Lion Cipher Lab
Detect SharpHound / BloodHound Active Directory recon from telemetry
- SOC Analyst / Blue Team
- Advanced
- ~60 min
- Free · no account required
Why it matters
BloodHound is the first thing most attackers run once they have a foothold in Active Directory: SharpHound, its collector, maps every user, group, computer and permission so the attacker can find the shortest path to Domain Admin. The good news for a defender is that this mapping is LOUD — it fans out thousands of LDAP queries and touches hundreds of machines in minutes. If your SOC can spot that footprint, you catch the intrusion during reconnaissance, before privilege escalation. Miss it, and the next thing you see is a domain compromise. This lab teaches you the exact events to hunt, a…
What you'll learn
- Active Directory attack detection
- Windows Security event analysis (4662 / 5145 / 4624)
- Get-WinEvent XPath filtering
- behavioral fan-out analytics
- SACL honey-object tripwires
- directory-service (1644) LDAP query logging
Steps in this lab
- The idea: recon is loud, so make the noise work for you
- The telemetry map — the exact events that light up
- Turn on the auditing that actually produces 4662 and 5145
- Turn on the DC's own LDAP query logging (event 1644)
- Build the synthetic log you'll hunt (key-free, offline)
- The analytic: one account, an anomalous fan-out of distinct computers
- The same hunt on a REAL Security log: Get-WinEvent XPath
- Deception assist: a honey-object SACL tripwire
- Where this breaks — name the limits out loud
- The load-bearing judgment — and where prevention fits