Visão Geral
Este curso aborda o DCSync como técnica de abuso dos mecanismos de replicação do Active Directory. O foco está na compreensão do funcionamento da replicação, dos privilégios necessários, dos indicadores de atividade suspeita e das estratégias de prevenção, detecção e resposta a esse tipo de comprometimento.
Conteúdo Programatico
Module 1: Active Directory Replication
- Directory replication fundamentals
- Domain Controller replication
- Replication partners
- Directory Replication Service
- Replication permissions
- Replication topology
- Synchronization processes
- Replication security
Module 2: DCSync Attack Concepts
- DCSync fundamentals
- Replication privilege abuse
- Directory synchronization requests
- Credential replication risks
- Privileged identity requirements
- Domain compromise scenarios
- Attack indicators
- Security implications
Module 3: DCSync Detection
- Directory Service Access auditing
- Replication-related events
- Privileged account monitoring
- Unusual replication requests
- Source host analysis
- Event correlation
- Behavioral detection
- Threat hunting
Module 4: Prevention and Hardening
- Replication permission management
- Privileged group protection
- Least privilege
- Domain Controller hardening
- Administrative tiering
- Credential protection
- Service account security
- Attack surface reduction
Module 5: Incident Response
- DCSync incident investigation
- Compromised account analysis
- Domain-wide credential exposure
- Privilege remediation
- Credential rotation
- Domain Controller assessment
- Persistence investigation
- Practical DCSync detection case studies