Educational Platform · Safe Lab Environment · Beginner Friendly

Master Active Directory Security Visually.

Learn enterprise security workflows, AD attack paths, and defensive concepts through beginner-friendly interactive simulations — no prior experience required.

Start Learning Open Virtual Lab Visit Main Website
6
Learning Stages
40+
Concepts Covered
100%
Safe & Educational
Domain Controller
lab.local
Privilege Paths Found
3 paths
⬆ Review recommended
Auth Protocol
Kerberos v5
AD
Active Directory Focus
6+
Security Tools Covered
0
Real Exploits — Safe Only
∞
Lab Simulations
Curriculum

Security Tools,
Explained Safely.

Understand how enterprise security tools operate conceptually — focused entirely on defensive awareness and educational understanding.

🛡️
Educational Environment Only. All tool demonstrations are theoretical, conceptual, and designed for safe learning. No real credentials, no live systems, no operational attack guidance.
🕸️
BloodHound
Visualize Active Directory relationships, privilege paths, and attack surface. Understand how domains are mapped for security review.
AD Mapping Graph Analysis Privilege Paths
🔐
Mimikatz (Theory)
Understand Windows credential security concepts, LSASS theory, and why credential protection is critical in enterprise environments.
Credential Security Windows Auth Defensive
📡
Impacket
Learn SMB, LDAP, and Kerberos protocol interactions. Understand how enterprise authentication workflows function at a protocol level.
Protocols Kerberos SMB/LDAP
🗺️
CrackMapExec
Network visibility and authentication auditing concepts. Learn how security teams assess enterprise environments for credential policy compliance.
Network Audit Auth Testing Inventory
🎯
Cobalt Strike (Concepts)
High-level red team operation concepts, C2 communication theory, and how SOC teams detect and respond to adversary simulation activities.
Red Team Ops C2 Theory Detection
⚡
Sliver
Modern red team framework architecture concepts. Understand how adversary simulation teams collaborate and how defenders detect this activity.
Modern C2 Adversary Sim SOC Response
Interactive Lab

Virtual
Enterprise Environment.

Explore a simulated Active Directory environment. Run educational commands, observe safe outputs, and understand how enterprise networks are structured.

Edwhere Virtual Lab — lab.local [Educational Simulation]
● SAFE MODE
Environment
Overview
BloodHound
Impacket
CrackMapExec
Domain Objects
DC01.lab.local
Users (14)
Groups (8)
Computers (6)
Overview
BloodHound
Impacket
CME
edwhere@lab:~$ echo "Welcome to Edwhere Virtual Lab"
Welcome to Edwhere Virtual Lab
edwhere@lab:~$ nmap -sP 192.168.1.0/24 --educational
Starting educational network scan...
Host: 192.168.1.10 [DC01.lab.local] Status: Up
Host: 192.168.1.20 [WS01.lab.local] Status: Up
Host: 192.168.1.21 [WS02.lab.local] Status: Up
Host: 192.168.1.30 [SRV01.lab.local] Status: Up
4 hosts discovered in simulated lab environment
edwhere@lab:~$ whoami
LAB\student01 (Domain User)
edwhere@lab:~$
edwhere@lab:~$ bloodhound-python --help
usage: bloodhound-python [-h] [-c COLLECTIONMETHOD] [-d DOMAIN]
[-u USERNAME] [--dns-tcp] [--zip]
Options:
-c Collection method (Default, All, Group, LocalAdmin, Session)
-d Target domain (e.g. lab.local)
-u Username for authentication
edwhere@lab:~$ bloodhound-python -d lab.local -c Default --simulate
INFO: Found AD domain: lab.local
INFO: Connecting to LDAP server: DC01.lab.local
INFO: Found 14 users
INFO: Found 8 groups
INFO: Found 6 computers
INFO: 3 privilege escalation paths identified for review
INFO: Collection complete — data ready for graph visualization
edwhere@lab:~$
edwhere@lab:~$ impacket-smbclient --help
Impacket v0.12.0 - Educational SMB Client
usage: smbclient [-h] [-port PORT] [-debug] target
Educational tool for understanding SMB protocol interactions
edwhere@lab:~$ impacket-lookupsid --help
usage: lookupsid [-h] target
Domain SID lookup for educational AD enumeration understanding
edwhere@lab:~$ impacket-lookupsid lab.local/student01@DC01 --simulate
Impacket: Connecting to DC01.lab.local
Domain SID: S-1-5-21-1234567890-987654321-1122334455
500: LAB\Administrator (User)
512: LAB\Domain Admins (Group)
513: LAB\Domain Users (Group)
edwhere@lab:~$
edwhere@lab:~$ crackmapexec --help
CrackMapExec v6.x - Educational Network Auditing Tool
usage: crackmapexec [-h] [-t THREADS] {smb,ssh,rdp,ldap,winrm}
Protocols: smb | ssh | rdp | ldap | winrm
edwhere@lab:~$ crackmapexec smb 192.168.1.0/24 --simulate
SMB 192.168.1.10 445 DC01 [*] Windows Server 2022 (name:DC01) (domain:LAB)
SMB 192.168.1.20 445 WS01 [*] Windows 11 (name:WS01) (domain:LAB)
SMB 192.168.1.21 445 WS02 [*] Windows 11 (name:WS02) (domain:LAB)
SMB 192.168.1.30 445 SRV01 [*] Windows Server 2019 (name:SRV01) (domain:LAB)
Network inventory complete — 4 hosts discovered
edwhere@lab:~$
edwhere@lab:~$
BloodHound

