corpus.blog
42,281 blogs · 5,361,753 posts Claim your blog
Record · corpus.blog/posts/01a0ffc4-330d-7309-996d-4769d21b5e00

Active Directory (Attack & Defense )

0xsp.com · published 19 April 2022

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at 0xsp.com Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
External links
336
Words captured
6,080

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://adsecurity.org/?p=1508
adsecurity.org
https://social.technet.microsoft.com/wiki/contents/articles/18996.active-directory-powershell-script-to-list-all-spns-used.aspx
social.technet.microsoft.com
https://blog.stealthbits.com/discovering-service-accounts-without-using-privileges/
blog.stealthbits.com
https://github.com/SnaffCon/Snaffler
github.com
https://thevivi.net/2018/05/23/a-data-hunting-overview/
thevivi.net
https://www.harmj0y.net/blog/redteaming/push-it-push-it-real-good/
harmj0y.net
https://blog.netspi.com/finding-sensitive-data-domain-sql-servers-using-powerupsql/
blog.netspi.com
https://www.youtube.com/watch?v=ZIOw_xfqkKM
youtube.com
https://www.fortynorthsecurity.com/remotely-search/
fortynorthsecurity.com
http://www.harmj0y.net/blog/penetesting/i-hunt-sysadmins/
harmj0y.net
https://www.crowdstrike.com/blog/hidden-administrative-accounts-bloodhound-to-the-rescue/
crowdstrike.com
https://adsecurity.org/?p=2535
adsecurity.org
https://adsecurity.org/?p=3719
adsecurity.org
http://www.labofapenetrationtester.com/2018/10/domain-enumeration-from-PowerShell-CLM.html
labofapenetrationtester.com
https://github.com/NetSPI/PowerUpSQL/wiki/Active-Directory-Recon-Functions
github.com
https://www.sixdub.net/?p=591
sixdub.net
https://blog.netspi.com/dumping-active-directory-domain-info-with-powerupsql/
blog.netspi.com
https://www.harmj0y.net/blog/redteaming/local-group-enumeration/
harmj0y.net
https://blog.stealthbits.com/local-admin-mapping-bloodhound
blog.stealthbits.com
Situational Awareness Read at the source ↗
pentestlab.blog
https://www.javelin-networks.com/static/5fcc6e84.pdf
javelin-networks.com
https://www.harmj0y.net/blog/activedirectory/a-pentesters-guide-to-group-scoping/
harmj0y.net
https://adsecurity.org/?p=3164
adsecurity.org
https://www.harmj0y.net/blog/powershell/running-laps-with-powerview/
harmj0y.net
https://rastamouse.me/tags/laps/
rastamouse.me
https://rastamouse.me/2018/09/enumerating-applocker-config/
rastamouse.me
https://github.com/SpecterOps/AzureHound
github.com
https://github.com/dirkjanm/ROADtools
github.com
https://github.com/Gerenios/AADInternals
github.com
https://www.slideshare.net/DirkjanMollema/im-in-your-cloud-reading-everyones-email-hacking-azure-ad-via-active-directory
slideshare.net
https://blog.netspi.com/utiilzing-azure-for-red-team-engagements/
blog.netspi.com
https://speakerdeck.com/tweekfawkes/blue-cloud-of-death-red-teaming-azure-1
speakerdeck.com
Azure AD Connect for Red Teamers Read at the source ↗
blog.xpnsec.com
https://www.blackhillsinfosec.com/red-teaming-microsoft-part-1-active-directory-leaks-via-azure/
blackhillsinfosec.com
https://adsecurity.org/wp-content/uploads/2019/08/2019-BlackHat-US-Metcalf-Morowczynski-AttackingAndDefendingTheMicrosoftCloud.pdf
adsecurity.org
https://www.youtube.com/watch?v=oTyLdAUjw30
youtube.com
https://blog.netspi.com/using-powershell-identify-federated-domains/
blog.netspi.com
https://github.com/mdsecresearch/LyncSniper
github.com
https://www.slideshare.net/DouglasBienstock/troopers-19-i-am-ad-fs-and-so-can-you
slideshare.net
