Visão Geral

Este curso aborda investigação de comprometimentos em Active Directory, com foco em credenciais, autenticação, privilégios, Domain Controllers, persistência, movimentação lateral e reconstrução de ataques.

Objetivo

Após realizar este curso, você será capaz de:

• Investigar comprometimentos de Active Directory
• Identificar técnicas utilizadas pelo atacante
• Reconstruir caminhos de ataque
• Apoiar contenção e recuperação

Publico Alvo

• Incident Responders
• DFIR Professionals
• Active Directory Security Teams
• Threat Hunters

Pre-Requisitos

• Conhecimentos avançados de Active Directory
• Familiaridade com Kerberos e NTLM
• Conhecimentos de Windows Event Logs
• Noções de SIEM
• Conhecimentos básicos de Digital Forensics

Conteúdo Programatico

Module 1: Active Directory Compromise Investigation

1. Active Directory compromise scenarios
2. Domain attack lifecycle
3. Identity compromise
4. Credential compromise
5. Privilege escalation
6. Lateral Movement
7. Persistence
8. Domain Controller compromise
9. Investigation methodology
10. Investigation scope

Module 2: Authentication Investigation

1. Kerberos authentication
2. NTLM authentication
3. Authentication events
4. Failed authentication
5. Abnormal authentication
6. Service ticket analysis
7. Ticket-based attacks
8. Pass-the-Hash indicators
9. Authentication timeline
10. Authentication investigation

Module 3: Credential Attack Investigation

1. Credential Dumping
2. LSASS activity
3. Kerberoasting
4. AS-REP Roasting
5. Pass-the-Hash
6. Pass-the-Ticket
7. DCSync
8. Golden Ticket
9. Silver Ticket
10. Credential compromise assessment

Module 4: Privilege and Persistence Investigation

1. Privileged accounts
2. Privileged group changes
3. Group Policy modifications
4. Service account abuse
5. Delegation abuse
6. Persistence mechanisms
7. Golden Ticket persistence
8. Silver Ticket persistence
9. Administrative persistence
10. Persistence investigation

Module 5: Lateral Movement Investigation

1. SMB activity
2. WinRM
3. Remote Desktop
4. WMI
5. Remote service execution
6. Credential reuse
7. Privileged movement
8. Authentication correlation
9. Movement timeline
10. Lateral Movement reconstruction

Module 6: Domain Controller Investigation

1. Domain Controller telemetry
2. Security logs
3. Directory Service logs
4. Replication activity
5. DCSync investigation
6. Group Policy activity
7. Account management
8. Privileged operations
9. Domain compromise indicators
10. Domain Controller investigation

Module 7: Attack Reconstruction and Response

1. Attack timeline
2. Initial Access
3. Credential Access
4. Privilege Escalation
5. Lateral Movement
6. Persistence
7. Command and Control
8. Impact assessment
9. Containment
10. Recovery planning

Module 8: Practical Active Directory Investigation

1. Compromise triage
2. Authentication analysis
3. Credential investigation
4. Privileged activity investigation
5. Lateral Movement analysis
6. Domain Controller analysis
7. Timeline reconstruction
8. SIEM investigation
9. Incident response
10. Active Directory compromise case study