Advanced Threat Hunting on Active Directory

34mAdvanced2024-08-23

Authors

Laurentiu Gabriel Raducu

Course details

Active Directory is a widely used directory service on Windows servers, managing user and resource permissions and enabling efficient network organization. In this course, experienced instructor and software developer Laurentiu Gabriel Raducu guides you through the nuances of Active Directory, emphasizing its critical role in network security. Learn the basics of Active Directory and build your understanding of its structure and common vulnerabilities. Delve into more complex aspects, such as how to spot unusual activity that could indicate a breach or an ongoing attack. Plus, explore essential tools and techniques used in threat hunting, including how to analyze logs, monitor network traffic, and use advanced querying to detect anomalies. When you complete this course, you'll be well-equipped to proactively search for potential threats in AD environments, respond effectively to identified risks, and strengthen your network's defenses against future attacks.

Skills covered

Active DirectoryMicrosoft Entra ID (Azure Active Directory)Incident ResponseNetwork AdministrationCybersecurityNetwork and System AdministrationMicrosoftOne-Off

Concepts

0. Introduction

01 - Introduction to threat hunting in Active Directory

1. Active Directory

02 - Understanding Active Directory - Architecture and components
03 - What are the key Active Directory services and roles
04 - Getting to know the Active Directory security model

2. Threat Hunting

05 - Understanding the essentials of threat hunting
06 - Getting familiar with the threat hunting process
07 - Tools and techniques for effective threat hunting

3. Threat Hunting in Active Directory

08 - Auditing and monitoring AD for signs of compromise
09 - Analyzing AD logs and events
10 - Uncovering lateral movement and privilege escalation
11 - Discovering common Kerberos attack techniques
12 - Detecting and responding to malicious GPO activities

Conclusion

13 - Next steps