Defending Active Directory

Module 0 of Defending Active Directory: what Active Directory is and why attackers want it, Northgate's domain, the evidence this course reads, your first investigation, four ways to write a detection, and what this course builds.

Module 1 of Defending Active Directory: sign-ins to domain controllers, stealing NTDS.dit, passwords in SYSVOL, replication and DCSync, the forgotten domain controller, and reading authentication on a DC.

Module 2 of Defending Active Directory: advanced audit policy for domain controllers, SACLs and directory service changes, collection gaps, and reading an event.

Module 3 of Defending Active Directory: reading an AD intrusion as a sequence, control is privilege, and mapping your detections to ATT&CK.

Module 4 of Defending Active Directory: native-command reconnaissance, LDAP reconnaissance, SharpHound collection, and detecting and scoring enumeration.

Module 5 of Defending Active Directory: hidden and forgotten privileged accounts and Tool 2, tier 0 credentials on lower-tier machines, administration from daily-use devices instead of privileged access workstations, helpdesk reset rights over privileged accounts, and break-glass accounts.

Module 6 of Defending Active Directory: credential theft from LSASS with Credential Guard and LSA protection, credentials exposed by Remote Desktop with Restricted Admin and Remote Credential Guard, Protected Users and authentication policies, and administrator passwords stored in services and scheduled tasks.

Module 7 of Defending Active Directory: lateral movement with one local administrator password shared across the laptops and Windows LAPS, who can read the passwords LAPS manages and the record a read leaves, and domain groups placed in every machine's Administrators group.

Module 8 of Defending Active Directory: pass-the-hash with a stolen NTLM credential, NTLM relay and the coercion that makes a controller authenticate, relay to LDAP with LDAP signing and channel binding, and auditing NTLM before restricting it.

Module 9 of Defending Active Directory: Kerberoasting, AS-REP roasting, pass-the-ticket and overpass-the-hash, golden tickets and krbtgt, and silver tickets.

Module 10 of Defending Active Directory: an over-privileged service account that reaches the domain, service accounts signing in interactively, moving to gMSA and dMSA, and the service account assessment.

Module 11 of Defending Active Directory: GenericWrite and GenericAll on a user, WriteDACL and WriteOwner, AddMember on a privileged group, ForceChangePassword, and finding dangerous permissions.

Module 12 of Defending Active Directory: a malicious GPO edit, a malicious GPO link, and reviewing delegated GPO rights.

Module 13 of Defending Active Directory: unconstrained delegation and coercion, constrained delegation and protocol transition, resource-based constrained delegation, and auditing delegation across the domain.

Module 14 of Defending Active Directory: collecting safely and reading the graph, the shortest realistic path to Domain Admin, breaking paths by choosing the cheapest edge, and the Attack Path Workbook.

Module 15 of Defending Active Directory: stealing the domain from backups and virtual machine snapshots, malicious services on a domain controller, exploiting an unpatched controller, and outbound traffic from controllers.

Module 16 of Defending Active Directory: LLMNR and NBT-NS poisoning, WPAD abuse, and malicious records through dynamic updates.

Module 17 of Defending Active Directory: moving across a forest trust without selective authentication, SID history across trusts and SID filtering, escalation from a child domain to its forest root, and abusing the inter-realm trust key.

Module 18 of Defending Active Directory: ESC1 and a requester who names the subject, ESC2 and ESC3 with any-purpose and enrollment agent certificates, ESC4 and editable templates, ESC6 and ESC7 on the CA's own settings and officers, and ESC8 relaying to web enrollment.

Module 19 of Defending Active Directory: from single detections to a catalog and a deployable pack, correlating alerts into incidents, testing detections with labeled attacks, and tuning against the legitimate activity that looks like an attack in Active Directory.

Module 20 of Defending Active Directory: what the sensors see and miss, investigating a reconnaissance alert, investigating a credential-access alert, and the posture assessments as a work queue.

Module 21 of Defending Active Directory: classifying an intrusion's impact, scoping every account, host and controller it touched, credential containment and reset order, resetting krbtgt, and the AD incident response playbook.

Module 22 of Defending Active Directory: AdminSDHolder backdoors, SID history injection, DCShadow and rogue domain controllers, Skeleton Key and malicious authentication packages, golden certificates and stolen CA keys, and hunting a domain for persistence.

Module 23 of Defending Active Directory: backups an attacker cannot destroy or poison, restoring a deleted or altered privileged object, recovering the first domain controller in isolation, and the forest recovery runbook.

Module 24 of Defending Active Directory: baselines and standards with Tool 1, the AD security assessment, the operating cadence that runs every recurring check, and measuring AD security over time.

One sheet per module of Defending Active Directory, each entry a question, the KQL and SPL query a lesson ran to answer it on the course month, what to read in the result and what the result does not prove.

Procedures for the questions an AD investigation raises, each run on the course month.

What the course runs on, and an optional lab domain of your own for the Defend and Verify steps: the AD corpus and evidence folders, building a corp.ne.com controller, and the script that seeds it with Northgate's weaknesses.

Six worked investigations on the course's Active Directory corpus, each from an alert or a detection row to a verdict: the Kerberoasting alert, svc-legacy's AS-REP, the LSASS read, the database copied over C$, the DCSync alert and the nightly backup.

Hunting patterns for AD persistence and detection tuning, and the AD security calendar.

Where to practice what the course teaches: queries on the AD corpus in the page, graded exercises and challenge sets, configuration audits, and the tools the course builds.

Every detection in Defending Active Directory, by phase of the course, in KQL, SPL, PowerShell and Sigma, generated from the course detection library.

The sources behind Defending Active Directory, arranged by the question each answers: the events, how AD works, the attacks, BloodHound, Defender for Identity, writing detections, hardening and public guidance.

The Defending Active Directory project: a prepared case from another company's domain, worked with the course's own tools from the evidence pack alone, ending in a timeline, the attack path, a scope register, the detections that fired and those that did not, a containment and reset order, the persistence found, and a page for leadership. No submission, no grading.

Defending Active Directory end-of-course exam: twenty-four tasks, one per teaching module, each answered by writing KQL against the course's AD corpus month and checked on the server.