https://github.com/SpecterOps/BloodHound
github.com
https://github.com/ly4k/Certipy
github.com
https://github.com/GhostPack/Certify
github.com
https://github.com/Pennyw0rth/NetExec
github.com
https://adsecurity.org/?p=2288
adsecurity.org
https://blog.rapid7.com/2016/07/27/pentesting-in-the-real-world-group-policy-pwnage/
blog.rapid7.com
https://adsecurity.org/?p=525
adsecurity.org
https://labs.mwrinfosecurity.com/blog/digging-into-ms14-068-exploitation-and-defence/
labs.mwrinfosecurity.com
https://www.trustedsec.com/2014/12/ms14-068-full-compromise-step-step/
trustedsec.com
http://www.labofapenetrationtester.com/2017/05/abusing-dnsadmins-privilege-for-escalation-in-active-directory.html
labofapenetrationtester.com
https://adsecurity.org/?p=4064
adsecurity.org
https://github.com/CravateRouge/bloodyAD
github.com
https://adsecurity.org/?p=1667
adsecurity.org
https://adsecurity.org/?p=4056
adsecurity.org
https://blog.stealthbits.com/unconstrained-delegation-permissions/
blog.stealthbits.com
https://labs.mwrinfosecurity.com/blog/trust-years-to-earn-seconds-to-break/
labs.mwrinfosecurity.com
https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1
posts.specterops.io
https://www.riccardoancarani.it/exploiting-unconstrained-delegation/
riccardoancarani.it
https://www.harmj0y.net/blog/redteaming/another-word-on-delegation/
harmj0y.net
https://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/
harmj0y.net
http://www.harmj0y.net/blog/activedirectory/s4u2pwnage/
harmj0y.net
https://www.secureauth.com/blog/kerberos-delegation-spns-and-more
secureauth.com
https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html
shenaniganslabs.io
https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/resource-based-constrained-delegation-ad-computer-object-take-over-and-privilged-code-execution
ired.team
https://blog.stealthbits.com/resource-based-constrained-delegation-abuse/
blog.stealthbits.com
http://www.harmj0y.net/blog/activedirectory/a-case-study-in-wagging-the-dog-computer-takeover/
harmj0y.net
https://www.youtube.com/watch?v=RUbADHcBLKg
youtube.com
https://www.harmj0y.net/blog/redteaming/abusing-gpo-permissions/
harmj0y.net
https://wald0.com/?p=179
wald0.com
https://github.com/rasta-mouse/GPO-Abuse
github.com
https://rastamouse.me/2019/01/gpo-abuse-part-1/
rastamouse.me
https://github.com/mwrlabs/SharpGPOAbuse
github.com
https://blog.stealthbits.com/exploiting-weak-active-directory-permissions-with-powersploit/
blog.stealthbits.com
Escalating privileges with ACLs in Active Directory
blog.fox-it.com
http://www.harmj0y.net/blog/redteaming/abusing-active-directory-permissions-with-powerview/
harmj0y.net
https://wald0.com/?p=112
wald0.com
https://adsecurity.org/?p=3658
adsecurity.org
https://techcommunity.microsoft.com/t5/Enterprise-Mobility-Security/Active-Directory-Access-Control-List-8211-Attacks-and-Defense/ba-p/250315
techcommunity.microsoft.com
https://www.slideshare.net/DirkjanMollema/aclpwn-active-directory-acl-exploitation-with-bloodhound
slideshare.net
http://www.harmj0y.net/blog/redteaming/a-guide-to-attacking-domain-trusts/
harmj0y.net
https://adsecurity.org/?p=1588
adsecurity.org
Active Directory forest trusts part 1 - How does SID filtering work? Read at the source ↗
dirkjanm.io
https://hackmag.com/security/ad-forest/
hackmag.com
https://posts.specterops.io/not-a-security-boundary-breaking-forest-trusts-cd125829518d
posts.specterops.io
http://www.harmj0y.net/blog/redteaming/the-trustpocalypse/
