Архіви категорій: ActiveDirectory

Monitoring Active Directory for Signs of Compromise

Оригінал статті

The following table lists events that you should monitor in your environment, according to the recommendations provided in Monitoring Active Directory for Signs of Compromise. In the following table, the “Current Windows Event ID” column lists the event ID as it is implemented in versions of Windows and Windows Server that are currently in mainstream support.

The “Legacy Windows Event ID” column lists the corresponding event ID in legacy versions of Windows such as client computers running Windows XP or earlier and servers running Windows Server 2003 or earlier. The “Potential Criticality” column identifies whether the event should be considered of low, medium, or high criticality in detecting attacks, and the “Event Summary” column provides a brief description of the event.

Читати далі →

Ссылки. Security

Пусть тут поживут. Постоянно приходится искать 🙂

– Определение LM\NTLM

https://secpfe.com/wordpress/en/2017/03/01/controlling-and-restricting-ntlm-usage-part-i/

https://secpfe.com/wordpress/en/2017/03/02/controlling-and-restricting-ntlm-usage-part-ii-audit-and-detection/

https://github.com/secpfe/NTLMHound/

 

– ATA и ATA Playbook

https://docs.microsoft.com/en-us/advanced-threat-analytics/what-is-ata

https://gallery.technet.microsoft.com/ATA-Playbook-ef0a8e38

 

– Identifying Clear Text LDAP binds to your DC’s

https://blogs.technet.microsoft.com/russellt/2016/01/13/identifying-clear-text-ldap-binds-to-your-dcs/

 

– LAPS Audit Reporting via WEF PoSH and PowerBI

https://blogs.technet.microsoft.com/kfalde/2015/11/18/laps-audit-reporting-via-wef-posh-and-powerbi/

 

-LAPS and permission to join computer to domain

https://blogs.msdn.microsoft.com/laps/2015/07/17/laps-and-permission-to-join-computer-to-domain/

 

– Pass-the-Hash

https://technet.microsoft.com/en-us/security/dn785092

(Mitigating Pass-the-Hash and Other Credential Theft v1, Mitigating Pass-the-Hash and Other Credential Theft v2, How Pass-the-Hash works PDF)

 

– Administrative Tools and Logon Types

https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material#ATLT_BM

 

– Privileged Access Workstations (PAW)

https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/privileged-access-workstations

 

– Privileged Access Workstation (PAW) Content

https://gallery.technet.microsoft.com/Privileged-Access-3d072563

 

Update 31.07.2017

Microsoft Advanced Threat Analytics Proof of Concept Playbook

https://gallery.technet.microsoft.com/Advanced-Threat-Analytics-591ca681

 

Update 21.08.2017

Troubleshooting ATA known issues

https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide

Update 26.08.2017

Understanding ATA Suspicious Activity Alerts

 https://blogs.technet.microsoft.com/enterprisemobility/2016/11/04/understanding-ata-suspicious-activity-alerts/

 

 

Табличка по групповым политиками и событиям в журнале

Тадам!

Еще не Новый Год, но Дед Мороз уже во всю дарит подарки. Я был хорошим мальчиком, потому один из своих подарков я полчил сегодня. И подарок этот – чудесная табличка, которая подскажет нам какую именно политику нужно подкрутить чтобы получить нужный на Event ID для сбора и последующего анализа информации. Т.к. одним из моих направление развития есть сесурити, в табличке собраны именно события по этой самой сесурити.

eye

Читати далі →