The Kerberoasting attack covered in this study. Here we propose a methodology to draw equivalent defensive plans for other similar attacks as The information was used to draw an efficient defensive plan against Of the attack lifecycle, the extracted information from the pcap files was used to highlight the features and Every pcap file contains the data related to a particular stage Kerberoasting attack scenario in pcap files. In this study, we have collected the data related to a suggested On the other hand, we propose a method to predict and early kill attacks in an active directoryĮnvironment, such as Kerberoasting attacks. These datasets can be used later in machine learning models to build intelligent defensive

Proposes a method to label datasets related to multi-stage attacks according to attack stages rather than These patterns can be used to predict, mitigate and stop these attacks. Invaders' actions over the internet can take patterns by going through specific stepsĮvery time they attack. Security over the Internet usually takes a defensive shape, aiming to fight against attacks createdįor malicious reasons. The wild nature of humans has become civilized, and the weapons they use to attack each other are nowĭigitized. As conclusions of the work carried out, it should be noted that although the attacks are mostly difficult to implement, their detection is even more complicated, and the damage is very severe so it’s necessary to continuously monitor the logs in these environments to detect them and taking into account strict recommendations for mitigation and response. Subsequently, they are discussed in a general way and the results of the attacks are analyzed according to some parameters.

For each attack the objective is studied, implementation is developed in a virtual laboratory and detection is analyzed, proposing measures for mitigation and response. This work analyzes the main Kerberos attacks in Active Directory Windows networks, inherent in the design of the protocol and not resolved. Therefore, it is necessary to investigate its resistance to the different types of attacks it can suffer, the best way to detect them and to parameterize it to mitigate the effects of the attacks. Organizations use Active Directory Windows service to authenticate users in a network with the extended Kerberos Authentication protocol.

Active directory kerberos