Files

medusa caa37e13cb Update tech_docs/lab/ad_lab.md

2025-06-30 06:15:57 +00:00

9.2 KiB

Raw Blame History

Great — aligning your AD lab to real-world security frameworks like MITRE ATT&CK, NIST 800-53, and CIS Controls transforms it from a sandbox into a credible training and validation environment.

Let’s develop a solid, extensible lab guide structured around defensive hardening, offensive simulation, and detection/response, explicitly mapped to real-world frameworks.

🧭 Active Directory Cybersecurity Lab: Framework-Aligned Guide

⚙️ 1. Lab Design Philosophy

Purpose: To build a modular AD lab that supports:

Simulating attacker TTPs from the MITRE ATT&CK Matrix
Testing controls mapped to NIST 800-53 and CIS Controls
Practicing defensive detection and incident response

Target Users:

Red and Blue Teamers
Security Engineers
SOC Analysts
Students preparing for certs (e.g., OSCP, GCED, AZ-500)

🗺️ 2. Framework Alignment Overview

Framework	Role in Lab	How It Maps
MITRE ATT&CK	Simulate real-world adversary behavior	TTPs via BloodHound, Mimikatz, Rubeus, Impacket
NIST 800-53	Compliance/hardening baseline	AC-2, AC-6, AU-6, CM-6, IA-5 mapped to GPOs
CIS Controls	Defensive controls and audit checks	Controls 4, 5, 6, 7, 8, 16 via logging, alerts

🖥️ 3. Lab Topology (Mermaid Diagram)

graph TD;
    A[Win Server 2019 - DC01] -->|AD DS| B[Domain: cyberlab.local];
    B --> C[Win 10 Client - WKS01];
    B --> D[Sysmon/Log Forwarding];
    B --> E[SIEM - Ubuntu ELK or Splunk];
    F[Kali Linux - Attacker] --> C;
    F --> B;
    B --> G[OU: Workstations];
    B --> H[OU: Service Accounts];
    B --> I[OU: Admins];

🛠️ 4. Lab Machines

Hostname	OS	Role	Tooling
`DC01`	Windows Server	Domain Controller	AD DS, GPO, AD CS, DNS, Sysmon
`WKS01`	Windows 10	Domain-joined host	User simulation, endpoint logs
`KALI01`	Kali Linux	Red Team	BloodHound, Mimikatz, CrackMapExec
`LOG01`	Ubuntu	SIEM	ELK or Splunk, Winlogbeat, Filebeat

🧪 5. Core Use Cases by Framework

✅ MITRE ATT&CK Mapping (Enterprise, Windows)

Tactic	Technique	Tool	System
Discovery	T1069.002 - AD Group Discovery	BloodHound	Kali
Credential Access	T1003.001 - LSASS Dumping	Mimikatz	Kali
Lateral Movement	T1021.002 - SMB/WinRM	Impacket	Kali
Priv. Escalation	T1055 - Process Injection	Rubeus	Kali
Persistence	T1053 - Scheduled Task	cmd/Taskschd	WKS01

✅ NIST 800-53 Example Mappings

Control ID	Control Name	Lab Mapping
AC-2	Account Management	Create users/groups with lifecycles
AU-6	Audit Review and Analysis	SIEM logs Sysmon + Event Logs
IA-5	Authenticator Management	Enforce GPO password policies
CM-6	Configuration Settings	Harden via GPOs (disable SMBv1, etc.)
AC-6	Least Privilege	RBAC via Security Groups

✅ CIS Controls (v8)

CIS Control	Description	Implementation Example
4	Secure Configuration	CIS Benchmarks applied to Windows Server
5	Account Management	Lifecycle: user creation, disablement tests
7	Email and Web Protection	Simulate phishing or malicious doc delivery
8	Malware Defenses	Windows Defender + malicious binaries
16	Application Monitoring	SIEM alerting + process creation via Sysmon

🧰 6. Scenario Playbook Examples

🔴 Attack Scenario 1: Kerberoasting

Target: Service account with SPN
Tools: Rubeus, Impacket, Hashcat
Logs to expect: 4769 events in SIEM