Active Directory
Relationship Mapping.

BloodHound uses graph theory to reveal hidden privilege relationships in Active Directory environments. Security teams use it to understand exposure and review permissions.

01
Graph-Based Analysis
Represents AD relationships as nodes and edges. Users, groups, computers, and their connections are visualized as a searchable graph.
02
Privilege Path Discovery
Identifies shortest paths to high-privilege accounts like Domain Admins, helping security teams prioritize remediation.
03
Defensive Visibility
Security teams use BloodHound to find and fix over-permissioned accounts before adversaries can exploit them.
04
LDAP Data Collection
Collects domain information via standard LDAP queries — no special privileges required for basic enumeration.
Domain Controller
Domain Admin
Regular User
Group
Computer
Mimikatz · Educational Theory

Windows Credential
Security Concepts.

📚
Theory only. This section covers conceptual understanding of credential security to help defenders understand what they're protecting, not how to attack it.

Understanding how Windows handles credentials in memory helps security teams build better defenses. Credential protection is a fundamental enterprise security control.

01
LSASS Process Security
Local Security Authority Subsystem Service (LSASS) handles Windows authentication. Modern defenses include Credential Guard, Protected Process Light, and Windows Defender Credential Guard.
02
Credential Guard
Windows Defender Credential Guard uses virtualization-based security to isolate secrets, preventing extraction even with administrative access.
03
Detection Opportunities
SIEM rules, endpoint detection, and behavioral analytics can identify unusual LSASS access patterns. Defenders monitor for these indicators.
Windows Authentication Flow (Conceptual)
👤
User Login Request
Username + password entered
Step 1
↓
🔑
LSASS Processing
Credential hashing & verification
Step 2
↓
🏰
Kerberos / NTLM Auth
Protocol-level authentication
Step 3
↓
🎫
TGT Issued (Kerberos)
Ticket-Granting Ticket for session
Step 4
↓
🛡️
Credential Guard Active
VBS isolation protects secrets
Defense
Defensive Controls
🔒
Windows Credential Guard
VBS-based credential isolation
📊
SIEM Detection Rules
Alert on anomalous LSASS access
🔍
EDR Behavioral Analytics
Process injection & memory analysis
Impacket

Enterprise Protocol
Understanding.

Impacket is a Python library implementing enterprise network protocols. Security professionals use it to understand SMB, LDAP, and Kerberos interactions at a deep level.

01
SMB Protocol
Server Message Block — used for file sharing and remote administration in Windows environments. Understanding SMB helps security teams monitor lateral movement indicators.
02
Kerberos Authentication
Ticket-based authentication protocol used in Active Directory. Security teams monitor Kerberos ticket anomalies as detection opportunities.
03
LDAP Enumeration
Lightweight Directory Access Protocol allows querying directory information. Defenders monitor LDAP queries for unusual enumeration patterns.
Protocol Stack — Enterprise Communication
LAYER 7 · APPLICATION
SMB · LDAP · Kerberos · WMI
Enterprise service protocols
↕
LAYER 5–6 · SESSION
NTLM · DCE/RPC · NetBIOS
Authentication & session management
↕
LAYER 4 · TRANSPORT
TCP/UDP · Port 445 · 389 · 88
Transport layer monitoring points
↕
LAYER 3 · NETWORK
IP · ICMP · ARP
Network layer
💡 Detection tip: Unusual LDAP queries (port 389) or excessive Kerberos tickets (port 88) can indicate enumeration activity. SOC teams monitor these ports.
CrackMapExec

Network Visibility
& Audit Concepts.

