مهدی حاتمی

• پیشرفته
• مسیر بنفش
• ۱۰ درس

دربارۀ این دوره

مخاطبان

• مناسب برای شکارچیان تهدید
• Red Teamerها
• کارشناسان لایۀ ۲ و ۳ مرکز عملیات امنیت
• تیم‌های پاسخ به رخداد

پیش‌نیازها

• حداقل ۲ سال سابقۀ فعالیت در زمینۀ امنیت سایبری

• Introduction to Active Directory Threat Hunting
  • What Active Directory (AD) is and why attackers target it
  • AD attack surface overview
  • Common AD misconfigurations
  • Threat hunting methodology for AD
  • Mapping AD threats to MITRE ATT&CK
• AD Enumeration & Reconnaissance (Attacker Tradecraft)
  • How attackers map and enumerate AD
  • BloodHound concepts (graphs, nodes, edges)
  • LDAP-based enumeration
  • PowerView and built-in reconnaissance utilities
  • Kerberos service enumeration
  • Identifying privilege paths
  • Discovering misconfigured ACLs and attack routes
• Authentication Abuse & Credential Attacks
  • Password spraying
  • Brute-force authentication
  • Kerberoasting
  • AS-REP Roasting
  • Golden Ticket / Silver Ticket concepts
  • Pass-the-Hash / Pass-the-Ticket
  • Token theft techniques
  • Skeleton Key malware behavior
• Kerberos Abuse & Authentication Weaknesses
  • Kerberos authentication overview
  • Overpass-the-Hash (Pass-the-Key)
  • S4U abuse
  • Constrained vs. unconstrained delegation
  • Resource-Based Constrained Delegation (RBCD)
  • Service account exploitation
  • Kerberos encryption weaknesses
• AD Persistence Techniques
  • AdminSDHolder abuse
  • KRBTGT persistence (Golden Ticket)
  • DCSync persistence
  • SID History injection
  • Group Policy persistence options
  • Shadow admin creation
  • Malicious SPNs
  • Directory replication backdoors
• Privilege Escalation Paths in Active Directory
  • Weak ACLs and ACE exploitation
  • Escalation using GenericAll, GenericWrite, WriteDACL, WriteOwner
  • Escalation via vulnerable Group Policy object permissions
  • Service account misconfigurations
  • Abusing domain trusts for privilege escalation
• Lateral Movement Techniques in AD Environments
  • PSExec, WMI, WinRM movement
  • Remote Registry abuse
  • SMB relay attacks
• GPO (Group Policy) Abuse & Misconfigurations
  • GPO fundamentals and security model
  • GPP password exposure
  • GPO privilege escalation
  • Startup scripts and scheduled tasks via GPO
  • Hunting for GPO injection routes
  • SYSVOL reconnaissance
• Domain Controller & Trust Attacks
  • DCSync vs DCShadow
  • Domain trust abuse in multi-domain environments
  • Cross-forest trust exploitation
  • SID filtering bypass
  • Attacking AD Certificate Services as part of DC compromise
• Active Directory Certificate Services (AD CS) Attacks
  • Overview of AD CS architecture
  • Attack categories
  • Certificate template misconfigurations
  • Authentication abuse via certificates
  • Persistence using long-lived certificates
  • Abuse certificate

گواهینامه‌ی دوره