Detecting Active Directory attacks
You build detections that catch Kerberos, NTLM, replication, certificate and GPO abuse from domain controller logs and network traffic, and spot attackers early with decoy accounts.
Level 401 · 13 lessons · 12 practice labs
Lessons
Logs
- Audit policy on domain controllers
- Kerberos events: 4768, 4769, 4771
- Directory change events: 5136 and group membership
- Short task: extract all privileged group changes in the last day
Attacks
- Detecting AS-REP roasting
- Forged tickets: traces of golden and silver tickets
- Abuse of certificate services
- Detecting code pushed through GPO
- Traces of NTLM relay attacks
- Short task: prove two techniques used in a recorded attack from the events
Deception
- Decoy accounts and SPNs
- Decoy credentials and shares
- Capstone: catch an attack chain against CORP.LAB with your detections
Practice labs
- Read the audit policy on the domain controller: From auditpol output state whether account management, directory service changes and Kerberos subcategories are enabled.
- Enable the missing audit subcategories through a GPO: Apply an advanced audit policy to the Domain Controllers OU and show a group membership change now produces event 4728.
- Capture attribute changes with object-level auditing: Add an audit entry on a critical OU to generate 5136 events, extract which attribute was changed by whom and narrow the noisy entries.
- Tell events 4768, 4769 and 4771 apart: Classify twenty given records as ticket request, service ticket or pre-authentication failure and explain the failure codes.
- Find ticket requests without pre-authentication in the SIEM: Search for 4768 events with pre-authentication type zero, extract the target accounts and source address and save it as a detection rule.
- Separate forged-ticket traces from normal tickets in recorded data: Find the suspicious session by looking together for service ticket use with no prior request, unusual ticket lifetime and encryption type, and write up the evidence.
- Extract the privileged group changes from the last day: List in time order who added whom to which group from events 4728, 4732 and 4756.
- Detect a new script pushed through a GPO: Combine SYSVOL file auditing and 5136 events to find a startup script added to a policy, the account that added it and the OU affected.
- Prove certificate service and NTLM relay traces in one incident: In recorded data find a certificate requested for another name from events 4886 and 4887 and a logon whose source address mismatches the machine name from 4624, then link both on a timeline.
- Find a logon attempt against a decoy account in the logs: Search events 4625 and 4768 for a decoy account that should never be used and name the source of the attempt.
- Create a decoy account with an SPN and alert on ticket requests: Create a realistic-looking account and SPN no service uses, alert on every 4769 event for it and test it in your own lab.
- Build an early warning line with a decoy share and decoy credentials: Prepare an audited decoy share and decoy credentials planted in a script, raise alerts of different severity when each is touched and filter the false alarm sources.
About this course
You build detections that catch Kerberos, NTLM, replication, certificate and GPO abuse from domain controller logs and network traffic, and spot attackers early with decoy accounts.
What you will learn
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in a Kali Linux terminal in the browser and in a practice domain (CORP.LAB) set up separately for every lab. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.