Hybrid Defense-in-Depth Architecture Map v2.0

SOC & Hardening Reference — Azure / Entra ID / On-Prem AD / Endpoint / Network
Countermeasures mapped to AD Attack, Red Team & Payload Evasion Architecture Maps
ENTRA ID ON-PREM AD CREDENTIAL PROT EDR / ENDPOINT DETECTION ENG NETWORK SEG AZURE / CLOUD LOGGING Conditional Access MFA • Device Compliance PIM / PAM Just-In-Time • Approval Token Protection CAE • Token Binding Risky Sign-in Policy Identity Protection App Registrations Consent • Permissions Cross-Tenant B2B • Lighthouse • CSP Tiered Admin Model Tier 0/1/2 Isolation LAPS / gMSA Local Admin Passwords Kerberos Hardening AES-only • Armoring LDAP Hardening Signing • Channel Binding Protected Users Group • AdminSDHolder ACL / Delegation Audit • Least Privilege ADCS Hardening ESC1-16 • Templates Credential Guard VBS Credential Isolation LSA Protection (PPL) RunAsPPL • UEFI Lock Remote Cred Guard RDP • No Cred on Target Windows Hello / FIDO2 Passwordless • Phish-Resistant NTLM Restriction Block NTLMv1 • Audit v2 ASR Rules Attack Surface Reduction Tamper Protection Prevent EDR Disable WDAC / AppLocker Application Control Network Protection Web Filtering • SmartScreen Controlled Folders Ransomware Protection Custom Detections KQL • IOC • YARA Sigma Rules Cross-platform Detections KQL Analytics Sentinel • MDE Hunting Honey Tokens Canary Accounts • SPNs YARA Rules Memory • File Scanning Attack Disruption Auto-Contain • Isolate PAW / SAW Privileged Workstations Jump Servers Bastion Hosts • RDP GW SMB Signing Relay Prevention Firewall Tiering Tier 0/1/2 ACLs RDP Restricted Admin No Cred Caching Sentinel SIEM Workspace • Connectors Diagnostic Settings Audit • Sign-in Logs Key Vault Secrets • Access Policies Storage Hardening Private Endpoints • SAS Defender for Cloud CSPM • CWP Windows Events Critical Event IDs Sysmon SwiftOnSecurity Config PowerShell Logging ScriptBlock • Module Cmd-Line Audit Process Creation 4688 ADCS Audit Cert Enrollment Logs detection informs hardening DEFENSE-IN-DEPTH: LAYERED PROTECTION — EACH LAYER COMPENSATES FOR GAPS IN OTHERS

01 // Entra ID / Azure AD Hardening

Identity is the new perimeter. Conditional Access, PIM, token protection, and app governance form the first line of defense in hybrid environments. Countermeasures mapped to offensive tools from the AD Attack, Red Team, and Payload Evasion Architecture Maps.
IDENTITYPOLICY

Conditional Access Policies

MFA // DEVICE COMPLIANCE // LOCATION // RISK // SESSION
  • Require phishing-resistant MFA (FIDO2/WHfB) for admins — counters CredMaster + FireProx IP-rotated password spraying, m365-fatigue MFA bombing, EvilGinx 3 AiTM phishing
  • Block legacy auth — IMAP, POP3, SMTP Auth, ActiveSync bypass MFA entirely. Conditions → Client Apps → Block. Counters o365spray, TrevorSpray, SprayingToolkit
  • Require compliant device — Intune or Hybrid Azure AD joined. Counters ROADtools roadtune fake device compliance bypass, PoCEntraDeviceComplianceBypass
  • Named Locations + block countries — define trusted corporate egress IPs; block nations with no business presence. Counters anonymous IP spraying
  • Sign-in risk policy — medium = require MFA, high = block. Counters impossible travel detection from CredMaster
  • User risk policy — force password change on breach detection; re-register MFA methods
  • Session controls — 12h sign-in frequency for admins, disable persistent browser sessions. Limits token reuse window
  • Token protection (preview) — binds tokens to device, preventing replay. Counters GraphSpy token theft, PRT replay attacks
  • Block device code flow for non-admin users — via CA policy. Counters device code phishing from TokenPhisher, SquarePhish
  • Authentication Strengths — require phishing-resistant MFA; ban SMS/voice for admins. Counters SIM-swap and SS7 interception attacks
IDENTITYHARDEN

Privileged Identity Management (PIM / PAM)

JUST-IN-TIME // APPROVAL // TIME-BOUND // ZERO STANDING ACCESS
  • Eliminate standing admin — all Entra ID admin roles eligible, not permanently assigned. Counters persistent access from compromised accounts
  • Max activation 1-4h for GA — require approval from 2+ admins. No permanent activations. Define multiple approvers to avoid single point of failure
  • Require MFA on activation — re-authenticate at role activation even if MFA was passed at sign-in
  • PIM for Groups — use PIM-managed groups for Tier 0 AD groups. Activation = temporary group membership. Counters bloodyAD AddMember, SharpGPOAbuse
  • Access reviews quarterly — auto-remove users who haven't activated in 90 days
  • Alert on permanent assignments outside PIM — fire high-priority alert when someone is permanently assigned a privileged role
  • Monitor for GraphSpy passkey enrollment — attackers enroll passkeys as phishing-resistant MFA persistence mechanism. Alert on new FIDO2/passkey registration for admin accounts
IDENTITYCREDENTIAL

CAE & Token Protection

REAL-TIME REVOCATION // STRICT LOCATION // CRITICAL EVENTS
  • Enable CAE — near real-time token revocation on critical events: account disable/delete, password change, MFA change, risk elevation
  • Strict Location Enforcement — re-evaluates token on IP change. Counters SeamlessPass, PRT theft, stolen access token replay
  • Counters token theft — stolen tokens become useless after next critical event or IP change; drastically reduces token-based persistence window
  • Pair with session controls — defense against GraphRunner, GraphSpy post-exploitation tools that rely on stolen tokens for persistent Graph API access
  • Monitor for CAE bypass attempts — attackers may try to use tokens from IPs that match trusted locations to evade re-evaluation
IDENTITYHARDEN

App Registration & Enterprise App Governance

CONSENT FLOW // PERMISSIONS AUDIT // SERVICE PRINCIPAL MONITORING
  • Disable user consent — force admin consent workflow. Counters OAuth consent phishing, GraphPreConsentExplorer abuse of pre-consented scopes
  • Block risky Graph permissions — Mail.ReadWrite, Files.ReadWrite.All, Directory.ReadWrite.All, RoleManagement.ReadWrite.Directory
  • Restrict app creation — set Users can register applications = No in Entra portal
  • Monitor app registration persistence — attackers use GraphSpy to create app registrations with client secrets + high-privilege API permissions for persistent backdoor access
  • Alert on new service principal credentials — especially from unexpected IPs or outside change windows
  • Audit first-party Microsoft client IDs — GraphPreConsentExplorer abuses first-party Entra clients with pre-consented Graph scopes to bypass CA policies
  • Monitor for APEX usage patterns — combines ROADrecon + GraphRunner + CA enumeration for comprehensive Entra ID post-exploitation
IDENTITYCLOUD

Cross-Tenant & External Access

B2B CONTROLS // LIGHTHOUSE // TENANT RESTRICTIONS // GUEST POLICIES
  • Default block inbound/outbound B2B — allowlist specific partner tenant IDs only. Review quarterly
  • Audit Azure Lighthouse delegations — remove stale MSP/CSP access that provides cross-tenant management plane access
  • Restrict guest invite to admins only — prevent users from inviting external guests without governance
  • Tenant restrictions v2 — prevent authentication to unauthorized tenants. Counters data exfiltration via personal M365 accounts
  • Block Cross-Tenant ROPC — attackers authenticate through a different tenant's token endpoint to bypass Conditional Access policies entirely
  • Monitor for TeamsEnum UPN vs email mismatch enumeration — enumerates valid accounts via Teams API. Also monitor TeamFiltration account enumeration and data exfiltration
IDENTITYDETECT

