~/tag/threat-detection
3 articles tagged threat detection
A hands-on Impacket tutorial for beginners: build a lab, then walk Kerberoasting, AS-REP roasting, secretsdump/DCSync, and remote execution end to end — with the red team, blue team, and attacker view of each, plus the exact Windows event IDs that detect them and the controls that stop them.
Build a lab Active Directory domain, collect it with SharpHound, and use BloodHound CE to find the permission chains that lead to Domain Admin — plus how red teams, blue teams, and real attackers each use it, and how to detect and dismantle the paths.
A beginner-friendly, step-by-step guide to DNS tunneling: how it works, how to build a safe isolated lab with iodine, what it looks like on the wire, and — most importantly — how to detect and defend against it.