Real-Time Detection of Attacks Leveraging Domain Administrator Privilege
summary
Claims a real-time detection method that flags activities using Domain Administrator privileges — including Golden Ticket impersonation — by ingesting only Domain Controller event logs and selected Event IDs (e.g. 4688/4674). It combines rule-driven signatures with unsupervised ML on process-related events to drop signature false positives (their evaluation shrinks flagged cases from 17 to 6) and reports roughly 90% precision/recall. Implementation uses Elastic Stack for collection, correlation and alerting, and demos catch Mimikatz/golden-ticket use and unusual admin commands.
AI-written summary · about
chapters (9)
- 0:00Introduction and agenda
- 1:23Threats to Active Directory
- 2:55Attack vectors and challenges
- 7:09Proposed detection methodology
- 9:21Technical implementation
- 13:40Evaluation and results
- 16:08System architecture
- 17:34Demonstration
- 22:19Considerations and conclusion
related talks
37mThreat Hunting in Active Directory Environment
51mHacker’s Perspective on Your Infrastructure: Lessons from the Field
40mTop Active Directory Attacks: Understand, then Prevent and Detect
45mYou « try » to detect mimikatz
29mWhy You Need to Detect More Than PtH
32mSysmon Deep Dive: Real Detection Scenarios You Can Reproduce
50mHybrid Active Directory Attacks: Anatomy and Defenses
23mSecurity Tools Don't Detect Attacks—Humans Do