Entra Security Hardening Checklist

BREAK-GLASS // SSPR // NUMBER MATCHING // ENUMERATION DETECTION
  • Break-glass accounts — 2 cloud-only GA accounts, excluded from all CA policies, 25+ character passwords, monitored with high-priority alerts. Test quarterly
  • Disable SSPR for admins — or require 2+ authentication methods for self-service password reset
  • Number matching for MFA — eliminates m365-fatigue MFA bombing by requiring user to enter displayed number
  • Restrict Azure AD admin portal — limit access to admin roles only via CA policy
  • Monitor for ROADtools/ROADrecon enumeration — uses legacy Azure AD Graph API with no read logging. Alert on legacy API usage patterns
  • Monitor for APEX post-exploitation framework — comprehensive Entra ID attack toolkit combining enumeration, CA bypass, and persistence
  • Monitor Intune Company Portal Client ID abuse — in CA bypass attempts using first-party app client IDs
  • Deploy MDI (Microsoft Defender for Identity) — detect identity-based attacks. Awareness: ldapx can strip suspicious LDAP attributes before MDI sensors see them, and SOAPhound uses ADWS (port 9389) to bypass LDAP-based MDI detection

02 // On-Prem Active Directory Hardening

Active Directory remains the backbone of enterprise identity. Tiered admin models, Kerberos hardening, ADCS lockdown, SCCM controls, and ACL hygiene form the critical defense layer against lateral movement, privilege escalation, and domain dominance. Countermeasures mapped to offensive tools from the AD Attack Architecture Map.
HARDENIDENTITY

Tiered Admin Model

TIER 0/1/2 ISOLATION // SEPARATE ACCOUNTS // AUTH POLICY SILOS
  • Tier 0/1/2 isolation with separate admin accounts — dedicated admin accounts per tier (e.g., T0-admin, T1-admin). Never reuse credentials across tiers
  • Enforce with GPO — Deny log on locally and Deny log on through Remote Desktop for cross-tier accounts on wrong-tier machines
  • Authentication Policy Silos — (2012 R2+ DFL) bind Tier 0 accounts to Tier 0 machines only. Prevents cross-tier authentication at the protocol level
  • Counters lateral movement chains — PsExec/wmiexec/evil-winrm credential reuse across tiers. Attacker with Tier 2 creds cannot reach DCs
  • Prevents cascading compromise — Tier 2 workstation compromise cannot reach Tier 0 (DCs, ADFS, AAD Connect, PKI servers)
  • AAD Connect server = Tier 0 — MSOL_ account has DCSync-equivalent rights. Counters secretsdump.py targeting MSOL_ account for full domain compromise
HARDENCREDENTIAL

LAPS, gMSA & Service Account Security

LOCAL ADMIN ROTATION // MANAGED SERVICE ACCOUNTS // SPN AUDIT
  • Windows LAPS (Win11 22H2+) — encrypted passwords stored in AD/Entra ID. Counters pyLAPS, goLAPS LAPS password extraction
  • Rotation every 24-72h — force rotation after each administrative use to limit exposure window
  • gMSA for all services — 240-character auto-rotating passwords. Eliminates Kerberoasting via GetUserSPNs.py, Rubeus kerberoast
  • Audit all accounts with SPNs — run Get-ADUser -Filter {ServicePrincipalName -like "*"}. Migrate to gMSA or set 25+ char random passwords
  • Counters targeted Kerberoasting — targetedKerberoast.py (GenericWrite to set SPN then Kerberoast the target)
  • Disable local admin RID-500 — where possible, disable the built-in Administrator account
  • Monitor pre2k — Pre-Windows 2000 computer account exploitation using predictable passwords
HARDENPOLICY

Kerberos Hardening

AES-ONLY // FAST ARMORING // DELEGATION AUDIT // KRBTGT ROTATION
  • Disable RC4-HMAC — AES128+AES256 only. Counters Kerberoasting (hashcat mode 13100 for RC4). Microsoft killing RC4 in Kerberos by 2026
  • Monitor Event 4769 TicketEncryptionType=0x17 — any RC4 TGS request is suspicious and warrants investigation
  • FAST (Kerberos Armoring) — protects AS-REQ/AS-REP exchanges. Counters ASREPRoast via GetNPUsers.py
  • Audit all delegation — msDS-AllowedToDelegateTo (constrained), TRUSTED_FOR_DELEGATION in UAC (unconstrained). Unconstrained on non-DC = critical finding. Counters Rubeus monitor TGT capture, S4U2Self+S4U2Proxy abuse
  • Audit RBCD — msDS-AllowedToActOnBehalfOfOtherIdentity. Counters rbcd.py, KrbRelayUp, SPNless RBCD attacks
  • Rotate krbtgt twice annually — with 12h gap between rotations. Counters Golden Ticket (forged TGT from krbtgt hash). After suspected compromise, rotate immediately
  • Kerberoast honeypot — fake SPN account with 100+ char password. Alert on any 4769 targeting it. Set realistic logonCount and lastLogonTimestamp values — attackers check these to spot honeypots
  • Counters Diamond Ticket — modified legitimate TGT PAC; harder to detect than Golden Ticket. Monitor for PAC anomalies
  • Counters Sapphire Ticket — Diamond + S4U2Self + U2U for real PAC; even harder to detect. Focus on behavioral detection and anomalous service access patterns
  • Counters Timeroasting — novel NTP ms-SNTP computer hash extraction. Monitor unusual NTP authentication patterns on DCs
HARDENNETWORK

LDAP & NTLM Relay Prevention

LDAP SIGNING // CHANNEL BINDING // COERCION DEFENSE // IPV6 HARDENING
  • Require LDAP signing on DCs — GPO LDAP server signing requirements = Require signing
  • LDAP channel binding = 2 (Always) — counters ntlmrelayx SMB-to-LDAP relay chains
  • Enable LDAPS (port 636) — monitor Event 2889 for unsigned LDAP binds. Remediate all sources
  • Client-side LDAP signing — on all domain-joined machines via GPO
  • Counters coercion-to-relay chains — PetitPotam (MS-EFSR CVE-2021-36942) + ntlmrelayx to LDAP, DFSCoerce (MS-DFSNM) + RBCD, ShadowCoerce (MS-FSRVP), PrinterBug/SpoolSample (MS-RPRN)
  • Counters CVE-2025-33073 — NTLM Reflection (SMB to LDAPS relay bypassing both LDAP signing AND channel binding). Patch immediately
  • Counters mitm6 — DHCPv6 poisoning to WPAD proxy to relay. Disable IPv6 if not needed, or deploy DHCPv6 Guard
  • Counters WebDAV + coercion — HTTP-based relay with no signing. Disable WebClient service where not needed via GPO
HARDENIDENTITY

Protected Users & ACL Hygiene

PROTECTED USERS GROUP // ADMINSDHOLDER // ACL AUDIT // DELEGATION CLEANUP
  • Add ALL privileged accounts to Protected Users group — enforces: no NTLM, no DES/RC4, no delegation, no credential caching, 4h TGT lifetime
  • Counters pass-the-hash — Protected Users members cannot authenticate via NTLM at all
  • Counters credential caching — no cached logon credentials stored for Protected Users members
  • Monitor AdminSDHolder modifications — ACL stamped to protected objects every 60 min. Attackers modify AdminSDHolder for persistent backdoor ACLs
  • Audit ACLs with defensive tools — BloodHound (as defender!), Invoke-ACLScanner, PingCastle, Purple Knight
  • Focus on dangerous ACEs — GenericAll, WriteDACL, WriteOwner, GenericWrite, ForceChangePassword, AddMember, AddSelf — the full ACL abuse chain from the AD Attack Map
  • Monitor for ACL manipulation tools — owneredit.py (ownership changes), dacledit.py (ACL modifications), bloodyAD object manipulation
  • Reduce Domain Admins to 2-3 break-glass only — all other admin access via PIM or tiered delegation
  • Counters OUned Attack — WriteDACL on OU with inheritance grants control over all child objects. Audit OU ACLs for unexpected write permissions
  • Counters Walking Dead / LazarusWakeUp — re-enabling disabled accounts with residual ACLs. Monitor Event 4722 (account enabled). Clean up ACLs on disabled accounts before leaving them
HARDENIDENTITY

ADCS Hardening (ESC1–ESC16)

