Detection Engineering
Detecting DCSync Attacks
How to detect DCSync — the Event 4662 replication signal, the GUIDs to watch, a Sigma rule, and the least-privilege hardening that removes the abused rights.
#active-directory
4 articles
Detection Engineering
Detecting AD CS Abuse (ESC1–ESC8)
How to detect AD CS abuse — the ESC1 and ESC8 escalation paths, the CVE-2022-26923 case, certificate-request audit events, and the template hardening that stops it.
Detection Engineering
Detecting NTLM Relay Attacks
How to detect and defend against NTLM relay — coercion primitives, the CVE-2025-24054 case, ADCS ESC8 audit events, and the SMB/LDAP signing plus EPA that stop it.
Defensive Research
Anatomy of a Kerberoasting Attack — and How to Detect It
How Kerberoasting abuses service tickets to crack service-account passwords offline — and the Sigma detection and hardening that shut it down. Lab-only.