Articles tagged active-directory

Tutorials
Cybersecurity Home Lab: Build One That Generates Alerts
Build a cybersecurity home lab with Active Directory, Sysmon and a SIEM, then run 5 attacks and check the exact event IDs each one should leave.

Tutorials
NTLM vs Kerberos: Differences and How to Read Them in Logs
NTLM vs Kerberos side by side, the 4624, 4776 and 4769 fields that show which one ran, why Windows falls back, and SPL and KQL that catch a downgrade.