Visão Geral

Este curso aborda técnicas de movimentação lateral em ambientes corporativos, com foco em Windows, Active Directory, autenticação, credenciais, administração remota, detecção e medidas defensivas.

Objetivo

Após realizar este curso, você será capaz de:

• Compreender técnicas de Lateral Movement
• Identificar caminhos de movimentação
• Detectar atividades suspeitas
• Aplicar medidas de prevenção

Publico Alvo

• Profissionais de Cybersecurity
• Penetration Testers e Red Team
• SOC e Blue Team
• Administradores Windows

Pre-Requisitos

• Conhecimentos de redes TCP/IP
• Familiaridade com Windows
• Conhecimentos de Active Directory
• Conhecimentos de Kerberos e NTLM
• Noções de PowerShell

Conteúdo Programatico

Module 1: Lateral Movement Fundamentals

1. Lateral Movement concepts
2. Attack chain and movement phases
3. Internal reconnaissance
4. Trust relationships
5. Credential reuse
6. Privileged access paths
7. Remote administration
8. Lateral Movement attack surface
9. Detection opportunities
10. Defensive strategies

Module 2: Windows Remote Services

1. Server Message Block
2. Windows Remote Management
3. Remote Desktop Services
4. Remote Service administration
5. Windows Management Instrumentation
6. Remote PowerShell
7. Administrative shares
8. Remote service authentication
9. Service-based movement detection
10. Remote service hardening

Module 3: Credential-Based Movement

1. Credential reuse
2. Pass-the-Hash
3. Pass-the-Ticket
4. NTLM authentication
5. Kerberos authentication
6. Credential exposure
7. Privileged credentials
8. Authentication monitoring
9. Credential-based detection
10. Credential protection

Module 4: Active Directory Lateral Movement

1. Domain enumeration
2. Privileged group discovery
3. Domain Controller identification
4. Trust relationships
5. Service account discovery
6. Administrative relationships
7. Delegation risks
8. Attack path analysis
9. Active Directory monitoring
10. Lateral Movement prevention

Module 5: Detection and Monitoring

1. Windows Event Logs
2. Authentication events
3. Process creation
4. Remote service events
5. Network connections
6. PowerShell logging
7. Sysmon telemetry
8. SIEM correlation
9. MITRE ATT&CK mapping
10. Detection rule development

Module 6: Defensive Controls

1. Least privilege
2. Administrative tiering
3. Network segmentation
4. Credential Guard
5. Protected Users
6. LAPS
7. Remote service restrictions
8. Privileged Access Workstations
9. Authentication hardening
10. Lateral Movement prevention

Module 7: Threat Hunting

1. Lateral Movement indicators
2. Authentication hunting
3. Remote service hunting
4. Privileged account hunting
5. Suspicious network activity
6. Credential reuse indicators
7. Endpoint telemetry
8. SIEM hunting queries
9. Attack path reconstruction
10. Threat hunting documentation

Module 8: Practical Lateral Movement Analysis

1. Internal reconnaissance
2. Credential-based access assessment
3. Remote service analysis
4. Active Directory attack path analysis
5. Authentication investigation
6. Event Log analysis
7. SIEM investigation
8. Defensive control validation
9. Incident response workflow
10. Lateral Movement case studies