Preface

Almost every day we hear about new breaches, data leaks, or ransomware attacks. Cybercrime nowadays is a big business that constantly strives for improvement. It is no longer a one-man show; cybercriminals have their own methodology, tooling, and qualified staff. The way to defend against them is to understand how they attack, their tactics, and their techniques.

We will apply this approach against various products of the most popular software vendor – Microsoft. This book is focused purely on Windows-based infrastructure because on-premises infrastructure is still a big thing for most companies. In this book, I will take you through an attack kill chain against Active Directory (AD), Active Directory Certificate Services, Microsoft Exchange Server, Microsoft SQL Server, and System Center Configuration Manager (SCCM). During the process, you will be introduced to known tactics and techniques with a lot of hands-on exercises.

By the end of the book, you will be able to perform a hands-on comprehensive security assessment of Windows-based infrastructure. In addition, you will receive recommendations on how to detect adversary activity and remediation suggestions.