AD-Attack-Defense - Attack and defend active directory using modern po

项目说明

Acti Kill Chain Attack & Defense

!image

Summary

This document was designed to be a useful, informational asset for those looking to understand the specific tactics, techniques, and procedures (TTPs) attackers are le to compromise acti and guidance to mitigation, detection, and pre. And understand Acti Kill Chain Attack and Modern Post Exploitation Ad Tradecraft Activity.

Table of Contents

* Discovery
* Pri Escalation
* Defense E
* Credential Dumping
* Lateral Mo
* Persistence
* Defense & Detection

------

Discovery

SPN Scanning

* SPN Scanning – Service Discovery without 网络 Port Scanning
* Acti: PowerShell script to list all SPNs used
* Disco Service Accounts Without Using Pri

Data Mining

* A Data Hunting O
* Push it, Push it Real Good
* Finding Sensitive Data on Domain SQL Servers using PowerUpSQL
* Sensitive Data Discovery in Email with MailSniper
* Remotely Searching for Sensiti
* I Hunt Sysadmins - harmj0y

User Hunting

* Hidden Administrati: BloodHound to the Rescue
* Acti Recon Without Admin Rights
* Gathering AD Data with the Acti PowerShell Module
* Using Acti module for Domain Enumeration from PowerShell Constrained Language Mode
* PowerUpSQL Acti Recon Functions
* Deri Local Admin
* Automated Deri Administrator Search
* Dumping Acti Domain Info – with PowerUpSQL!
* Local Group Enumeration
* Attack Mapping With Bloodhound
* Situational Awareness
* Commands for Domain Network Compromise
* A Pentester’s Guide to Group Scoping

LAPS

* Microsoft LAPS Security & Acti LAPS Configuration Recon
* Running LAPS with PowerView
* RastaMouse LAPS Part 1 & 2

AppLocker

* Enumerating AppLocker Config

Acti Federation Services

* 118 Attacking ADFS Endpoints with PowerShell Karl Fosaaen
* Using PowerShell to Identify Federated Domains
* LyncSniper: A 工具 for penetration testing Skype for Business and Lync deployments
* Troopers 19 - I am AD FS and So Can You
------

Pri Escalation

BadSuccessor

* BadSuccessor: Abusing dMSA to Escalate Pri in Acti
* Operationalizing the BadSuccessor: Abusing dMSA for Domain Pri Escalation

sAMAccountName Spoofing

* sAMAccountName spoofing
* C/C Weaponisation

Abusing Acti Certificate Services

* Certified Pre-Owned
* AD CS Domain Escalation

PetitPotam

* PetitPotam
* From Stranger to DA // Using PetitPotam to NTLM relay to Domain Administrator

Zerologon

* Cobalt Strike ZeroLogon-BOF
* C POC
* Zerologon: instantly become domain admin by sub Netlogon cryptography (C)

Passwords in SYSVOL & Group Policy Preferences

* Finding Passwords in SYSVOL & Exploiting Group Policy Preferences
* Pentesting in the Real World: Group Policy Pwnage

MS14-068 Kerberos

* MS14-068: in (Acti) Kerberos Could Allow Ele of Pri
* Digging into MS14-068, Exploitation and Defence
* From MS14-068 to Full Compromise – Step by Step

DNSAdmins

* Abusing DNSAdmins pri for escalation in Acti
* From DNSAdmins to Domain Admin, When DNSAdmins is More than Just DNS Administration

Kerberos Delegation

* Constructing Kerberos Attacks with Delegation Primitives
* No Shells Required - a Walkthrough on Using Impacket and Kerberos to Delegate Your Way to DA
* C: Kerberos Bronze Bit Attack – O

#### Unconstrained Delegation
* Domain Controller Print 服务端 + Unconstrained Kerberos Delegation = Pwned Acti Forest
* Acti Security Risk #101: Kerberos Unconstrained Delegation (or How Compromise of a Single 服务端 Can Compromise the Domain)
* Unconstrained Delegation Permissions
* Trust? Years to earn, seconds to break
* Hunting in Acti: Unconstrained Delegation & Forests Trusts
* Exploiting Unconstrained Delegation

#### Constrained Delegation
* Another Word on Delegation
* From Kekeo to Rubeus
* S4U2Pwnage
* Kerberos Delegation, Spns And More...

