Defender XDR series · Lab 4 of 5 · Advanced

On-premises Active Directory is still the crown

Four alerts landed on the domain controllers between 02:10 and 04:40 UTC: a Kerberoasting pattern, a directory replication enquiry, an NTLM downgrade and a honeytoken hit. One of them is a false positive created by your own backup job. Nothing here can be fixed by resetting one password — the objective is to cut the path, not the symptom.

Required

Console replica · not Microsoft software · synthetic tenant.

Offline and deterministic: the KQL objectives run in your browser against six hand-built tables. No directory, no connector, no sensor is contacted. Account names, SIDs, hosts and addresses are fabricated (documentation ranges only) and no vendor marks are reproduced.

Objectives · 100 pts

Seven graded decisions

1
Alert triage · 10Which of the four alerts are real, and which one is your backup agent.
2
Attack path · 15Read the exposure graph and pick the single edge with the least collateral damage.
3
Hunt the directory · 10KQL over IdentityDirectoryEvents: prove who asked for replication data.
4
Risky user remediation · 20Order matters: sessions and refresh tokens, then password, then re-registration.
5
Detection coverage · 10Honeytoken, Lateral Movement path exemptions and what you deliberately do not exclude.
6
Hardening the path · 20Kerberos, NTLM, delegation, Protected Users and the dMSA decision.
7
Report & notify · 15What is known, what is not, and which clock is running.

Environment

What you are protecting

Simulated "now": 2026-09-02T06:00:00Z
Forest: contoso-rcw.example · 2 domains · 6 DCs
Hybrid: Entra Connect (staged) · password writeback on · PHS enabled
Identities in scope: svc_backup · adrsync-02$ · DC-01$ · it.admin.k · svc_print
Sensors: DFI on all 6 DCs · traffic mirror healthy · one DC with a 4-minute clock skew
Change window: 06:00–10:00 UTC today; anything else needs an emergency approval

The clock-skew line matters.

Kerberos tolerance is five minutes by default. A domain controller four minutes out of skew can produce failures that look like an attack, and can mask ones that are real. Note it before you conclude anything about authentication.

Objective 1 · 10 pts

Identity alert queue · 2026-09-02 night shift

Select the alerts that belong to one campaign. The fourth one is your backup agent doing exactly what it was told to do.

Required

Queue

Four alerts, one correlated intrusion

Multi-select the alerts to include in the incident. No rows selected
Alert	Severity	Entity	Technique	Time (UTC)	Evidence
ALT-4401Kerberoasting activity	High	svc_backup	T1558.003	02:14	214 service tickets in 6 minutes, 3 different SPNs
ALT-4402Suspicious user account mapping (recon)	Medium	DC-01$	T1087.002	02:16	Enumerated all members of Protected Users from a workstation session
ALT-4403Active directory replication data access (DCSync)	High	it.admin.k	T1003.006	04:38	GetChangesAll on the domain naming context, from a server OS
ALT-4404Honeytoken account used	High	svc_honey01	T1187	04:40	NTLM auth attempt from 203.0.113.97 — this account must never authenticate
ALT-4405Suspicious connection to a domain controller	Low	backup-agent-02	T1087.002	03:02	Scheduled Veeam-style enumeration, matches the change record for the backup rollout

A honeytoken hit is never a false positive on its own: the account exists only to be used. Two alerts 24 seconds apart on the same account pair is correlation, not coincidence.

Objective 1

Triage decision

Required

What you do with ALT-4405 (the backup agent) Handling the clock skew on DC-03

Why the four alerts are one incident and not four (min 90 chars)

Reading the alerts

What each one really claims

Kerberoasting (4401): Service tickets requested for SPNs with weak history. It proves *requests*, not a cracked password — say so in the record.
Account mapping (4402): A machine account enumerated the privileged groups. Normal for some scanners, so look at the source: it came from a workstation session, not a service.
DCSync (4403): GetChangesAll requires replication rights. If the account legitimately has them, this is a permission design problem as much as an attack.
Honeytoken (4404): Definitive. Anything that touches it is in the environment with credentials it should not possess.
Backup enumeration (4405): Matches a change record. Suppress narrowly, with an owner and an expiry — do not turn off the detection class.

