Active Directory Red Team Simulation with Wazuh Detection Engineering
An Active Directory red team assessment across a six phase attack chain, integrated with Wazuh SIEM for detection validation and rule tuning.
Active Directory Red Team Simulation with Wazuh Detection Engineering
Project Description
This project involved a complete adversary emulation exercise against a remotely hosted Microsoft Active Directory environment. The assessment was designed to reproduce a realistic intrusion lifecycle, beginning with an external attacker establishing an anonymous foothold and progressing through credential access, lateral movement, privilege escalation, persistence attempts, and full Active Directory domain compromise.
The victim infrastructure was deployed within a dedicated Proxmox virtualization environment using the 192.168.90.0/24 private network. All offensive activities were conducted remotely through an OpenVPN connection, allowing the assessment to simulate an external operator accessing an isolated enterprise network through a controlled entry point.
Rather than focusing exclusively on successful attack techniques, the project documented the complete implementation process, including:
- Successful attack paths
- Failed exploitation attempts
- Tool compatibility problems
- Authentication and authorization errors
- Windows security controls that blocked specific techniques
- Detection gaps identified during the assessment
- False positive tuning performed on Wazuh
- Troubleshooting steps required to continue the operation
The offensive assessment was directly integrated with a defensive validation process. Every major action performed during the adversary emulation was reviewed from the Wazuh SIEM perspective to determine whether the activity generated sufficient telemetry, triggered an existing detection rule, or remained completely undetected.
The final result was not only a domain compromise scenario, but also an improved detection ruleset, a documented visibility matrix, and a portable Sigma detection package for use across different SIEM platforms.
Goals & Objectives
Execute Full Kill Chain
Run a realistic 6 phase AD attack from anonymous foothold to domain admin using real world tooling.
Validate Detection
Pair every attack phase with Wazuh analysis confirm hits, find gaps, tune noisy rules.
Close the Gaps
Rewrite the ruleset to v2: fix decoder anchors and add coverage for silent techniques.
Make It Portable
Produce Sigma equivalents for all 16 detections for cross SIEM reuse.
Architecture & Workflow
graph TB subgraph ATTACKER["Attacker Machine (Local Laptop)"] KALI["Kali Linux on VMware eth0: 192.168.100.171 tun0: 192.168.24.2 (after VPN)"] end
subgraph VPN["VPN Tunnel (OpenVPN)"]
OVPN["VPN config: SSLVPN_COLO_vpn-username.ovpn
Route: 192.168.90.0/24 via 192.168.24.1"]
end
subgraph PROXMOX["Remote Hypervisor (Proxmox)"]
PVE1["Proxmox hypervisor-1:8006"]
PVE2["Proxmox hypervisor-2:8006"]
PVE3["Proxmox hypervisor-3:8006"]
end
subgraph VICTIM["Victim Network 192.168.90.0/24"]
DC["windows-ad-dc
192.168.90.121
Domain Controller
Windows Server 2022
domain: lab.local"]
AGENT1["win-agent-01
192.168.90.122
Domain joined
Wazuh Agent + Sysmon64"]
AGENT2["win-agent-02
192.168.90.123
Domain joined
Wazuh Agent + Sysmon64"]
WAZUH["wazuh-dashboard
192.168.90.118
Wazuh 4.14.5"]
LB["haproxy-lb
192.168.90.112
Agent Enrollment LB"]
end
KALI -->|"Transfer .ovpn via SCP"| OVPN
OVPN -->|"tun0 established"| DC
OVPN -->|"tun0 established"| AGENT1
OVPN -->|"tun0 established"| AGENT2
PROXMOX -->|"manage VMs"| VICTIM
AGENT1 -->|"Wazuh Agent"| LB
AGENT2 -->|"Wazuh Agent"| LB
DC -->|"Wazuh Agent"| LB
LB --> WAZUH
Implementation
Phase 0: Connectivity: OpenVPN tunnel established (tun0 192.168.24.2, ~22ms RTT to DC), DNS pointed at the DC.
AD Setup: Three vulnerable accounts created via PowerShell john.doe (foothold), svc-backup (Kerberoastable, SPN HTTP/backup.lab.local), svc-legacy (AS-REP Roastable via Set-ADAccountControl -DoesNotRequirePreAuth). Password complexity disabled via secedit so service passwords landed in rockyou.
Phase 1: Recon (T1046, T1087.002, T1069.002): nmap, ldapdomaindump, bloodhound-python → 7 users, 3 computers, 52 groups dumped. crackmapexec install failed (python3-terminaltables3 404); switched to netexec (nxc 1.5.1).
Phase 2: Password Spray (T1110.003): nxc smb → john.doe:Winter2024! compromised, 5 other users failed.
Phase 3: Execution & Persistence (T1059.001, T1547.001, T1562.001): Evil-WinRM shell after fixing WinRM authorization (added john.doe to Remote Management Users). HKCU Run key persistence + AMSI bypass succeeded; SYSTEM scheduled task denied (medium integrity).
Phase 4: Credential Access (T1558.003/.004, T1003.001): Kerberoasting (GetUserSPNs) and AS-REP Roasting (GetNPUsers) → both svc accounts cracked in 0s. LSASS dump via comsvcs.dll MiniDump + pypykatz → Administrator NTLM harvested.
Phase 5: Lateral & PtH (T1021.006, T1550.002): Evil-WinRM lateral to win-agent-02 (local admin), then Pass-the-Hash to DC → Pwn3d.