#### Resource-Based Constrained Delegation
* Wagging the Dog: Abusing Resource-Based Constrained Delegation to Attack Acti
* Kerberos Resource-based Constrained Delegation: Computer Object Take Over
* Resource Based Constrained Delegation
* A Case Study in Wagging the Dog: Computer Takeover
* BloodHound 2.1's New Computer Takeo

Insecure Group Policy Object Permission Rights

* Abusing GPO Permissions
* A Red Teamer’s Guide to GPOs and OUs
* File templates for GPO Abuse
* GPO Abuse - Part 1
* GPO Abuse - Part 2
* SharpGPOAbuse

Insecure ACLs Permission Rights

* Exploiting Weak Acti Permissions With Powersploit
* Escalating pri with ACLs in Acti

* Abusing Acti Permissions with PowerView

* BloodHound 1.3 – The ACL Attack Path Update
* Scanning for Acti Pri & Pri Accounts
* Acti Access Control List – Attacks and Defense
* aclpwn - Acti ACL exploitation with BloodHound

Domain Trusts

* A Guide to Attacking Domain Trusts
* It's All About Trust – Forging Kerberos Trust Tickets to Spoof Access across Acti Trusts
* Acti forest trusts part 1 - How does SID filtering work?
* The Forest Is Under Control. Taking over the entire Acti forest
* Not A Security Boundary: Breaking Forest Trusts
* The Trustpocalypse
* Pentesting Acti Forests
* Security Considerations for Acti (AD) Trusts
* Kerberos Golden Tickets are Now More Golden

DCShadow

* Pri Escalation With DCShadow
* DCShadow
* DCShadow explained: A technical deep dive into the latest AD attack technique
* DCShadow - Silently turn off Acti Auditing
* DCShadow - Minimal permissions, Acti Deception, Shadowception and more

RID

* Rid Hijacking: When Guests Become Admins

Microsoft SQL Server

* How to get SQL Ser Pri as a Local Admin with PowerUpSQL
* Compromise With Powerupsql – Sql Attacks

Red Forest

* Attack and defend Microsoft Enhanced Security Administrative

Exchange

* Exchange-AD-Privesc
* Abusing Exchange: One API call away from Domain Admin
* NtlmRelayToEWS

NTLM Relay & LLMNR/NBNS

* Pwning with Responder – A Pentester’s Guide
* Practical guide to NTLM Relaying in 2017 (A.K.A getting a foothold in under 5 minutes)
* Relaying credentials e with ntlmrelayx
* Beyond LLMNR/NBNS Spoofing – Exploiting Acti DNS
* Combining NTLM Relaying and Kerberos delegation
* mitm6 – compromising IPv4 networks via IPv6
* The worst of both worlds: Combining NTLM Relaying and Kerberos delegation
------

Lateral Mo

Microsoft SQL Ser links

* SQL Server – Link… Link… Link… and Shell: How to Hack 数据库 Links in SQL 服务端!
* SQL 服务端 Link Crawling with PowerUpSQL

Pass The Hash

* Performing Pass-the-hash Attacks With Mimikatz
* How to Pass-the-Hash with Mimikatz
* Pass-the-Hash Is Dead: Long LierPolicy

System Center Configuration Manager (SCCM)

* Targeted Workstation Compromise With Sccm
* PowerSCCM - PowerShell module to interact with SCCM deployments

WSUS

* Remote Weaponization of WSUS MITM
* WSUSpendu
* Le WSUS – Part One

Password Spraying

* Password Spraying Windows Acti Accounts - Tradecraft Security Weekly #5
* Attacking Exchange with MailSniper
* A Password Spraying 工具 for Acti Credentials by Jacob Wilkin
* SprayingToolkit

Automated Lateral Mo

* GoFetch is a 工具 to automatically exercise an attack plan generated by the BloodHound application
* DeathStar - Automate getting Domain Admin using Empire
* ANGRYPUPPY - Bloodhound Attack Path Automation in CobaltStrike
------

Defense E

In-Memory E

* Bypassing Memory Scanners with Cobalt Strike and Gargoyle
* In-Memory E Course
* Bring Your Own Land (BYOL) – A Novel Red Teaming Technique

Endpoint Detection and Response (EDR) E

* Red Teaming in the EDR age
* Sharp-Suite - Process Argument Spoofing
* Red Team Tactics: Combining Direct System Calls and sRDI to bypass AV/EDR
* Dechaining Macros and E EDR
* Bypass EDR’s memory protection, introduction to hooking
* Bypassing Cylance and other AVs/EDRs by Unhooking Windows APIs
* Silencing Cylance: A Case Study in Modern EDRs