Objective 2 · 15 pts

The path is a graph, not a list of names

Six edges connect the attacker's foothold to Domain Administrators. Cutting the wrong one breaks a business process; cutting the right one removes three paths at once.

Required

Attack path AP-118

Workstation foothold → Enterprise Admins in four hops

Critical path6 edges

The highlighted edge is the one the graph engine scores as the shortest exploitable hop with the highest exposure. Read the table before you decide whether you agree with it.

Edges

Select the single edge you cut today

Single select. No row selected
Edge	Rights	Exploitable now?	Cost of removing
svc_print → Helpdesk	Reset password on 410 non-privileged accounts	Yes	Self-service password reset stops working
Helpdesk → it.admin.k	GenericAll on 3 accounts, one of them a DA	Yes	None — the right was granted by mistake in 2021
it.admin.k → APP-SRV-01	Unconstrained delegation on a server running an unsupported app	Yes — already used in the alert chain	Medium — needs a service account replacement plan
svc_backup → Account Operators	Create and manage groups	Suspected (4401)	Backup job must move to a scoped gMSA
APP-SRV-01 → DC-01	Domain Admins membership	Yes	Breaking — the payroll batch runs as this account
FIN-WKS-0777 → svc_print	Local admin to saved credentials	Yes	None — rotate and remove the saved credential

Removing the delegation edge (EDGE-3) removes the already-used hop and does not stop a business process; EDGE-5 is the true crown but cannot be cut before the batch job is fixed. That trade-off is the whole exercise.

Objective 2

Justify the cut

Required

Objective 3 · 10 pts

Who asked the domain controller for replication data?

One query, one answer, and a follow-up decision based on your own result.

Required

Query

DCSync-style replication requests, last 30 days

Requirements: start from IdentityDirectoryEvents, bound the window, keep only ActionType == 'DirectoryServiceReplicationGetChangesAll', and summarise by AccountName. Then state what you do about the result.

KQL

Available: IdentityDirectoryEvents, IdentityLogonEvents, IdentityInfo, DeviceProcessEvents, DeviceNetworkEvents, AlertInfo.

Objective 3

Interpret the result

Required

Objective 4 · 20 pts

it.admin.k — risk confirmed, and the order is the whole point

A password reset alone does not stop a stolen refresh token. Perform the actions in the order that actually removes access, using the action bar below; each click is recorded.

RequiredRisk level: high

User at risk

Detected anomalies

Risk state: Confirmed compromised risk
Detections: Anonymous IP address · Atypical travel (11 minutes, impossible) · Malicious IP login
Last sign-in: 2026-09-02 04:36 UTC · from 203.0.113.97 · Chrome on Windows
Sessions today: 3 · 1 with a refresh token minted at 04:37
License / policy: P2 · MFA registered (FIDO2 + phone) · self-service reset enabled
On-premises: Domain account enabled · member of Domain Admins (via APP-SRV-01 path)
Protection state: Not blocked on-premises — a cloud disable does not stop Kerberos tickets

The last line is the trap.

Disabling the cloud account and resetting the cloud password does not affect the on-premises account while writeback is scoped away from privileged accounts. Both sides need an action, and the record must say so.

Action bar

Click in the order you would really work

The sequence you click is graded against the documented containment order. “Revoke refresh tokens” after a password reset is the mistake that leaves an attacker holding a working token for up to its lifetime.

Scope of the disable action you chose Do you require re-registration of MFA?

Around the account Kerberos ticket-granting state considered: the SPNs owned by this identity were re-keyed Mail rule and inbox-forward check run on the mailbox before it was locked Legacy authentication is now blocked for this account (or the tenant, with a documented exception) KRBTGT double-rollback discussed and deferred with a reason, not skipped

Containment note (min 160 chars, no addresses)

Objective 5 · 10 pts

Coverage is a setting you can lose by accident

Two of the “fixes” below would have removed the alert that caught this intrusion. Choose what to exclude, and why.