CERTIFICATE TEMPLATE LOCKDOWN // CA PERMISSIONS // ENROLLMENT RESTRICTIONS
  • ESC1 — remove CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT from templates or restrict enrollment. #1 ADCS abuse vector. Counters Certipy, Certify
  • ESC2 — remove Any Purpose / SubCA EKU from templates; these allow certificate use for any purpose
  • ESC3 — restrict enrollment agent enrollment to specific admins only
  • ESC4 — ACL on templates: only CA admins modify. Remove Authenticated Users write. Counters Certipy ESC4-to-ESC1 chain (modify template, 8h propagation)
  • ESC6 — disable EDITF_ATTRIBUTESUBJECTALTNAME2: run certutil -setreg policy\EditFlags -EDITF_ATTRIBUTESUBJECTALTNAME2
  • ESC7 — restrict ManageCA / ManageCerts to CA admins only
  • ESC8 — disable HTTP web enrollment or enforce EPA. Counters NTLM relay to HTTP cert enrollment
  • ESC9 — require CT_FLAG_NO_SECURITY_EXTENSION is NOT set. Ensures SID is embedded in certificates
  • ESC10 — set StrongCertificateBindingEnforcement = 2 (Full enforcement, not 0 or 1). Counters weak certificate mapping abuse
  • ESC11 — enable IF_ENFORCEENCRYPTICERTREQUEST on CA. Counters NTLM relay to RPC enrollment
  • ESC13 — audit msDS-OIDToGroupLink — issuance policy OID linked to AD group. Remove unnecessary links
  • ESC14 — audit altSecurityIdentities for explicit certificate mappings that shouldn't exist
  • ESC15 (EKUwu, CVE-2024-49019) — audit Schema v1 templates: Application Policy injection allows EKU bypass. Update templates to Schema v2 or restrict enrollment
  • ESC16 — CA-level analog of ESC9. Ensure security extension is enforced at the CA level
  • Regular auditing — run PSPKIAudit, certipy find -vulnerable, Locksmith regularly. Monitor Event 4887 for suspicious cert requests (SAN ≠ requestor UPN)
HARDENDETECT

SCCM / MECM Hardening

NAA ELIMINATION // PXE HARDENING // CLIENT PUSH // TAKEOVER PREVENTION
  • Harden NAA (Network Access Account) — use Enhanced HTTP instead. Counters SCCMDecryptor-BOF, SCCMSecrets.py NAA credential extraction from policy bodies
  • Disable PXE without a password — or use Enhanced HTTP. Counters pxethief PXE boot credential theft from TFTP media
  • Restrict client push installation — counters SCCM ELEVATE attacks (client push coercion to relay for site server compromise)
  • Harden SMS Provider access — restrict who can connect to the SMS Provider. Counters TAKEOVER 1-9 relay attacks against site systems
  • Monitor enumeration tools — detect sccmhunter, SharpSCCM enumeration patterns in logs
  • Restrict EXEC-1 and EXEC-2 — app deployment (EXEC-1) and script execution (EXEC-2) restricted to authorized admins only
  • Audit task sequence secrets — remove embedded credentials from task sequences and collection variables
  • Counters full SCCM attack chain — CRED → ELEVATE → EXEC → TAKEOVER as documented in the AD Attack Map
HARDENIDENTITY

Shadow Credentials, ADIDNS & Object Security

KEYCREDENTIALLINK // DNS POISONING // DCSHADOW // SKELETON KEY // SID HISTORY
  • Monitor msDS-KeyCredentialLink modifications (Event 5136) — counters Shadow Credentials attack via Certipy, keycred. Jan 2026 patch broke, but bypass exists: CustomKeyInformation flags 0x02 + remove KeyApproximateLastLogonTimeStamp
  • Protect ADIDNS — audit DNS record creation permissions. Counters dnstool.py ADIDNS poisoning, time bomb records, wildcard injection for MITM
  • Monitor AD Recycle Bin restores (Event 5138) — counters restoration of deleted objects with preserved group memberships for unauthorized access
  • DCShadow detection — alert on new nTDSDSA objects (rogue DC registration). Counters Mimikatz lsadump::dcshadow for stealthy replication-based persistence
  • Skeleton Key detection — memory-only attack on DC LSASS. Detect via Kerberos encryption downgrade to RC4 or failed NTLM auths with master password pattern. Reboot DC clears it
  • DSRM backdoor — monitor DsrmAdminLogonBehavior registry value (should not be 2). Counters Directory Services Restore Mode local admin backdoor on DCs
  • Custom SSP detection — monitor for new Security Support Providers in HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages
  • SID History audit — alert on sIDHistory attribute changes (Event 4765). Counters ExtraSID forest takeover attack for cross-domain privilege escalation
  • Monitor for BadSuccessor (dMSA) — delegated Managed Service Account privesc on Windows Server 2025. SharpSuccessor PoC available

03 // Credential Protection

Credentials are the keys to the kingdom. VBS isolation, LSA protection, NTLM restriction, phishing-resistant MFA, and DPAPI hardening protect against the most common credential theft and replay attacks. Countermeasures mapped to credential dumping and relay tools from the AD Attack and Red Team Architecture Maps.
CREDENTIALENDPOINT

Credential Guard & LSA Protection

VBS ISOLATION // RUNAS PPL // UEFI LOCK // LSASS DEFENSE
  • Credential Guard (VBS) — isolates LSASS secrets in virtualization-based security. NTLM hashes and TGTs inaccessible even to SYSTEM. Requires UEFI Secure Boot + TPM
  • UEFI Lock — cannot be disabled remotely; requires physical access to the machine to turn off
  • LSA Protection (RunAsPPL) — marks LSASS as Protected Process Light. Blocks unsigned code injection into LSASS
  • Counters primary dump tools — Mimikatz sekurlsa::logonpasswords, lsassy (remote LSASS dump), pypykatz (offline parsing)
  • Counters evasive dump techniques — MultiDump (LOLBin-style with argument spoofing), GhostKatz, nanodump
  • Counters WER abuse — WSASS (Windows Error Reporting abuse for LSASS dump)
  • Counters clone+suspend — LSASS clone via PssCaptureSnapshot to clone LSASS, dump the clone process instead
  • Counters raw hive extraction — AxiomSecrets (raw NTFS parsing of SAM/SYSTEM/SECURITY hives)
  • BYOVD PPL bypass awareness — Dellicious (Dell BIOS driver), PPLBlade, PPLdump, Sunder rootkit can strip PPL. Deploy Microsoft Vulnerable Driver Blocklist via WDAC/HVCI
  • Monitor for VM memory extraction — physmem2profit (VM snapshot .vmem + .vmsn), Volumiser VMDK clone. Restrict vSphere snapshot permissions
  • Counters additional techniques — SharpSAMDump (in-memory SAM parsing), 7-Zip raw disk \\.\PhysicalDrive0 (confirmed bypasses CrowdStrike 2025), drag-and-drop API bypass
CREDENTIALHARDEN

NTLM Restriction & Relay Prevention

NTLMV1 ELIMINATION // EPA // SMB SIGNING // COERCION CHAIN DEFENSE
  • Block NTLMv1 entirely — GPO Send NTLMv2 only. Refuse LM & NTLM. NTLMv1 is trivially crackable via crack.sh to NT hash
  • Audit NTLMv2 (Event 8004) before blocking — identify NTLM-dependent applications and migrate them first
  • Restrict NTLM to allowlisted servers only — deny all NTLM authentication except to explicitly allowlisted servers
  • EPA on all web services — IIS, ADFS, Exchange, web enrollment. Binds NTLM to TLS channel, preventing relay
  • SMB signing everywhere + encryption — SMB 3.1.1 encryption on Server 2022+. Counters all SMB relay attacks
  • Disable NTLM on DCs (ultimate goal) — the most impactful single hardening measure for relay prevention
  • Counters full coercion chain — PetitPotam (MS-EFSR) → ntlmrelayx → LDAP → DCSync. Also: SpoolSample/PrinterBug (MS-RPRN), DFSCoerce (MS-DFSNM), ShadowCoerce (MS-FSRVP), Coercer (multi-protocol)
  • Counters Responder — LLMNR/NBT-NS/mDNS poisoning. Disable LLMNR via GPO, disable NBT-NS via DHCP/network adapter settings
  • Counters mitm6 — DHCPv6 poisoning. Disable IPv6 where not needed, deploy DHCPv6 Guard on switches
  • Counters ntlm_theft — coercion files (LNK, SCF, URL, desktop.ini). Block outbound SMB (TCP 445) to internet at firewall
  • Counters CVE-2025-24071 — .library-ms archive NTLM hash leak. Patch and block outbound SMB
  • Counters RemoteMonologue — DCOM-based Internal-Monologue NTLMv2 hash extraction without LSASS access. Restrict DCOM access via GPO
CREDENTIALIDENTITY

