دوره آموزش MCSE Security Engineering

توضیحات

شرح دوره

MCSE Security Engineering

معرفی و فلسفه دوره

دوره مهندسی امنیت زیرساخت مایکروسافت با هدف پر کردن شکاف بزرگ میان «مدیریت سنتی ویندوز سرور» و «امنیت تهاجمی/تدافعی سازمانی» طراحی شده است. در این دوره، دانشجویان صرفاً کانفیگ و راه‌اندازی رول‌های سرور را نمی‌آموزند؛ بلکه از سطح معماری عمیق سیستم‌عامل (User/Kernel Mode, PE, Win32 API, Token Manipulation, SRM) وارد سازوکار داخلی سرویس‌های حیاتی مانند اکتیودایرکتوری، کربروس، AD CS و AD FS می‌شوند.

این سرفصل‌ها به‌گونه‌ای چیده شده‌اند که دانشجو تکنیک‌های اکسپلویت و بردار حملات را به‌صورت عملی بررسی کرده و سپس استراتژی‌های مقاوم‌سازی (Hardening)، تحلیل ریسک و معماری‌های نوین هویتی مانند Tier Model و Enterprise Access Model را طبق الگوهای Windows Server 2025 و استانداردهای CIS Benchmarks پیاده‌سازی می‌کند.

• Network plus
• Security plus

۲. اهداف آموزشی دوره

در پایان این دوره، دانش‌آموختگان قادر خواهند بود:

1. ساختار درونی سیستم‌عامل ویندوز، فرایندها، هندل‌ها، توکن‌های امنیتی و فراخوانی‌های سیستمی (System Calls) را برای تحلیل رفتارهای بدافزاری و مهار حملات درک کنند.
2. پروتکل‌های احراز هویت دامین (NTLM و Kerberos) را در سطح جریان بسته‌ها و ساختار تیکت/PAC موشکافی کرده و از اکسپلویت‌های پیچیده جلوگیری کنند.
3. زنجیره‌های حمله و رله مدرن (PetitPotam, Coercion Chains, Relay to LDAP/RPC) را تحلیل، شبیه‌سازی و خنثی سازند.
4. زیرساخت کلید عمومی اکتیودایرکتوری (AD CS) را ممیزی کرده و بردارهای سوءاستفاده کلاسیک و مدرن (از ESC1 تا ESC16) را برطرف نمایند.
5. بردارهای حمله مبتنی بر دسترسی‌های نادرست ACL و ساختار شیءهای اکتیودایرکتوری را با ابزارهایی مانند BloodHound و PowerView کشف و ترمیم کنند.
6. معماری‌های اعطای کمترین سطح دسترسی و حفاظت از هویت‌های ممتاز (LAPS, gMSA, dMSA, PAM, JEA) را مطابق جدیدترین متدهای Server 2025 پیاده‌سازی نمایند.
7. تمامی سرویس‌های پیرامونی شبکه (DNS, DHCP, WSUS, IIS, NPS, AD FS, AD RMS, Firewall) را بر اساس چک‌لیست‌های CIS Benchmarks پایدار و امن‌سازی کنند.

 

۳. مخاطبان هدف

• مهندسان ارشد امنیت شبکه و زیرساخت (Security Engineers)
• کارشناسان تیم قرمز (Red Teamers) و آزمون‌نفوذ داخلی (Internal Penetration Testers)
• تحلیل‌گران سطح ۲ و ۳ مراکز عملیات امنیت (SOC Analysts Tier 2/3) و کارشناسان تیم آبی (Blue Teamers)
• مدیران ارشد سیستم و زیرساخت اکتیودایرکتوری (Enterprise System Administrators)
• معماران هویت و دسترسی سازمانی (IAM Architects)

سر فصل دوره MCSE Security Engineering 

 

Chapter 1: Course Foundations & Lab Environment

1.1 Prerequisites Bridge

• OSI / TCP-IP model recap (CompTIA Network+)
• AAA, CIA triad, PKI basics recap (CompTIA Security+)
• Windows Server editions & licensing overview

1.2 Core Infrastructure Basics

• Windows Server installation, Server Core vs Desktop Experience
• Hyper-V fundamentals
• Windows Containers & Nano Server overview
• Storage Spaces & Storage Spaces Direct
• Software-Defined Networking overview

1.3 Lab Setup

• Domain controller, member server, Windows client topology
• Central log collection setup (Windows Event Forwarding / SIEM sink)

