03 · Event Logs
Active Directory Forensics: Domain Controller Event Logs
Investigate domain controllers: Kerberos and NTLM events, account and group changes, DCSync 4662, directory changes, GPO abuse, NTDS.dit theft, forged tickets.
Articles tagged: #active-directory
08 · Lateral Movement
Credential Access Forensics: LSASS, DCSync and Kerberoasting
Investigate Windows credential theft: LSASS dumps, SAM and NTDS.dit extraction, DCSync, DPAPI, Kerberoasting and AS-REP roasting, with event IDs and ATT&CK.