Visão Geral

Este curso aborda investigação e resposta a incidentes envolvendo ambientes Active Directory. O participante aprenderá a identificar comprometimento de contas, investigar Domain Controllers, analisar autenticação, rastrear movimentação lateral e executar processos de contenção e recuperação.

Objetivo

Após realizar este curso, você será capaz de:

• Investigar incidentes em Active Directory
• Identificar comprometimento de identidades
• Analisar evidências de ataque
• Executar contenção e recuperação

Publico Alvo

• Incident Responders
• Analistas de SOC e Blue Team
• Profissionais de Cybersecurity
• Administradores de Active Directory

Pre-Requisitos

• Conhecimentos de Active Directory
• Familiaridade com Windows Event Logs
• Conhecimentos de Kerberos e NTLM
• Noções de SIEM
• Conhecimentos básicos de Digital Forensics

Conteúdo Programatico

Module 1: Active Directory Incident Response Fundamentals

1. Active Directory incident response
2. Domain compromise scenarios
3. Identity compromise
4. Credential compromise
5. Privileged account compromise
6. Domain Controller incidents
7. Incident severity assessment
8. Evidence sources
9. Response lifecycle
10. Incident response preparation

Module 2: Authentication and Credential Investigation

1. Kerberos event analysis
2. NTLM event analysis
3. Account logon events
4. Credential theft indicators
5. Pass-the-Hash indicators
6. Pass-the-Ticket indicators
7. Kerberoasting indicators
8. DCSync indicators
9. Suspicious authentication
10. Authentication timeline reconstruction

Module 3: Active Directory Compromise Investigation

1. Compromised account analysis
2. Privileged group changes
3. Group Policy modifications
4. Suspicious account creation
5. Domain Controller activity
6. Replication activity
7. Persistence mechanisms
8. Lateral Movement
9. Attack path reconstruction
10. Domain compromise assessment

Module 4: Windows Event Log Investigation

1. Security Event Logs
2. System Event Logs
3. PowerShell logs
4. Process creation events
5. Authentication events
6. Account management events
7. Group membership events
8. Domain Controller events
9. Event correlation
10. Timeline analysis

Module 5: Containment and Eradication

1. Account containment
2. Credential reset
3. Privileged account containment
4. Kerberos ticket invalidation
5. Endpoint isolation
6. Persistence removal
7. Malicious account removal
8. Unauthorized GPO remediation
9. Domain security restoration
10. Eradication validation

Module 6: Recovery

1. Active Directory recovery planning
2. Domain Controller recovery
3. Credential recovery
4. Privileged access restoration
5. Security configuration restoration
6. Monitoring reinforcement
7. Backup validation
8. Recovery verification
9. Post-recovery monitoring
10. Business continuity considerations

Module 7: Threat Hunting During Response

1. Compromise indicator development
2. Authentication hunting
3. Credential theft hunting
4. Lateral Movement hunting
5. Persistence hunting
6. Privileged activity hunting
7. SIEM queries
8. Endpoint telemetry
9. MITRE ATT&CK mapping
10. Threat hunting documentation

Module 8: Practical Incident Response

1. Active Directory compromise scenario
2. Initial triage
3. Evidence collection
4. Authentication investigation
5. Privileged account investigation
6. Lateral Movement analysis
7. Containment execution
8. Eradication validation
9. Recovery workflow
10. Incident response case study