Passwordless & Phishing-Resistant MFA

FIDO2 // WHFB // PASSKEYS // NUMBER MATCHING // REMOTE CRED GUARD
  • FIDO2 security keys (YubiKey, Feitian) — cannot be phished, replayed, or MFA-fatigued. Counters EvilGinx 3 AiTM phishing, Modlishka, Muraena reverse proxy phishing
  • Windows Hello for Business (WHfB) — device-bound, TPM-protected credential. Cloud trust model recommended for hybrid environments
  • Passkeys — FIDO2 without requiring a physical security key; platform authenticator based
  • Authenticator with number matching — eliminates MFA fatigue attacks. Counters m365-fatigue MFA bombing tools
  • Ban SMS/voice for admins — counters SIM-swap and SS7 interception attacks against admin accounts
  • Remote Credential Guard for RDP — credentials never sent to remote host during RDP sessions. Counters credential harvesting from compromised RDP hosts
  • Be aware: GraphSpy passkey persistence — can enroll passkeys as phishing-resistant MFA, counting as compliant authentication. Monitor new FIDO2/passkey registrations for admin accounts
  • Be aware: WHfB registration abuse — can be abused for persistence via new key credential enrollment. Monitor Event 4624 with new WHfB key credential
CREDENTIALHARDEN

DPAPI & Cached Credential Protection

DPAPI BACKUP KEY // WDIGEST // DCC2 CACHE // GPP // BROWSER CREDS
  • DPAPI backup key protection — restrict access to the DPAPI domain backup key. Counters DonPAPI (mass DPAPI extraction), SharpDPAPI, dploot
  • DPAPI extraction scope — these tools extract browser passwords, Wi-Fi PSKs, RDP saved credentials, OAuth tokens, certificate private keys
  • Disable WDigest — ensure UseLogonCredential=0 in registry. Counters WDigest plaintext password storage in memory
  • DCC2 cached credentials — reduce cached logon count via GPO Interactive logon: Number of previous logons to cache = 1 (or 0 for servers). Counters Mimikatz lsadump::cache (hashcat mode 2100)
  • Protect GPP passwords — verify SYSVOL is clean of Groups.xml with cpassword (MS14-025). Run Get-GPPPassword to audit
  • Monitor credential theft tools — ThievingFox credential harvesting, BrowserSnatch/ChromeAlone/HackBrowserData browser credential extraction, cookie-monster BOF
  • Restrict cmdkey stored credentials — clean up Credential Manager entries; audit for stored RDP/SMB credentials on workstations
  • Protect sensitive files — audit access to unattend.xml, web.config, registry autologon values, scheduled task credentials

04 // EDR & ENDPOINT HARDENING

Attack Surface Reduction, application control, tamper protection, anti-injection defenses, and initial-access hardening across all managed endpoints.
ENDPOINTPOLICY

ASR Rules

MDE // BLOCK EXECUTION // OFFICE HARDENING
  • Block executable content from email — BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550
  • Block Office creating executable content — 3B576869-A4EC-4529-8536-B80A7769E899. Counters macro-based droppers, vba2clr, VBA-to-CLR chains
  • Block Office creating child processes — D4F940AB-401B-4EFC-AADC-AD5F3C50688A. Stops cmd/powershell/mshta from Office. Counters MacroPack Pro WEAPONIZE_DOTNET delivery
  • Block Office injecting into processes — 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84
  • Block JS/VBS launching downloaded content — D3E037E1-3EB8-44C8-A917-57927947596D. Counters HTML smuggling chains (via WALK, SilkWASM)
  • Block WMI/PSExec process creation — D1E49AAC-8F56-4280-B9BA-993A6D77406C. Counters wmiexec, PsExec lateral movement. WARNING: may break SCCM
  • Block credential stealing from LSASS — 9E6C4E1F-7D60-472F-BA1A-A39EF669E4B2. Additional LSASS protection
  • Block Win32 API calls from Office macros — 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B
  • Block untrusted/unsigned processes from USB — B2B3F03D-6A65-4F7B-A9C7-1C7EF74A9BA4
  • Deployment strategy — deploy in Audit mode 2–4 weeks first, then switch to Block
ENDPOINTHARDEN

WDAC & Application Control

APPLICATION CONTROL // APPLOCKER // EXOTIC FORMAT DEFENSE
  • WDAC over AppLocker — kernel-enforced, cannot be bypassed by admin-level users. Counters AMSI bypass (patching AmsiScanBuffer), CLM bypass (PSByPassCLM), AppLocker bypass via whitelisted paths
  • Recommended block rules — start with Microsoft recommended block rules, add custom allowlist
  • DLL enforcement on Tier 0 systems — blocks DLL sideloading. Counters DllShimmer, GimmeShelter, Spartacus DLL/COM hijacking, Node.js .node sideloading, Godot .pck BYOI
  • Script enforcement — WDAC enforces CLM for unsigned PowerShell. Counters ShadowShell (PowerShell without powershell.exe), UnmanagedPowerShell, BOF.NET
  • Block exotic formats — configure file association policies to block .msc files (counters GrimResource MMC XSS), .cpl files (counters SentinelOne bypass), .hta execution, .wsh/.wsf scripts
  • Block .winget file execution — counters .winget DSC payload chain (no SmartScreen, no MOTW). Restrict winget configure via AppLocker/WDAC
  • Block msiexec for non-admin users — counters MSI-based lateral movement and initial access (running DLLs via msiexec bypassed CrowdStrike)
  • Chocolatey/package manager policy — restrict choco install and winget install to admin-approved packages. Counters ChocoBonzer (reflective DLL loader via Chocolatey)
  • Smart App Control (SAC) — cloud intelligence blocks untrusted executables for standard users. Be aware: BAT/CMD search order hijack bypasses SAC
ENDPOINTHARDEN

Tamper Protection & EDR Resilience

PREVENT EDR DISABLE // BYOVD DEFENSE // EDR HEALTH
  • Enable tamper protection — cloud-managed via MDE portal, not local GPO
  • Monitor EDR health — alert on devices not reporting for >24h. Counters EDR silencing techniques
  • Vulnerable Driver Blocklist via WDAC/HVCI — blocks known BYOVD drivers. Counters Sunder rootkit (Lazarus-style), TrueSightKiller, Dellicious (Dell BIOS driver), DriverJack, appid.sys abuse, PatchGuardEncryptorDriver
  • Monitor for WDAC weaponization — attackers use Krueger to remotely deploy WDAC policies that block EDR drivers, then reboot. Alert on unexpected WDAC policy changes
  • Monitor for EDRSilencer — uses Windows Filtering Platform (WFP) to block EDR network communications. Alert on WFP filter rule creation
  • Monitor for EDR-Freeze — WerFaultSecure vulnerability to suspend EDR threads via NtSuspendThread. Alert on bulk thread suspension events
  • Monitor for service account manipulation — attackers change EDR service from LocalSystem to low-priv via sc config. Alert on service account changes for security products
  • Detect WindowsDowndate — Windows Update hijack for downgrade attacks. Monitor for unexpected OS build regressions
  • Additional counters — ColdWer, Fairy-Law (EDR process termination via BYOVD), EDR-GhostLocker (locks EDR driver files)
  • Network Protection — block connections to known-malicious domains/IPs. Counters C2 callback attempts
  • Automatic Attack Disruption — auto-contain compromised accounts, isolate devices, disable malicious OAuth apps. Be aware: can also quarantine/contain AD accounts per MDE
ENDPOINTDETECT

Anti-Injection & Memory Defenses

PROCESS INJECTION // MEMORY SCANNING // BEHAVIORAL DETECTION
  • Monitor injection APIs — CreateRemoteThread, QueueUserAPC, SetThreadContext API calls from unexpected processes. Counters classic injection, APC injection (including Early Bird variant)
  • Monitor direct syscall chains — NtAllocateVirtualMemory + NtWriteVirtualMemory + NtCreateThreadEx syscall chains. Counters direct/indirect syscalls via SysWhispers3, HellsGate, HalosGate, TartarusGate
  • Detect PPID spoofing — PROC_THREAD_ATTRIBUTE_PARENT_PROCESS abuse. Alert when parent-child process relationships don’t match expected trees
  • Detect Block DLLs mitigation flag — PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY used to block EDR DLL injection into new processes
  • Monitor RW→RX transitions — VirtualProtect RW→RX transitions in non-standard processes. Counters shellcode loaders, reflective loading (BokuLoader, AceLDR, TitanLdr)
  • Monitor unsigned DLL loads — unsigned DLL loads in sensitive processes. Counters DLL sideloading, DllShimmer, COM hijacking
  • Threadless injection defense — hook-based injection into long-lived processes (splwow64.exe, BdeUISrv.exe). Monitor for API hook modifications in target processes
  • Advanced injection counters — PoolParty/PoolPartyBof (thread pool injection), Voidgate (per-instruction decryption), Dirty Vanity (process forking via RtlCreateProcessReflection), Caro-Kann (kernel memory scan avoidance)
  • Memory scanning solutions — deploy Moneta (testing), hollows_hunter (scanning). Look for unbacked executable memory, modified PE headers, floating code
  • Sleep obfuscation awareness — Be aware: Ekko (timer queue ROP chain), Foliage (APC-based), Deathsleep (unmaps implant memory), KrakenMask, GPU VRAM sleep (not scanned by any EDR)
  • Call stack spoofing awareness — Be aware: ThreadStackSpoofer, SilentMoonwalk, Unwinder. Deploy stack-based behavioral detection where available
ENDPOINTPOLICY

