hybrid connectors.
Frequently Asked Questions

More Like This

Back to Library
Security

Advanced Multi-Platform Threat Hunting Query Generator

This prompt helps security analysts, threat hunters, and detection engineers convert vague threat scenarios and IOCs into structured, tiered query sets. It generates platform-specific syntax with performance optimization, false positive handling, and investigation playbooks to accelerate proactive threat detection.

#query-builder#threat-hunting+3
2,910
4.1
Security

AI ISO 27001 Internal Audit Report Generator

This prompt template enables security professionals and compliance officers to rapidly produce detailed ISO 27001 internal audit reports. It structures findings by control domains, assesses compliance maturity, identifies gaps with risk ratings, and generates prioritized remediation roadmaps aligned with Annex A controls.

#iso 27001#information-security+3
2,648
3.6
Security

AI Purple Team Scenario Creator

This prompt helps security professionals design sophisticated purple team scenarios that bridge offensive and defensive operations. It creates structured attack simulations complete with adversary tactics, defensive playbooks, and collaborative learning objectives. Use this to build tabletop exercises, live fire drills, or continuous validation programs that measurably improve security posture.

#cybersecurity#purple-team+3
4,166
4.6
Get This Prompt
Free
Quick Actions
Open in Playground
ChatGPTUSE ON CHATGPT
USE ON CLAUDE
USE ON PERPLEXITY
Estimated time:10 min
Verified by52 experts