1.4 PowerShell for Windows Administration

• PowerShell fundamentals
• PowerShell Remoting (WinRM/PSRemoting)
• PowerShell logging (Module, Script Block, Transcription)

Chapter 2: Windows OS Internals

2.1 Windows Architecture Fundamentals

• NT Architecture, User Mode / Kernel Mode
• Kernel, Executive, Win32, Native API
• System Calls, dll

2.2 PE / EXE / DLL & Code Execution

• PE Headers, Sections, Entry Point
• Import/Export Table, IAT/EAT
• Loader mechanics & DLL search order
• Attacks: DLL Hijacking / sideloading

2.3 Processes, Threads, Objects & Handles

• Process & thread fundamentals, PID/TID, parent/child, sessions
• Object Manager, Object Types, Handle Table, Access Rights, Object Namespace
• Attacks: process tampering concepts, handle duplication

2.4 Windows Security Model

• SID & Security Principals (SID, RID, well-known SID, service SID, virtual account)
• Access Tokens (primary/impersonation, groups, privileges, integrity level, logon session, linked token, UAC)
• Token manipulation (duplication, impersonation-to-primary conversion, named-pipe impersonation)
• Security Descriptors & ACLs (DACL/SACL/ACE/SDDL/inheritance)
• Access Check & SRM, Mandatory Integrity Control
• Attacks: UAC bypass, local token-theft privilege escalation

2.5 Filesystem & Registry

• NTFS internals & permissions, share permissions, effective access
• ADS, reparse points, junctions, symlinks
• Registry architecture, hives, keys, values, registry ACLs
• Attacks: ACL abuse, world-writable paths, Run-key persistence

2.6 Windows Services

• SCM architecture, service accounts, service SIDs, service DLLs, dependencies, startup types
• Attacks: unquoted service paths, service binary replacement

2.7 Windows IPC Fundamentals

• Named Pipes: server/client, security descriptors
• RPC architecture: endpoint mapper, UUID, RPC over TCP/SMB
• COM/DCOM: CLSID/IID, COM server, DCOM–RPC relationship

2.8 Windows Networking Fundamentals

• TCP/IP stack, Winsock, ports, routing, IPv4/IPv6 recap (CompTIA Network+)
• SMB architecture, authentication, shares, NTFS vs share permissions, signing/encryption
• Attacks: SMB enumeration

2.9 Windows Local Authentication

• LSA/LSASS/SAM architecture, authentication packages, SSP, credential providers, logon sessions, LSA secrets
• NTLM architecture: challenge/response, NT hash, NTLMv2, NetNTLM, session security
• Attacks: LSASS dump & credential extraction, local Pass-the-Hash

2.10 Windows Defenses & Evasion Foundations

• AMSI architecture & scan pipeline
• AMSI bypass concepts (buffer patching, provider unregistration)
• LOLBins, syscall/API abuse concepts
• Windows Defender & ETW basics

Chapter 3: Name Resolution & DNS Fundamentals

3.1 Name Resolution Concepts

• Hosts file, NetBIOS vs DNS resolution order
• WINS architecture (legacy NetBIOS name resolution)
• LLMNR & mDNS overview

3.2 DNS Architecture

• Zones, records, forward/reverse lookup
• Primary/secondary/stub zones, forwarders, delegation

3.3 Windows DNS Server

• AD-integrated DNS zones introduction
• Dynamic DNS & secure dynamic updates
• DNS scavenging & aging

Chapter 4: Active Directory Domain Services: Architecture & Objects

4.1 AD DS Foundations

• Domain, Forest, Tree, OU, DC, GC, RODC
• dit, SYSVOL
• How AD DS depends on DNS

4.2 LDAP & ADWS

• LDAP protocol, DN, RDN, attributes, search filters
• ADWS & SOAP, Global Catalog

4.3 AD Schema

• Classes, attributes, schema extensions, Schema Admin implications

4.4 AD Replication

• Sites, USN, Invocation ID, DRSUAPI

4.5 AD Objects & ACLs

• Object ACL, ACE, extended rights, attribute-level permissions

4.6 Groups & Special Identities

• Group types & scopes, special identities

4.7 FSMO Roles

• Domain Naming Master, Infrastructure Master, RID Master, PDC Emulator, Schema Master