Phase 6: Domain Domination (T1003.006, T1558.001): secretsdump DCSync dumped all 9 account hashes. Golden Ticket forged with krbtgt AES256 key but blocked by WS2022 PAC enforcement (KDC_ERR_TGT_REVOKED) across all three attempts; DA confirmed instead via PtH Evil-WinRM shell.
Blue Team: OpenSearch Dev Tools aggregations by event/rule ID. DCSync confirmed via rule 110001 (57 events, level 12, mail alert) and password spray via rule 60122 (26 failed logons, 17 usernames). Rule 92900 fired 53 MsMpEng.exe LSASS false positives over 6 days; suppression rule 92901 was present on disk but found NOT loaded into memory because the manager had run 6 days without a restart corrected by restarting wazuh-manager (documented in CHANGELOG v2.1). Kerberoasting (4769) remained visible but not cleanly detectable. Ruleset rewritten to v2 to close gaps.
Tech Stack Used
Multi-node SIEM cluster, custom rules + tuning
Endpoint telemetry on domain joined agents
Password spray and Pass-the-Hash
GetUserSPNs, GetNPUsers, secretsdump, ticketer
Portable cross SIEM detection logic
Key Features & Deliverables
windows_redteam_detection.xml
v2 ruleset (92750-92767): anchors fixed, gaps closed, 6 new rules
16 Sigma rules
Portable detections for BloodHound recon, Kerberoasting, DCSync, PtH, forged-ticket rejection, and more
Technique → Detection Matrix
Per-technique v1 baseline vs v2 status with audit prerequisites documented
6 Phase Documentation
Full walkthrough docs including failures, troubleshooting, and environment constraints
Key Metrics
Results & Outcome
Full domain compromise achieved (lab\administrator on windows-ad-dc, member of Domain Admins + Enterprise Admins + Schema Admins, High Mandatory Level). On the detection side, v2 raised confirmed coverage from 2/9 to 9/9 executed techniques, with two remaining amber prerequisites: AS-REP Roasting requires the Kerberos AS audit subcategory enabled, and high volume recon detection needs threshold tuning to a per-DC baseline. Golden Ticket moved from "undetectable" to detected on rejection (KDC 4769 status 0x1F when WS2022 rejects the forged ticket).
Key findings: DCSync was the strongest detection (rule 110001, level 12, 57 events with mail alert). Password spray fired cleanly (rule 60122, 26 events). LSASS false positives (53 from MsMpEng.exe over 6 days) masked the real dump; the suppression rule was found inactive and only loaded after a manager restart a reminder that a rule on disk is not "deployed" until the manager reloads it. AS-REP Roasting succeeded technically but left no clean trace due to the audit gap, and SMB being filtered on agents forced WinRM as the only viable lateral path (PsExec/WMIExec both timed out).
Screenshots & Demo
Domain Admin Shell via Pass-the-Hash
Successful administrator access validation on the Active Directory Domain Controller after a Pass-the-Hash simulation. The screenshot shows an Evil-WinRM session connected to windows-ad-dc, with whoami /groups confirming membership in Domain Admins and Enterprise Admins.
Kerberoast Hash Cracking with Hashcat
Kerberoasted service account hash validation using Hashcat mode 13100 with the rockyou.txt wordlist. The screenshot shows the cracked result for the svc-backup account in the Active Directory lab, with sensitive hash and password values safely redacted for public portfolio use.
Password Spray and Initial WinRM Access
Initial access phase in the Active Directory offensive security lab. The screenshot shows a password spray simulation using NetExec against SMB, identifying a valid john.doe credential, followed by a successful Evil-WinRM session to a domain-joined Windows host for access validation.
Credential Extraction Analysis with Pypykatz
Credential extraction analysis from an LSASS memory dump using pypykatz in a controlled Active Directory lab. The screenshot shows parsed Administrator logon data, including NTLM and Kerberos credential artifacts, with sensitive hash and key material redacted for safe public portfolio presentation.
LSASS Memory Dump Simulation
Credential access phase in the Active Directory offensive security lab. The screenshot shows an Evil-WinRM session where the lsass process was identified and a memory dump was created for analysis, demonstrating post-exploitation credential harvesting activity in a controlled lab environment.
DCSync Attack Detection in Wazuh SIEM
Detection validation for a simulated DCSync attack in the Active Directory lab. The screenshot shows Wazuh alert rule 110001 triggering on Windows Security Event ID 4662, indicating suspicious Directory Service Access activity associated with domain credential replication behavior.
Pass-the-Hash Validation and DCSync
Post exploitation validation in the Active Directory lab showing successful administrator authentication through Pass-the-Hash, followed by a controlled DCSync simulation using Impacket. Sensitive credential material and domain secrets are redacted before publication to keep the screenshot safe for a public portfolio.
Password Spray Detection in Wazuh SIEM
Detection validation for a simulated password spray attempt against the Active Directory Domain Controller. The screenshot shows Wazuh parsing Windows Security Event ID 4625, where multiple failed NTLM logon attempts were recorded and mapped to authentication failure detection logic.
Kerberoasting Account Hash Extraction
Kerberoasting simulation against the Active Directory lab using Impacket GetUserSPNs to identify the svc-backup service account and request its Kerberos TGS hash. The extracted hash is redacted before publication to keep the portfolio screenshot safe and professional.
Interested in This Project?
Discuss your security needs or explore collaboration opportunities.