osvaldobeato/Active-Directory-Attack-Detection-Investigation

# SOC Active Directory：攻击检测与调查 ## 项目概述 本项目演示了 Active Directory 家庭实验室的设计与实施，该实验室用于模拟企业身份验证攻击并调查由此产生的 Windows 安全事件。 该环境由一台 Windows Server 2022 域控制器、一台已加入域的 Windows 10 工作站、Kali Linux 和 Splunk Enterprise 组成。通过收集和分析 Sysmon 与 Windows 事件日志，为身份验证活动、端点行为和攻击遥测数据提供了可视性。 攻击模拟包括 Active Directory 用户管理、远程管理、暴力破解身份验证尝试以及 Atomic Red Team 测试。使用 Splunk 调查 Windows 安全事件，验证检测，识别监控盲区，并演示检测工程技术。 本项目展示了构建企业 Windows 环境、生成真实攻击遥测数据、使用 SIEM 数据调查恶意活动，以及通过结构化的 SOC 调查工作流记录发现结果的能力。 ## 实验室架构 ## 展示技能 - Active Directory 管理 - Windows Server 2022 配置 - 域控制器部署 - Windows 域管理 - Splunk 日志分析 - Windows 事件日志分析 - Sysmon 端点监控 - 身份验证攻击检测 - 暴力破解攻击模拟 - Atomic Red Team 测试 - 事件调查 - 检测工程 - 威胁狩猎 - 安全事件关联 - MITRE ATT&CK 框架 ## 使用的工具 | 工具 | 用途 | |------|---------| | Windows Server 2022 | Active Directory 域控制器 | | Windows 10 | 用于攻击模拟的已加入域的端点 | | Kali Linux | 用于暴力破解身份验证测试的攻击平台 | | Splunk Enterprise | 集中式日志收集、搜索和调查 | | Sysmon | 端点遥测和进程监控 | | Splunk Universal Forwarder | 将 Windows 日志转发至 Splunk | | Hydra | 暴力破解身份验证测试 | | Atomic Red Team | 模拟对手技术以进行检测验证 | | VirtualBox | 承载 Active Directory 实验室环境 | ## 调查演练 本节记录了整个项目中 Active Directory 环境的完整部署、攻击模拟和调查过程。 ### 阶段 1 – 构建 Active Directory 环境 构建此 Active Directory 环境是为了模拟一个小型企业 Windows 域。Windows Server 2022 被提升为域控制器，Windows 10 加入到域中，同时配置了 Splunk 以从该环境中收集端点遥测数据。 以下截图记录了实验室基础设施的初始部署和验证。 VirtualBox environment containing all required virtual machines; Windows Server 2022, Windows 10, Ubuntu Server (Splunk), and Kali Linux   Splunk Universal Forwader installed on the Windows Server, with inputs.conf configured in the local directory to collect Windows Event Logs and Sysmon telemetry for fowarding to the Splunk server   Splunk Enterprise successfully receiving endpoint telemetry from both the Windows Server (Domain Controller) and Windows 10 workstation through the Splunk Universal Forwarder. The custom endpoint index confirms successful log ingestion, validating communication between the Windows endpoints and the Ubuntu Splunk server. The Windows 10 workstation was configured using the same Universal Forwarder and inputs.conf configuration as the Windows Server.   Active Directory Domain Services (AD DS) successfully installed on the Windows Server. The server is ready to be promoted to a Domain Controller, enabling centralized authentication, domain management, and Group Policy administration.   Active Directory Domain Services successfully configured with the osvaldo.local domain. Organizational Units (OUs) for the IT and HR departments were created, along with user accounts for each department, demonstrating centralized identity and user management within the domain.   Windows 10 workstation successfully joined to the OSVALDO.LOCAL Active Directory domain using Domain Administrator credentials, confirming secure communication and integration with the Domain Controller.   ### 阶段 2 - 域管理 Successfully authenticated to the Windows 10 workstation using the domain user account Jenny Smith, confirming that Active Directory user authentication and domain login are functioning correctly across the enterprise environment.   Prepared the Kali attack workspace by creating a dedicated ad-project directory to organize attack resources. Downloaded the Crowbar brute-force tool, transferred and trimmed the rockyou.txt wordlist to a focused set of 20 entries, and created a custom passwords.txt file containing the credentials for the two Active Directory user accounts created during the lab. This setup establishes the environment for the upcoming password attack simulation.   