Threat Hunting in Active Directory Environment
summary
Mandiant teams report concrete backdoors: attackers set constrained delegation or msDS-AllowedToActOnBehalfOfOtherIdentity via PowerShell to impersonate users and reach domain controllers, grant DCSync/dsReplicationGetChanges to low‑privilege accounts (PowerView + Mimikatz), steal machine$ hashes and change the 30‑day rotation to 365 days in the registry, plant malicious GPO logon scripts to push ransomware, inject a DLL into Azure AD Connect with AADInternals to harvest creds, and abuse SIDHistory across forest trusts. Detect via Event IDs 4742/4662/5136/4738/462, missing 4768/4769, Sysmon Event 7 and targeted PowerShell hunts.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 6:11What is Delegation
- 9:44PowerShell Configuration
- 10:54Detecting
- 11:58RBCD
- 13:16How to use RBCD
- 13:55Detecting RBCD
- 14:52BS Replication
- 16:23Configuration
- 17:04Detect
- 17:57Persistence
- 18:48Machine Account
- 19:38Registry
- 20:28Detection
related talks
35m"Inside Cybercrime Groups Harvesting Active Directory for Fun..."
50mHybrid Active Directory Attacks: Anatomy and Defenses
40mTop Active Directory Attacks: Understand, then Prevent and Detect
50mBeyond the Mcse: Active Directory for the Security Professional
40mHacker’s Paradise: Top 10 Biggest Threats When Working From Home
40mWhat’s Old is New: Hybrid Security for Microsoft Azure and On-Premises Tech
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field
25mInvestigating PowerShell Attacks