Skip to main content
back to List back
on this page

Achieving Full Visibility: Developing Advanced Threat Detection for On-premises AD

live online
price $1,400
Mars
Intermediate
2 Days
Threat Focus
Sun 6 Dec - Mon 7 Dec
price $1,400
Register


Online, Available in English

Overview

On-premises Active Directory (AD) remains the identity fabric of almost every enterprise in the Middle East and Africa — across banking, telecommunications, oil & gas, government, and utilities — and it continues to be the single most-abused asset chain in modern intrusions. Despite more than a decade of public research on Kerberos abuse, delegation exploitation, ACL misconfiguration, and AD Certificate Services (AD CS) attacks, most defenders still struggle to translate those attack techniques into reliable, production-grade detections. This two-day, lab-intensive training is designed to close exactly that gap.

The course takes a purple-team approach: for every attack technique we cover, students will first execute the attack in a controlled lab domain, study the behavioral and log-level artifacts it produces, and then build an end-to-end detection pipeline — from telemetry source selection, to event parsing, to correlation rules — that catches the attack in realistic conditions. Equal attention is given to the adversary's OPSEC (Operational Security) considerations, so that students understand which detections are robust and which can be trivially bypassed by a careful attacker.

By the end of the class, students will have hands-on experience implementing detections for the full spectrum of modern AD threats — from Kerberoasting and Golden Tickets to Diamond / Sapphire / Silver tickets, Pass-the-Ticket, ticket harvesting, DPAPI abuse, Unconstrained / Constrained / Resource-Based Constrained Delegation, ACL-based escalation (GenericAll / GenericWrite / WriteDACL), gMSA attacks, DNSAdmin and default privileged-group abuse, GPO-based persistence, and — in the extended track — the full AD CS attack chain (enumeration, account persistence via PKINIT, certificate theft, domain escalation, and domain persistence) plus Domain Trust abuse and so on.

This training has been deliberately adapted for the Middle-East & Africa audience. The attack techniques taught are universal, but the scenarios students walk through — and the example detections that ship with the course — are tuned to the tradecraft consistently observed against MEA enterprises.

 

Topics:

  • Lab Use PowerShell to build AD (~45 mins) 
  • Lab Build Detection Mechanism with Wazuh (~35 mins)
  • Lab Discovery  - AD Reconnaissance (~45 mins) 
  • Lab Privilege Escalation - Kerberoasting  (~30 mins)
  • Lab Persistence - Pass the Ticket (Golden Ticket) (~90 mins)
  • Lab Persistence - Pass the Ticket (Diamond Ticket) (~35 mins) 
  • Lab Persistence - Pass the Ticket (Sapphire Ticket) (~35 mins) 
  • Lab Persistence - Pass the Ticket (Silver Ticket) (~40 mins) 
  • Lab Persistence - Ticket Harvest (~35 mins)
  • Lab Persistence - DPAPI (50 mins)
  • Lab Lateral Movement - Unconstrained Delegation I and II (60 mins)
  • Lab Lateral Movement - Constrained Delegation (Traditional and Resource-based) (60mins)
  • Lab Privilege Escalation - ACL Abuse I, II and III (80mins) 
  • Lab Privilege Escalation - Group Managed Service Account (40 mins) 
  • Lab Privilege Escalation - DNSAdmin Abuse and Domain Default Group Abuse (60mins) 
  • Lab GPO Abuse - Persistence-Edit GPO to setting C2 script (Limited User) (60mins) 
  • Lab Lateral Movement - Domain Trust (Golden Ticket with SID-History, Trust Ticket with SID-History) 
  • Lab Credential Access - NTLM Relay
  • AD Certificate Service Abuse (Enumeration, Account Persistence, Certificate Theft, Domain Escalation, and Domain Persistence) 

  • M9: Envoy Lua AI output PII redaction + Cosign-attested RAG corpus

     

Who Should Attend (Target Audience)

  • SOC analysts (L2 / L3) and detection engineers at MEA-regional organizations responsible for writing and tuning rules against Windows / AD telemetry.
  • Threat hunters supporting regional CERTs, sector ISACs, or in-house CSIRTs who need a structured, attack-technique-driven framework for hunting across AD estates.
  • Blue-team leads and purple-team operators who want to validate their existing AD detection coverage against modern tradecraft observed in-region.
  • Incident responders and DFIR consultants who regularly handle AD-centric intrusions across banking, telecom, oil & gas, and government and want deeper understanding of the artifacts each technique leaves behind.
  • Red teamers and penetration testers who want to understand what their operations actually look like from the defender's telemetry side — and how to tune their OPSEC accordingly.

Prerequisites

Required Knowledge

  • Working knowledge of Windows administration (users, groups, GPO basics, PowerShell fundamentals).

Hardware / Software Requirements

  • Laptop with at least 16 GB RAM (32 GB recommended), 100 GB free disk space, and full administrative rights.
  • Hypervisor of choice (VMware Workstation) pre-installed and tested.

  • Modern 64-bit CPU with virtualization (VT-x / AMD-V) enabled in BIOS.

     

By the end of this course, the participant will learn about: 

  • Map modern on-premises AD attack techniques to the MITRE ATT&CK framework and explain the underlying Windows / Kerberos protocol abuse that makes each one work.
  • Stand up a realistic AD lab from scratch using PowerShell, and deploy a working detection stack (Wazuh SIEM, Windows Event Forwarding, Sysmon-enhanced telemetry) suitable for production-representative coverage.
  • Design and author high-fidelity detection rules for Kerberoasting, AS-REP Roasting, Golden / Diamond / Sapphire / Silver Ticket forgery, Pass-the-Ticket, and ticket-harvesting operations — including the OPSEC-aware variants.
  • Configure and interpret SACL-based auditing on LSASS.exe and Winlogon.exe on domain controllers to catch credential extraction and DCSync with high precision (Event 4656 chain).
  • Detect DPAPI-based credential theft (master-key extraction, offline decryption) and ticket extraction from the Kerberos — including variants that avoid classic Mimikatz indicators.
  • Identify lateral-movement abuse of Unconstrained, Constrained (traditional), and Resource-Based Constrained Delegation, and understand why each produces different detection opportunities.
  • Catch ACL-based privilege escalation (GenericAll, GenericWrite, WriteDACL, WriteOwner) across user, group, and computer objects (5136 / 5137 chain); detect gMSA password retrieval abuse; detect DNSAdmin and built-in privileged-group abuse.
  • Detect persistence through GPO modification — including malicious scheduled-task / startup-script injection by a limited user with delegated GPO rights.
  • Reason about attacker OPSEC: for each detection, articulate the specific evasion technique that defeats it, and design a fallback detection layer that closes the gap.
  • (Extended track) Detect the full AD CS attack chain — ESC1 / ESC8-class misconfigurations, certificate theft (Event ID 1007), PKINIT abuse, domain escalation (Event ID 4887), and certificate-based domain persistence — and handle Domain Trust abuse (Golden Ticket with SID-History, inter-forest Trust Ticket) and NTLM Relay.
  • Apply every detection taught to a representative MEA-regional threat scenario drawn from publicly-documented incidents.