Detection & Response

Master the tools and techniques for detecting AD attacks in real time -- from Wireshark packet analysis and SIEM detection rules to PowerShell security scripts.

3 Topics0/3 complete

Wireshark Packet Analysis for AD

Every Active Directory attack leaves traces on the wire. Learning to read Kerberos, LDAP, NTLM, and replication traffic in Wireshark lets you see attacks in real time -- before the event logs even catch up.

Advanced

SIEM Detection Engineering for AD

Detection engineering transforms raw Windows event logs into actionable alerts. By writing Sigma rules, Splunk SPL queries, and Microsoft Sentinel KQL, you can detect Kerberoasting, DCSync, Golden Tickets, and more -- before attackers achieve their objectives.

Advanced

PowerShell Security Toolkit for AD

PowerShell is both the defender's best friend and the attacker's favorite tool. Master the essential scripts for assessing AD security posture, hardening configurations, and detecting compromise -- from finding Kerberoastable accounts to rotating the KRBTGT password.

Intermediate