Altered Security - Active Directory Attacks for Red and Blue Teams - Advanced Edition - Altered Security - DCTSG2027
Description
Name of Training: Altered Security - Active Directory Attacks for Red and Blue Teams - Advanced Edition
Trainer(s): Altered Security, Manthan Chhabra
Skill Level: Intermediate, Advanced
Dates: March 5 – March 7, 2027
Time: 9 to 5 pm
Venue: TBD
Early Bird Cost: S$3,300 ((incl. GST, until Dec 31, 2026)
Regular Cost: S$3600 (incl. GST)
Short Summary
This hands-on class is aimed towards attacking modern Enterprise environment with focus on OPSEC and Stealth. We target a lab environment that has Server 2025 machines with effective countermeasures.
Course Description
More than 95% of Fortune 500 companies use Active Directory! Enterprises are managed using Active Directory (AD) and it often forms the backbone of the complete enterprise network. Often burdened with maintaining backward compatibility and interoperability with a variety of products, AD environments lack ability to tackle latest threats.
This training is aimed towards attacking modern AD with focus on OPSEC and Stealth. The training is based on real world penetration tests and Red Team engagements for highly secured environments. Some of the techniques used in the course:
- Introduction to OPSEC and Stealth used in the class.
- Offensive .NET and PowerShell tradecraft
- OPSEC friendly AD Enumeration
- Privilege Escalation (User Hunting, Delegation issues, LAPS abuse, gMSA abuse and more)
- Credential Extraction (Defeating Credential Guard, extracting credentials without touching LSASS, Stealing certificates and more)
- Lateral Movement (Abuse COM objects to evade EDR, Abusing WinRM with custom tooling)
- Advanced Kerberos Attacks and Defense (Forging tickets, BadSuccessor, AD Sites abuse and more)
- Domain Dominance and Persistence (Forging tickets, Shadow Credentials, utilizing Domain DPAPI backup keys and KDS root key)
- Advanced cross forest trust abuse (Lateral movement across forest, Cross-forest RBCD, Cross-Forest AD CS, FSPs, Side Filtering bypass and more)
- Credentials Replay Attacks (Over-PTH, Token Replay, Certificate Replay etc.)
- Attacking Entra ID integration for On-prem to Cloud lateral movement (Hybrid Identity)
- Abusing trusts for MS products (AD CS, SQL Server etc.)
- Monitoring Active Directory
- Defenses (JEA, PAW, LAPS, Selective Authentication, Deception, App Allowlisting, MDE EDR, Microsoft Defender for Identity etc.)
- Bypassing defenses (MDE, MDI, Credential Guard, WDAC and more)
Attendees will get free two months access to an Enterprise environment comprising of multiple domains and forests and an attempt for the Certified Red Team Expert Exam (CRTE) certification exam.
Course Outline
View full outline
Hide outline
Day 1 - Morning
Introduction OPSEC and Stealth used in the class. (30 minutes)
Attack methodology and tradecraft (30 minutes)
Offensive .Net Tradecraft (60 minutes)
- Understand the approach of customizing/obfuscating tools and understand the approach to bypass static detection by AVs.
- Bypass behavioral based detection and EDR hooks using indirect syscalls.
Powershell Tradecraft (30 minutes)
- Learn about various ways to load scripts and tools in memory.
- Understand about various PowerShell defense mechanisms and ways to evade them.
OPSEC friendly AD Enumeration (60 minutes)
- Understand enumeration OPSEC to bypass detections from tools like Microsoft Defender for Identity (MDI) and other Identity defense tools.
- Leverage OPSEC friendly tools such as SOAPHound and SharADWS for enumerating Active Directory.
Day 1 - Afternoon
Local Privilege Escalation (60 minutes)
- Understand the approach of escalating privileges locally on a Windows system and abuse Leaked Handles to gain SYSTEM privileges.
- Understand the OPSEC to enumerate local admin access on remote machines.
Domain Privilege Escalation (180 minutes)
- Abusing ACLs to extract credentials from LAPS.
- Understand about gMSA and learn to generate the gMSA password offline with appropriate privileges.
- Learn, understand and abuse delegation based configurations (Constrained delegation and RBCD).
- Understand and abuse dMSA accounts to gain Domain Administrator privileges.
Day 2 - Morning
Lateral Movement (150 minutes)
- Understand various ways to gain remote access on the target machine and OPSEC considerations.
- Abuse COM objects to bypass Microsoft Defender for Endpoint EDR, defeat WDAC and extract credentials.
- Learn multiple ways to extract credentials (DPAPI, Certificates, Browser Credentials) with Credential Guard enabled on hosts.
- Use custom tooling for Cross Session COM activation and WinRM to evade EDR and command exectuion on remote machines.
Domain Dominance and Persistence (90 minutes)
- Learn forging tickets and OPSEC considerations.
- Learn utilizing Domain DPAPI backup key and KDS root key.
- Perform Computer and User account takeover using Shadow Credentials.