harmj0y.net
https://www.dropbox.com/s/ilzjtlo0vbyu1u0/Carlos%20Garcia%20-%20Rooted2019%20-%20Pentesting%20Active%20Directory%20Forests%20public.pdf?dl=0
dropbox.com
https://blog.stealthbits.com/privilege-escalation-with-dcshadow/
blog.stealthbits.com
DCShadow Read at the source ↗
pentestlab.blog
https://blog.alsid.eu/dcshadow-explained-4510f52fc19d
blog.alsid.eu
http://www.labofapenetrationtester.com/2018/05/dcshadow-sacl.html
labofapenetrationtester.com
http://www.labofapenetrationtester.com/2018/04/dcshadow.html
labofapenetrationtester.com
https://blog.stealthbits.com/rid-hijacking-when-guests-become-admins/
blog.stealthbits.com
https://blog.netspi.com/get-sql-server-sysadmin-privileges-local-admin-powerupsql/
blog.netspi.com
https://blog.stealthbits.com/compromise-with-powerupsql-sql-attacks/
blog.stealthbits.com
https://download.ernw-insight.de/troopers/tr18/slides/TR18_AD_Attack-and-Defend-Microsoft-Enhanced-Security.pdf
download.ernw-insight.de
https://github.com/gdedrouas/Exchange-AD-Privesc
github.com
Abusing Exchange: One API call away from Domain Admin Read at the source ↗
dirkjanm.io
https://github.com/Arno0x/NtlmRelayToEWS
github.com
https://www.notsosecure.com/pwning-with-responder-a-pentesters-guide/
notsosecure.com
https://byt3bl33d3r.github.io/practical-guide-to-ntlm-relaying-in-2017-aka-getting-a-foothold-in-under-5-minutes.html
byt3bl33d3r.github.io
https://www.fox-it.com/en/insights/blogs/blog/inside-windows-network/
fox-it.com
https://blog.netspi.com/exploiting-adidns/
blog.netspi.com
https://github.com/GhostPack/ForgeCert
github.com
https://github.com/ly4k/Certipy/wiki/06-%E2%80%90-Privilege-Escalation
github.com
https://trustedsec.com/blog/ekuwu-not-just-another-ad-cs-esc
trustedsec.com
https://hacktricks.wiki/en/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation.html
hacktricks.wiki
https://www.thehacker.recipes/ad/movement/kerberos/samaccountname-spoofing
thehacker.recipes
https://github.com/eladshamir/Whisker
github.com
https://github.com/ShutdownRepo/pywhisker
github.com
https://www.thehacker.recipes/ad/movement/kerberos/shadow-credentials
thehacker.recipes
https://github.com/p0dalirius/Coercer
github.com
https://github.com/Dec0ne/KrbRelayUp
github.com
https://www.microsoft.com/en-us/security/blog/2022/05/25/detecting-and-preventing-privilege-escalation-attacks-leveraging-kerberos-relaying-krbrelayup/
microsoft.com
You Thought It Was Over? Authentication Coercion Keeps Evolving Read at the source ↗
unit42.paloaltonetworks.com
https://www.akamai.com/blog/security-research/abusing-dmsa-for-privilege-escalation-in-active-directory
akamai.com
https://www.semperis.com/blog/badsuccessor-how-to-detect-mitigate-dmsa-privilege-escalation/
semperis.com
https://github.com/Semperis/GoldenGMSA
github.com
https://www.semperis.com/blog/golden-gmsa-attack/
semperis.com
https://blog.netspi.com/how-to-hack-database-links-in-sql-server/
blog.netspi.com
https://blog.netspi.com/sql-server-link-crawling-powerupsql/
blog.netspi.com
https://blog.stealthbits.com/passing-the-hash-with-mimikatz
blog.stealthbits.com
https://blog.cobaltstrike.com/2015/05/21/how-to-pass-the-hash-with-mimikatz/
blog.cobaltstrike.com
https://www.harmj0y.net/blog/redteaming/pass-the-hash-is-dead-long-live-localaccounttokenfilterpolicy/
harmj0y.net
https://github.com/subat0mik/Misconfiguration-Manager
github.com
https://github.com/Mayyhem/SharpSCCM
github.com
https://github.com/garrettfoster13/sccmhunter
github.com
