From b7a2923c6c414f5f9f47eede7e43a642cfafe782 Mon Sep 17 00:00:00 2001 From: Rahmat Nurfauzi Date: Sun, 3 Mar 2024 16:08:43 +0700 Subject: [PATCH] Added resources AD CS Domain Escalation & tools Locksmith, FalconHound --- README.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index f8bd82b..e7864c5 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # Active Directory Kill Chain Attack & Defense - + ## Summary This document was designed to be a useful, informational asset for those looking to understand the specific tactics, techniques, and procedures (TTPs) attackers are leveraging to compromise active directory and guidance to mitigation, detection, and prevention. And understand Active Directory Kill Chain Attack and Modern Post Exploitation Adversary Tradecraft Activity. @@ -68,7 +68,8 @@ This document was designed to be a useful, informational asset for those looking ### Abusing Active Directory Certificate Services * [Certified Pre-Owned](https://posts.specterops.io/certified-pre-owned-d95910965cd2) - +* [AD CS Domain Escalation](https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation) + ### PetitPotam * [PetitPotam](https://github.com/topotam/PetitPotam) * [From Stranger to DA // Using PetitPotam to NTLM relay to Domain Administrator](https://blog.truesec.com/2021/08/05/from-stranger-to-da-using-petitpotam-to-ntlm-relay-to-active-directory/) @@ -459,6 +460,8 @@ Advanced Threat Protection and Advanced Threat Analytics](https://www.blackhat.c * [DFIR-O365RC](https://github.com/ANSSI-FR/DFIR-O365RC) - The DFIR-O365RC PowerShell module is a set of functions that allow the DFIR analyst to collect logs relevant for Office 365 Business Email Compromise investigations. * [AzureADIncidentResponse](https://www.powershellgallery.com/packages/AzureADIncidentResponse/4.0) - Tooling to assist in Azure AD incident response * [ADTimeline](https://github.com/ANSSI-FR/ADTimeline) - The ADTimeline script generates a timeline based on Active Directory replication metadata for objects considered of interest. +* [Locksmith](https://github.com/TrimarcJake/Locksmith) - A small tool built to find and fix common misconfigurations in Active Directory Certificate Services. +* [FalconHound](https://github.com/FalconForceTeam/FalconHound) - FalconHound is a blue team multi-tool. It allows you to utilize and enhance the power of BloodHound in a more automated fashion. It is designed to be used in conjunction with a SIEM or other log aggregation tool. ### Sysmon Configuration * [sysmon-modular](https://github.com/olafhartong/sysmon-modular) - A Sysmon configuration repository for everybody to customise