Group 06: Windows and Active Directory

What is Active Directory?

Microsoft’s directory service for centrally managing users, computers, groups, authentication, and security policies.

What is a domain?

A centrally managed collection of users, computers, groups, and policies.

What is a domain controller?

A server that stores Active Directory information and authenticates users and computers.

What is the difference between a local and domain account?

A local account exists on one computer, while a domain account is centrally managed and can access authorized domain resources.

What is Group Policy?

A feature used to centrally configure operating-system and security settings across domain systems.

What is Kerberos?

A ticket-based authentication protocol commonly used in Active Directory environments.

What is NTLM?

An older Windows challenge-response authentication protocol that may be used when Kerberos is unavailable.

What is LDAP?

A protocol used to query and manage directory-service information.

What is LSASS?

A Windows process responsible for security policies, authentication, and credential-related information.

Why do attackers target LSASS?

It may contain password hashes, Kerberos tickets, tokens, or other credentials useful for privilege escalation and lateral movement.

What is PowerShell?

A Windows command-line shell and scripting language used for administration and frequently abused by attackers.

What is a scheduled task?

A Windows feature that executes commands or programs at defined times or conditions and can be abused for persistence.

What is a Windows service?

A background process that can start automatically and may be abused for execution or persistence.

What is privilege escalation?

Gaining permissions beyond those originally assigned.

What is lateral movement?

Moving from one compromised system or account to another inside an environment.

What is pass-the-hash?

Using a stolen password hash to authenticate without knowing the plaintext password.

What is pass-the-ticket?

Reusing a stolen Kerberos ticket to access resources.

What does Event ID 4624 indicate?

A successful Windows logon.

What does Event ID 4625 indicate?

A failed Windows logon.

What does Event ID 4648 indicate?

A logon attempt using explicitly supplied credentials.

What does Event ID 4672 indicate?

Special administrative privileges were assigned to a logon session.

What does Event ID 4688 indicate?

A new process was created when process-creation auditing is enabled.

What does Event ID 4698 indicate?

A scheduled task was created.

What does Event ID 4720 indicate?

A user account was created.

What does Event ID 4722 indicate?

A user account was enabled.

What does Event ID 4728 indicate?

A member was added to a global security group.

What does Event ID 4732 indicate?

A member was added to a local security group.

What does Event ID 4740 indicate?

A user account was locked out.

What does Event ID 4768 indicate?

A Kerberos ticket-granting ticket was requested.

What does Event ID 4769 indicate?

A Kerberos service ticket was requested.

What does Event ID 7045 indicate?

A new Windows service was installed.

What does Microsoft Defender Event ID 1116 indicate?

Microsoft Defender detected malware or potentially unwanted software.

What does Microsoft Defender Event ID 1117 indicate?

Microsoft Defender took action against detected malware or potentially unwanted software.

Why should event IDs never be interpreted alone?

Analysts must review the user, process, system, timestamp, source, surrounding events, and business contex