https://docs.specterops.io/misconfiguration-manager-docs/README
docs.specterops.io
https://enigma0x3.net/2015/10/27/targeted-workstation-compromise-with-sccm/
enigma0x3.net
https://github.com/PowerShellMafia/PowerSCCM
github.com
https://github.com/nettitude/SharpWSUS
github.com
https://www.sixdub.net/?p=623
sixdub.net
https://www.blackhat.com/docs/us-17/wednesday/us-17-Coltel-WSUSpendu-Use-WSUS-To-Hang-Its-Clients-wp.pdf
blackhat.com
https://ijustwannared.team/2018/10/15/leveraging-wsus-part-one/
ijustwannared.team
https://github.com/ropnop/kerbrute
github.com
https://www.youtube.com/watch?v=xB26QhnL64c
youtube.com
https://www.blackhillsinfosec.com/attacking-exchange-with-mailsniper/
blackhillsinfosec.com
https://github.com/SpiderLabs/Spray
github.com
https://github.com/byt3bl33d3r/SprayingToolkit
github.com
https://github.com/GoFetchAD/GoFetch
github.com
https://github.com/byt3bl33d3r/DeathStar
github.com
https://github.com/vysec/ANGRYPUPPY
github.com
Primary Refresh Token Exploitation - Attacking Entra Authenticated Services, Bypassing Passwords and MFA Read at the source ↗
pulsesecurity.co.nz
https://learn.microsoft.com/en-us/entra/identity/devices/concept-primary-refresh-token
learn.microsoft.com
https://labs.mwrinfosecurity.com/blog/experimenting-bypassing-memory-scanners-with-cobalt-strike-and-gargoyle/
labs.mwrinfosecurity.com
https://www.youtube.com/playlist?list=PL9HO6M_MU2nc5Q31qd2CwpZ8J4KFMhgnK
youtube.com
https://www.fireeye.com/blog/threat-research/2018/06/bring-your-own-land-novel-red-teaming-technique.html
fireeye.com
https://youtu.be/l8nkXCOYQC4
youtu.be
https://github.com/FuzzySecurity/Sharp-Suite
github.com
https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/
outflank.nl
https://www.countercept.com/blog/dechaining-macros-and-evading-edr/
countercept.com
https://medium.com/@fsx30/bypass-edrs-memory-protection-introduction-to-hooking-2efb21acffd6
medium.com
https://ired.team/offensive-security/defense-evasion/bypassing-cylance-and-other-avs-edrs-by-unhooking-windows-apis
ired.team
https://www.mdsec.co.uk/2019/03/silencing-cylance-a-case-study-in-modern-edrs/
mdsec.co.uk
https://blog.cobaltstrike.com/2017/10/25/modern-defenses-and-you/
blog.cobaltstrike.com
https://blog.cobaltstrike.com/2017/06/23/opsec-considerations-for-beacon-commands/
blog.cobaltstrike.com
https://sec564.com/
sec564.com
https://www.youtube.com/watch?v=RoqVunX_sqA
youtube.com
https://www.blackhat.com/docs/eu-17/materials/eu-17-Thompson-Red-Team-Techniques-For-Evading-Bypassing-And-Disabling-MS-Advanced-Threat-Protection-And-Advanced-Threat-Analytics.pdf
blackhat.com
https://www.slideshare.net/nikhil_mittal/red-team-revenge-attacking-microsoft-ata
slideshare.net
https://www.slideshare.net/nikhil_mittal/evading-microsoft-ata-for-active-directory-domination
slideshare.net
https://cobbr.io/ScriptBlock-Logging-Bypass.html
cobbr.io
https://0x00-0x00.github.io/research/2018/10/28/How-to-bypass-AMSI-and-Execute-ANY-malicious-powershell-code.html
0x00-0x00.github.io
https://www.blackhat.com/docs/us-16/materials/us-16-Mittal-AMSI-How-Windows-10-Plans-To-Stop-Script-Based-Attacks-And-How-Well-It-Does-It.pdf
blackhat.com
https://www.cyberark.com/threat-research-blog/amsi-bypass-patching-technique/
cyberark.com
https://github.com/OmerYa/Invisi-Shell
github.com
https://secureyourit.co.uk/wp/2019/05/10/dynamic-microsoft-office-365-amsi-in-memory-bypass-using-vba/
secureyourit.co.uk
https://rastamouse.me/2018/10/amsiscanbuffer-bypass---part-1/
