Attacking and Defending Active Directory: Advanced Edition [Jan 2023]

Build expertise in attacking and defending real-world enterprise Active Directory environments. Identify and analyze threats and practice attacks against a modern multi-forest Active Directory environment. 
View Syllabus
Starts:  15 January 2023  Duration: 4 weeks
Recordings of live sessions included!

Enrollment ends in:

What You'll Learn

This advanced bootcamp is designed to help security professionals understand, analyze and practice threats and attacks in a modern, multi-forest Active Directory environment with fully patched Server 2019 machines.

In addition to learning the popular tactics, techniques and procedures (TTPs), you will also see how they change for attacks across forest trusts. You will also learn how to abuse or bypass modern Windows defenses like Advanced Threat Analytics, Local Administrator Password Solution (LAPS), Just Enough Administration (JEA), Resource-Based Constrained Delegation (RBCD), Windows Defender Application Control (WDAC), Application Whitelisting (AWL), Constrained Language Mode (CLM), virtualization and more.

  • 4 live sessions

  • 3 hrs per session

  • 4 weeks access

  • 60 flags to be collected

  • 29 lab exercises

  • 1 CRTE attempt

  • Recordings of Live Sessions

Build Your Cybersecurity Credentials

  • Become a Certified Red Team Expert (CRTE)

This is the natural next step for anyone who’s got their CRTP and wants to level up even further in techniques, tools. With the CRTE, you ensure your skills in modern, multi-forest Active Directory environments are recognized by top professionals in the industry.

  • Bootcamp Completion Certificate

Attendees will also get a course completion certificate after completing Learning Objectives covered during the course.

Live Session Schedule

Weekly 3.5 hr sessions start at 10:00am ET and end at 1:30pm ET.
15 January 2023
22 January 2023
29 January 2023
05 February 2023
Introduction to Active Directory, Enumeration and Local Privilege Escalation
Lateral Movement, Domain Privilege Escalation and Persistence
Domain Persistence, Dominance and Escalation to Enterprise Admins
Defenses, Monitoring and Bypassing Defenses

Prerequisites

1. A good understanding of Active Directory security.
2. The ability to use command line tools.

Bootcamp Syllabus

The course is split in four modules across four weeks:

Module I:

  • Introduction to Active Directory, attack methodology and tradecraft
  • Domain Enumeration (Attacks and Defense)
  • Enumerating information that would be useful in attacks with leaving minimal footprint on the endpoints
  • Understand and practice what properties and information to look for when preparing attack paths to avoid detection
  • Enumerate trust relationships within and across forests to map cross trust attack paths
  • Learn and practice escalating to local administrator privileges in the domain by abusing OU Delegation, Restricted Groups, LAPS, Nested group membership and hunting for privileges using remote access protocols
  • Credential Replay Attacks

Module II:

  • Abusing on-prem MS Exchange for privilege escalation and extracting emails and sensitive information from mailboxes
  • Evading application whitelisting (WDAC)
  • Domain Privilege Escalation by abusing Unconstrained Delegation: understand how unconstrained delegation is useful in compromising multiple high privilege servers and users in AD
  • Abusing Constrained Delegation for Domain Privilege Escalation by impersonating high privilege accounts
  • Using ACL permissions to abuse Resource-based Constrained Delegation
  • Domain Persistence Techniques

Module III:

  • Advanced Cross Domain attacks. Learn and practice attacks that allow escalation from Domain Admins to Enterprise Admins by abusing MS Products and delegation issues
  • Lateral movement from on-prem to Azure AD by attacking Hybrid Identity infrastructure
  • Advanced Cross Forest attacks. Execute attacks like abuse of Kerberoast, SID Filtering misconfigurations etc. across forest trusts forests and understand the nuances of such attacks

Module IV:

  • Abusing SQL Server for cross forest attacks
  • More on advanced Cross Forest attacks like abuse of Foreign Security Principals, ACLs etc.
  • Abusing PAM trust and shadow security principals to execute attacks against a managed forests
  • Detections and Defenses (Red Forest, JEA, PAW, LAPS, Selective Auth, Deception, App Whitelisting, ATA, Tiered Administration)
  • Bypassing defenses like Advanced Threat Analytics, Protected Users Group, WDAC etc.
Meet the instructor

Chirag Savla

Chirag Savla is an information security professional whose areas of interest include penetration testing, red teaming, azure, active directory security, and post-exploitation research.

He has over 7+ years of experience in information security. Chirag likes to research new attack methodologies and create open-source tools that can be used during the red team assessments. He has worked extensively on Azure, Active Directory attacks, defense, and bypassing detection mechanisms.

He is the author of multiple Open Source tools such as Process Injection, Callidus, etc. He has spoken in multiple conferences and local meetups.
Chirag Savla - Principal Instructor

Can't attend this bootcamp? Get informed about future bootcamps!

Thank you!
Thank you!
  • Online cybersecurity training
  • Earn certifications
  • Suitable for beginners
  • Expert trainers
  • Join a community of professionals from 130+ countries

Featured links

Connect with us