OPSEC

* Modern Defenses and YOU!
* OPSEC Considerations for Beacon Commands
* Red Team Tradecraft and TTP Guidance
* Fighting the Toolset

Microsoft ATA & ATP E

* Red Team Techniques for E, Bypassing, and Disabling MS
Ad Threat Protection and Ad Threat Analytics
* Red Team Revenge - Attacking Microsoft ATA
* E Microsoft ATA for Acti Domination

PowerShell ScriptBlock Logging Bypass

* PowerShell ScriptBlock Logging Bypass

PowerShell Anti-Malware Scan Interface (AMSI) Bypass

* How to bypass AMSI and execute ANY malicious Powershell 代码
* AMSI: How Windows 10 Plans to Stop Script-Based Attacks
* AMSI Bypass: Patching Technique
* In - Hide your Powershell script in plain sight. Bypass all Powershell security features
* Dynamic Microsoft Office 365 AMSI In Memory Bypass Using VBA
* AmsiScanBuffer Bypass - Part 1
* AMSI Bypass

Loading .NET Assemblies Anti-Malware Scan Interface (AMSI) Bypass

* A PoC function to corrupt the g_amsiContext global in clr.dll in .NET 框架 Early Access build 3694

AppLocker & Device Guard Bypass

* Living Off The Land Binaries And Scripts - (LOLBins and LOLScripts)

Sysmon E

* Sub Sysmon: Application of a Formalized Security Product E Methodology
* sysmon-config-bypass-finder
* Shhmon — Silencing Sysmon Unload

HoneyTokens E

* Forging Trusts for Deception in Acti
* Honeypot Buster: A Unique Red-Team Tool

Disabling Security Tools

* In - Windows Event Log Killer

------

Credential Dumping

NTDS.DIT Password Extraction

* How Attackers Pull the Acti 数据库 (NTDS.dit) from a Domain Controller
* Extracting Password Hashes From The Ntds.dit File

SAM (Security Accounts Manager)

* Internal Monologue Attack: Retrieving NTLM Hashes without Touching LSASS

Kerberoasting

* Kerberoasting Without Mimikatz
* Cracking Kerberos TGS Tickets Using Kerberoast – Exploiting Kerberos to Compromise the Acti Domain
* Extracting Service Account Passwords With Kerberoasting
* Cracking Service Account Passwords with Kerberoasting
* Kerberoast PW list for cracking passwords with complexity requirements
* DerbyCon 2019 - Kerberoasting Re

Kerberos AP-REP Roasting

* Roasting AS-REPs

Windows Credential Manager/Vault

* Operational Guidance for Offensive User DPAPI Abuse
* Jumping Network Segregation with RDP

DCSync

* Mimikatz and DCSync and ExtraSids, Oh My
* Mimikatz DCSync Usage, Exploitation, and Detection
* Dump Clear-Text Passwords for All Admins in the Domain Using Mimikatz DCSync

LLMNR/NBT-NS Poisoning

* LLMNR/NBT-NS Poisoning Using Responder

Others

* Compromising Plain Text Passwords In Acti
* Kerberos Tickets on Linux Red Teams
------

Persistence

Diamond Ticket

* A Diamond (Ticket) in the Ruff

Golden Ticket

* Golden Ticket
* Kerberos Golden Tickets are Now More Golden

SID History

* Sneaky Acti Persistence #14: SID History

Sil

* How Attackers Use Kerberos Sil to Exploit Systems
* Sneaky Acti Persistence #16: Computer Accounts & Domain Controller Sil

DCShadow

* Creating Persistence With Dcshadow

AdminSDHolder

* Sneaky Acti Persistence #15: Le AdminSDHolder & SDProp to (Re)Gain Domain Admin Rights
* Persistence Using Adminsdholder And Sdprop

Group Policy Object

* Sneaky Acti Persistence #17: Group Policy

Skeleton Keys

* Unlocking All The Doors To Acti With The Skeleton Key Attack
* Skeleton Key
* Attackers Can Now Use Mimikatz to Implant Skeleton Key on Domain Controllers & BackDoor Your Acti Forest

SeEnableDelegationPri

* The Most Dangerous User Right You (Probably) Ha Heard Of
* SeEnableDelegationPri Acti Backdoor

