Weaponizing Active Directory

[@phxnt0m348]

Not even watched the video yet, but it came up as a recommendation. Already know I will love it. Black Hills content is pure gold for the Infosec community.

[@BrixofGreen]

Great info as always guys keep up the good work! Can’t wait for the next video.

[@TsukiCTF]

Awesome

[@infomagnumitsolutions8555]

Love BHIS man, crazy insights. Better than SAN - Just saying, just saying. 1. Quick question : Do you do these domain discovery as a domain user or just through a network internal IP ? 2. Honey Tokens, Bread Crumbs, honeypot, honey router, honey applications/web pages and more and more... are available,: Did you come up with any opensource to devops this or any opensource that orchestrate these illusive networks. I know a few commercial versions of these. But, opensource will let me play around in our IT cheap companies. Appreciate your view always!

[@davidfletcher7300]

1. In a modern Windows environment all of the discovery is performed as an authenticated standard domain user. You don't necessarily need to use Windows for it, but having credentials (or malware running) is a prerequisite. 2. I'm currently working on a provisioning script for the techniques identified in the presentation. Just need time to gather all of the right resources (it will create more than just user accounts, it will create the GPP files, the login scripts, the UIF, and others, and provision group membership based on XML config). I've heard of other frameworks but they don't appear to focus specifically on AD.

[@michaelrogers2011]

Where are the slides?

[@BlackHillsInformationSecurity]

www.activecountermeasures.com/presentations/ - in the BHIS_Webcast folder