Day 2 - Afternoon
Cross Domain Attacks (90 minutes)
- Understand how to leverage KRBTGT account hash or Trust key to move across the domain.
- Learn and understand about Active Directory Certificate Services (AD CS) environment and ways to abuse the AD CS misconfigurations to escalate privileges.
Cross Forest Attacks (150 minutes)
- Understand about sIDHistory and its abuse using Trust Keys and krbtgt to move across the forest trust.
- Learn about techniques to enumerate SQL Servers and leverage the Database Links to move laterally across the forest.
- Abuse Entra Hybrid Identity to move from on-prem to Azure Cloud.
Day 3 - Morning
Cross Forest Attacks(continued) - (240 minutes)
- Understand how RBCD attacks can be used to escalate privileges across the forest.
- Enumerate and abuse AD Sites to move across forest.
- Understand about Foreign Security Principals and ways to abuse the same to move across the forest.
- Learn and Execute SID Filtering bypass.
- Enumerate ACLs and abuse them to move across the forest.
- Understand PAM trust and execute attacks by compromising the admin/bastion forest.
- Learn and execute attacks against trust transitivity.
Day 3 - Afternoon
Defenses and Bypass (180 minutes)
- Learn about Microsoft’s EDR – Microsoft Defender for Endpoint and Microsoft Identity Protection (MDI).
- Understand the telemetry and components used by MDE for detection.
- Execute an entire chain of attacks across forest trust without triggering any alert by MDE.
- Understand how MDI relies on anomaly to spot an attack.
- Bypass various MDI detections throughout the course.
- Revisit evading Credential Guard, PPL and other security measures.
Defenses
- Understand about privileges groups, security flags/settings that can be configured on the privilege accounts / groups.
- Learn and understand the need to leverage Privilege Administrative Workstation.
- Learn and understand Time Bound Administrations (JIT & JEA).
- Learn Tier Model & Enterprise Access Model (EAM) environment.
- Learn Deception techniques that can be deployed to deceive an attacker.
Difficulty Level
Intermediate - The student has education and some experience in the field and familiarity with the topic being presented. The student has foundational knowledge that the course will leverage to provide practical skills on the topic.;Advanced - The student is expected to have significant practical experience with the tools and technologies that the training will focus on.
Suggested Prerequisites
- Familiarity with Windows command-line.
- Basic understanding of red teaming/penetration testing or blue teaming/security administration of AD environment.
- Ability to think like an adversary and inclination towards abusing features rather than exploits
What Students Should Bring
- System with 4 GB RAM and ability to install OpenVPN client and RDP to Windows boxes.
- Privileges to disable/change any antivirus or firewall.
What the Trainer Will Provide
- Attendees will get free two months access to a lab configured like an Enterprise network, during and after the training.
- An attempt to completely hands-on Certified Red Team Expert (CRTE) certification exam.
- In addition to that, lifetime access to learning aid like course slides, lab manual, walk-through videos and lab support till the lab access is active.
Trainer(s) Bio
Manthan is a security researcher with a strong passion for enterprise security, red teaming, evasion, and Active Directory security. He specializes in testing enterprise security defences with a deep understanding of offensive strategies, including EDR evasion and Active Directory attacks. He continuously researches emerging threats, attack techniques, and mitigation strategies to stay ahead of evolving adversaries.
He works as a Security Researcher at Altered Security - a company focusing on hands-on enterprise security learning - https://www.alteredsecurity.com/
Proficiency Exam
Hands-on and course-based questions that students have to answer by submitting flags during the course. Students need to complete all the flags to demonstrate proficiency.
Registration Terms and Conditions
Trainings are refundable before January 29, 2027, minus a non-refundable processing fee of $350.
Between January 30, 2027 and February 28, 2027 partial refunds will be granted, equal to 50% of the course fee minus a processing fee of $350.
All trainings are non-refundable after Feb 28, 2027.
Training tickets may be transferred to another student. Please email us at training@defcon.org for specifics.
If a training does not reach the minimum registration requirement, it may be cancelled. In the event the training you choose is cancelled, you will be provided the option of receiving a full refund or transferring to another training (subject to availability).
Failure to attend the training without prior written notification will be considered a no-show. No refund will be given.
DEF CON Training may share student contact information, including names and emails, with the course instructor(s) to facilitate sharing of pre-work and course instructions. Instructors are required to safeguard this information and provide appropriate protection so that it is kept private. Instructors may not use student information outside the delivery of this course without the permission of the student.
By purchasing this ticket you agree to abide by the DEF CON Training Code of Conduct and the registration terms and conditions listed above.
Several breaks will be included throughout the day. Please note that food is not included.
All courses come with a certificate, contingent on attendance at 75% of course sessions. Students who pass the end-of-course evaluation will be issued a certificate of proficiency. All other students with sufficient course attendance will be issued a certificate of completion. Students are responsible for making sure their attendance is recorded at the start of the day and after returning from lunch.