Security Support Provider

* Sneaky Acti Persistence #12: Malicious Security Support Provider (SSP)

Directory Services Restore Mode

* Sneaky Acti Persistence #11: Directory Service Restore Mode (DSRM)
* Sneaky Acti Persistence #13: DSRM Persistence v2

ACLs & Security Descriptors

* An ACE Up the Slee Acti DACL Backdoors
* Shadow Admins – The Stealthy Accounts That You Should Fear The Most
* The Unintended Risks of Trusting Acti

Tools & Scripts

* BadSuccessor - This repository contains tooling related to the BadSuccessor attack - a no Directory pri escalation technique that abuses a in a feature introduced in Windows 服务端 2025.
* AD_Miner - AD Miner is an Acti audit 工具 that le cypher queries to crunch data from the #Bloodhound graph 数据库 to unco weaknesses.
* Certify - Certify is a C# 工具 to enumerate and abuse misconfigurations in Acti Certificate Services (AD CS).
* PSPKIAudit - PowerShell toolkit for auditing Acti Certificate Services (AD CS).
* PowerView - Situational Awareness PowerShell 框架
* BloodHound - Six Degrees of Domain Admin
* Impacket - Impacket is a collection of Python classes for working with 网络 protocols
* aclpwn.py - Acti ACL exploitation with BloodHound
* CrackMapExec - A swiss army knife for pentesting networks
* ADACLScanner - A 工具 with 界面 or command linte used to create reports of access control lists (DACLs) and system access control lists (SACLs) in Acti
* zBang - zBang is a risk assessment 工具 that detects potential pri account threats
* SafetyKatz - SafetyKatz is a combination of slightly modified of 's Mimikatz project and 's .NET PE Loader.
* SharpDump - SharpDump is a C# port of PowerSploit's Out-Minidump.ps1 functionality.
* PowerUpSQL - A PowerShell Toolkit for Attacking SQL 服务端
* Rubeus - Rubeus is a C# toolset for raw Kerberos interaction and abuses
* ADRecon - A 工具 which gathers information about the Acti and generates a report which can provide a holistic picture of the current state of the target AD en
* Mimikatz - Utility to extract plaintexts passwords, hash, PIN 代码 and kerberos tickets from memory but also perform pass-the-hash, pass-the-ticket or build Golden tickets
* Grouper - A PowerShell script for helping to find settings in AD Group Policy.
* Powermad - PowerShell MachineAccountQuota and DNS exploit tools
* RACE - RACE is a PowerShell module for executing ACL attacks against Windows targets.
* DomainPasswordSpray - DomainPasswordSpray is a 工具 written in PowerShell to perform a password spray attack against users of a domain.
* MailSniper - MailSniper is a penetration testing 工具 for searching through email in a Microsoft Exchange en for specific terms (passwords, insider intel, 网络 architecture information, etc.)
* LAPSToolkit - 工具 to audit and attack LAPS en.
* CredDefense - Credential and Red Teaming Defense for Windows En
* ldapdomaindump - Acti information dumper via LDAP
* SpoolSample - PoC 工具 to coerce Windows hosts authenticate to other machines via the MS-RPRN RPC interface
* adconnectdump - Azure AD Connect password extraction
* o365recon - Script to retrie via O365 with a valid cred
* ROADtools - ROADtools is a 框架 to interact with Azure AD. I
* Stormspotter - Stormspotter creates an “attack graph” of the resources in an Azure subscription.
* AADInternals - AADInternals is PowerShell module for administering Azure AD and Office 365
* MicroBurst: A PowerShell Toolkit for Attacking Azure - MicroBurst includes functions and scripts that support Azure Services discovery, weak configuration auditing, and post exploitation actions such as credential dumping.
* sam-the-admin - Exploiting C and C to impersonate DA from standard domain user
* C/C Scanner & Exploiter. - C/C Scanner & Exploiter. Yet another low effort domain user to domain admin exploit.
* ADModule - Microsoft signed Acti PowerShell module
* ImproHound - Identify the attack paths in BloodHound breaking your AD tiering
* ADExplorerSnapshot.py - ADExplorerSnapshot.py is an AD Explorer snapshot ingestor for BloodHound.
* orpheus - Bypassing Kerberoast Detections with Modified KDC Options and Encryption Types
* BackupOperatorToolkit

