Visão Geral

Este curso apresenta os conceitos de Credential Dumping em ambientes Windows, abordando mecanismos de armazenamento de credenciais, exposição de material de autenticação, principais técnicas utilizadas por adversários e métodos de detecção e mitigação. O conteúdo é orientado à análise defensiva, threat hunting e resposta a incidentes.

Objetivo

Após realizar este curso, você será capaz de:

• Compreender os mecanismos de credential dumping
• Identificar fontes de credenciais no Windows
• Reconhecer indicadores de credential access
• Investigar atividades suspeitas
• Aplicar medidas de proteção e mitigação

Publico Alvo

• Analistas de Cybersecurity
• Profissionais de SOC e Blue Team
• Incident Responders
• Threat Hunters
• Pentesters e Red Teamers

Pre-Requisitos

• Conhecimentos de Windows
• Familiaridade com Active Directory
• Noções de autenticação Windows
• Conhecimentos básicos de PowerShell
• Familiaridade com Windows Event Logs é recomendada

Conteúdo Programatico

Module 1: Credential Dumping Fundamentals

1. Credential dumping concepts
2. Credential Access lifecycle
3. Authentication material
4. Credential exposure
5. Password hashes
6. Authentication tokens
7. Session credentials
8. Local and domain credentials
9. Privileged credentials
10. Credential theft risks

Module 2: Windows Credential Storage

1. LSASS memory
2. SAM database
3. NTDS.dit
4. Cached credentials
5. Windows Credential Manager
6. Windows secrets
7. Registry-based credentials
8. Service account credentials
9. Application credentials
10. Credential protection mechanisms

Module 3: Credential Dumping Techniques

1. Memory-based credential access
2. Local credential extraction concepts
3. Domain credential exposure
4. Credential database access
5. Cached credential access
6. Stored credential access
7. Token-related credential exposure
8. Privileged process access
9. Credential dumping indicators
10. Attack prerequisites

Module 4: Credential Access and Active Directory

1. Domain credential exposure
2. Domain Controller targeting
3. NTDS.dit risks
4. DCSync concepts
5. Replication privilege abuse
6. Privileged account compromise
7. Credential reuse
8. Lateral movement
9. Domain compromise indicators
10. Active Directory credential protection

Module 5: Detection and Telemetry

1. Credential access telemetry
2. Process creation monitoring
3. Process access monitoring
4. Authentication events
5. Privileged activity
6. Windows Event Logs
7. Endpoint Detection and Response
8. SIEM correlation
9. Behavioral indicators
10. Detection engineering

Module 6: Threat Hunting

1. Credential Access hunting
2. Suspicious process analysis
3. Abnormal authentication analysis
4. Privileged account hunting
5. LSASS access hunting
6. NTDS-related activity
7. Credential exposure indicators
8. Lateral movement hunting
9. Attack chain reconstruction
10. Hunt validation

Module 7: Prevention and Hardening

1. Credential Guard
2. Local Administrator Password Solution
3. Privileged Access Management
4. Administrative tiering
5. Least privilege
6. Protected Process Light
7. Credential isolation
8. Domain Controller hardening
9. Endpoint security controls
10. Credential protection policies

Module 8: Incident Response and Practical Investigation

1. Credential dumping incident identification
2. Compromised endpoint assessment
3. Credential exposure analysis
4. Account compromise investigation
5. Lateral movement assessment
6. Credential rotation
7. Endpoint containment
8. Domain security assessment
9. Recovery procedures
10. Practical credential dumping investigation cases