Visão Geral

Este curso apresenta os principais ataques direcionados às credenciais em ambientes Active Directory, incluindo ataques contra Kerberos, NTLM, contas privilegiadas e mecanismos de replicação. O curso também aborda técnicas de detecção, mitigação e hardening.

Objetivo

Após realizar este curso, você será capaz de:

• Identificar ataques contra credenciais do Active Directory
• Compreender mecanismos de autenticação exploráveis
• Detectar atividades suspeitas
• Aplicar medidas de mitigação

Publico Alvo

• Profissionais de Cybersecurity
• Penetration Testers
• Red Team
• SOC e Blue Team
• Administradores de Active Directory

Pre-Requisitos

• Conhecimentos de Active Directory
• Familiaridade com Windows Server
• Conhecimentos de Kerberos e NTLM
• Noções de PowerShell
• Conhecimentos básicos de segurança de redes

Conteúdo Programatico

Module 1: Active Directory Credential Attack Fundamentals

1. Credential attack lifecycle
2. Active Directory authentication architecture
3. Credential Access techniques
4. Identity attack surface
5. Privileged credential exposure
6. Authentication trust relationships
7. Credential attack paths
8. Domain compromise concepts
9. Attack detection principles
10. Credential defense architecture

Module 2: NTLM Credential Attacks

1. NTLM authentication
2. NTLM challenge-response
3. NTLM hashes
4. Pass-the-Hash
5. NTLM relay concepts
6. Credential reuse
7. NTLM attack surface
8. NTLM security weaknesses
9. NTLM monitoring
10. NTLM hardening

Module 3: Kerberos Credential Attacks

1. Kerberos authentication
2. Ticket Granting Tickets
3. Service tickets
4. Kerberoasting
5. AS-REP Roasting
6. Ticket extraction concepts
7. Pass-the-Ticket
8. Service account exposure
9. Kerberos attack detection
10. Kerberos hardening

Module 4: Active Directory Replication Attacks

1. Directory replication architecture
2. Replication permissions
3. DCSync attack concepts
4. Replication privilege abuse
5. Domain credential extraction risks
6. Privileged replication accounts
7. DCSync detection
8. Event-based monitoring
9. Replication security
10. Defensive controls

Module 5: Privileged Credential Attacks

1. Domain Administrator targeting
2. Enterprise Administrator targeting
3. Privileged group abuse
4. Credential dumping
5. Service account attacks
6. Administrative session exposure
7. Credential reuse
8. Privilege escalation
9. Privileged account monitoring
10. Privileged identity defense

Module 6: Credential Attack Chains

1. Initial credential compromise
2. Credential harvesting
3. Credential validation
4. Privilege escalation
5. Lateral Movement
6. Domain persistence
7. Credential replay
8. Attack path construction
9. Detection opportunities
10. Attack chain analysis

Module 7: Detection and Defense

1. Authentication monitoring
2. Windows Event Logs
3. Kerberos event analysis
4. NTLM event analysis
5. Privileged activity monitoring
6. SIEM correlation
7. MITRE ATT&CK mapping
8. Threat hunting
9. Detection engineering
10. Credential attack response

Module 8: Practical Active Directory Credential Defense

1. Credential attack assessment
2. Kerberos security assessment
3. NTLM security assessment
4. Privileged account assessment
5. Replication security review
6. Detection rule implementation
7. Attack investigation
8. Hardening validation
9. Incident response simulation
10. Active Directory credential attack case studies