Topic: Attacking & Defending Active Directory Workshop

Topic:  Attacking & Defending Active Directory Workshop

How do you defend Active Directory, aka the “keys to the kingdom,” if you don’t know where the attacks are coming from? Hackers constantly find new ways to break into AD. And once inside, they’re increasingly adept at covering their tracks to silently create backdoors and establish persistent privileged access.

In this workshop, we’ll demonstrate real-world attacks that are frequently used against AD, including credential theft, Kerberos-based attacks, Group Policy-based attacks, and ACL attacks.

During this workshop, we’ll play out both perspectives:  the attacker and defender.  This is a red vs blue standoff, so don’t expect a bunch of slideware.  We’ll show:

Ways that hackers can exploit AD in every stage of the cyber kill chain

Common AD hacking and discovery tools such as Mimikatz, PowerSploit, and BloodHound

Proactive steps to identify vulnerabilities in your AD configuration

Strategies to harden your AD so that hackers don’t have an easy path to Domain Admins

Agenda

11:30-11:50 setup and test,

11:55 SPIE Announcements,

12:00 Speaker Presentation

───────────────────────────────────────────────

Please join my meeting from your computer, tablet or smartphone.

 https://global.gotomeeting.com/join/341772605

You can also dial in using your phone.

(For supported devices, tap a one-touch number below to join instantly.)

Canada (Toll Free): 1 888 455 1389

One-touch: tel:+18884551389,,341772605#

Canada: +1 (647) 497-9391

One-touch: tel:+16474979391,,341772605#

Access Code: 341-772-605

 More phone numbers:

(For supported devices, tap a one-touch number below to join instantly.)

 United States (Toll Free): 1 877 309 2073

One-touch: tel:+18773092073,,341772605#

United States: +1 (571) 317-3129

One-touch: tel:+15713173129,,341772605#

Join from a video-conferencing room or system.

Dial in or type: 67.217.95.2 or inroomlink.goto.com

Meeting ID: 341 772 605

Or dial directly: 341772605@67.217.95.2 or 67.217.95.2##341772605 

Presenter:  Darren Mar-Elia, VP of Products, Semperis

A 14-year Cloud and Datacenter Microsoft MVP, Darren has a wealth of experience in Identity and Access Management and was the CTO and founder of SDM software, a provider of Microsoft systems management solutions. Prior to launching SDM, Darren held senior infrastructure architecture roles in Fortune 500 companies and was also the CTO of Quest Software. As a Microsoft MVP, Darren has contributed to numerous publications on Windows networks, Active Directory and Group Policy, and was a Contributing Editor for Windows IT Pro Magazine for 20 years.