Solution overview
Identity is the new perimeter — and attackers know it. In this lab, you'll step into a real-world breach simulation where a red team adversary targets Active Directory through Kerberoasting and Pass-the-Hash techniques. Your job is to track the attack using CrowdStrike Falcon ITDR, validate lateral movement with Security Onion's network telemetry, and confirm containment using Falcon SOAR.
This isn't just about detection — it's about proving your ability to defend the core of your enterprise: identity. You'll analyze anomalous Kerberos behavior, spot privilege escalation from endpoint to domain, and watch automation kick in to shut it all down — fast.
If you're serious about defending Active Directory in modern SOC environments, this is where you sharpen that skill.