visitor@hunterweygandt:~$ ls vulnerable-ad-lab/|
Vulnerable Active Directory Lab
To see the supporting documents for this project, please visit my GitHub repository.
See my GitHub repositoryWhy this lab exists, the DC-only scope, and how each attack maps to a custom Wazuh rule.
Standing up the ecorp.local domain controller and Wazuh manager from clean install to first detection.
Cracking service-account credentials from their SPNs, and catching the RC4 ticket request in event 4769.
Abusing accounts with pre-auth disabled to pull crackable hashes, flagged on a pre-auth type 0 in event 4768.
One password against many accounts to dodge lockouts, detected by correlating a burst of 4625 failures from a single source.
Replaying a shared local admin's stolen NTLM hash to move between workstations, caught by an NTLM network logon from a local account in event 4624.
Exploiting misconfigured object permissions to reach Domain Admins, tracked through group changes and DACL edits.
Impersonating a domain controller to replicate password hashes, caught when replication rights come from a non-DC account.