Required

Pending exclusion requests

Approve none, one, or two

Request	From	Would it hide this attack?
Exclude backup-agent-02 from “suspicious connection to a DC”	Infrastructure team	No — the alert name is still monitored elsewhere, and the account is not the one used
Exclude the whole “Account Operations” alert category	Service desk	Yes — it contains the enumeration that preceded the DCSync
Exclude svc_honey01 from all monitoring	Unattributed, raised at 05:01	Yes — and it is the trip-wire; a request to mute a honeytoken at 05:01 is itself an indicator
Exclude DC-03 from sensors until NTP is fixed	Server team	Yes — fix the clock instead; excluding a DC removes visibility of exactly the traffic you need

Objective 5

Configuration decision

Required

Which exclusion request do you approve? Honeytoken account: what makes it usable as a control

Coverage checks Every domain controller still reports a healthy sensor after the change The 05:01 request to mute svc_honey01 is recorded in the incident as suspicious Exclusions are documented in the runbook with owner and expiry

Objective 6 · 20 pts

Four actions this sprint, one exception with a date

The path exists because of permissions, protocols and hygiene. Pick what you can land in two weeks without breaking payroll, and write down what you are deliberately not doing yet.

Required

Candidate mitigations

Select exactly four to schedule now

Multi-select exactly four. No rows selected
ID	Mitigation	Blocks	Effort	Breaks
MIT-1	Remove unconstrained delegation from APP-SRV-01; replace with resource-based constrained delegationDirectly removes the exploited edge EDGE-3	T1558.004	Medium	Nothing if the SPN is migrated in the same window
MIT-2	Revoke GenericAll on it.admin.k from the Helpdesk groupCloses the mistaken 2021 grant	T1098.001	Low	Nothing
MIT-3	Move svc_backup to a gMSA with a 40-character password and remove its interactive logon rightKerberoasting target becomes unkernelable	T1558.003	Medium	Backup job must be re-pointed (planned)
MIT-4	Add all tier-0 and privileged accounts to Protected UsersNo NTLM, weaker encryption, no cached creds	T1558.004	Medium	Legacy agents using NTLM break — audit first
MIT-5	Disable LDAP signing enforcement to reduce help-desk tickets	nothing — helps the attacker	Low	Sensitive-data exposure (T1021.005)
MIT-6	Set the domain functional level to 2016 and enable SAM-R filtering only	partly	Low	Nothing, but it does not address this path
MIT-7	Deploy LAPS across all workstations and remove local admin from every userRemoves the credential source at the foothold	T1078	High	Two apps need elevation — use a broker

MIT-5 and MIT-6 are the two options that look like hardening and are not. Choosing “all of the above” is exactly how a sprint becomes a slide.

Objective 6

Decisions and the exception

Required

NTLM on servers KRBTGT rollback Service accounts: dMSA vs gMSA Exception you accept today

Compensating control while that exception is open (min 90 chars)

Objective 7 · 15 pts

What you can say, and to whom, by when

The tenant is an EU hospital group: an essential entity under NIS2, personal data of patients in the affected file share, and no financial-services oversight. The regulator clocks are different from last week's bank.

Required

Evidence at 06:00 UTC

Confirmed, indicated, unknown

Claim	Status	Because
Credential material for svc_backup was requested (Kerberoasting pattern)	Confirmed	214 service tickets in 6 minutes; honeytoken tripped 2 h later
Replication data was read from DC-01 by an account without a right to it	Confirmed	GetChangesAll from 203.0.113.97 · source host is not a DC
The svc_backup password was cracked and used	Indicated	Logon from an anomalous source after the ticket storm — no offline-cracking artefact
Patient-identifying data was exfiltrated	Not established	9.7 MB staged, upload failed; no egress confirmed
Two more accounts were mapped but not used	Confirmed	Directory enumeration events; no authentication followed

A regulator-facing summary that upgrades “indicated” to “confirmed” is not confidence, it is a defect — and it is the sentence that gets quoted back at you.

