Главная
Study mode:
on
1
Introduction
2
About Me
3
Agenda
4
What is ATA
5
How it works
6
Lab Configuration
7
Threat Detection
8
User Hunting
9
SP and Scanning
10
Evading ATA with Power View
11
Brute Force
12
EType
13
AES Keys
14
Over Pasta Hash Detection
15
Fake Events
16
Golden Ticket Attack
17
Golden Ticket Downgrade
18
Lifetime Based Detection
19
Constrainted Delegation
20
Not Detected
21
No Use
22
No Detection
23
Kerberos
24
Sequel Servers
25
Interactions
26
Espeon Scanning
27
LDAP IPSec ESB
28
Attacking Microsoft ATA
29
MongoDB
30
Change Alert Identity
31
Set Alert Visibility
32
Defenses
33
Avoiding ATA
34
Limitations
35
ATA Team
36
Summary
37
Conclusion
Description:
Explore techniques for evading Microsoft Advanced Threat Analytics (ATA) in Active Directory environments in this Black Hat conference talk. Delve into ATA's functionality, threat detection capabilities, and lab configurations. Learn about user hunting, service principal scanning, and evasion methods using PowerView. Examine brute force attacks, golden ticket techniques, and constrained delegation vulnerabilities. Discover how to manipulate ATA's MongoDB, alter alert identities, and set visibility. Analyze ATA's limitations and discuss defensive strategies. Gain insights into avoiding detection and understanding the implications for Active Directory security.

Evading Microsoft ATA for Active Directory Domination

Black Hat
Add to list
#Conference Talks #Black Hat #Information Security (InfoSec) #Cybersecurity #Computer Science #Information Technology #Windows Systems Administration #Windows Server #Active Directory #Computer Networking #LDAP #Threat Detection #Brute-Force Attacks #Network Security #IPsec #Business #Business Software #Microsoft Office 365 #Microsoft Excel #Power View
0:00 / 0:00
1 of 37

Introduction