MOTW, SmartScreen & Initial Access Hardening

MARK-OF-THE-WEB // HTML SMUGGLING // FILE FORMAT DEFENSE
  • MOTW enforcement — ensure Group Policy does not disable MOTW checking. Counters ISO/VHD container bypass (legacy pre-patch), WebDAV bypass
  • MOTW bypass awareness — Be aware: ADS bypass (nested ADS streams), RAR file type gaps (WinRAR does NOT apply MOTW to XLL, JS, URL, ClickOnce, IQY, CPL, WSF, CHM), .winget files (MOTW not applied), ASD files (Office AutoRecover strips MOTW)
  • Block polyglot LNK techniques — LNK+VBS, LNK+ZIP, LNK+MSHTA polyglots. Counters DarkLnk, LNKUp, LNKSmuggler. Monitor for LNK files with suspiciously large sizes (appended payloads)
  • HTML smuggling defense — block JavaScript blob downloads in corporate proxy/email gateway. Counters WALK (Rust-WASM), SilkWASM (Go-WASM), SVG smuggling, Webpack/TypeScript bloated smuggling
  • Block .pif files — renamed EXEs with always-hidden extension (1 of 16 Windows hidden extension types)
  • Block .suo files in email — Visual Studio Solution User Options execute code on project open (used by DPRK)
  • Monitor for ClickOnce execution — .application execution deploys .NET executables from URL via legitimate dfsvc.exe
  • Corrupted DOCM technique — first bytes corrupted to bypass spam filters, Word auto-recovery opens. Ensure email gateway inspects recovered documents
  • Block developer-targeted attacks — warn on cargo build from untrusted repos (malicious build.rs), Visual Studio project attacks (EvilSln), VS Code extension loading abuse
  • Disable Quick Assist — if not needed. Used by Black Basta for initial access via social engineering

05 // DETECTION ENGINEERING

Sigma/KQL detections mapped to offensive techniques, honey tokens and deception, MDE custom rules, and OPSEC-aware detection for sophisticated adversaries.
DETECTPOLICY

Critical Sigma / KQL Detections

ATTACK-MAPPED DETECTIONS // CROSS-REFERENCED TO OFFENSIVE MAPS
  • DCSync — Event 4662 with properties {1131f6aa-9c07-11d1-f79f-00c04fc2dcd2} from non-DC source. Counters secretsdump.py, Mimikatz lsadump::dcsync, DSInternals. Be aware: DCSync from DC machine account ($) may evade Elastic rules
  • Kerberoasting — Event 4769 TicketEncryptionType=0x17 (RC4). High volume from single source = GetUserSPNs.py, Rubeus kerberoast. Be aware: AES-256 (etype 17/18) Kerberoasting evades RC4-focused rules — monitor volume of TGS requests per source
  • ASREPRoast — Event 4768 PreAuthType=0. Counters GetNPUsers.py
  • Shadow Credentials — Event 5136 on msDS-KeyCredentialLink attribute modification. Counters Certipy, keycred, Whisker
  • RBCD modification — Event 4742/5136 on msDS-AllowedToActOnBehalfOfOtherIdentity. Counters rbcd.py, KrbRelayUp
  • Golden Ticket — Event 4769 with anomalous TGT lifetime (>10h) or domain mismatch. Diamond/Sapphire tickets are harder — focus on behavioral patterns
  • Pass-the-Hash — Event 4624 LogonType 9 (NewCredentials) + 4648 from unexpected sources. NTLMv2 workstation-to-workstation = suspicious
  • ADCS abuse — Event 4887 where SAN ≠ requestor UPN. Detect ESC1/ESC6 exploitation. Monitor template modifications for ESC4 chain
  • Service creation — Event 7045 for PsExec (PSEXESVC), SCShell (modifies existing service binary path via ChangeServiceConfigA — no 7045, port 135 only)
  • Scheduled task abuse — Event 4698 with suspicious actions. atexec uses randomized task names. PhantomTask creates tasks invisible to schtasks/Task Scheduler GUI — detect via registry monitoring
  • LDAP enumeration — Event 1644 (expensive search logging). SharpHound/bloodhound-python generates hundreds of queries in seconds. Be aware: SOAPhound uses ADWS port 9389 instead of LDAP — enable ADWS auditing
  • Machine account creation — Event 5137 for new computer objects. Counters addcomputer.py for RBCD setup
  • SPN modification — Event 5136 on servicePrincipalName. Counters targeted Kerberoasting via targetedKerberoast.py
DECEPTIONDETECT

Honey Tokens & Deception

CANARY ACCOUNTS // FAKE SPNS // DECOY FILES // CANARY DETECTION AWARENESS
  • Kerberoast canary — fake SPN account with 100+ char password. ANY TGS request = active attacker. Set realistic logonCount and lastLogonTimestamp — attackers check these to detect honeypots
  • Honey admin account — looks like DA but has NO permissions. Alert on any auth attempt
  • Canary files — passwords.xlsx, network_diagram.vsd on shares. Monitor Event 4663
  • DNS canary — tempting hostnames (backup-dc01, nas-finance) pointing to monitored IP with no services
  • Fake creds in LSASS — via HoneyCreds. Attacker dumps LSASS, uses fake creds, triggers alert
  • Canary detection awareness — IMPORTANT: attackers are canary-aware. IndicatorOfCanary tool detects canary tokens. ProjFS detection (PrjGetOnDiskFileState API) detects Thinkst canarytokens. AWS canary evasion exists (spoofed fake events). Cortex creates fake data (hooks samcli.dll)
  • Counter canary detection — use canaries that don’t rely on ProjFS, vary canary implementations, use server-side detection (LDAP query monitoring, Kerberos ticket monitoring) that can’t be detected client-side
  • Deploy at scale — Thinkst Canary, SentinelOne Hologram, CounterCraft, or manual canaries
DETECTENDPOINT

MDE Custom Detection & Threat Hunting

KQL RULES // INJECTION DETECTION // C2 HUNTING
  • Process injection — DeviceEvents | where ActionType in ("CreateRemoteThreadApiCall", "QueueUserApcRemoteApiCall", "SetThreadContextRemoteApiCall") | where InitiatingProcessFileName !in ("csrss.exe", "lsass.exe", "services.exe")
  • LSASS access — DeviceEvents | where ActionType == "OpenProcessApiCall" | where FileName == "lsass.exe" | where InitiatingProcessFileName !in ("csrss.exe","wmiprvse.exe","MsMpEng.exe")
  • Suspicious PowerShell — hunt for -enc, FromBase64String, IEX, Invoke-Expression, downloadstring. Counters encoded PowerShell loaders
  • LOLBin detection — certutil decode, mshta remote content, regsvr32 /s /n /u /i:http, msbuild inline tasks, wmic process call create, forfiles, IExpress.exe. Each from the Red Team Map LOLBin arsenal
  • Scheduled hunting (weekly) — unusual service installations, new scheduled tasks, registry Run key modifications, unsigned DLL loads, named pipe creation (C2 indicators), DNS query anomalies
  • C2 beaconing detection — look for regular interval HTTP/HTTPS connections with jitter. Hunt for JA3/JARM fingerprints matching known C2 frameworks (Cobalt Strike, Sliver, Mythic, Havoc, Brute Ratel). Be aware: attackers use nginx/Apache proxies to mitigate JA3/JARM fingerprinting
  • DNS exfiltration detection — high volume of DNS TXT queries or unusual subdomain lengths. Counters dnscat2, iodine, DoH (DNS-over-HTTPS) exfil channels
  • Custom IOC management — STIX/TAXII feeds via Sentinel TI connector. Feed threat intel IOCs automatically
  • Hunt for COM hijacking persistence — monitor HKCU CLSID overrides, TypeLib hijacking in HKCU\Software\Classes\TypeLib\{GUID}
  • Hunt for WMI event subscriptions — Get-WMIObject -Namespace root/Subscription -Class __EventFilter — counters fileless WMI persistence (SharpEventPersist)
DETECTHARDEN

