CyberSec Lab — Active Directory Defence & Detection

OBJECTIVES

Triage the initial alert

Detect Kerberoasting (Event 4769)

Detect Pass-the-Hash (Event 4624)

Detect DCSync (Event 4662)

Detect Golden Ticket (Event 4672)

Identify the source workstation

Complete the investigation questions

Submit the IR report

📋

Event Log

🚨

Alert Dashboard

🔬

Defender Tools

❓

Investigation

📖

Reference

📝

Notepad

📄

IR Report

NETWORK SECURITY — INCIDENT RESPONSE

🔗 Peer lab — Penetration Testing path:
Active Directory Attacks

AD DEFENCE & DETECTION

DOMAIN: APEXCORP.LOCAL — SOC ANALYST PERSPECTIVE

SITUATION

Microsoft Defender for Identity has fired an alert on the APEXCORP.LOCAL domain at 09:14 UTC. Windows Security Event logs show anomalous Kerberos and LDAP activity originating from an internal workstation. Your job as a SOC analyst is to investigate, identify the attack chain, and document the incident.

ENVIRONMENT

Asset	Detail
Domain	APEXCORP.LOCAL
Domain Controller	DC01 — 10.10.18.10
Affected workstation	Investigate from logs
Alert time	2026-05-08 09:14:02 UTC
Your role	SOC Analyst — Tier 2

METHODOLOGY

Start with the Alert Dashboard to understand what fired
Open the Event Log and hunt the key Event IDs
Use Defender Tools to run KQL queries against the log
Answer the Investigation questions as you find evidence
Document everything in the IR Report

KEY EVENT IDs TO HUNT

Event ID	Technique
4769	Kerberos Service Ticket — look for RC4 (0x17)
4624	Logon — look for Type 3, NtLmSsp package
4662	Object access — DS-Replication-Get-Changes-All
4672	Special privileges assigned to new logon
4768	Kerberos TGT request — baseline activity

WINDOWS SECURITY EVENT LOG — DC01.APEXCORP.LOCAL

Level

Event

Time

Message

Source

Select an event to view details

DEFENDER FOR IDENTITY — ALERT DASHBOARD

CRITICAL

HIGH

MEDIUM

INFO

DEFENDER TOOLS — KQL / POWERSHELL QUERIES

# Defender for Identity / Microsoft Sentinel KQL Console

# Type "help" for available queries, or run your own

KQL>

INVESTIGATION — GUIDED QUESTIONS

0 / 8

REFERENCE — AD DETECTION

KERBEROASTING

Attacker requests service tickets for SPN accounts. Detection: RC4 encryption (0x17) when AES is available is anomalous.

Event 4769 — TicketEncryptionType: 0x17 (RC4-HMAC) for a service account SPN

SecurityEvent | where EventID == 4769 | where TicketEncryptionType == "0x17" | where ServiceName !endswith "$"

PASS-THE-HASH

Attacker authenticates using an NTLM hash without knowing the password. Detection: NTLM authentication from a workstation to a Domain Controller.

Event 4624 — LogonType: 3, AuthPackage: NtLmSsp from non-DC host to DC

SecurityEvent | where EventID == 4624 | where LogonType == 3 | where AuthenticationPackageName == "NTLM" | where WorkstationName != "" and IpAddress != DCip

DCSYNC

Attacker mimics DC replication to extract all password hashes. Detection: replication rights accessed from a non-DC host.

Event 4662 — DS-Replication-Get-Changes-All accessed by non-DC account

SecurityEvent | where EventID == 4662 | where Properties contains "DS-Replication-Get-Changes-All" | where SubjectUserName !endswith "$"

GOLDEN TICKET

Forged Kerberos TGT using the krbtgt hash. Detection: ticket with anomalous attributes or privileges granted without recent TGT issuance by the DC.

Event 4769 + 4672 — Sensitive account with anomalous ticket, or special privilege without DC-issued TGT

CONTAINMENT ACTIONS

Reset-ADAccountPassword -Identity krbtgt -NewPassword (ConvertTo-SecureString -AsPlainText "NewPass!" -Force) # Must reset TWICE — 24 hours apart # Disable compromised accounts Disable-ADAccount -Identity svc-sql