rastamouse.me
https://www.contextis.com/en/blog/amsi-bypass
contextis.com
https://gist.github.com/mattifestation/ef0132ba4ae3cc136914da32a88106b9
gist.github.com
https://lolbas-project.github.io/
lolbas-project.github.io
https://github.com/mattifestation/BHUSA2018_Sysmon
github.com
https://github.com/mkorman90/sysmon-config-bypass-finder
github.com
https://posts.specterops.io/shhmon-silencing-sysmon-via-driver-unload-682b5be57650
posts.specterops.io
http://www.labofapenetrationtester.com/2018/10/deploy-deception.html
labofapenetrationtester.com
https://jblog.javelin-networks.com/blog/the-honeypot-buster/
jblog.javelin-networks.com
https://github.com/hlldz/Invoke-Phant0m
github.com
https://adsecurity.org/?p=451
adsecurity.org
https://blog.stealthbits.com/extracting-password-hashes-from-the-ntds-dit-file/
blog.stealthbits.com
https://github.com/eladshamir/Internal-Monologue
github.com
https://www.harmj0y.net/blog/powershell/kerberoasting-without-mimikatz/
harmj0y.net
https://adsecurity.org/?p=2293
adsecurity.org
https://blog.stealthbits.com/extracting-service-account-passwords-with-kerberoasting/
blog.stealthbits.com
https://www.cyberark.com/blog/cracking-service-account-passwords-kerberoasting/
cyberark.com
https://gist.github.com/edermi/f8b143b11dc020b854178d3809cf91b5
gist.github.com
https://www.slideshare.net/harmj0y/derbycon-2019-kerberoasting-revisited
slideshare.net
http://www.harmj0y.net/blog/activedirectory/roasting-as-reps/
harmj0y.net
https://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/
harmj0y.net
https://rastamouse.me/2017/08/jumping-network-segregation-with-rdp/
rastamouse.me
https://www.harmj0y.net/blog/redteaming/mimikatz-and-dcsync-and-extrasids-oh-my/
harmj0y.net
https://adsecurity.org/?p=1729
adsecurity.org
https://adsecurity.org/?p=2053
adsecurity.org
https://www.4armed.com/blog/llmnr-nbtns-poisoning-using-responder/
4armed.com
https://blog.stealthbits.com/compromising-plain-text-passwords-in-active-directory
blog.stealthbits.com
Golden Ticket Read at the source ↗
pentestlab.blog
https://adsecurity.org/?p=1640
adsecurity.org
https://adsecurity.org/?p=1772
adsecurity.org
https://adsecurity.org/?p=2011
adsecurity.org
https://adsecurity.org/?p=2753
adsecurity.org
https://blog.stealthbits.com/creating-persistence-with-dcshadow/
blog.stealthbits.com
https://adsecurity.org/?p=1906
adsecurity.org
https://blog.stealthbits.com/persistence-using-adminsdholder-and-sdprop/
blog.stealthbits.com
https://adsecurity.org/?p=2716
adsecurity.org
https://blog.stealthbits.com/unlocking-all-the-doors-to-active-directory-with-the-skeleton-key-attack/
blog.stealthbits.com
Skeleton Key Read at the source ↗
pentestlab.blog
https://adsecurity.org/?p=1275
adsecurity.org
https://www.harmj0y.net/blog/activedirectory/the-most-dangerous-user-right-you-probably-have-never-heard-of/
harmj0y.net
https://www.youtube.com/watch?v=OiqaO9RHskU
youtube.com
https://adsecurity.org/?p=1760
adsecurity.org
https://adsecurity.org/?p=1714
adsecurity.org
https://adsecurity.org/?p=1785
adsecurity.org
https://www.blackhat.com/docs/us-17/wednesday/us-17-Robbins-An-ACE-Up-The-Sleeve-Designing-Active-Directory-DACL-Backdoors-wp.pdf
blackhat.com
https://www.cyberark.com/threat-research-blog/shadow-admins-stealthy-accounts-fear/
cyberark.com
https://www.slideshare.net/harmj0y/the-unintended-risks-of-trusting-active-directory
slideshare.net
https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1
github.com
https://github.com/BloodHoundAD/BloodHound
