Skip to content

Back to the catalog

github.comrepo

M-med/Active-Directory-Simulation-Attack-

Active-Directory-Simulation-Attack- is a purple team lab for the lab.local domain (192.168.100.0/24). It walks through an attack chain: BloodHound/SharpHound recon, Kerberoasting, hash cracking with John the Ripper or Hashcat, and lateral movement with Impacket. It then applies hardening (gMSA, tiering, LLMNR/NetBIOS disabling) and adds Sysmon, Wazuh SIEM and custom Kerberoasting rules (Event ID 4769, RC4).

TL;DR Builds an Active Directory purple team lab that runs Kerberoasting and lateral movement attacks, then hardens the domain and detects them with Wazuh and Sysmon.
Open original ↗

Organisations named here

  • T1558.003

Technologies named here

  • Active Directory
  • BloodHound / SharpHound
  • John the Ripper
  • Ubuntu Server
  • hashcat
  • Windows Event Logs
  • Wazuh SIEM
  • BloodHound
  • Impacket
  • Wazuh
  • Sysmon
  • Kerberos

Techniques named here

  • Active Directory reconnaissance with BloodHound / SharpHound
  • Lateral movement with Impacket psexec
  • Credential dumping with Impacket secretsdump
  • LLMNR / NetBIOS poisoning
  • MITRE ATT&CK mapping in all Wazuh alerts
  • Kerberoasting

Also named here

  • MITRE ATT&CK

Related in Offensive Security