Active › Module 5 › Lesson 4
Lab — Auth Abuse Notes
Pack Kerberoast, AS-REP, and PtH/PtT class cards — auth abuse literacy file from $LAB_AD only.
Visual · t25_auth_abuse_lab
Lab: auth abuse pack. $LAB_AD only. Original Cyberlium.
Opening
Auth abuse pack names attack classes with mitigations — paperwork before privilege paths module.
Lessons 5-1–5-3 named Kerberoast, AS-REP, and PtH/PtT classes with defender responses. This lab merges three class cards plus a one-page mitigation matrix for $LAB_AD purple-team style reporting. No roast, dump, or PtH execution — classification and defense paperwork only. Next: Quiz — Auth Abuse Named.
1. Lab contract: auth abuse pack
Create $HOME/cyberlium-lab/t25-m05-l04-auth-abuse-lab.txt merging Kerberoast, AS-REP, and PtH/PtT cards with mitigation matrix (class → detection → remediation).
Optional: map each class to one MITRE technique ID as literacy — still no attack commands.
Command guide
Try these commands — Lab contract: auth abuse pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Auth abuse literacy — https://attack.mitre.org/tactics/TA0006/ (Credential Access tactic) Microsoft auditing — https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/ (detection baseline) adsecurity.org — https://adsecurity.org/ (technique names + mitigations)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export LAB_AD=${LAB_AD:-$HOME/cyberlium-lab/t25-ad}
cat > "$LAB_AD/notes/auth-abuse-lab.txt" <<'EOF'
auth abuse literacy checklist (YOUR lab only):
[ ] Read MITRE T1558 / T1550 pages — no attack execution
[ ] Document Event IDs defenders watch (4769, 4624, 4768)
[ ] Draft mitigation: gMSA, pre-auth, Credential Guard
[ ] Confirm RoE: never Impacket/Mimikatz/Rubeus cookbooks
EOFCommand — copy this
grep '\[ \]' "$LAB_AD/notes/auth-abuse-lab.txt" curl -sS https://attack.mitre.org/tactics/TA0006/ | head -8
Primary tools to practice this lesson: grep, curl. Reference sites: Auth abuse literacy (https://attack.mitre.org/tactics/TA0006/); Microsoft auditing (https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/); adsecurity.org (https://adsecurity.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check refusal
Grep for Rubeus, GetNPUsers, sekurlsa, secretsdump, roast, dump — remove command blocks. Pack stays named classes and mitigations.
Use fictional lab account names in examples.
3. Lock the proof
chmod 600 on the pack. Quiz next — then Privilege Paths Named.
Auth abuse literacy feeds DCSync and ACL path lessons in M6.
4. What you ship: auth abuse literacy pack for $LAB_AD
Merged Kerberoast, AS-REP, PtH/PtT cards + mitigation matrix. $LAB_AD named. NO cookbooks. chmod 600.
5. What you record before the next lesson
Date. Auth abuse pack path. $LAB_AD named. File t25-m05-l04-auth-abuse-lab.txt chmod 600.
6. Wrong vs right: stranger-domain attacks vs lab AD literacy
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Include working roast commands. Attach production hash dumps.
Right
Write YOUR auth abuse pack for $LAB_AD. chmod 600. Next: Quiz — Auth Abuse Named.
Mission: freeze YOUR auth abuse pack
1) Merge three class cards. 2) Build mitigation matrix table. 3) Confirm zero attack command blocks. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Detection + remediation columns make purple reports actionable.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: Auth abuse pack should contain mitigations not Rubeus recipes.
True or False
Knowledge Check
APPLY: Mitigation matrix should map:
Multiple choice