github.com
https://github.com/SecureAuthCorp/impacket
github.com
https://github.com/fox-it/aclpwn.py
github.com
https://github.com/byt3bl33d3r/CrackMapExec
github.com
https://github.com/canix1/ADACLScanner
github.com
https://github.com/cyberark/zBang
github.com
https://github.com/GhostPack/SafetyKatz
github.com
https://github.com/GhostPack/SharpDump
github.com
https://github.com/NetSPI/PowerUpSQL
github.com
https://github.com/GhostPack/Rubeus
github.com
https://github.com/sense-of-security/ADRecon
github.com
https://github.com/gentilkiwi/mimikatz
github.com
https://github.com/l0ss/Grouper
github.com
https://github.com/Kevin-Robertson/Powermad
github.com
https://github.com/samratashok/RACE
github.com
https://github.com/mdavis332/DomainPasswordSpray
github.com
https://github.com/dafthack/MailSniper
github.com
https://github.com/leoloobeek/LAPSToolkit
github.com
https://github.com/CredDefense/CredDefense
github.com
https://www.ernw.de/download/BloodHoundWorkshop/ERNW_DogWhispererHandbook.pdf
ernw.de
https://www.varonis.com/blog/varonis-ebook-pen-testing-active-directory-environments/
varonis.com
https://github.com/HarmJ0y/CheatSheets
github.com
https://github.com/SadProcessor/Cheats/blob/master/DogWhispererV2.md
github.com
https://gist.github.com/HarmJ0y/184f9822b195c52dd50c379ed3117993
gist.github.com
https://gist.github.com/HarmJ0y/3328d954607d71362e3c
gist.github.com
https://github.com/Scoubi/BloodhoundAD-Queries
github.com
https://gist.github.com/TarlogicSecurity/2f221924fef8c14a1d8e29f3cb5c5c4a
gist.github.com
BloodHound Cypher Cheatsheet Read at the source ↗
hausec.com
https://docs.google.com/presentation/d/1j2nW05H-iRz7-FVTRh-LBXQm6M6YIBQNWa4V7tp99YQ/
docs.google.com
https://www.pentestpartners.com/security-blog/bloodhound-walkthrough-a-tool-for-many-tradecrafts/
pentestpartners.com
https://adsecurity.org/?p=2362
adsecurity.org
https://www.slideshare.net/nettitude_labs/powershellisdeadepiclearningslondon
slideshare.net
https://docs.google.com/presentation/d/1lQHTqXZIDxwaIUnXdO-EdvGp79RzH1rbM4zE45Kki2I/edit
docs.google.com
https://www.youtube.com/watch?v=JcFdNAleIk4&feature=youtu.be
youtube.com
https://github.com/davidprowe/AD_Sec_Tools
github.com
https://gallery.technet.microsoft.com/SAMRi10-Hardening-Remote-48d94b5b
gallery.technet.microsoft.com
https://gallery.technet.microsoft.com/Net-Cease-Blocking-Net-1e8dcb5b
gallery.technet.microsoft.com
https://www.pingcastle.com/
pingcastle.com
https://gallery.technet.microsoft.com/Aorato-Skeleton-Key-24e46b73
gallery.technet.microsoft.com
https://gallery.technet.microsoft.com/Reset-the-krbtgt-account-581a9e51
gallery.technet.microsoft.com
https://gallery.technet.microsoft.com/Reset-The-KrbTgt-Account-5f45a414
gallery.technet.microsoft.com
https://github.com/cyberark/RiskySPN
github.com
https://github.com/samratashok/Deploy-Deception
github.com
https://github.com/vletoux/SpoolerScanner
github.com
https://github.com/secureworks/dcept
github.com
https://github.com/JPCERTCC/LogonTracer
github.com
https://github.com/shellster/DCSYNCMonitor
github.com
https://github.com/Neo23x0/sigma/
github.com
https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
docs.microsoft.com
https://github.com/JPCERTCC/SysmonSearch
github.com
https://github.com/endgameinc/ClrGuard
github.com
https://gist.github.com/dezhub/2875fa6dc78083cedeab10abc551cb58
gist.github.com
https://gist.github.com/jaredcatkinson/23905d34537ce4b5b1818c3e6405c1d2
gist.github.com
