← incident responder
Take Quiz →
Active Directory Compromise IR — Golden Tickets, DCSync, and Full Remediation
advanced 5h
Respond to AD compromise — detect Golden/Silver Ticket attacks, DCSync, and pass-the-hash; scope the credential blast radius; execute a defensible full AD remediation including the krbtgt reset sequence.
Lessons
1 Kerberos Attack Detection — Golden Tickets, Silver Tickets, and Kerberoasting
25 min 2 DCSync, NTDS.dit Theft, and Pass-the-Hash Lateral Movement
25 min 3 Full AD Remediation — krbtgt Reset Sequence, Credential Rotation, and Eviction
30 min Module Quiz
Test your knowledge before moving on.