CrackMapExec helps security teams assess authentication policies, enumerate network inventory, and validate security configurations across enterprise environments.

🗺️
Network Inventory
Quickly identify all SMB-enabled hosts in a subnet. Security teams use this to maintain accurate asset inventories and detect rogue devices.
🔐
Auth Policy Audit
Test whether password policies are enforced consistently. Identify hosts accepting weak or default credentials as part of security assessments.
📋
Multi-Protocol Support
Supports SMB, LDAP, RDP, WinRM, and SSH — giving security teams comprehensive coverage across enterprise authentication surfaces.
Cobalt Strike · High-Level Concepts

Red Team Operation
Lifecycle.

🎓
Conceptual overview only. This section helps defenders understand how red team operations work at a high level — purely for detection and response awareness.

Cobalt Strike is a commercial adversary simulation platform. Understanding its workflow helps Blue Team operators build better detection rules and response playbooks.

01
Team Server Architecture
Red team operators connect to a central team server. The server coordinates activities, stores collected data, and manages communication channels.
02
Beacon Communication
Beacons check in to the C2 server periodically (configurable sleep time). Defenders detect beacons by identifying periodic network connections to external hosts.
03
Detection Engineering
SOC teams create SIEM rules to detect Cobalt Strike indicators: specific TLS certificate fingerprints, JARM signatures, and anomalous HTTP patterns.
C2 Detection Lifecycle (Defensive View)
🔴 Simulated Red Team Activity
Beacon deploys, begins check-ins
Initial Access
↓
📡 Network Traffic Generated
HTTPS/DNS beaconing to C2 server
Beaconing
↓
🚨 SIEM Alert Triggered
Periodic connection pattern detected
Detected
↓
🔍 SOC Investigation
Analyst reviews alert, confirms IoC
Response
↓
🛡️ Containment & Review
Isolate host, document findings
Remediated
Sliver

Modern Red Team
Framework Concepts.

Sliver is an open-source adversary simulation framework. Security teams use it for authorized penetration tests and red team exercises to understand attacker techniques from a defensive perspective.

01
mTLS & WireGuard C2
Sliver supports mutual TLS and WireGuard for C2 communications. Detection involves monitoring for unusual certificate patterns and VPN-like traffic from workstations.
02
Implant Architecture
Cross-platform implants compiled on-demand. Defenders use binary analysis, memory scanning, and behavioral detection to identify implant activity.
03
Team Collaboration
Multiple operators can connect to a single Sliver server, enabling coordinated red team exercises with shared visibility across the engagement.
Detection Architecture
🎯
Implant Detection
AV/EDR behavioral analysis, memory scanning, anomalous parent-child process relationships
📊
Network-Level Detection
mTLS fingerprinting, JARM scoring, anomalous certificate chains from internal hosts
🛡️
Response Playbooks
Isolate affected host, pull memory dump, review process tree, document IoCs, patch vector
Visual Workflows

How It All
Connects.

Understand the full security lifecycle — from reconnaissance to detection. Each workflow shows how tools fit into the enterprise security story.