https://github.com/fireeye/SilkETW
github.com
https://github.com/olafhartong/sysmon-modular
github.com
https://github.com/MHaggis/sysmon-dfir
github.com
https://github.com/SwiftOnSecurity/sysmon-config
github.com
https://acsc.gov.au/publications/Mitigation_Strategies_2017.pdf
acsc.gov.au
https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/reducing-the-active-directory-attack-surface
docs.microsoft.com
https://techcommunity.microsoft.com/t5/Premier-Field-Engineering/Changes-to-Ticket-Granting-Ticket-TGT-Delegation-Across-Trusts/ba-p/440283
techcommunity.microsoft.com
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV190023
portal.msrc.microsoft.com
https://social.technet.microsoft.com/wiki/contents/articles/20964.active-directory-ultimate-reading-collection.aspx
social.technet.microsoft.com
https://social.technet.microsoft.com/wiki/contents/articles/18931.security-hardening-tips-and-recommendations.aspx
social.technet.microsoft.com
https://adsecurity.org/?p=3377
adsecurity.org
https://adsecurity.org/?p=3299
adsecurity.org
https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/implementing-secure-administrative-hosts
docs.microsoft.com
https://docs.microsoft.com/en-us/microsoft-identity-manager/pam/privileged-identity-management-for-active-directory-domain-services
docs.microsoft.com
https://github.com/PaulSec/awesome-windows-domain-hardening
github.com
https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/best-practices-for-securing-active-directory
docs.microsoft.com
https://posts.specterops.io/introducing-the-adversary-resilience-methodology-part-one-e38e06ffd604
posts.specterops.io
https://posts.specterops.io/introducing-the-adversary-resilience-methodology-part-two-279a1ed7863d
posts.specterops.io
https://download.microsoft.com/download/7/7/A/77ABC5BD-8320-41AF-863C-6ECFB10CB4B9/Mitigating-Pass-the-Hash-Attacks-and-Other-Credential-Theft-Version-2.pdf
download.microsoft.com
https://github.com/nsacyber/Windows-Secure-Host-Baseline
github.com
https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/monitoring-active-directory-for-signs-of-compromise
docs.microsoft.com
https://www.jpcert.or.jp/english/pub/sr/Detecting%20Lateral%20Movement%20through%20Tracking%20Event%20Logs_version2.pdf
jpcert.or.jp
https://cert.europa.eu/static/WhitePapers/UPDATED%20-%20CERT-EU_Security_Whitepaper_2014-007_Kerberos_Golden_Ticket_Protection_v1_4.pdf
cert.europa.eu
https://digital-forensics.sans.org/blog/2013/06/20/overview-of-microsofts-best-practices-for-securing-active-directory
digital-forensics.sans.org
https://dsimg.ubm-us.net/envelope/155422/314202/1330537912_Keys_to_the_Kingdom_Limiting_AD_Admins.pdf
dsimg.ubm-us.net
https://blogs.sans.org/cyber-defense/2018/09/10/protect-privileged-ad-accounts-with-five-free-controls/
blogs.sans.org
https://adsecurity.org/?p=1684
adsecurity.org
https://github.com/nsacyber/Event-Forwarding-Guidance
github.com
https://www.mwrinfosecurity.com/our-thinking/planting-the-red-forest-improving-ad-on-the-road-to-esae/
mwrinfosecurity.com
https://adsecurity.org/?p=3458
adsecurity.org
https://docs.microsoft.com/pt-pt/previous-versions/windows/server/cc755321(v=ws.10
docs.microsoft.com
https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide
docs.microsoft.com
https://cert.europa.eu/static/WhitePapers/CERT-EU-SWP_14_07_PassTheGolden_Ticket_v1_1.pdf
cert.europa.eu
https://download.microsoft.com/download/C/1/4/C14579CA-E564-4743-8B51-61C0882662AC/Windows%2010%20credential%20theft%20mitigation%20guide.docx
