Search icon CANCEL
Subscription
0
Cart icon
Your Cart (0 item)
Close icon
You have no products in your basket yet
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Conferences
Free Learning
Arrow right icon
Arrow up icon
GO TO TOP
Pentesting Active Directory and Windows-based Infrastructure

You're reading from   Pentesting Active Directory and Windows-based Infrastructure A comprehensive practical guide to penetration testing Microsoft infrastructure

Arrow left icon
Product type Paperback
Published in Nov 2023
Publisher Packt
ISBN-13 9781804611364
Length 360 pages
Edition 1st Edition
Languages
Concepts
Arrow right icon
Author (1):
Arrow left icon
Denis Isakov Denis Isakov
Author Profile Icon Denis Isakov
Denis Isakov
Arrow right icon
View More author details
Toc

Table of Contents (13) Chapters Close

Preface 1. Chapter 1: Getting the Lab Ready and Attacking Exchange Server 2. Chapter 2: Defense Evasion FREE CHAPTER 3. Chapter 3: Domain Reconnaissance and Discovery 4. Chapter 4: Credential Access in Domain 5. Chapter 5: Lateral Movement in Domain and Across Forests 6. Chapter 6: Domain Privilege Escalation 7. Chapter 7: Persistence on Domain Level 8. Chapter 8: Abusing Active Directory Certificate Services 9. Chapter 9: Compromising Microsoft SQL Server 10. Chapter 10: Taking Over WSUS and SCCM 11. Index 12. Other Books You May Enjoy

Enumeration detection evasion

Enumeration can be a noisy process if tools are used without precautions. Also, defenders hunt for reconnaissance activities by using security products and deception methods. These methods are like a hidden bell in a dark room – you need to know where it is located to avoid detection. We will cover Microsoft ATA and its successor – Defender for Identity (MDI) together with honey tokens.

Microsoft ATA

Microsoft Advanced Threat Analytics (ATA) is an on-premises platform that helps to protect enterprises from threats. Extended support ends in 2026, so it makes sense to quickly cover it.

In this section, we will discuss only detections for recon methods; other attacks and bypasses will be covered in respective chapters. In general, ATA parses the network traffic of multiple protocols to detect malicious activity. It’s important to mention that it will take time for the tool to learn the normal behavior of the users and machines...

lock icon The rest of the chapter is locked
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at $19.99/month. Cancel anytime
Banner background image