Detecting AD Initial Access

In an AD environment, every internet-facing service that authenticates against the domain is a potential entry point. This room teaches how to detect initial access attacks against three of the most common ones: IIS web applications, Exchange OWA, and VPN gateways. 

Each scenario uses a different application log source, but they share a common principle:

• The attack is visible in the application logs first
• Then, correlating with other log sources (e.g., Sysmon and Windows Security logs) to reveal the full scope

Learning Objectives

• Analyze IIS logs to detect web application attacks and web shell activity
• Correlate Exchange/OWA authentication events with Windows Security logs
• Investigate VPN credential attacks using NPS event logs
• Investigate post-authentication activity to determine the impact of a breach
• Build investigation timelines by correlating application logs with Windows Security logs

Prerequisites

• Active Directory: How users, groups, and authentication work (Active Directory Basics room)
• Windows Event Logs: Reading and filtering Security events (Windows Event Logs room)
• Splunk: Writing SPL queries to search and filter log data (Splunk: Exploring SPL room)
• AD Monitoring: Understanding the main Event IDs needed to know what's normal in AD to detect abnormal (Monitoring Active Directory room)

Machine Access

Start the machine by clicking the Start Machine button below. Give the Splunk instance about 4-5 minutes to launch, then access it using the link below. Feel free to continue reading the next tasks while it boots:

• https://LAB_WEB_URL.p.thmlabs.com (opens in new tab)

Info: This Splunk instance is used throughout Tasks 2-7. A separate instance with different data is provided for the Task 8 challenge.

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting the Target Machine, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.

Target machine - Task 1

Status:Off

Start Machine