Kerberos & Authentication
Defending against Kerberoasting and AS-REP roasting
Shrink Kerberoasting and AS-REP roasting exposure: inventory SPNs, remove stale ones, move to gMSA and AES, deploy a honey SPN and detect RC4 4769 spikes.
Foundation
Guides tagged
#detection
Object & ACL Security
Finding and removing DCSync rights in Active Directory
Audit who holds DS-Replication-Get-Changes-All and equivalent rights on the domain root, remove the ones that should not exist, and alert on DCSync.
Foundation
Auditing, Logging & Detection
AD honeytokens: honey accounts, honey SPNs and decoys
Deploy honey accounts, honey SPNs, AS-REP decoys, fake GPP passwords and read-audited decoy objects in AD, and alert on them with near-zero false positives.
Intermediate
Auditing, Logging & Detection
Windows Event Forwarding for domain controllers
Build a Windows Event Forwarding pipeline for DCs: source-initiated subscriptions, GPO, log access, XPath queries, collector sizing and health checks.
Intermediate
Auditing, Logging & Detection
Active Directory security event IDs: a DC reference
Every AD security event ID worth collecting on domain controllers: logon, Kerberos, NTLM, account, group, directory and AD CS events, with fields to hunt.
Foundation
Auditing, Logging & Detection
AD auditing and detection: audit policy and event IDs
Configure Advanced Audit Policy, SACLs, and Windows Event Forwarding so you can actually see Kerberoasting, DCSync, and privilege escalation in AD.
Foundation