1
Domain Reconnaissance
Security analyst connects to the Active Directory environment and begins collecting domain data via standard LDAP queries. BloodHound ingests user, group, and computer objects.
bloodhound-python -d lab.local -c Default
2
Graph Data Ingestion
Collected JSON data is imported into BloodHound's Neo4j graph database. Nodes (users, groups, computers) and edges (permissions, sessions, trusts) are created.
BloodHound UI → Import Data
3
Privilege Path Analysis
Analysts query "Shortest Paths to Domain Admins" to understand which accounts have indirect privilege escalation paths through group memberships and ACL relationships.
Cypher Query → Path Analysis
4
Risk Visualization
High-risk paths are identified and prioritized. Security teams use the visualization to explain complex permission relationships to stakeholders and plan remediation.
BloodHound → Node Details
5
Security Review & Remediation
Teams remove unnecessary group memberships, fix dangerous ACLs, and implement least-privilege. BloodHound is re-run after changes to verify improvement.
AD Hardening → Re-validation
BloodHound Analysis Flow
🏢 AD Environment
lab.local domain
Source
↓ LDAP Collection
📊 Graph Database
Neo4j nodes & edges
Stored
↓ Cypher Queries
🕸️ Privilege Paths
3 paths to Domain Admin
Identified
↓ Security Review
🛡️ Remediation Plan
Remove risky permissions
Action
1
Protocol Discovery
Security team maps available enterprise protocols on the network. SMB (445), LDAP (389), Kerberos (88), and WMI are commonly found in Windows environments.
Port scan → Service enumeration
2
Authentication Flow Analysis
Analysts use Impacket to understand how authentication works at the protocol level. Understanding request/response patterns helps build detection signatures.
impacket-lookupsid lab.local/user@DC01
3
Kerberos Ticket Analysis
Security teams examine how Kerberos tickets are requested and used. Anomalous ticket patterns (e.g., unusual encryption types) serve as detection indicators.
Wireshark + Kerberos dissectors
4
Detection Signature Creation
Knowledge of protocol behavior enables creating precise SIEM rules that detect abnormal patterns without generating false positives.
SIEM → Sigma Rules
Enterprise Protocol Stack
👤 Client Workstation
Initiates auth request
Client
↓ Kerberos AS-REQ (port 88)
🏰 Domain Controller
Issues TGT via KDC
KDC
↓ TGT → TGS-REQ
🎫 Service Ticket
TGS issued for target resource
Ticket
↓ SMB Auth (port 445)
📁 Resource Access
Authenticated connection
Access
1
Red Team Engagement Begins
Authorized red team deploys a C2 implant in a simulated engagement. The implant begins periodic beacon check-ins to the team server over HTTPS or DNS.
Authorized engagement only
2
Beaconing Traffic Generated
Network sensors capture periodic outbound connections. The regularity of beacon sleep intervals creates a distinctive pattern visible in network flow data.
NetFlow → SIEM ingestion
3
SIEM Alert Generated
Detection rules fire on periodic connection patterns, known C2 certificate fingerprints (JARM), or anomalous DNS query patterns to uncategorized domains.
Elastic SIEM → Alert triggered
4
SOC Analyst Investigates
Analyst reviews the alert, correlates with endpoint telemetry, examines process tree, and determines if the activity matches known red team IoCs or is a real threat.
EDR → Process investigation
5
Red Team Debrief
Red and Blue teams share findings. Detection gaps are identified, new detection rules are created, and defensive improvements are documented.
Purple Team debrief session
C2 Detection & Response
🔴 Implant Active
60s sleep, HTTPS beacon
Active
↓
📡 Network Sensor
Periodic outbound captured
Captured
↓
🚨 SIEM Alert
JARM fingerprint match
Alert
↓
🔍 SOC Response
Isolate, investigate, document
Response
1
Continuous AD Monitoring
Deploy agents and collectors that feed Active Directory event logs (4624, 4672, 4768, 4769) into a centralized SIEM for analysis and alerting.
Windows Event Logs → SIEM
2
Privilege Use Baselining
Establish normal behavior for privileged accounts. Any deviation — unusual login times, new machines, off-hours access — triggers investigation.
UEBA → Behavioral baseline
3
BloodHound Periodic Review
Run BloodHound assessments quarterly or after any major AD changes. Track privilege path count as a security metric — fewer paths means better security posture.
BloodHound → Security metrics
4
Tiered Administration Model
Implement Microsoft's AD Tier model — separate accounts for Tier 0 (DCs), Tier 1 (servers), and Tier 2 (workstations). Prevents lateral movement privilege escalation.
AD Tiering → PAW deployment
Defensive Security Cycle
📊 Collect & Ingest
AD logs → SIEM
Collect
↓
🔍 Detect & Alert
Rules fire on anomalies
Detect
↓
🚨 Investigate & Triage
SOC analyst reviews
Triage
↓
🛡️ Remediate & Harden
Fix, document, improve
Harden
Commands & Concepts

Safe Educational
Command Reference.

Every command explained with purpose, syntax, and simulated output. Designed for beginner understanding of enterprise security tooling.