Ebooks

* The Dog Whisperer’s Handbook – A Hacker’s Guide to the BloodHound Galaxy
* eBook: Pen Testing Acti En

Cheat Sheets

* Tools Cheat Sheets - Tools (PowerView, PowerUp, Empire, and PowerSploit)
* DogWhisperer - BloodHound Cypher Cheat Sheet (v2)
* Power.0 tips and tricks
* Power.0 tips and tricks
* BloodhoundAD-Queries
* Kerberos Attacks Cheat Sheet
* Bloodhound Cypher Cheatsheet
* Kerberos cheatsheet
* Acti Exploitation Cheat Sheet
* Pentesting Acti Mindmaps

Other Resources

* Tactics, Techniques and Procedures for Attacking Acti BlackHat Asia 2019
* Bloodhound walkthrough. A 工具 for Many Tradecrafts
* Attack Methods for Gaining Domain Admin Rights in Acti
* PowerShell Is Dead Epic Learnings
* Finding Our Path: How We’re Trying to Impro Directory Security
* SteelCon 2019: Getting Splunky With Kerberos - Ross Bingham and Tom MacDonald
* AD-security-workshop

Azure Acti

* AZURE AD INTRODUCTION FOR RED TEAMERS
* I'm in your cloud... reading e's email. Hacking Azure AD Directory
* Utilizing Azure Services for Red Team Engagements
* Blue Cloud of Death: Red Teaming Azure
* Azure AD Connect for Red Teamers
* Red Teaming Microsoft: Part 1 – Acti Leaks
* Attacking & Defending the Microsoft Cloud
* How to create a backdoor to Azure AD
* Azurehound Cypher Cheatsheet
* Keys of the kingdom: Playing God as Global Admin
* AZURE AD KERBEROS TICKETS: PI TO THE CLOUD
------

Defense & Detection

Tools & Scripts

* In - The In.ps1 PowerShell script is designed to gather data from a single domain AD forest to performed Acti Security Assessment (ADSA).
* Create-Tiers in AD - Project Title Acti Auto Deployment of Tiers in any en
* SAMRi10 - Hardening SAM Remote Access in Windows 10/服务端 2016
* Net Cease - Hardening Net Session Enumeration
* PingCastle - A 工具 designed to assess quickly the Acti security level with a methodology based on risk assessment and a maturity 框架
* Aorato Skeleton Key Malware Remote DC Scanner - Remotely scans for the existence of the Skeleton Key Malware
* Reset the krbtgt account password/keys - This script will enable you to reset the krbtgt account password and related keys while minimizing the likelihood of Kerberos authentication issues being caused by the operation
* Reset The KrbTgt Account Password/Keys For RWDCs/RODCs
* RiskySPN - RiskySPNs is a collection of PowerShell scripts focused on detecting and abusing accounts associated with SPNs (Service Principal Name).
* Deploy-Deception - A PowerShell module to deploy acti decoy objects
* SpoolerScanner - Check if MS-RPRN is remotely a with powershell/c#
* dcept - A 工具 for deploying and detecting use of Acti honeytokens
* LogonTracer - In malicious Windows logon by and analyzing Windows event log
* DCSYNCMonitor - Monitors for DCSYNC and DCSHADOW attacks and create custom Windows Events for these events
* Sigma - Generic Signature Format for SIEM Systems
* Sysmon - System Monitor (Sysmon) is a Windows system service and device driver that, once installed on a system, remains resident across system reboots to monitor and log system activity to the Windows event log.
* SysmonSearch - In suspicious activity by Sysmon's event log
* ClrGuard - ClrGuard is a proof of concept project to explore instrumenting the Common Language Runtime (CLR) for security purposes.
* Get-ClrReflection - Detects memory-only CLR (.NET) modules.
* Get-InjectedThread - Get-InjectedThread looks at each running thread to determine if it is the result of memory injection.
* SilkETW - SilkETW & SilkService are flexible C# wrappers for ETW, they are meant to abstract away the complexities of ETW and gi a simple interface to perform research and introspection.
* WatchAD - AD Security Intrusion Detection System
* Sparrow - Sparrow.ps1 was created by CISA's Cloud Forensics team to help detect possible compromised accounts and applications in the Azure/m365 en.
* DFIR-O365RC - The DFIR-O365RC PowerShell module is a set of functions that allow the DFIR analyst to collect logs relevant for Office 365 Business Email Compromise in.
* AzureADIncidentResponse - Tooling to assist in Azure AD incident response
* ADTimeline - The ADTimeline script generates a timeline based on Acti replication metadata for objects considered of interest.
* Locksmith - A small 工具 built to find and fix common misconfigurations in Acti Certificate Services.
* FalconHound - FalconHound is a blue team multi-工具. It allows you to utilize and enhance the power of BloodHound in a more automated fashion. It is designed to be used in conjunction with a SIEM or other log aggregation 工具.
* PlumHound - Bloodhound for Blue and Purple Teams.

