A Mimikatz copy in the compromised Windows 10 endpoint.A domain administrator account on the Active Directory is required to serve as the target of the pass the hash attack.This account is the compromised user account used to simulate our attacks. A domain account on the Active Directory with local administrative privilege on the compromised Windows 10 endpoint.The Windows 10 endpoint is registered to the Active Directory and serves as the attacker’s initial foothold after compromise. A Windows 10 Pro or Enterprise edition endpoint running Wazuh agent 4.3.10.In this blogpost, we use the domain names Windows10 and

You can use this Wazuh guide to install the Wazuh agent. This domain controller hosts the Active Directory infrastructure.

A Windows Server 2022 domain controller running the Wazuh agent 4.3.10.

You can install the Wazuh central components using this Quickstart installation guide.

A Centos 7 endpoint with Wazuh 4.3.10 installed.

We use the following setup to simulate AD attacks and show how Wazuh can detect them: In this blog post, we demonstrate how to simulate and detect the following AD attacks:Īctive Directory attacks: Infrastructure setup Implementing several layers of defense mechanisms ensures that when the initial line of defense fails and hackers get access to Active Directory, the consequences are limited and contained. To defend against threats, organizations need to implement the principle of defense in depth.

AD is a perfect target for attackers because many system administrators use it to manage enterprise networks. It is adopted by small, medium, and large enterprises to manage enterprise networks, so it is an ideal target for attackers. Active Directory (AD) is the most widely used Identity and Access Management (IAM) technology for Windows domain networks in modern organizations.

Sysinternals active directory