TCL-Internship/Challenges/Silent_Forest at main · HaydnZK/TCL-Internship
Haydn K. — Lead Community Operator
Case Study: Active Directory Control Failures and SIEM Visibility Gaps
During my internship with The Cyber Ledger, I worked through an intense Active Directory incident response project called Silent Forest. For this scenario, I stepped into the role of SOC L3 and Detection Engineering Lead to perform a complete post-mortem of a domain-wide takeover.
The attack chain moved fast, escalating from a password spray to full domain control via a DCSync attack and KRBTGT compromise within six hours. What made this a massive learning experience was that the compromise actually survived initial remediation efforts due to an incomplete KRBTGT cleanup.
My job was to audit the telemetry failures and build the blueprint to fix them. Here are the core areas I focused on:
The Telemetry Failure Split: I classified our visibility gaps into three operational buckets. Telemetry Not Enabled (missing PowerShell script block logging and advanced Azure AD auditing), Telemetry Present but Not Correlated (unlinked log anomalies), and Alerts Generated but Not Operationalized (ignored identity alerts).
Endpoint Control Failures: I analyzed how the attacker easily disabled Microsoft Defender real-time monitoring via PowerShell, tracing the issue back to weak GPO privilege governance, lack of change monitoring on security policy objects, and missing tenant-level tamper protection.
The Persistence Flaw: The reason the attack survived remediation came down to a single rotation of the KRBTGT account. Because the initial team didn't perform a double rotation, previously forged Golden Tickets remained valid within their lifetime window, giving the attacker a quiet backdoor right back into the environment.
To bridge the gap between technical detection and business risk, I authored a comprehensive 30-60-90 Day Security Hardening Plan mapped directly to ISO 27001 Annex A controls. The plan prioritizes immediate domain controller log ingestion and DCSync detection rules in the first 30 days, moves into restricting replication permissions and expanding PowerShell transcription by day 60, and finishes with purple team validation exercises by day 90.
I also built a SIEM Improvement Blueprint to shift our monitoring away from isolated alerts and move toward behavior-based correlation rules that focus on high-risk, identity-centric attack paths.
The project was a fantastic exercise in looking beyond the malware to fix the underlying identity and engineering gaps that let an adversary succeed.
You can find the full breakdown, the visibility matrix, and the exact 30-60-90 day hardening roadmap in my repository here: https://github.com/HaydnZK/TCL-Internship/tree/main/Challenges/Silent_Forest
1 reactions · 0 comments