Visão Geral

Este curso apresenta o funcionamento do Pass-the-Hash (PtH), técnica associada ao abuso de autenticação NTLM mediante reutilização de material de autenticação. O curso enfatiza os fundamentos técnicos, identificação de indicadores, investigação, prevenção e mitigação em ambientes Windows e Active Directory.

Objetivo

Após realizar este curso, você será capaz de:

• Compreender o funcionamento do Pass-the-Hash
• Identificar indicadores de uso indevido de credenciais
• Analisar autenticações NTLM suspeitas
• Aplicar técnicas de detecção
• Implementar medidas de mitigação

Publico Alvo

• Analistas de Cybersecurity
• Profissionais de SOC e Blue Team
• Administradores Windows
• Incident Responders
• Pentesters e Red Teamers

Pre-Requisitos

• Conhecimentos de Windows
• Familiaridade com NTLM
• Conhecimentos básicos de Active Directory
• Noções de autenticação e credenciais
• Familiaridade com Windows Event Logs é recomendada

Conteúdo Programatico

Module 1: NTLM Authentication Fundamentals

1. NTLM authentication architecture
2. Challenge-response authentication
3. NTLM authentication flow
4. Password and hash concepts
5. Authentication material
6. Local authentication
7. Domain authentication
8. NTLM session security
9. NTLM security limitations
10. Credential protection mechanisms

Module 2: Pass-the-Hash Fundamentals

1. Pass-the-Hash attack concepts
2. Credential material reuse
3. Authentication without plaintext passwords
4. Relationship between NTLM hashes and authentication
5. Local versus domain credential abuse
6. Attack prerequisites
7. Privileged account exposure
8. Lateral movement concepts
9. Attack objectives
10. Security implications

Module 3: Credential Exposure and Attack Surface

1. Credential exposure scenarios
2. Local administrator credentials
3. Domain administrator credentials
4. Shared administrative credentials
5. Credential reuse across endpoints
6. Privileged account risks
7. Credential isolation
8. Administrative workstation security
9. Credential theft indicators
10. Attack surface reduction

Module 4: Pass-the-Hash and Lateral Movement

1. Lateral movement fundamentals
2. Remote authentication
3. Windows administrative protocols
4. Remote service access
5. Administrative shares
6. Remote management mechanisms
7. Authentication source and destination analysis
8. Privileged session monitoring
9. Lateral movement indicators
10. Attack chain analysis

Module 5: Pass-the-Hash Detection

1. NTLM authentication monitoring
2. Windows logon events
3. Source workstation analysis
4. Destination host analysis
5. Account behavior analysis
6. Privileged logon monitoring
7. Unusual authentication patterns
8. Authentication event correlation
9. Behavioral detection
10. Detection engineering

Module 6: Threat Hunting for Pass-the-Hash

1. Threat hunting methodology
2. Authentication-based hunting
3. Identifying abnormal NTLM usage
4. Investigating privileged authentication
5. Host-to-host authentication analysis
6. Account activity baselining
7. Lateral movement hunting
8. Credential compromise indicators
9. Hunt hypothesis development
10. Hunt result validation

Module 7: Prevention and Mitigation

1. Credential Guard
2. Local Administrator Password Solution
3. Privileged Access Management
4. Administrative tiering
5. Least privilege
6. NTLM reduction strategies
7. Local administrator account protection
8. Credential isolation
9. Endpoint hardening
10. Security policy implementation

Module 8: Incident Response and Practical Investigation

1. Pass-the-Hash incident identification
2. Compromised account investigation
3. Source and destination host analysis
4. Lateral movement investigation
5. Credential exposure assessment
6. Account containment
7. Credential rotation
8. Endpoint remediation
9. Persistence investigation
10. Practical Pass-the-Hash investigation case studies