Assumed Compromise: A Methodology with Detections and Microsoft Sentinel with Alyssa Snow and Kaitlyn Wimberley

This course will deep dive into what we call threat optics: auditing endpoints, centralizing logs, and visualizing results.

Assumed Compromise – A Methodology with Detections and Microsoft Sentinel is for you if:

You need a methodology for assessing networks and domains. You want to improve the efficiency of your red and blue teams. You have an interest in threat optics. You want to implement a methodology for improving business processes around your security culture. Your business executives require ROI data to warrant further capital expenditure on threat-optic and threat-hunting initiatives. You want to see Azure Sentinel’s threat visualizations in near real-time.

You have interest in modern post-exploitation and pentest-related activities, including:

• Active Directory Certificate Services
• Command and Control
• Credential Attacks
• Impacket’s Heavy Hitters
• Kerberoasting
• Shadow Credentials
• Threat actor TTPs

You have interest in deception techniques and detection engineering, including:

• Honey accounts and service principals
• BloodHound and Kerberoasting detections
• Password spray and credential attack detects
• Certificate request and KeyCredentialLink auditing
• Real world attacker attribution using services

The Nitty Gritty:

Assumed Compromise: This is an Active Directory post-exploitation course where students can walk through penetration testing methodology with two well-seasoned veterans. The courseware is entirely lab based and most of those labs are based on attacks used as part of an industry proven penetration testing methodology.

Detections: The course provides configuration walkthroughs for Linux syslog and Windows event log data connectors for Microsoft Sentinel. An introduction to Kusto Query Language and Microsoft Sentinel alerts is provided to demonstrate threat detection. Association between attacker techniques, Windows event IDs, and detection logic is provided for most of the courseware’s attack labs.

Defenses: Students are guided through highly effective Active Directory deception techniques. Deception tech is then used throughout the courseware as a baseline for detecting common Active Directory enumeration like ADExplorer, BloodHound, and Impacket’s GetADUsers.py. Alongside the assumed compromise methodology and detection logic is a thorough discussion of security defenses and best practices.