Combining AD Honey Pot Accounts with Canaries to Detect Password Sprays and Kerberoasting for free!

Name: Combining AD Honey Pot Accounts with Canaries to Detect Password Sprays and Kerberoasting for free!
Uploaded: 2022-09-09T20:02:42Z
Channel: IppSec
Description: **IMPORTANT: The event filter should be 4625 not 4624. 00:00 - Intro 01:00 - Going over CanaryTokens 04:00 - Scheduled Task Basics 06:10 - Switching ove...

IppSec · Beginner ·🧠 Large Language Models ·3y ago

**IMPORTANT: The event filter should be 4625 not 4624. 00:00 - Intro 01:00 - Going over CanaryTokens 04:00 - Scheduled Task Basics 06:10 - Switching over to Event Log 07:15 - Enabling logging for failures 09:30 - Searching Events based upon Event ID via XPATH/XML 11:30 - Searching Events based upon data in the Event Log 12:20 - Searching a specific field within the event log data 16:00 - Adding Boolean Logic to watch multiple events 19:00 - Preventing the account from being able to be used by setting login hours to none 21:00 - Creating a SPN so the account becomes kerberoastable 22:00 - Chan…

Watch on YouTube ↗ (saves to browser)

Chapters (14)

Intro

1:00 Going over CanaryTokens

4:00 Scheduled Task Basics

6:10 Switching over to Event Log

7:15 Enabling logging for failures

9:30 Searching Events based upon Event ID via XPATH/XML

11:30 Searching Events based upon data in the Event Log

12:20 Searching a specific field within the event log data

16:00 Adding Boolean Logic to watch multiple events

19:00 Preventing the account from being able to be used by setting login hours to no

21:00 Creating a SPN so the account becomes kerberoastable

22:00 Changing our Search Query to easily find events related to the kerberoasting

23:10 Fixing up how we parsed multiple Event ID's

25:10 Exporting and Importing the task

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →

Combining AD Honey Pot Accounts with Canaries to Detect Password Sprays and Kerberoasting for free!

Chapters (14)

Playlist

Lesson complete!