AD · Incident Response · Incident Response
Active Directory DC compromise · Kerberoast + Pass-the-Ticket · 200 endpoints at risk
At a manufacturing firm with 200 endpoints, a SOC analyst noticed anomalous Kerberos TGS requests. 280 TGS-REQ for SPNs in 12 minutes. The attacker is trying to crack the Domain Admin hash. BloodHound indicator: there was also an attempt from the same PC 3 weeks ago. You will make 11 critical decisions in sequence.
Before you start the scenario
- You are the decision-maker in this incident · every choice leaves time/cost/reputation behind
- There are no wrong answers · just like in real life · but some paths are more expensive
- You can restart it anytime · try different paths
- At the end, a 3-axis score + alternative routes are shown