38. Active Directory Attacks and Defence
38.8 Defence Checklist – Raja-Rani Traders Style AD
Fictional Raja-Rani Traders, Nashik/Pune style SMB: 1 DC, 2 file servers, 25 Win10 PCs, helpdesk Ruhi Bagale, accounts Salman (sales), Zoya (accounts). Attacker foothold on Zoya's PC – kay rokto Domain Admin path?
| Hardening item | Why | Quick check idea |
|---|---|---|
| Tier model + no DA on workstations | Stops HasSession → DA cred theft | DA never RDP to Tier-2 |
| LAPS / Windows LAPS | Unique local admin per PC | Random local admin works |
| SMB signing required | Breaks many NTLM relays | GPO: signing required |
| LDAP signing + channel binding | Relay to LDAP harder | Domain controller policy |
| Kerberos pre-auth on all users | Stops AS-REP roast | Find DONT_REQ_PREAUTH = 0 |
| gMSA / long SPN passwords | Kerberoast offline fail | SPN accounts 64+ or gMSA |
| BloodHound Blue reviews monthly | Paths shrink over time | No path from helpdesk to DA |
| Protected Users + MFA for admins | Ticket theft harder | Admins in Protected Users |
| Patch DC + members | Old CVEs = lateral fuel | WSUS / patch compliance |
| Audit 4768/4769/4728 + forward to SIEM | Detect roast / group changes | Wazuh/Splunk alerts |
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Chains enum → roast → relay → ACL → DA | Checklist above as GPO + monthly Purple Team retest in lab |
| Hopes SMB shop "never changes defaults" | Written AD hardening baseline for Raja-Rani Traders; owner signs |
Ravindra Bagale's Tip
Checklist poster banva class madhe – tools list nahi, controls list. Interview: "How would you harden a 30-user AD?" – Tier, LAPS, signing, gMSA, BloodHound Blue, monitoring. CEH exam modules madhe pan identity attacks yetat – defence line nehmi sanga.
Practice task
Raja-Rani Traders sathi 1-page AD hardening policy (bullet form) liha: GPO names imaginary OK, controls real. Mag Red vs Blue table madhun 3 controls pick karun "how we verify in lab" column bhara.
Project: Build it, hack it, fix it
Build: In YOUR host-only AD lab create three intentional weaknesses (document them): (1) one user without Kerberos pre-auth, (2) one SPN service account with a weak lab password, (3) SMB signing not required on one member (lab GPO). Hack (lab only): From Kali 192.168.56.10 use Impacket GetNPUsers.py / GetUserSPNs.py and optional BloodHound path notes – prove you obtained crackable lab material or a graph path. Fix: Re-enable pre-auth; set 40+ random SPN password or gMSA; enforce SMB signing; remove bad ACLs. Re-verify: Same Impacket commands should fail or yield uncrackable material; BloodHound shortest path to DA from low user gayab zhali pahije. Write a 1-page report for fictional owner Rani: finding → risk → fix → evidence. No real org, no internet targets.