Sysmon Configuration

* sysmon-modular - A Sysmon configuration repository for e to customise
* sysmon-dfir - Sources, configuration and how to detect e utilizing Microsoft Sysmon.
* sysmon-config - Sysmon configuration file template with default high-quality event tracing

Acti Security Checks (by Sean Metcalf - )

#### General Recommendations
* Manage local Administrator passwords (LAPS).
* Implement RDP Restricted Admin mode (as needed).
* Remo OSs from the network.
* Monitor scheduled tasks on sensiti (DCs, etc.).
* Ensure that OOB management passwords (DSRM) are changed regularly & securely stored.
* Use SMB v2/v3+
* Default domain Administrator & KRBTGT password should be changed every year & when an AD admin leaves.
* Remo that are no longer necessary & enable SID filtering as appropriate.
* All domain authentications should be set (when possible) to: "Send NTLMv2 response onlyrefuse LM & NTLM."
* Block internet access for DCs, servers, & all administration systems.

#### Protect Admin Credentials
* No "user" or computer accounts in admin groups.
* Ensure all admin accounts are "sensitive & cannot be delegated".
* Add admin accounts to "Protected Users" group (requires Windows 服务端 2012 R2 Domain Controllers, 2012R2 DFL for domain protection).
* Disable all inacti accounts and remove from pri groups.

#### Protect AD Admin Credentials
* Limit AD admin membership (DA, EA, Schema Admins, etc.) & only use custom delegation groups.
* ‘Tiered’ Administration mitigating credential theft impact.
* Ensure admins only logon to appro workstations & servers.
* Le time-based, temporary group membership for all admin accounts

#### Protect Service Account Credentials
* Limit to systems of the same security level.
* Le “(Group) Managed Service Accounts” (or PW >20 characters) to mitigate credential theft (kerberoast).
* Implement FGPP (DFL =>2008) to increase PW requirements for SAs and administrators.
* Logon restrictions – prevent interacti & limit logon capability to specific computers.
* Disable inactive SAs & remove from pri groups.

#### Protect Resources
* Segment 网络 to protect admin & critical systems.
* Deploy IDS to monitor the internal corporate 网络.
* 网络 device & OOB management on separate 网络.

#### Protect Domain Controllers
* Only run software & services to support AD.
* Minimal groups (& users) with DC admin/logon rights.
* Ensure patches are applied before running DCPromo (especially MS14-068 and other critical patches).
* scheduled tasks & scripts.

#### Protect Workstations (& Servers)
* Patch quickly, especially pri escalation .
* Deploy security back-port patch (KB2871997).
* Set Wdigest reg key to 0 (KB2871997/Windows 8.1/2012R2+): HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSecurityPro
* Deploy workstation whitelisting (Microsoft AppLocker) to block 代码 exec in user folders – home dir & profile path.
* Deploy workstation app sandboxing technology (EMET) to mitigate application memory exploits (0-days).

#### Logging
* Enable enhanced auditing
* “Audit: Force audit policy subcategory settings (Windows Vista or later) to o audit policy category settings”
* Enable PowerShell module logging (“*”) & forward logs to central log 服务端 (WEF or other method).
* Enable CMD Process logging & enhancement (KB3004375) and forward logs to central log 服务端.
* SIEM or equi to centralize as much log data as possible.
* User Beha Analysis system for enhanced knowledge of user activity (such as Microsoft ATA).

#### Security Pro’s Checks
* Identify who has AD admin rights (domain/forest).
* Identify who can logon to Domain Controllers (& admin rights to en hosting DCs).
* Scan Acti Domains, OUs, AdminSDHolder, & GPOs for inappropriate custom permissions.
* Ensure AD admins (aka Domain Admins) protect their credentials by not logging into untrusted systems (workstations).
* Limit service account rights that are currently DA (or equi).

