🛡️ Breaking Things in Active Directory So You Don't Have To

As an SOC Analyst most days that means staring at alerts, chasing down false positives, and occasionally finding something real buried in the noise. What I don't get to do very often is sit on the other side of the fence and actually run the attacks I'm supposed to detect.

That's the point of this project.

I'm building a home lab, attacking my own Active Directory environment, and writing down what I find. Not as a tutorial on how to hack AD, and not as a polished blog series with a content calendar behind it. This is closer to a lab notebook. I'm documenting the process as I go, mistakes included, because I think the "how it actually looked when I did it" version is more useful than the "here's the clean write-up after three rewrites" version.

🎯 Why this, why now

A lot of AD attacks get talked about in security circles like everyone already understands them: Kerberoasting, Pass-the-Hash, DCSync, Golden Ticket. You'll see the names dropped in incident reports, conference talks, and Twitter threads. But there's a gap between knowing the name of an attack and knowing what it actually looks like on your end, in your logs, on your SIEM dashboard.

I've spent enough time on the defensive side to know that gap is where a lot of us live. You can memorize an Event ID without ever having seen the raw event fire in front of you. I wanted to close that gap for myself first, then write about it for anyone else trying to do the same.

👥 Who this is actually for

If you're a SOC analyst, a blue teamer, or just someone trying to get more comfortable with AD security, this project is aimed at you. You don't need to be an offensive security expert to follow along. You do need some baseline comfort with Windows environments and a willingness to read log output without your eyes glazing over.

This isn't written for red teamers looking for a new technique. There are better resources for that, written by people who live on that side full time. I'm coming at this from the defense angle, and that's the lens everything here will go through.

🧪 The lab

To run these attacks safely, I needed an AD environment I could break without consequences.

I'm using GOAD (Game of Active Directory) by Orange Cyberdefense, specifically a lighter build of it. Running a full multi-domain forest alongside Kali and Splunk on my own hardware turned into a RAM math problem pretty fast, so GOAD-Light is the version doing the actual work here.

I won't be doing a setup walkthrough in this series. GOAD's own documentation covers that better than I could, and it isn't the point of this project. What matters is that the lab gives me a realistic AD environment to attack, observe, and pull real logs from, which is the whole reason this is worth writing about instead of just reading someone else's summary.

🗺️ What's coming

Here's the roadmap. Each post gets its own attack and follows the same structure: what it is, how it works, what it looks like in logs, how to detect it, and how to defend against it.

Each one gets its own post, and each post follows the same structure: what the attack is, how it actually works, what it looks like in logs and events, how you'd detect it, and how you'd defend against it.

Next up: Kerberoasting. Lab's getting set up now, so that post will have real screenshots and real log samples, not just theory.

Final Thoughts

This isn't about proving I can run an attack. It's about closing the gap between knowing an attack's name and knowing what it looks like when you're the one watching the logs.

Start small. Build the lab. Document what you find. Then repeat it for the next attack.

Following along? Let's connect.