Visão Geral

Este curso aborda técnicas avançadas de obtenção, extração, proteção e detecção de credenciais em ambientes Windows. O conteúdo explora fontes de credenciais, mecanismos de autenticação, riscos de exposição e técnicas de defesa utilizadas em avaliações de segurança e resposta a incidentes.

Objetivo

Após realizar este curso, você será capaz de:

• Compreender técnicas avançadas de credential theft
• Identificar fontes de credenciais em Windows
• Analisar ataques contra credenciais
• Implementar mecanismos de detecção e proteção

Publico Alvo

• Profissionais de Cybersecurity
• Analistas de SOC e Blue Team
• Penetration Testers
• Administradores Windows e Active Directory

Pre-Requisitos

• Conhecimentos de Windows
• Familiaridade com Active Directory
• Conhecimentos de Kerberos e NTLM
• Noções de Windows Event Logs
• Conhecimentos básicos de PowerShell

Conteúdo Programatico

Module 1: Advanced Credential Theft Fundamentals

1. Credential theft attack lifecycle
2. Windows authentication architecture
3. Credential material and authentication secrets
4. Credential exposure and attack surface
5. Credential Access techniques
6. Local and domain credential sources
7. Privileged credential targeting
8. Credential theft indicators
9. Defensive architecture
10. Credential protection strategy

Module 2: Windows Credential Sources

1. LSASS memory
2. SAM database
3. Security Account Manager architecture
4. Windows Credential Manager
5. Cached domain credentials
6. Registry-based credential material
7. Service account credentials
8. Browser and application credential stores
9. DPAPI-protected secrets
10. Credential source assessment

Module 3: Advanced Credential Access Techniques

1. Memory-based credential extraction concepts
2. Credential dumping attack chains
3. Hash extraction
4. Ticket extraction
5. Token abuse
6. Credential replay concepts
7. Privileged credential targeting
8. Remote credential exposure
9. Credential theft detection opportunities
10. Attack path analysis

Module 4: Credential Theft in Active Directory

1. Domain credential exposure
2. Kerberos ticket abuse
3. NTLM credential abuse
4. DCSync attack concepts
5. Replication privilege abuse
6. Service account targeting
7. Kerberoasting
8. AS-REP Roasting
9. Domain credential compromise
10. Active Directory credential defense

Module 5: Credential Protection and Hardening

1. Credential Guard
2. Protected Users
3. LAPS
4. Windows Defender protections
5. Administrative tiering
6. Privileged Access Workstations
7. Least privilege
8. Authentication hardening
9. Credential exposure reduction
10. Credential security architecture

Module 6: Detection and Investigation

1. Credential Access detection
2. Windows Event Logs
3. Sysmon telemetry
4. Process creation monitoring
5. Authentication event analysis
6. Suspicious memory access
7. Privileged account monitoring
8. SIEM correlation
9. Threat hunting
10. Credential theft investigation

Module 7: Incident Response

1. Credential compromise assessment
2. Compromised account identification
3. Credential revocation
4. Password reset strategy
5. Kerberos ticket invalidation
6. Privileged account containment
7. Endpoint isolation
8. Evidence preservation
9. Recovery procedures
10. Post-incident credential analysis

Module 8: Practical Credential Theft Defense

1. Credential exposure assessment
2. Credential source identification
3. Detection rule development
4. Event Log investigation
5. Privileged account analysis
6. Credential protection validation
7. Attack path analysis
8. Security control assessment
9. Incident response simulation
10. Advanced credential theft case studies