Objective 7

Notification decision

Required

Which clock applies to the competent authority? GDPR Article 33 for the patient data Who is told at 06:15, before any filing Where does the “indicated” claim go?

Executive summary (min 200 chars, no addresses or names of people)

Reference

Marking, deliberate traps, and what this lab cannot teach

Marking

How the 100 points are awarded

#	Objective	Pts	Validated behaviour
1	Alert triage	10	Exactly the four campaign alerts selected, the backup alert handled as a false positive with a narrow suppression, skew acknowledged, correlation argued in writing
2	Attack path	15	One edge chosen (the already-used delegation hop), the Domain Admins trade-off understood, a path the graph cannot see described
3	Directory hunt	10	Bounded KQL over IdentityDirectoryEvents returning exactly the two accounts, plus the correct legitimate-vs-abuse reading
4	Risky user remediation	20	Documented order of actions, both cloud and on-premises disable, refresh-token revocation before the password reset, no deletion, four surrounding checks, containment note
5	Detection coverage	10	Only the narrowly scoped exclusion approved, honeytoken properties correct, three coverage checks confirmed
6	Hardening	20	Exactly four feasible mitigations (not the two decoys), NTLM audited before enforced, KRBTGT deferred with a reason, a real compensating control for the accepted exception
7	Report & notify	15	NIS2 clocks (not DORA) chosen for this entity, Article 33 handled on risk, confirmed/indicated distinction preserved, 200-character summary without personal data

Traps in this lab

Six things that cost points on purpose

“Both DCSync accounts are attacks.” One is the sync account by design. Verify the source host before you disable a connector and stop the directory synchronising.
Password reset before token revocation. The refresh token keeps minting access tokens after the reset; the attacker does not notice for hours.
Cloud-only disable of a hybrid account. On-premises Kerberos keeps working; the record must state both actions.
Excluding an alert category to please a queue. Approve the narrow request, refuse the category, and treat a 05:01 request to mute the honeytoken as an indicator.
Disabling LDAP signing as “hardening”. It is the opposite; the option is there to be resisted.
Importing last week's regulator. DORA's four-hour clock belongs to financial entities. This tenant is an essential entity under NIS2 with GDPR duties — read the entity, not the habit.

Standards mapped

MITRE ATT&CK for enterprise: T1558.003, T1558.004, T1003.006, T1098.001, T1187, T1087.002, T1078. Process: NIST SP 800-61r3 §3.3 containment and §3.4 eradication/recovery; ISO/IEC 27001:2022 A.5.15, A.5.17, A.8.2 (privileged access), A.8.16 (monitoring). Timelines: NIS2 Art. 23(4), GDPR Art. 33/34. Training aid only, not certification preparation, and not affiliated with or endorsed by Microsoft.

Limits

What this replica cannot teach you

No directory is queried, so you will not learn the PowerShell module, repadmin output or the shape of a real replication metadata dump.
No Entra tenant, so the portals' latency, licensing gates and conditional-access evaluation What-If are absent.
Six tables with a handful of rows: real hunting is dominated by schema discovery, retention surprises and query cost, not syntax.
Nothing here rehearses the human part: the 06:15 phone call, the trust you lose by over-claiming, the negotiating with the payroll team about a two-week fix.

Everything is deterministic and offline; the state lives in your browser's localStorage and is wiped by the reset control.

Data & access

Synthetic identifiers, accessible controls

Kind	In this lab	Rule
Accounts	svc_backup · it.admin.k · svc_honey01	Invented; no real UPNs, no directory suffixes outside `.example`
Hosts	DC-01 · APP-SRV-01 · FIN-WKS-0777	Role-prefixed, local only
Addresses	203.0.113.97 · 2001:db8::ff:1	RFC 5737 / RFC 4193 documentation ranges
Graph	Hand-drawn SVG	No vendor iconography, no Microsoft marks

The path diagram carries a full aria-label description and the notes table repeats every edge in text, so nothing important exists only as a picture. Actions are real buttons with visible focus; the sequence state is announced in a live region; forced-colours and reduced-motion are honoured by the shared stylesheet.

Series compliance standard →