Visão Geral

Este curso apresenta o AS-REP Roasting e sua relação com contas do Active Directory configuradas de forma inadequada para autenticação Kerberos. O participante compreenderá o processo de pré-autenticação, os fatores que podem permitir exposição de material de autenticação, técnicas de detecção e estratégias de proteção.

Objetivo

Após realizar este curso, você será capaz de:

• Compreender o funcionamento do AS-REP Roasting
• Identificar contas potencialmente vulneráveis
• Analisar eventos de autenticação Kerberos
• Detectar comportamentos suspeitos
• Aplicar medidas de proteção

Publico Alvo

• Analistas de Cybersecurity
• Administradores de Active Directory
• Profissionais de SOC e Blue Team
• Threat Hunters
• Pentesters e Red Teamers

Pre-Requisitos

• Conhecimentos de Active Directory
• Familiaridade com Kerberos
• Conhecimentos básicos de contas de usuário
• Noções de PowerShell
• Familiaridade com Windows Event Logs é recomendada

Conteúdo Programatico

Module 1: AS-REP Roasting Fundamentals

1. AS-REP Roasting concepts
2. Kerberos pre-authentication
3. AS-REQ and AS-REP messages
4. User authentication
5. Pre-authentication security
6. Authentication material
7. Attack prerequisites
8. Credential exposure risks
9. Security implications
10. AS-REP Roasting lifecycle

Module 2: Kerberos Pre-Authentication

1. Pre-authentication architecture
2. Authentication requests
3. Authentication responses
4. Timestamp-based authentication
5. Encryption mechanisms
6. User account configuration
7. Pre-authentication requirements
8. Authentication failure scenarios
9. Security controls
10. Pre-authentication troubleshooting

Module 3: Vulnerable Account Identification

1. User account security properties
2. Pre-authentication configuration
3. Account inventory
4. Privileged accounts
5. Service-related accounts
6. Legacy account configurations
7. Weak account security
8. Account exposure assessment
9. Configuration auditing
10. Remediation prioritization

Module 4: Detection and Monitoring

1. Kerberos authentication events
2. AS-REQ monitoring
3. Authentication failure analysis
4. Abnormal authentication patterns
5. Source host analysis
6. Account behavior analysis
7. Windows Event Logs
8. SIEM correlation
9. Threat hunting
10. Detection engineering

Module 5: Active Directory Hardening

1. Kerberos pre-authentication protection
2. Account configuration management
3. Strong password policies
4. Privileged account protection
5. Account lifecycle management
6. Legacy account remediation
7. Least privilege
8. Administrative tiering
9. Authentication monitoring
10. Security baseline implementation

Module 6: Threat Hunting

1. AS-REP Roasting hunting methodology
2. Suspicious authentication requests
3. Account configuration hunting
4. Kerberos event analysis
5. Authentication baselining
6. Source system investigation
7. Privileged account monitoring
8. Credential exposure indicators
9. Attack chain reconstruction
10. Hunt validation

Module 7: Incident Response

1. AS-REP Roasting incident identification
2. Suspicious authentication investigation
3. Compromised account assessment
4. Credential exposure analysis
5. Privilege assessment
6. Account containment
7. Password reset
8. Domain security review
9. Persistence investigation
10. Recovery procedures

Module 8: Practical AS-REP Roasting Analysis

1. Account configuration assessment
2. Kerberos event analysis
3. Authentication anomaly investigation
4. Vulnerable account identification
5. Detection rule development
6. Hardening assessment
7. Incident response exercise
8. Security control validation
9. Monitoring improvement
10. Practical AS-REP Roasting case studies