OPSEC-Aware Detection

DETECTING QUIET ATTACKERS // EVASION-AWARE RULES
  • SOAPhound detection — monitor ADWS (port 9389) access patterns. Most SOC rules monitor LDAP (389/636) but SOAPhound uses SOAP/ADWS to bypass LDAP-based MDI detection. Enable ADWS auditing
  • ldapx detection — ldapx acts as LDAP proxy stripping suspicious attributes before MDI sensors. Detect by comparing LDAP query results from different vantage points, or monitor for LDAP proxy indicators
  • Diamond Ticket detection — harder than Golden Ticket since it modifies a legitimate TGT. Focus on PAC anomalies, unusual privilege escalation patterns after TGT issuance
  • Stealthy Kerberoast detection — when attackers request AES-256 (etype 17/18) instead of RC4, traditional rules miss them. Monitor total TGS request volume per source regardless of encryption type
  • DCSync timing detection — attackers execute during scheduled AD replication windows to blend in. Correlate replication requests with actual replication schedule
  • SCShell detection — modifies existing service binary path (no Event 7045). Monitor for ChangeServiceConfigA calls and Event 4657 (registry value modification) on service ImagePath
  • CrowdStrike time desync awareness — attackers manipulate system clock to make events disappear from EDR console. Monitor for system clock changes (W32Time events, Event 1) on endpoints
  • MDE emulator detection — attackers detect Defender sandbox via MpSomeSandboxOnlyFunction resolve or fake process enumeration. Layer detection with cloud-based detonation
  • Silverfort bypass awareness — Silverfort provides MFA across all protocols via DC agent. Attackers are aware of it — look for Silverfort-evasion indicators

06 // NETWORK SEGMENTATION

Privileged access workstations, SMB hardening, firewall tiering, and advanced lateral movement prevention across network boundaries.
NETWORKHARDEN

PAW / SAW Architecture

PRIVILEGED ACCESS WORKSTATIONS // ZERO TRUST ADMIN
  • Dedicated hardware for Tier 0 admin — no internet, no email, no LOB apps
  • PAW compliance — Intune-managed, BitLocker, WDAC, Credential Guard. CA policy: require compliant device for admin role activation
  • No internet from PAW subnet — block all except Windows Update and MDE endpoints. Only allow access to Tier 0 resources (DCs, ADFS, PKI, AAD Connect, admin portals)
  • Clean source principle — Autopilot with dedicated profile, never from standard golden image
  • Physical security — locked area, USB/boot restrictions, BIOS password, Secure Boot
  • Counters credential theft from admin sessions — attackers target admin workstations for high-value credentials. Isolated PAWs contain the blast radius
  • Device impersonation awareness — Be aware: attackers use fakeprinter to make attack boxes appear as HP printers on the network. Monitor for new devices on admin VLANs
NETWORKHARDEN

SMB Hardening & Relay Prevention

SMB SIGNING // ENCRYPTION // RELAY DEFENSE
  • Require SMB signing everywhere — GPO. Counters NTLM relay via SMB — ntlmrelayx, PetitPotam chains
  • SMB encryption (3.1.1) — on Server 2022+ / Win11
  • Disable SMBv1 — vulnerable to EternalBlue-class attacks, no signing enforcement
  • Block SMB (TCP 445) outbound to internet — counters NTLM credential theft via UNC paths in phishing, ntlm_theft files (LNK, SCF, URL, desktop.ini), CVE-2025-24071 (.library-ms hash leak)
  • Restrict anonymous SMB access — prevent null session enumeration
  • Block workstation-to-workstation SMB — Windows Firewall inbound TCP 445 block on all workstations (allow only from admin subnets). This single rule disrupts most PsExec, smbexec, Invoke-SMBRemoting lateral movement
NETWORKPOLICY

Firewall Tiering & Service Hardening

TIER BOUNDARIES // HOST FIREWALL // SERVICE LOCKDOWN
  • Tier boundary ACLs — Tier 2→Tier 0 DENY ALL, Tier 2→Tier 1 specific app ports only, Tier 1→Tier 0 management ports from jump servers only
  • Host-based Windows Firewall — DO NOT disable. Block RDP/WinRM/SMB from non-admin subnets on workstations
  • RDP through jump server / RDP Gateway only — NLA required. Counters SharpRDP (programmatic keystrokes), HiddenDesktop (HVNC for CS), RDP session hijacking (tscon). Restrict RDP Restricted Admin mode — while it prevents credential caching, it also enables pass-the-hash RDP
  • WinRM lockdown — disable on workstations, restrict to management subnets on servers. Counters evil-winrm, bof-winrm-client, WinRM Plugin Abuse
  • DNS sinkhole — redirect known-malicious domains to monitored IP. Alert on resolution attempts
  • Disable Print Spooler service — on servers that don’t need printing. Counters PrinterBug/SpoolSample coercion (MS-RPRN). Critical on DCs
  • Disable WebClient service — where not needed. Counters WebDAV-based coercion and NTLM relay (HTTP-based, no signing required)
  • Block RPC high ports from workstations — counters atexec-pro (brute-force RPC high ports when 445/135 blocked), wmiexec-Pro (port 135 only)
NETWORKDETECT

DCOM & Advanced Lateral Movement Prevention

DCOM HARDENING // MSSQL // LATERAL MOVEMENT DETECTION
  • Restrict DCOM activation — counters MMC20.Application (ExecuteShellCommand), ShellWindows, ShellBrowserWindow, Excel.Application (RegisterXLL/DDEInitiate), Outlook.Application DCOM chains
  • Advanced DCOM counters — GoExec (DCOM htafile + urlmon JScript), BitlockMove (Bitlocker DCOM + COM Hijacking), DCOMRunAs (DCOM DLL hijacking), fileless DCOM (Forshaw research)
  • SessionHop defense — counters SessionHop (COM-based cross-session injection, Session 0 to interactive sessions). Monitor for cross-session COM activation
  • MSSQL hardening — disable xp_cmdshell, restrict sp_OACreate, audit linked servers (remove unnecessary links), limit EXECUTE AS LOGIN = 'sa'. Counters MSSQL linked server lateral movement chains, CLR assembly injection
  • Monitor for SCShell — fileless lateral movement via ChangeServiceConfigA (port 135 only, no Event 7045). XOR encrypted, PtH support. Detect via service ImagePath registry changes
  • Monitor for TaskHound — scheduled task enumeration and weaponization for lateral movement. Alert on remote scheduled task modifications
  • Named pipe monitoring — counters Invoke-SMBRemoting (interactive shell over Named Pipes, fileless). Monitor named pipe creation events (Sysmon 17/18)
  • Block Bluetooth attack surface — where not needed. Counters BlueDucky (0-click Bluetooth pairing exploit), BLE C2 (GATT/GAP protocol C2 channel)
  • VPN bypass monitoring — TunnelVision (DHCP manipulation) bypasses VPN tunnels. Ensure VPN clients are hardened against DHCP-based attacks

07 // Azure & Cloud Security

Sentinel SIEM, diagnostic settings, hybrid identity security, and multi-cloud defense to counter cloud attack techniques from the offensive maps.
clouddetect

Microsoft Sentinel Configuration

WORKSPACE // CONNECTORS // ANALYTICS // AUTOMATION
  • Single workspace — recommended for most orgs. Multi-workspace only for data residency or regulatory requirements
  • Essential connectors — Entra ID (ALL log categories: AuditLogs, SignInLogs, NonInteractiveUserSignInLogs, ServicePrincipalSignInLogs, ManagedIdentitySignInLogs, ProvisioningLogs, ADFSSignInLogs, RiskyUsers, UserRiskEvents), M365 Defender, Azure Activity, Identity Protection, Defender for Cloud, Syslog, Windows Security Events via AMA, DNS logs
  • Fusion rules — enable for multi-stage attack detection across data sources
  • Custom KQL analytics — build detections for attacks from offensive maps: GraphSpy app registration activity, device code phishing flows, unusual ROADtools/ROADrecon API usage, APEX post-exploitation patterns
  • SOAR playbooks — auto-isolate device on high-severity EDR alert, auto-disable user on confirmed credential compromise, auto-enrich alerts with TI
  • Data retention — 90 days interactive (minimum), archive 1–2 years. SecurityEvent and SigninLogs = longest retention
  • Watchlists — Tier 0 accounts, PAW devices, known-good service accounts, external IP ranges. Reduce false positives by excluding known-good activity
  • Monitor for RedELK — Red Team's SIEM for operational logging. If detected during IR, indicates coordinated red team/threat actor operation
cloudidentity

