active-directory

Active Directory internals for detection engineering — Kerberos authentication flow (AS-REQ/TGT/TGS/service ticket), NTLM challenge-response mechanics, AD replication protocol (DRS/DCSync), trust types and delegation abuse (constrained/unconstrained/RBCD), Group Policy processing, AD Certificate Services attack paths (ESC1-ESC13), SPN mechanics and Kerberoasting, LDAP reconnaissance patterns, and the telemetry each operation produces. Use when authoring detections for credential access, lateral movement, privilege escalation, or persistence that involves Active Directory.