🔵 Detection Scenario: Unusual Admin Logon

Trigger: Admin logs in outside normal hours from a user PC
Tooling: LogonTracer, SIEM alert rule

⚙️ Configuration Scenario: GPO Hardening

Apply baselines via LGPO.exe or Security Compliance Toolkit
Disable LM hashes, SMBv1, enable Defender ASR rules

📦 7. Optional Enhancements

Feature	Purpose
ADCS (Certificate Services)	Golden ticket, relay attacks
GPO Backdoor Simulation	Persistence and detection scenarios
Azure AD Connect	Hybrid attack simulation
DCSync/Golden Ticket Labs	Advanced credential theft tactics

📁 8. Suggested Repo Structure (GitHub-Ready)

ad-cyberlab/
├── docs/
│   ├── framework_mappings.md
│   ├── attack_scenarios.md
│   └── setup_guide.md
├── diagrams/
│   └── topology.mmd
├── configs/
│   ├── gpos/
│   └── sysmon-config.xml
├── scripts/
│   └── user-gen.ps1
├── detections/
│   └── elastic-rules.yml
└── README.md

✅ Next Steps

Would you like me to generate:

The initial GitHub-ready lab repo structure and README?
A few MITRE-mapped attack walkthroughs (step-by-step)?
The GPO hardening starter pack mapped to CIS/NIST?

Let me know what you want help building out first — I can generate clean code, scripts, detection rules, and markdown docs to get you production-ready.

Active Directory Setup Framework for Cybersecurity Testing

Overview

This guide provides a detailed starting point for setting up a simulated Active Directory environment tailored for cybersecurity exploration and testing. It covers essential steps from initial planning and installation to security configurations and testing groundwork.

1. Planning and Design

Before diving into the installation, it's crucial to lay out the design and planning of your AD environment. This includes determining the domain structure, planning the network infrastructure, and deciding on security group and OU designs.

Domain Structure

Domain Name: cyberlab.local
Forest Design: Single forest, single domain

Network Infrastructure

Consider a simple network layout with a primary domain controller (PDC) and additional domain controllers (ADCs) as needed.

Security Groups and OUs

Create OUs for different departments or teams, e.g., IT, HR, Sales.
Plan security groups for role-based access control (RBAC), e.g., IT Admins, HR Managers.

2. Installation and Core Setup

Install Windows Server

Version: Windows Server 2019 Standard
Machine: VM or physical server for the PDC

Promote to Domain Controller

Install the Active Directory Domain Services role.
Run the AD DS Configuration Wizard to promote the server to a domain controller.

3. Security Configuration

Baseline Security Policies

Implement GPOs for security policies affecting users and machines.

Test Accounts

Populate the AD with test user accounts and groups reflecting various roles.

4. Advanced Features and Testing Preparation

Advanced AD Services

Optionally, explore setting up ADFS, AD CS, and AD RMS for advanced testing scenarios.

5. Maintenance and Continuous Improvement

Regular Updates

Apply updates and patches regularly to keep the environment secure.

Sample Mermaid Diagram

To visualize the setup, here's a Mermaid diagram illustrating a basic AD setup:

graph TD;
    A[Windows Server 2019] -->|Installs AD DS| B(PDC: Primary Domain Controller);
    B --> C{Domain: cyberlab.local};
    C --> D[OU: IT];
    C --> E[OU: HR];
    C --> F[OU: Sales];
    D --> G[Security Group: IT Admins];
    E --> H[Security Group: HR Managers];
    B --> I[ADCS Advanced Services];
    I --> J[ADFS];
    I --> K[AD CS];
    I --> L[AD RMS];

This diagram illustrates the foundational elements of the AD setup, including the primary domain controller (PDC) setup with Windows Server 2019, the creation of organizational units (OUs) for IT, HR, and Sales departments, and the setup of security groups within those OUs. It also highlights the incorporation of advanced AD services like ADFS, Certificate Services, and Rights Management Services for comprehensive security testing.

This framework and visual guide offer a solid starting point for setting up an AD environment optimized for cybersecurity testing and training. It's a flexible template; you can expand or adjust it based on specific testing requirements or to explore various cybersecurity scenarios.

9.2 KiB Raw Blame History Unescape Escape