Azure AD Connect / Hybrid Identity Security

HYBRID IDENTITY // MSOL ACCOUNT // PTA // GOLDEN SAML DEFENSE
  • AAD Connect server = Tier 0 — MSOL_ account has DCSync-equivalent rights. Counters secretsdump.py targeting MSOL_ for full domain hash dump, AADInternals exploitation
  • MSOL_ permissions — limit to minimum required per sync feature in use
  • PHS preferred over PTA — PTA agents on-prem can be backdoored. Counters AADInternals PTA backdoor (accept any password). If using PTA, monitor agent health and integrity
  • Golden SAML defense — protect ADFS token-signing certificate. Store in HSM if possible. Monitor for ADFS config changes. Counters forged SAML tokens that grant access to any federated service
  • MSOL_ sign-in monitoring — should only authenticate programmatically from Connect server. Alert on interactive logon
  • Password writeback — exclude Tier 0 admin OUs from writeback scope. Counters cloud-to-on-prem privilege escalation
  • PRT (Primary Refresh Token) protection — enable token protection in CA policies. Monitor for PRT extraction tools: ROADtools roadtoken, aadprt BOF, SeamlessPass. PRT = cloud equivalent of TGT
  • Seamless SSO defense — protect AZUREADSSOACC$ computer account hash. If compromised, attacker forges Kerberos Silver Ticket → Azure access token via DesktopSsoToken. Counters SeamlessPass, AAD BOFs
  • Entra Metaverse protection — monitor Azure AD Connect Metaverse database for unauthorized manipulation
cloudharden

Azure Resource & Multi-Cloud Hardening

KEY VAULT // STORAGE // MULTI-CLOUD // RBAC
  • Key Vault — use Azure RBAC (not Vault Access Policies). Least privilege: Key Vault Secrets User for apps, Key Vault Administrator for ops. Enable purge protection and soft delete
  • Storage — disable public blob access, require HTTPS, Private Endpoints, disable shared key access. Counters SAS token exfiltration to attacker-controlled S3/Blob
  • SAS token management — prefer Stored Access Policies (revocable), shortest practical expiry. Counters data exfiltration via pre-signed URLs (AWS S3, Azure Blob SAS)
  • Subscription locks — CanNotDelete on production resource groups
  • Azure Policy — enforce tags, restrict VM sizes, require encryption, deny public IPs, require NSGs. CIS/NIST baselines
  • Defender for Cloud (CSPM) — Secure Score, attack path analysis, cloud security graph
  • AWS security — monitor for AWSRoleJuggler (persistent IAM role access), AWS-Key-Hunter (key enumeration), VPCShark (EC2 traffic mirroring). Restrict IAM role chaining, audit GitHub Actions OIDC trust
  • GCP security — audit Domain-Wide Delegation. Counters DelePwn (DWD misconfig exploitation). Restrict DWD to minimum required scopes
  • Monitor for Awseye — unauthenticated AWS account enumeration. Porch-Pirate — Postman workspace credential harvesting
  • Multi-cloud logging — centralize AWS CloudTrail, GCP Cloud Audit, and Azure Activity logs in Sentinel or unified SIEM
clouddetect

Cloud Persistence Detection

APP REGISTRATION // PASSKEY // TOKEN PERSISTENCE // CLOUD C2
  • App registration monitoring — monitor new app registrations with high-privilege API permissions. Counters GraphSpy app registration + client secret persistence. Alert on: Mail.Read, Files.ReadWrite.All, Directory.ReadWrite.All granted to new apps
  • Passkey enrollment — monitor FIDO2/passkey enrollment for admin accounts. GraphSpy can enroll passkeys as phishing-resistant MFA persistence that survives password resets
  • WHfB key registration — monitor Windows Hello for Business key registration. Can be abused for persistent authentication
  • Refresh token patterns — monitor refresh token usage patterns. Counters refresh token persistence, TokenSmith token manipulation
  • Service principal credentials — alert on new certificates/secrets added outside of change management
  • Direct Send connector abuse — monitor for abuse. Counters email-based social engineering from internal-looking addresses
  • Cloud C2 detection — detect Claude-C2 (MCP server), Mythic MCP (Claude driving Mythic/Apollo), AI-driven C2 frameworks. Monitor for unusual API call patterns from automated agents
  • AWS persistence — monitor for Lambda IP rotation (credential spraying), self-hosted runner compromise, GitHub Actions OIDC abuse
  • ADFS DRS abuse — monitor legacy Device Registration Service for persistence
  • Conditional access policy modifications — alert on CA policy changes. Attackers may weaken CA policies for persistence

08 // Logging & Visibility

Critical event IDs, Sysmon, PowerShell logging, and advanced audit policies that provide telemetry needed to detect the attack techniques documented in the offensive maps.
logdetect

Critical Windows Event IDs

SECURITY LOG // MUST-COLLECT EVENTS // ATTACK-MAPPED
  • 4624 — Successful logon — Types: 2 (Interactive), 3 (Network), 7 (Unlock), 9 (NewCredentials/RunAs), 10 (RDP). Type 3 workstation-to-workstation = lateral movement. Counters PsExec, wmiexec, smbexec
  • 4625 — Failed logon — high volume = brute force/spray. Correlate with 4771. Counters kerbrute, CredMaster, o365spray
  • 4648 — Explicit credential logon — RunAs usage. Common in pass-the-hash. Counters Mimikatz sekurlsa::pth, NetExec -H
  • 4662 — AD object access — DCSync detection: DS-Replication-Get-Changes property {1131f6aa-9c07-11d1-f79f-00c04fc2dcd2} from non-DC. Counters secretsdump.py, DSInternals
  • 4672 — Special privileges assigned — alert on unexpected SeDebugPrivilege, SeTcbPrivilege
  • 4688 — Process creation — with command line. Foundation of endpoint detection. Requires Include command line in process creation events GPO
  • 4698/4699/4700/4702 — Scheduled task CRUD — creation, deletion, enable, update. Counters atexec, PhantomTask, TaskHound
  • 4722 — Account enabled — counters Walking Dead/LazarusWakeUp (re-enable disabled accounts)
  • 4728/4732/4756 — Member added to security group — global, local, universal group changes. Counters bloodyAD AddMember, SharpGPOAbuse
  • 4742 — Computer account changed — counters RBCD modification. Counters rbcd.py
  • 4765 — SID History changed — counters ExtraSID forest takeover attack
  • 4769 — TGS request — EncType 0x17 = RC4 = Kerberoasting. Counters GetUserSPNs.py, Rubeus
  • 4771 — Kerberos pre-auth failed — Status 0x18 = wrong password. Detects password spraying
  • 4776 — NTLM credential validation — track NTLM usage for deprecation planning
  • 4887 — Certificate requested — SAN != requestor UPN = ADCS abuse (ESC1/ESC6). Counters Certipy, Certify
  • 5136 — AD object modified — monitor: msDS-KeyCredentialLink (Shadow Creds), msDS-AllowedToActOnBehalfOfOtherIdentity (RBCD), servicePrincipalName (targeted Kerberoast), member (group changes)
  • 5137 — AD object created — new computer objects = addcomputer.py for RBCD setup
  • 5138 — AD object undeleted — counters AD Recycle Bin abuse (restore deleted objects with preserved group memberships)
  • 7045 — New service installed — counters PsExec (PSEXESVC). Note: SCShell does NOT create Event 7045 (modifies existing service instead)
  • 1102 — Audit log cleared — anti-forensics indicator. Always alert on this event
logendpoint