Important Security Updates

|C|Description|Link|
|---|-----|-----------|----|
|C|Netlogon Ele of Pri |An ele of pri exists when an attacker establishes a Netlogon secure channel connection to a domain controller, using the Netlogon Remote 协议 (MS-NRPC). An attacker who successfully exploited the could run a specially crafted application on a device on the 网络.|
|C|Windows NTLM Tampering |A tampering exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) protection, aka 'Windows NTLM Tampering '.|
|C|Acti Ele of Pri |An ele of pri exists in Acti Forest trusts due to a default setting that lets an attacker in the trusting forest request delegation of a TGT for an identity from the trusted forest, aka 'Acti Ele of Pri '.|
|C|Remote Desktop Services Remote 代码 Execution |A remote 代码 execution exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Remote Desktop Services Remote 代码 Execution '.|
|C|Microsoft Exchange Ser of Pri |An ele of pri exists in Microsoft Exchange 服务端, aka "Microsoft Exchange Ser of Pri ." This affects Microsoft Exchange 服务端.|
|C|Windows SMB Remote Code Execution |The SMBv1 服务端 in Microsoft Windows Vista SP2; Windows 服务端 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows 服务端 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows 服务端 2016 allows remote attackers to execute arbitrary 代码 packets, aka "Windows SMB Remote 代码 Execution ." This is different from those described in C, C, C, and C.|
|C|Windows SAM and LSAD Downgrade |The SAM and LSAD 协议 implementations in Microsoft Windows Vista SP2, Windows 服务端 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows 服务端 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 do not properly establish an RPC channel, which allows man-in-the-middle attackers to perform 协议-downgrade attacks and impersonate users by modifying the 客户端-服务端 data stream, aka "Windows SAM and LSAD Downgrade " or "BADLOCK."|
|C| in Kerberos Could Allow Ele of Pri (3011780)|The Kerberos Key Distribution Center (KDC) in Microsoft Windows 服务端 2003 SP2, Windows Vista SP2, Windows 服务端 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows 服务端 2012 Gold and R2 allows remote authenticated domain users to obtain domain administrator pri via a forged signature in a ticket, as exploited in the wild in No 2014, aka "Kerberos Checksum ."|
|C| in Group Policy Preferences could allow ele of pri|The Group Policy implementation in Microsoft Windows Vista SP2, Windows 服务端 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows 服务端 2012 Gold and R2 does not properly handle distribution of passwords, which allows remote authenticated users to obtain sensiti information and consequently gain pri by le access to the SYS, as exploited in the wild in May 2014, aka "Group Policy Preferences Password Ele of Pri ."|

Detection

|Attack|Event ID|
|------|--------|
|Account and Group Enumeration|4798: A user's local group membership was enumerated<br>4799: A security-enabled local group membership was enumerated|
|AdminSDHolder|4780: The ACL was set on accounts which are members of administrators groups|
|Kekeo|4624: Account Logon<br>4672: Admin Logon<br>4768: Kerberos TGS Request|
|Sil|4624: Account Logon<br>4634: Account Logoff<br>4672: Admin Logon|
|Golden Ticket|4624: Account Logon<br>4672: Admin Logon|
|PowerShell|4103: Script Block Logging<br>400: 引擎 Lifecycle<br>403: 引擎 Lifecycle<br>4103: Module Logging<br>600: Provider Lifecycle<br>|
|DCShadow|4742: A computer account was changed<br>5137: A directory service object was created<br>5141: A directory service object was deleted<br>4929: An Acti replica 源码 naming context was removed|
|Skeleton Keys|4673: A pri service was called<br>4611: A trusted logon process has been registered with the Local Security Authority<br>4688: A new process has been created<br>4689: A new process has exited|
|PYKEK MS14-068|4672: Admin Logon<br>4624: Account Logon<br>4768: Kerberos TGS Request|
|Kerberoasting|4769: A Kerberos ticket was requested|
|S4U2Proxy|4769: A Kerberos ticket was requested|
|Lateral Mo|4688: A new process has been created<br>4689: A process has exited<br>4624: An account was successfully logged on<br>4625: An account failed to log on|
|DNSAdmin|770: DNS Ser DLL has been loaded<br>541: The setting ser on scope . has been set to <dll path><br>150: DNS Ser not load or initialize the plug-in DLL|
|DCSync|4662: An operation was performed on an object|
|Password Spraying|4625: An account failed to log on<br>4771: Kerberos pre-authentication failed<br>4648: A logon was attempted using explicit credentials|