BloodHound
Impacket
CrackMapExec
AD Commands
bloodhound-python --help
Help / Discovery
Displays all available options and collection methods. Use this as your starting point to understand what BloodHound can collect from an AD environment.
bloodhound-python --help
usage: bloodhound-python [-h] [-c COLLECTIONMETHOD] [-d DOMAIN] [-u USERNAME] Collection methods: Default, All, Group, LocalAdmin Default: Users, Groups, Computers, Sessions All: Everything including ACLs and GPOs
bloodhound-python -d lab.local
Collection
Connects to the target domain and begins collecting AD relationship data via LDAP. This is a standard security assessment activity in authorized environments.
bloodhound-python -d lab.local -u student01 -p [password] -c Default
INFO: Found AD domain: lab.local INFO: Connecting to LDAP: DC01.lab.local INFO: Found 14 users, 8 groups, 6 computers INFO: Collection complete — JSON files created
impacket-smbclient --help
Help / Discovery
Shows SMB client options. Understanding SMB shares is fundamental to Windows network security — shares are a common place where sensitive data is inadvertently exposed.
impacket-smbclient --help
Impacket v0.12.0 - SMB Client usage: smbclient [-h] [-port PORT] [-debug] target target: [[domain/]username[:password]@]<targetName> Connects to SMB service for share enumeration
impacket-lookupsid --help
SID Enumeration
SID brute-forcing resolves domain user/group names. Security teams use this to validate AD inventory completeness and understand domain trust relationships.
impacket-lookupsid domain/user:pass@target
Domain SID: S-1-5-21-1234567890-... 500: LAB\Administrator (User) 512: LAB\Domain Admins (Group) 513: LAB\Domain Users (Group)
crackmapexec --help
Help / Overview
Displays available protocols and options. CME supports SMB, SSH, RDP, LDAP, and WinRM — covering the full range of Windows remote management protocols.
crackmapexec --help
CrackMapExec v6.x - Swiss Army knife for pentesting usage: crackmapexec [-h] [-t THREADS] {smb,ssh,rdp,ldap,winrm,mssql} -t: Number of threads (default: 100)
crackmapexec smb [subnet]
Network Audit
Discovers SMB hosts and enumerates basic information. Used in security audits to build accurate network inventory and identify unpatched or misconfigured hosts.
crackmapexec smb 192.168.1.0/24
SMB 192.168.1.10 445 DC01 [*] Windows Server 2022 SMB 192.168.1.20 445 WS01 [*] Windows 11 Signing:True SMBv1:False (SMB signing status affects relay attack risk)
Get-ADUser -Filter *
PowerShell AD
Lists all AD users. This is a standard administrative command. Security teams monitor excessive usage of AD enumeration commands as a detection indicator.
Get-ADUser -Filter * -Properties Name,Enabled,LastLogonDate
Name Enabled LastLogon Administrator True 2024-01-15 student01 True 2024-01-20 svc-backup True 2024-01-01
Get-ADGroupMember
Group Enumeration
Lists members of an AD group. Auditing Domain Admins and privileged groups is a fundamental security hygiene task — groups should have only necessary members.
Get-ADGroupMember "Domain Admins" | Select Name
Name ---- Administrator krbtgt (service account) [Minimize membership for security]
Learning Roadmap

Your Path to
AD Security Mastery.

Six structured stages from zero to enterprise-grade security understanding. Each stage builds on the previous.

1
Enterprise Networking Foundations
Beginner
Master the networking protocols that underpin every Windows enterprise environment. Without this foundation, advanced concepts won't stick.
TCP/IP Fundamentals DNS Resolution DHCP Authentication Basics Kerberos Overview LDAP Introduction SMB Protocol
2
Active Directory Architecture
Beginner-Intermediate
Understand how Active Directory organizes enterprise identities, permissions, and trust relationships across the domain.
Domain & Forest Structure Users & Groups GPOs Privilege Levels Trust Relationships OUs & Delegation ACLs & Permissions
3
BloodHound & Privilege Analysis
Intermediate
Learn to map and visualize AD relationships using BloodHound. Understand how privilege paths are identified and remediated.
Graph Theory Basics BloodHound Setup Data Collection Privilege Path Analysis Cypher Queries Remediation Strategies
4
Impacket & Protocol Deep Dives
Intermediate
Explore enterprise protocols hands-on using Impacket. Understand authentication workflows, remote management, and network communication patterns.
SMB Deep Dive Kerberos Mechanics NTLM vs Kerberos CrackMapExec Auditing Remote Admin Concepts Network Enumeration
5
Detection Engineering & Monitoring
Intermediate-Advanced
Build the defender mindset. Learn how SIEM rules, EDR policies, and monitoring frameworks detect and alert on adversarial activity.
SIEM Fundamentals Sigma Rules Windows Event Logs EDR & Behavioral Analytics MITRE ATT&CK Framework Incident Response Basics
6
Red Team Concepts & Purple Teaming
Advanced
Understand adversary simulation at a conceptual level. Learn how red team engagements work and how Blue Team uses findings to improve defenses.
Red Team Methodology Adversary Simulation C2 Architecture (Theory) Purple Team Exercises Detection Engineering Security Operations
Begin Your Journey

Ready to Learn Active
Directory Security?

Start with Stage 1 and work your way up. Each module builds practical, defensively-focused knowledge in a safe, beginner-friendly environment.

Start Learning Free Open Virtual Lab

100% educational. No real exploits. Safe authorized lab environment only.