Top Active Directory Attacks - Understand, then Prevent and Detect

This course explains common attacks against enterprise Active Directory environments and shows defenders how to prevent, detect, and respond to them. It covers internal access, credential attacks, file-share discovery, DNS fallback abuse, printer-related risks, and Kerberoasting.

Syllabus

Introduction
Agenda
Different ways of conceptualizing breaches
Lockheed Martin Cyberkill Train trademark
What every attacker or attack needs
Internal access
Why internal access
A 10000 employee company
Twitter breach
Finding the right data
X filtration
Ransomware
High Level Picture
Prevent vs Detect
Safes
Assume Breach
Realistic Threat Model
Password Spraying
Single Factor Authentication
Credential Stuffing
File Sharing
dns fallback abuse
Look printers
Kerberos roasting
What are kerberos
normal flow
analogies
authentication
ticket granting
service ticket
kerberos steam
preventive detective controls
password protection
printers
sensitive files
longterm action
fallback abuse
Jeff