Sysmon Configuration

SWIFTONECURITY // MODULAR // ATTACK-SPECIFIC RULES
  • Deploy Sysmon — visibility that native logging lacks: DLL loads, named pipes, WMI events, DNS queries, process access, file/registry monitoring with hashing
  • Base config — SwiftOnSecurity sysmon-config or Olaf Hartong sysmon-modular. Customize for your environment
  • Event 1 (Process Create) — parent process + hashes + command line. Detects LOLBins: mshta.exe, certutil.exe, rundll32.exe, msbuild.exe, regsvr32.exe, wmic.exe, cscript/wscript, hh.exe
  • Event 3 (Network Connection) — process-level network telemetry. Detects C2 beaconing by process
  • Event 7 (Image Loaded) — DLL sideloading detection. Alert on unsigned DLLs loaded by signed processes. Counters DllShimmer, Spartacus, COM hijacking
  • Event 8 (CreateRemoteThread) — injection detection. Counters classic injection, APC injection
  • Event 10 (ProcessAccess) — LSASS access. Counters Mimikatz, lsassy, MultiDump, nanodump
  • Event 11 (FileCreate) — files in sensitive paths (Temp, AppData, ProgramData). Detects payload drops
  • Event 13 (RegistryValueSet) — persistence detection: Run keys, services, COM objects, TypeLib hijacking
  • Event 17/18 (PipeEvent) — named pipe creation/connection. Counters C2 pipe-based communication (Cobalt Strike SMB beacon), PipeTap, pipe-intercept
  • Event 22 (DNSQuery) — process-level DNS. Detects C2 beacon DNS, dnscat2, DNS exfil
  • Event 25 (ProcessTampering) — detect process hollowing and image tampering
  • Protect Sysmon — rename driver/service during install (sysmon64 -i -d [drivername]). Counters attacker detection and unloading
  • Forward to SIEM — via AMA (Data Collection Rule targeting Microsoft-Windows-Sysmon/Operational) or WEF
logdetect

PowerShell & Script Logging

SCRIPTBLOCK // MODULE // TRANSCRIPTION // CLM
  • ScriptBlock Logging (Event 4104) — logs DEOBFUSCATED script content. Single most valuable PowerShell log. Detects Invoke-Mimikatz, AMSI bypass attempts, encoded stagers
  • Module Logging (Event 4103) — pipeline execution for all modules. Captures cmdlet invocations with parameters
  • Transcription — full session I/O to network share. Useful for forensics
  • CLM (Constrained Language Mode) — no .NET types, no COM, no Win32 API. Auto-enforced with WDAC for unsigned scripts. Counters ShadowShell, UnmanagedPowerShell alternatives. Be aware: PSByPassCLM, custom C# runners, downgrade to PowerShell v2 can bypass CLM
  • Command-line process creation logging (Event 4688) — full command line for every process. Detects LOLBin chains, encoded commands, attacker tool execution
  • AMSI logging — AMSI feeds content to AV before execution. Monitor for AMSI bypass signatures (Event 1116 Defender). Counters AMSI bypass techniques: patch AmsiScanBuffer, hardware breakpoints, reflection (amsiContext null), CLR hooking, Null-AMSI, block amsi.dll load
  • ETW monitoring — alert on ETW provider disabling or patching. Counters EtwEventWrite patch to ret 0, NtTraceEvent patch, Threat Intelligence ETW provider disabling. These blind EDR telemetry
  • Block PowerShell v2 — Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root. PSv2 has no AMSI, no ScriptBlock logging, no CLM
logharden

ADCS, DNS & Advanced Audit

CERTIFICATE AUDIT // DNS LOGGING // MDI // OBJECT ACCESS
  • ADCS audit — Event 4886/4887/4888. Alert on SAN != requestor UPN. Monitor template modifications (Event 4899/4900). Detect ESC1–ESC16 exploitation attempts
  • DNS query logging — DNS analytical logging on DNS servers + Sysmon Event 22 on endpoints. Detects C2 beaconing, DNS exfil (dnscat2, iodine, DoH), malicious domain resolution, ADIDNS poisoning
  • Directory Service auditing — Audit DS Access + DS Changes on DCs. Detects enumeration, ACL modifications, DPAPI backup key access, BloodHound/SharpHound queries
  • Kerberos auditing — enable all: Audit Kerberos Service Ticket Ops + Kerberos Authentication Service. Feeds 4768/4769/4771 for Kerberoasting, ASREPRoast, ticket anomaly detection
  • Object access auditing (selective) — AdminSDHolder, GPO objects, ADCS templates, krbtgt account, DPAPI backup key, AZUREADSSOACC$ account
  • MDI (Microsoft Defender for Identity) — deploy sensors on all DCs. Detects LDAP enumeration, DCSync, lateral movement, Kerberos attacks. Be aware: ldapx strips suspicious LDAP attributes before MDI; SOAPhound uses ADWS (port 9389) to bypass LDAP monitoring. Enable ADWS auditing as compensating control
  • Defender for Identity health — monitor MDI sensor connectivity. Alert on sensor service stops or communication failures — may indicate EDR-Freeze or process termination attack on DC
  • Log forwarding — WEF collector → SIEM or AMA direct to Sentinel. NEVER rely on local-only storage (attackers clear Event 1102). Pre-filter high-volume events at WEF tier before SIEM

09 // Defensive Tool Arsenal

Reference of defensive tools, audit frameworks, and assessment utilities. Organized by function with notes on which offensive techniques each tool helps detect or prevent.

Assessment & Audit

Assessment & Audit
├── PingCastle          // AD security assessment — health score, remediation priorities, detects ACL abuse paths
├── Purple Knight       // Semperis — 130+ AD security indicators, detects delegation misconfigs, ADCS issues
├── BloodHound-CE       // Run as DEFENDER — map attack paths, find dangerous ACLs, identify Tier 0 exposure. Same tool attackers use (SharpHound, bloodhound-python)
├── PlumHound           // BloodHound reporting — actionable remediation reports from BH data
├── Invoke-ACLScanner   // PowerShell — audit AD ACLs for WriteDACL, GenericAll, GenericWrite, AddMember, WriteOwner
├── PSPKIAudit          // ADCS security audit — checks templates for ESC1-ESC16 vulnerabilities
├── Locksmith           // ADCS vulnerability scanner — comprehensive ESC detection
├── ADRecon             // AD reconnaissance report (Excel/HTML) — environment baseline
├── Maester             // Entra ID security assessment — automated config audit via Graph API
├── Adalanche           // AD ACL visualization — same tool attackers use, shows attack paths graphically
└── RelayInformer       // Identifies NTLM relay opportunities in your environment before attackers do

Monitoring & Detection

Monitoring & Detection
├── Sysmon              // Enhanced Windows event logging — process, network, file, registry, DNS telemetry
├── SwiftOnSecurity Config // Community Sysmon config — well-tuned baseline
├── Sysmon-Modular      // Olaf Hartong — modular rules for granular management
├── Microsoft Sentinel  // Cloud-native SIEM — KQL analytics, Fusion ML detection, SOAR playbooks
├── Microsoft Defender for Identity (MDI)  // Identity-based attack detection on DCs — DCSync, Kerberoast, lateral movement
├── Sigma Rules         // Cross-platform detection rules — convert to KQL/Splunk/Elastic/QRadar
├── HELK                // Hunting ELK — open-source threat hunting with Jupyter notebooks
├── Velociraptor        // Endpoint forensic triage — VQL-based artifact collection and monitoring
├── Moneta              // In-memory detection testing — find unbacked executable memory, injected code
├── hollows_hunter      // Memory scanning — detect process hollowing, reflective loading, PE injection
└── VECTR               // Purple team tracking — map detection coverage to MITRE ATT&CK

Deception & Canaries

Deception & Canaries
├── Thinkst Canary      // Commercial deception — hardware/software canaries across network, cloud, AD
├── HoneyCreds          // Inject fake creds into LSASS — alerts on use by credential dumpers
├── DejaVu              // Open-source deception framework — deploy and manage decoy systems
├── AD Canary Accounts  // Manual — fake SPN accounts, honey admin accounts, canary files on shares
└── Artillery           // Honeypot alerter — detect reconnaissance and scanning on your infrastructure

Hardening & Compliance

Hardening & Compliance
├── HardenTools         // Disable common attack surfaces — macros, OLE, PowerShell, WSH
├── CIS Benchmarks      // Hardening baselines for Windows, Server, Azure, M365 — GPO templates
├── Microsoft Security Baselines (SCT)  // GPO baselines per OS version
├── Intune Security Baselines  // Cloud-managed hardening profiles for Windows endpoints
├── Azure Policy / Blueprints  // Enforce cloud resource compliance — CIS/NIST initiatives
└── Misconfiguration-Manager   // SCCM/MECM security audit — identify SCCM attack paths

Forensics & Response

Forensics & Response
├── Velociraptor        // Endpoint triage and artifact collection at scale
├── capa                // Static capability identification — what can this binary do?
├── KAPE                // Kroll Artifact Parser — rapid forensic artifact collection
├── Chainsaw            // Fast Windows Event Log analysis — hunt for IOCs in EVTX files
└── ThreatCheck / avred // Test your own defenses — identify what signatures detect (use for purple teaming)