Скачать или смотреть Seen It All: Detecting Active Directory Attacks with Suricata IDS [English Subtitles]

A research study on detecting attacks on Windows networks based on traffic analysis. Especially for Blue Team engineers and Windows administrators.

You can find more detailed and up-to-date information about the security of Kerberos in my article “Parallax”: https://caster0x00.com/parallax

Gist flie with signatures: https://gist.github.com/caster0x00/b0...
Github link: https://github.com/caster0x00
ORCID: https://orcid.org/0009-0006-6385-5091

Caster - Seen It All
Genre: Defensive
Release Date: 21 February 2025
Performance: Mahama Bazarov
Visuals: Mahama Bazarov
Voice: Mahama Bazarov (Stereo)
Cover Man: Mahama Bazarov (Sony ILCE-7M3, f/9.0, 1.6 sec)

00:00 Intro
00:39 Prologue
01:01 Caution
01:24 LLMNR/NBT-NS/mDNS Poisoning
05:57 Interlude
06:44 IPv6 Takeover
11:35 AS-REP Roasting
24:25 Impacket vs Rubeus
25:43 Outro
26:46 Data Transmission
27:13 Last Transmission