Resources

* Detecting and Mitigating Acti Compromises
* Acti: Tactical Containment to Curb Domain Dominance
* Total Identity Compromise: DART lessons on securing Acti
* How to manage the changes in Netlogon secure channel connections associated with C
* Securing Acti: Performing an Acti Security Review
* ACTI SECURITY ASSESSMENT CHECKLIST
* ASD Strategies to Mitigate Cyber Security Incidents
* Reducing the Acti Attack Surface
* Changes to Ticket-Granting Ticket (TGT) Delegation Across Trusts in Windows 服务端 (AskPFEPlat edition)
* AD | Guidance to mitigate unconstrained delegation
* AD | Microsoft Guidance for Enabling LDAP Channel Binding and LDAP Signing
* Acti: Ultimate Reading Collection
* Security Hardening Tips and Recommendations
* Securing Domain Controllers to Impro Directory Security
* Securing Windows Workstations: De a Secure Baseline
* Implementing Secure Administrati
* Pri Access Management for Acti Domain Services
* Awesome Windows Domain Hardening
* Best Practices for Securing Acti
* Introducing the Ad Resilience Methodology — Part One
* Introducing the Ad Resilience Methodology — Part Two
* Mitigating Pass-the-Hash and Other Credential Theft, 2
* Configuration guidance for implementing the Windows 10 and Windows 服务端 2016 DoD Secure Host Baseline settings
* Monitoring Acti for Signs of Compromise
* Detecting Lateral Mo through Tracking Event Logs
* Kerberos Golden Ticket Protection Mitigating Pass-the-Ticket on Acti
* O of Microsoft's "Best Practices for Securing Acti"
* The Keys to the Kingdom: Limiting Acti Administrators
* Protect Pri AD Accounts With Five Free Controls
* The Most Common Acti Security Issues and What You Can Do to Fix Them
* Event Forwarding Guidance
* Planting the Red Forest: Improving AD on the Road to ESAE
* Detecting Kerberoasting Activity
* Security Considerations for Trusts)
* Ad Threat Analytics suspicious activity guide
* Protection from Kerberos Golden Ticket
* Windows 10 Credential Theft Mitigation Guide
* Detecting Pass-The- Ticket and Pass-The- Hash Attack Using Simple WMI Commands
* Step by Step Deploy Microsoft Local Administrator Password Solution
* Acti Security Best Practices
* Finally Deploy and Audit LAPS with Project VAST, Part 1 of 2
* Windows Security Log Events
* Talk Transcript BSidesCharm Detecting the Elusi Directory Threat Hunting
* Pre Mimikatz Attacks
* Understanding "Red Forest" - The 3-Tier ESAE and Alternative Ways to Protect Pri Credentials
* Securing Microsoft Acti Federation 服务端 (ADFS)
* Azure AD and ADFS best practices: Defending against password spray attacks
* AD Reading: Acti Backup and Disaster Recovery
* Ten Process Injection Techniques: A Technical Survey Of Common And Trending Process Injection Techniques
* Hunting For In-Memory .NET Attacks
* Mimikatz O, Defenses and Detection
* Trimarc Research: Detecting Password Spraying with Security Event Auditing
* Hunting for Gargoyle Memory Scanning E
* Planning and getting started on the Windows Defender Application Control deployment process
* Pre Lateral Mo Using 网络 Access Groups
* How to Go from Responding to Hunting with Sysinternals Sysmon
* Windows Event Forwarding Guidance
* Threat Mitigation Strategies: Part 2 – Technical Recommendations and Information
* Modern Hardening: Lessons Learned on Hardening Applications and Services
* ITSP.70.012 Guidance for Hardening Microsoft Windows 10 Enterprise
* Blue Team Tips
* Acti Domain Security Technical Implementation Guide (STIG)
* Acti Security Testing Guide - v2.0
* Best practices for securing Acti Federation Services
* The most common on premises & misconfigurations
* Acti Certificate Services: Modern Attack Paths, Mitigations, and Hardening

License

![CC0]()

To the extent possible under law, Rahmat Nurfauzi &#34;&#34; has waived all copyright and related or neighboring rights to this work.

项目信息

开发语言：未知

Star 数：4866

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Attack and defend acti using modern post exploitation ad tradecraft activity展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。