Active Directory and Windows Security Monitoring
Active Directory and Windows Security Monitoring tests whether you can read domain-controller and endpoint telemetry to detect credential theft, privilege escalation, and lateral movement.
Core rules
- Kerberos events: 4768 TGT request, 4769 service ticket request, 4771 pre-auth failure. Note encryption type - RC4 (0x17) where AES is expected can indicate Kerberoasting. 4768 with pre-auth disabled can indicate AS-REP roasting.
- Logon events: 4624 success and 4625 failure, with Logon Type (2 interactive, 3 network, 10 RDP). 4672 marks special privileges. 4776 is NTLM authentication.
- Directory changes: 4720 user created, 4728/4732 group membership added, 5136 object modified, 4662 directory service access. DCSync appears as 4662 with replication GUIDs.
- Service and persistence: 7045 and 4697 service installation, plus Sysmon registry and process events.
Worked example
A single workstation generates 4769 requests for many service accounts using RC4 encryption within two minutes. Reasoning: normal users request a few tickets with AES; a burst of RC4 service tickets is consistent with Kerberoasting, where an attacker requests crackable service tickets. Pivot to 4624 and process telemetry on that host to find the tool and the compromised account.
Traps
- Counting 4624 without Logon Type, which hides network and RDP access.
- Ignoring encryption type in 4769 events.
- Treating service-account activity as benign without a baseline.
- Missing 1102 log clearing, which often follows credential theft.
- Assuming domain-admin activity is authorized without checking source host.