Visão Geral

Este curso apresenta o protocolo NTLM, seu funcionamento, componentes de autenticação e utilização em ambientes Windows. O participante compreenderá o processo challenge-response, hashes, sessões, limitações de segurança e os principais riscos relacionados ao uso do NTLM, incluindo Pass-the-Hash e movimentação lateral.

Objetivo

Após realizar este curso, você será capaz de:

• Compreender o funcionamento do NTLM
• Analisar o fluxo de autenticação
• Identificar riscos do protocolo
• Reconhecer indicadores de abuso
• Aplicar estratégias de proteção

Publico Alvo

• Administradores Windows
• Administradores de Active Directory
• Analistas de Cybersecurity
• Profissionais de SOC
• Pentesters

Pre-Requisitos

• Conhecimentos básicos de Windows
• Familiaridade com Active Directory
• Conhecimentos básicos de autenticação
• Noções de criptografia
• Familiaridade com Windows Event Logs é recomendada

Conteúdo Programatico

Module 1: NTLM Authentication Fundamentals

1. NTLM authentication architecture
2. Challenge-response authentication
3. NTLM authentication flow
4. NTLM credentials
5. Password hash concepts
6. Authentication challenges
7. Authentication responses
8. Session establishment
9. Local authentication
10. Domain authentication

Module 2: NTLM Protocol Architecture

1. NTLM message structure
2. Negotiate messages
3. Challenge messages
4. Authenticate messages
5. Session security
6. Authentication flags
7. Security parameters
8. NTLM protocol negotiation
9. Client-server authentication
10. Protocol limitations

Module 3: NTLM Credentials and Hashes

1. Password hashing
2. NT hashes
3. Credential material
4. Password verification
5. Credential storage
6. Credential exposure
7. Local account credentials
8. Domain account credentials
9. Credential protection
10. Password security

Module 4: NTLM in Active Directory

1. NTLM and Domain Controllers
2. Domain authentication
3. NTLM fallback scenarios
4. Legacy application compatibility
5. SMB authentication
6. Remote authentication
7. Service authentication
8. NTLM trust relationships
9. NTLM usage monitoring
10. NTLM security considerations

Module 5: NTLM Attack Techniques

1. Pass-the-Hash fundamentals
2. Credential reuse
3. NTLM relay concepts
4. Credential interception risks
5. Authentication forwarding
6. Lateral movement
7. Privileged account abuse
8. NTLM-based attack indicators
9. Attack prerequisites
10. Defensive considerations

Module 6: NTLM Detection and Monitoring

1. NTLM authentication events
2. Logon monitoring
3. Source and destination analysis
4. Authentication anomalies
5. NTLM usage baselining
6. Privileged authentication monitoring
7. Event correlation
8. Network telemetry
9. Threat hunting
10. Detection engineering

Module 7: NTLM Hardening

1. NTLM reduction strategies
2. Restricting NTLM usage
3. Credential Guard
4. SMB security
5. LDAP signing considerations
6. Extended Protection
7. Privileged account protection
8. Least privilege
9. Legacy application assessment
10. NTLM security baseline

Module 8: Practical NTLM Security Analysis

1. NTLM authentication investigation
2. Authentication flow analysis
3. Suspicious NTLM activity
4. Pass-the-Hash indicators
5. Relay attack indicators
6. Lateral movement investigation
7. NTLM reduction assessment
8. Security configuration review
9. Incident response
10. Practical NTLM security case studies