Technical Writeup
Active Directory Attack & Defense
BloodHound · Kerberoasting · Pass-the-Hash · Sysmon Hardening · Wazuh Detection
Two-phase approach: attack a virtualised Windows Server AD environment using real adversary techniques, then harden the same environment and validate that the attacks now produce detectable signals. The two-phase structure is deliberate: detection rules can only be written well if you know exactly what attack traffic and logs look like from the attacker side.
Techniques Practiced
- BloodHound enumeration: shortest path from low-priv domain user to Domain Admin identified in 3 hops via machine account ACL
- Kerberoasting via Impacket GetUserSPNs: TGS ticket for SPN service account extracted and cracked in under 2 minutes (rockyou.txt)
- Pass-the-Hash via CrackMapExec and psexec.py: SYSTEM shell on workstation using NTLM hash without plaintext password
- Custom Wazuh detection rule for Kerberoasting: Event ID 4769 with RC4 encryption type (0x17), a high-confidence indicator
- Custom detection for Pass-the-Hash: Event ID 4624 Type 3 NTLM network logons from non-system accounts
- Sysmon LSASS access detection (EID 10): tuned to exclude known-good callers (AV, Wazuh agent); Mimikatz still fires
- BloodHound detection: Event ID 4662 volume rule, 50+ LDAP queries from single source in 60 seconds
- Hardening: gMSA replacement (240-char auto-rotated password), Protected Users group, Credential Guard, GPO audit policies
MITRE ATT&CK
T1558.003: KerberoastingT1550.002: Pass-the-HashT1069.002: Domain GroupsT1003.001: LSASS Memory
Tools
Windows Server 2019Kali LinuxBloodHoundImpacketCrackMapExecSysmonWazuhhashcatVirtualBox