download.microsoft.com
https://blog.javelin-networks.com/detecting-pass-the-ticket-and-pass-the-hash-attack-using-simple-wmi-commands-2c46102b76bc
blog.javelin-networks.com
https://gallery.technet.microsoft.com/Step-by-Step-Deploy-Local-7c9ef772
gallery.technet.microsoft.com
https://www.troopers.de/downloads/troopers17/TR17_AD_signed.pdf
troopers.de
https://blogs.technet.microsoft.com/jonsh/2018/10/03/finally-deploy-and-audit-laps-with-project-vast-part-1-of-2/
blogs.technet.microsoft.com
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/default.aspx
ultimatewindowssecurity.com
https://www.trimarcsecurity.com/single-post/Detecting-the-Elusive-Active-Directory-Threat-Hunting
trimarcsecurity.com
https://medium.com/blue-team/preventing-mimikatz-attacks-ed283e7ebdd5
medium.com
https://www.slideshare.net/QuestSoftware/understanding-red-forest-the-3tier-esae-and-alternative-ways-to-protect-privileged-credentials
slideshare.net
https://adsecurity.org/?p=3782
adsecurity.org
https://www.microsoft.com/en-us/microsoft-365/blog/2018/03/05/azure-ad-and-adfs-best-practices-defending-against-password-spray-attacks/
microsoft.com
https://adsecurity.org/?p=22
adsecurity.org
https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
endgame.com
https://www.endgame.com/blog/technical-blog/hunting-memory-net-attacks
endgame.com
https://www.sans.org/reading-room/whitepapers/detection/mimikatz-overview-defenses-detection-36780
sans.org
https://www.trimarcsecurity.com/single-post/2018/05/06/Trimarc-Research-Detecting-Password-Spraying-with-Security-Event-Auditing
trimarcsecurity.com
https://www.countercept.com/blog/hunting-for-gargoyle/
countercept.com
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide
docs.microsoft.com
https://medium.com/think-stack/preventing-lateral-movement-using-network-access-groups-7e8d539a9029
medium.com
https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow
onedrive.live.com
https://github.com/palantir/windows-event-forwarding
github.com
http://threatexpress.com/2018/05/threat-mitigation-strategies-technical-recommendations-and-info-part-2/
threatexpress.com
https://channel9.msdn.com/Events/Ignite/2015/BRK3486
channel9.msdn.com
http://publications.gc.ca/collections/collection_2019/cstc-csec/D97-3-70-12-2019-eng.pdf
publications.gc.ca
https://www.sneakymonkey.net/2018/06/25/blue-team-tips/
sneakymonkey.net
https://www.stigviewer.com/stig/active_directory_domain/
stigviewer.com
https://www.slideshare.net/HuyKha2/adstg-v20-guidance
slideshare.net
https://academy.bluraven.io/blog/edr-silencer-and-beyond-exploring-methods-to-block-edr-communication-part-2
academy.bluraven.io
https://github.com/TwoSevenOneT/EDRChoker
github.com
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1040
portal.msrc.microsoft.com
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0683
portal.msrc.microsoft.com
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708
portal.msrc.microsoft.com
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8518
portal.msrc.microsoft.com
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0143
portal.msrc.microsoft.com
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2016-0128
portal.msrc.microsoft.com
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-068
docs.microsoft.com
https://support.microsoft.com/en-us/help/2962486/ms14-025-vulnerability-in-group-policy-preferences-could-allow-elevati
support.microsoft.com
Elsewhere on 0xsp.com (1)