Ravindra BagaleCourses & study guides मराठी Track your progress

38. Active Directory Attacks and Defence

By Last updated:

Chala mitrano, Chapter 37 madhe LDAP basics baghitla – aata Active Directory (AD) deep dive. AD = Windows networks cha directory brain: users, groups, computers, Group Policy, Kerberos tickets. Attacker la Domain Admin milala tar sagla jungle open – mhanun aapan lab madhech Impacket ani BloodHound shiku, ani pratyek step sobat bachav. Ghabru naka – concepts aadhi, commands nantar. He khup important aahe!

What you will learn in this chapter

  • AD basics: domain, forest, Domain Controller (DC), Kerberos vs NTLM, LDAP role
  • Safe AD lab: Windows Server DC + Windows client + Kali (host-only) – fictional sahyadri.lab
  • AD enumeration ideas: NetExec LDAP, Impacket scripts, BloodHound collectors (lab only)
  • Kerberos attack ideas explained for Blue: AS-REP roasting, Kerberoasting + fixes
  • NTLM relay / Pass-the-Hash concepts – signing, LAPS, Credential Guard, Tier model
  • BloodHound edges (AdminTo, MemberOf, HasSession, GenericAll) – Blue path reduction
  • Privilege escalation paths, unconstrained delegation awareness, Domain Admin risk
  • Defence checklist – Raja-Rani Traders style fictional Maharashtra AD
  • Project: Build a weak AD config, hack in lab, then fix and re-verify

Lab scope

Build and attack only your own AD lab (VirtualBox/VMware host-only: Kali 192.168.56.10, your Windows Server DC + Windows 10/11 member). Never point Impacket, BloodHound collectors, NetExec or relay tools at a real corporate / institute / client AD. Without written permission this is illegal under the IT Act (sections such as 43 and 66 – verify current text). Lab = learn. Real AD = defend only.

Concepts in this chapter

  1. 38.1AD Basics for Defenders
  2. 38.2Safe AD Lab Setup
  3. 38.3Enumeration of AD
  4. 38.4Kerberos Basics: AS-REP Roasting and Kerberoasting (Defensive View)
  5. 38.5NTLM Relay and Pass-the-Hash Concepts (Lab Only)
  6. 38.6BloodHound Attack-Path Analysis
  7. 38.7Privilege Escalation Paths and Domain Admin Risks
  8. 38.8Defence Checklist – Raja-Rani Traders Style AD
  9. 38.9Putting It Together – Purple Team Mindset

The chapter recap is at the end of the last concept page.

Chapter 38: Active Directory attacks and defence — practice tasks

Open chapter lessons · Full guided lab: windows separate admin daily account audit 4625 (not repeated here)

38.1 Separate admin and daily accounts

EasyIT

Why: Daily browsing as Domain Admin is high risk.

What: On your Windows lab, use two accounts.

How:

  1. Create user alice (daily) and alice-adm (admin).
  2. Browse the web only as alice.
  3. Use Run as different user for admin tools.

Expected output: Two accounts exist; daily has no Domain Admins.

Hint

See linked Windows accounts lab.

Answer / how to check
  1. whoami on daily is not Domain Admins.

38.2 Read failed logons (4625)

MediumBanking

Why: 4625 storms mean password spraying.

What: Generate and read a failed logon on your lab.

How:

  1. Try a wrong password on the console.
  2. Event Viewer → Security → Filter 4625.
  3. Note Account Name and Source Network Address.

Expected output: At least one 4625 event.

Hint

Forward these to a SIEM in real orgs.

Answer / how to check
  1. Event shows your wrong attempt.

38.3 Kerberoasting defence checklist (paper)

MediumHealthcare

Why: Defence first — no attacking production AD.

What: Mark each control Present/Missing for a fictional clinic AD.

Data file: ad-def.csv

ControlIn place?
MSA/gMSA for servicesYes
AES Kerberos encryptionYes
No SPN on user accounts with weak passwordsNo

About this file: Fictional AD controls. Each row is one control. Columns: Control; In place?.

How:

  1. Read the data file.

Expected output: Items with Yes = Present; No = Missing.

Hint

This is a paper task only.

Answer / how to check
  1. List the Missing controls.

Extended teaching notes

Why this lesson matters

Active Directory is the identity plane for many Indian enterprises. Attack path tools exist so defenders can remove dangerous edges: excessive admin rights, unconstrained delegation, stale accounts.

  • Tiered admin model; no daily Domain Admin use.
  • LAPS for local admin passwords.
  • Monitor for unusual Kerberos / replication behaviour.
  • Lab AD only — never against a corporate domain without a signed engagement.

Mini case study

Suppose we are on a purple-team exercise for an Indian mid-size company (sample data). Red notes a technique from this lesson against a lab clone. Blue must show the control that stops it, the log that would have fired, and the ticket that hardens production. That is the standard this course trains you for.

Defender's worksheet (do this today)

  1. Write the lesson title, date and the exact lab target you are allowed to use.
  2. List three owned systems (VMs, apps, or cloud accounts) where this lesson applies.
  3. Run one safe check from the lesson on a lab system only. Paste the command and output.
  4. Write a two-sentence fix you would give a teammate.
  5. Name one related public advisory (CERT-In, CISA, NVD, or a vendor bulletin) with its date.

Indian workplace (sample data)

Suppose we are a junior analyst at Infosys, TCS, Wipro or a fintech SOC in Bengaluru/Pune. Turn this lesson into one checklist item with an owner, a due date and a place to store evidence (ticket + screenshot).

Global practice

Compare your notes with OWASP, CIS Benchmarks, NIST CSF/IR guidance or a cloud Well-Architected security question. Write five lines on what overlaps.

Everyday analogy

Explain the risk and the fix to a family member without jargon. If they can repeat the warning, you understand it well enough to teach juniors.

Key terms

  • Control: a safeguard (patch, config, process, detection).
  • Finding: a weakness backed by evidence.
  • Remediation: the fix plus how you verified it.
  • Scope: systems you have written permission to touch.
  • Least privilege: only the access the task needs.
  • Defence in depth: several layers so one failure does not end the story.

Common mistakes

  • Skipping written permission "just for a quick scan".
  • Practising on hostel, office or public targets without authorisation.
  • Collecting tool output without writing the fix.
  • Copying attack steps onto production to "verify". Defenders verify with versions, configs and patches.
  • Publishing screenshots that contain secrets, cookies or internal hostnames.

Recap

  • Evidence, fix, owner, date.
  • Own lab only.
  • Fix > spectacle.