Visão Geral

Este curso apresenta os principais conceitos e técnicas de Lateral Movement em ambientes Windows e Active Directory. O participante compreenderá como adversários podem se deslocar entre sistemas após um comprometimento inicial, além de estudar protocolos, indicadores, telemetria, threat hunting e controles destinados a limitar a movimentação lateral.

Objetivo

Após realizar este curso, você será capaz de:

• Compreender os fundamentos de lateral movement
• Identificar principais vetores de movimentação
• Analisar autenticações entre sistemas
• Detectar indicadores de movimentação lateral
• Aplicar controles para reduzir o risco

Publico Alvo

• Analistas de Cybersecurity
• Profissionais de SOC e Blue Team
• Threat Hunters
• Incident Responders
• Pentesters e Red Teamers

Pre-Requisitos

• Conhecimentos de Windows
• Familiaridade com Active Directory
• Conhecimentos básicos de redes
• Noções de autenticação Windows
• Familiaridade com Windows Event Logs e SIEM é recomendada

Conteúdo Programatico

Module 1: Lateral Movement Fundamentals

1. Lateral Movement concepts
2. Post-compromise activity
3. Internal reconnaissance
4. Credential-based movement
5. Remote authentication
6. Trust relationships
7. Privileged access
8. Attack paths
9. Movement objectives
10. Lateral Movement lifecycle

Module 2: Windows Remote Services

1. SMB
2. Windows Remote Management
3. Remote Desktop Protocol
4. Windows Management Instrumentation
5. Remote Service execution concepts
6. Administrative shares
7. Remote administration protocols
8. Service-based movement
9. Remote authentication
10. Remote service security

Module 3: Credential-Based Lateral Movement

1. Credential reuse
2. Pass-the-Hash
3. Pass-the-Ticket
4. Kerberos authentication
5. NTLM authentication
6. Credential exposure
7. Privileged credentials
8. Service accounts
9. Authentication material
10. Credential protection

Module 4: Active Directory Attack Paths

1. Domain relationships
2. Privileged groups
3. Delegated permissions
4. Nested group memberships
5. Service accounts
6. Kerberos delegation
7. Trust relationships
8. Attack path analysis
9. Privilege escalation relationships
10. Domain compromise pathways

Module 5: Lateral Movement Detection

1. Authentication monitoring
2. Remote logon events
3. Process creation monitoring
4. Remote service activity
5. SMB activity
6. RDP activity
7. PowerShell activity
8. Windows Event Logs
9. Endpoint telemetry
10. SIEM correlation

Module 6: Threat Hunting

1. Lateral Movement hunting
2. Authentication baselining
3. Host-to-host communication
4. Privileged account behavior
5. Remote service hunting
6. Suspicious administrative activity
7. Credential abuse indicators
8. Attack chain reconstruction
9. Hunt hypothesis development
10. Hunt validation

Module 7: Prevention and Hardening

1. Network segmentation
2. Administrative tiering
3. Privileged Access Management
4. Least privilege
5. Credential Guard
6. Local Administrator Password Solution
7. Remote service restrictions
8. RDP security
9. SMB security
10. Lateral Movement attack surface reduction

Module 8: Incident Response and Practical Analysis

1. Lateral Movement incident identification
2. Source and destination analysis
3. Authentication timeline reconstruction
4. Compromised account investigation
5. Host compromise assessment
6. Attack path reconstruction
7. Containment strategies
8. Credential rotation
9. Persistence assessment
10. Practical Lateral Movement investigation cases