Enabled Remote Desktop RDP access and configured the two domain users IT and HR as authorized Remote Desktop Users, allowing both accounts to remotely log in to the Windows workstation for administration and testing within the Active Directory lab.   ### 阶段 3 - 攻击模拟 Used Hydra to perform an RDP password attack against the domain-joined Windows endpoint. The attack successfully identified valid credentials and generated Windows Security Event Logs for investigation in Splunk.   Hydra brute-force attack successfully captured in Splunk. The search results show 20 failed logon attempts (Event ID 4625) followed by 1 successful logon (Event ID 4624), confirming that the attack telemetry was successfully ingested and indexed for analysis.   Splunk event details confirm the successful logon originated from the Kali attack VM. The event identifies the tsmith account and the Kali workstation as the source of the authentication attempt, validating the origin of the simulated Hydra brute-force attack.   ### 阶段 4 - 检测与调查 Executed Atomic Red Team test T1136.001 (Create Local Account) to simulate a MITRE ATT&CK Persistence technique. The test created a local user account on the Windows 10 target, generating security telemetry that was analyzed in Splunk to validate detection coverage and identify potential monitoring gaps.   Splunk successfully detected the Atomic Red Team T1136.001 (Create Local Account) simulation by capturing the creation of the NewLocalUser account. This validates that the current detection pipeline is ingesting and identifying persistence-related activity. Simulated attacks like this can be used to evaluate detection coverage, identify monitoring blind spots, and improve detection engineering by creating or refining rules for techniques that are not currently detected. ## 攻陷指标（IOC） 在攻击模拟和调查过程中识别出以下指标： - 暴力破解测试期间产生的多次 Windows 身份验证失败尝试。 - 发现有效凭据后成功的身份验证。 - 与身份验证活动相关的 Windows 安全事件 ID。 - 与攻击执行相关的 Sysmon 进程创建事件。 - 发起攻击的 Kali Linux 系统的源 IP 地址。 - 在暴力破解攻击中被针对的用户账号。 ## MITRE ATT&CK 映射 | 战术 | 技术 | ATT&CK ID | |-----------|-----------|-----------| | 凭据获取 | 暴力破解 | T1110 | | 防御规避/持久化 | 有效账号 | T1078 | | 横向移动 | 远程服务 (RDP) | T1021.001 | | 发现 | 账号发现 | T1087 | ## 实验室挑战与故障排除 ### 挑战 1 Troubleshooting: The original lab walkthrough used Crowbar for the RDP attack. During testing, Crowbar's RDP module was incompatible with my Kali environment and did not successfully authenticate despite valid credentials. After validating RDP connectivity and credentials, I adapted the lab by using Hydra with a single-threaded configuration (-t 1 -W 3), which successfully completed the attack and generated the required Windows security events.   ### 挑战 2 During the lab, authentication events were not appearing in Splunk. Investigation revealed that the Windows 10 endpoint and Splunk server had different system times. After synchronizing the VM clocks and restarting Splunk and the Universal Forwarder, the authentication events were indexed correctly. ## 关键发现 - 成功部署了用于安全测试的企业级 Active Directory 环境。 - 验证了 Windows 安全事件和 Sysmon 遥测数据被成功转发至 Splunk。 - 成功针对域环境模拟了暴力破解身份验证活动。 - 使用 Splunk 搜索和事件关联调查了身份验证事件。 - 验证了检测可见性，同时找出了提升监控覆盖范围的机会。 ## 经验教训 - Active Directory 为 SOC 调查和检测工程提供了逼真的企业环境。 - 准确的日志收集对于识别身份验证攻击和还原攻击者活动至关重要。 - 攻击模拟对于验证检测和识别监控盲区非常有价值。 - 基础设施和安全工具的故障排除是防御性安全运营的常规环节，有助于增强调查技能。

标签：Active Directory, Plaso, Sysmon, 安全运营, 扫描框架, 攻击模拟, 管理员页面发现, 红队行动, 驱动签名利用