Masterclass: Advanced Active Directory Attacks and Mitigations: Investigation and Monitoring Suplement
- Course Code AADA-IM
- Duration 2 days
Course Delivery
Jump to:
Course Delivery
This course is available in the following formats:
-
Virtual Learning
Learning that is virtual
Request this course in a different delivery format.
Course Overview
TopThis is an international Live Virtual Class, which means you will share the learning experience with a group of IT pros from around the world! This is a great workshop that teaches how to implement secure Microsoft Active Directory infrastructure. The course covers all modern attacks against core Windows identity solutions that everybody talks about and during the session, you will learn how to prevent them! Our goal is to show you how to make your AD infrastructure immune to modern hacking techniques.
This is a deep dive workshop on Active Directory services security, a must-go for administrators, security officers and architects.All exercises are based on Windows Server 2022 and 2025, Windows 11, and Kali Linux. This course is based on our practical knowledge from tons of successful projects, many years of real-world experience, and zero mercy for misconfigurations or insecure solutions!
Course Schedule
TopTarget Audience
Top- Security architects
- Active Directory administrators
- Security administrators
- Security auditors, and other people responsible for implementing secure identity.
Course Objectives
TopAfter completing this course you should be able to:
- Assess the health and structure of AD objects, containers, and GPOs
- Analyze and validate permissions and access control configurations
- Understand NTLM authentication workflow (v1 and v2)
- Detect indicators of NTLM-based attacks
- Understand the Kerberos authentication flow and ticketing process
- Identify and execute common Kerberos attacks
Course Content
TopModule 1: Active Directory Services Health Check
- Objects, containers, GPOs
- Permissions
- Delegation of privileges
- Trusts
- Monitoring
Module 2: NTLM authentication
- NTLM v1
- NTLM v2
- Pass-the-Hash
- MITM Attacks
- NetNTLM Response cracking
- NTLM Relay
- Online password attacks
Module 3: Attacks on NTLM: Detection and Mitigations
- NTLM attack detections
- Hardening NTLM authentication
Module 4: Kerberos authentication
- Authentication flow
- Service kerberization
- PKInit
- PAC validation
Module 5: Attacks against Kerberos: Detection and Mitigations
- Pass-the-Ticket
- Pass-the-Key and Overpass-the-Hash
- Silver ticket
- Golden ticket
- Keberoasting and AS_REP Roasting
- Kerberos armoring
Module 6: Advanced AD Attacks and Persistence: Detection and Mitigations
- Domain and forest security boundaries
- DCSync
- DCShadow
- AdminSDHolder
- NGC Keys and Shadow Credentials
- Skeleton Key
- Golden Ticket
- Offline attacks
- Decrypting secrets with DPAPI and DPAPI-NG
- Attacks against smart card-based-authentication
Module 7: System based mitigations against identity attacks
- LAPS
- LSA Protection
- Credential Guard
- Defender Attack Surface Reduction
- RPC Filters
Module 8: Active Directory auditing techniques
- Security Assessment Checklists and Tools
- Attack Path Mapping
- ACL Analysis
Module 9: Entra ID Hybrid Security
- Stealing Entra ID tokens
- Kerberos Trust
- Seamless SSO
- Federated Authentication
Course Prerequisites
TopAttendees should meet the following prerequisites:
- A good hands-on experience with Active Directory Domain Services (AD DS) administration
- Basic experience with Windows Server administration
- Familiarity with identity and access management concepts (users, groups, permissions, Kerberos, NTLM)
Test Certification
Top- What is wonderful about our certification is that it is lifetime valid with no renewal fees – the technology changes, but fundamentals and attitude remain mostly the same. Our Virtual Certificates, which entitle you to collect CPE Points, are issued via Accredible.
