HackBlue

Tools · Workbench

Identity defense

Lessons on BloodHound CE from the defender’s side, AD CS template audits, and Entra ID sign-in logs: measuring privilege paths and closing them.

  • 5 lessons
  • 1 h of reading
  • 3 topics
Start with lesson 1All workbenches

Most intrusions end with an identity: a delegated right nobody remembered, a certificate template that lets a user choose who it names, a legacy protocol that skips MFA. These lessons find those conditions in your own directory, fix them, and measure again to prove the fix.

Collect directory data under a change ticket, from an admin workstation, with the SOC told in advance.

BloodHound CE

2 lessons

  1. 01BloodHound CE for defenders: measure who can reach Tier ZeroCollect your lab domain with SharpHound under an approved change, load it into BloodHound Community Edition, and count the users and computers with any path to Domain Admins.13 min
  2. 02Closing an attack path in AD and proving it with a second collectionRemove an over-broad delegation found in BloodHound, re-collect the lab domain, compare the Tier Zero path count before and after, and catch a second path the first fix exposed.12 min

AD CS

1 lesson

  1. 01Auditing AD Certificate Services templates for escalation risksAudit your lab’s AD CS certificate templates for the misconfigurations known as ESC1 and ESC4, using read-only queries, Locksmith, and Certipy find, and fix them in the template settings.13 min

Entra ID

2 lessons

  1. 01Entra ID sign-in logs: read one record from status to Conditional AccessRead a Microsoft Entra ID sign-in record field by field, including the error code, authentication requirement, Conditional Access result, and risk, and pull the same data with Microsoft Graph PowerShell.11 min
  2. 02Hunting password spray in Entra sign-in logs, then testing a policy in report-onlyWrite KQL over SigninLogs that separates password spray from one user’s typos, then use Conditional Access report-only results to see who a new policy would block before enforcing it.12 min