4.8 Trusts

• Parent/child, tree root, external, forest, shortcut trusts

4.9 Group Policy Architecture

• GPC, GPT, SYSVOL, LSDOU order, inheritance, enforcement

4.10 AdminSDHolder & SDProp

• Protected groups, adminCount, security descriptor propagation

Chapter 5: Active Directory Authentication: Kerberos & Domain NTLM

5.1 Kerberos Architecture

• KDC, AS, TGS, SPN, realm, krbtgt

5.2 Kerberos Protocol Flow

• AS-REQ/AS-REP, TGS-REQ/TGS-REP, AP-REQ/AP-REP, session keys

5.3 Ticket Structure

• TGT, service ticket, encryption, lifetime, flags, authorization data

5.4 PAC (Privilege Attribute Certificate)

• KERB_VALIDATION_INFO, SIDs, claims, resource groups, PAC signatures & KDC validation
• UnPAC-the-hash concept

5.5 Kerberos Delegation

• Unconstrained, Constrained, Protocol Transition
• Resource-Based Constrained Delegation (RBCD)

5.6 Domain NTLM & Authentication Policies

• NTLM in a domain context
• Authentication Policies & Authentication Silos
• Protected Users security group

Chapter 6: Active Directory Attacks, Detection & Hardening

6.1 Reconnaissance & Enumeration

• LDAP enumeration, anonymous exposure, BloodHound collection

6.2 Credential Attacks

• Password spraying
• AS-REP Roasting
• Kerberoasting incl. RC4-downgrade
• Pass-the-Hash, Overpass-the-Hash

6.3 Ticket Attacks

• Pass-the-Ticket, Golden Ticket, Silver Ticket
• S4U2Self / S4U2Proxy abuse, RBCD exploitation

6.4 Coercion & Relay Chains

• PetitPotam (MS-EFSRPC)
• PrinterBug/SpoolSample, DFSCoerce, ShadowCoerce
• NTLM relay to LDAP/LDAPS

6.5 GPO Abuse

• GPP/cpassword, startup scripts, scheduled tasks in GPO
• *gPCFileSysPath abuse / GPOddity technique (NTLM-relay-driven GPO takeover)*

6.6 ACL, Delegation & Identity Abuse

• AdminSDHolder abuse, SIDHistory injection, trust key abuse
• Shadow Credentials (msDS-KeyCredentialLink abuse)
• MachineAccountQuota abuse

6.7 Domain Dominance & Replication Abuse

• DCSync, DCShadow
• sAMAccountName spoofing / noPac (CVE-2021-42278 / CVE-2021-42287)

6.8 Lateral Movement

• PsExec / WMI / WinRM / DCOM-based movement

6.9 Privilege Escalation

• ACL abuse primitives: GenericAll, GenericWrite, WriteOwner, WriteDACL, AllExtendedRights, ForceChangePassword
• Group membership & GPO-linked OU ACL abuse
• *ReadGMSAPassword / ReadLAPSPassword abuse*
• Attack-path enumeration & tooling: PowerView (Get-DomainUser, Get-DomainComputer, Get-DomainObjectAcl, Find-InterestingDomainAcl, Add-DomainObjectAcl), SharpHound/BloodHound attack-path graphing, ADSearch

6.10 AD DS Hardening

• CIS Benchmark: Windows Server member server & domain controller baseline
• CIS Benchmark: Active Directory / Group Policy baseline

Chapter 7: DNS: Advanced Configuration, Attacks & Hardening

7.1 AD-Integrated DNS Deep Dive

• Replication scope, secure dynamic update enforcement

7.2 DNS Attacks

• Zone transfer abuse, dynamic update abuse, DNS enumeration, DNS as C2

7.3 Name Resolution Poisoning

• LLMNR poisoning, NBT-NS poisoning, mDNS poisoning, WINS-related exposure
• SMB signing as the actual relay mitigation

7.4 DNS & WINS Hardening

• CIS Benchmark DNS hardening
• Disabling LLMNR/NBT-NS via GPO

Chapter 8: Enterprise Identity & Privileged Access

8.1 LAPS

• Legacy Microsoft LAPS: architecture, ms-Mcs-AdmPwd
• Windows LAPS: AD-backed & Entra-backed storage, DSRM password
• Attacks: enumerating LAPS-enabled machines, extracting passwords

8.2 gMSA

• Architecture, KDS root key, managed password, deployment (IIS/SQL/scheduled tasks)
• Attacks: gMSA enumeration & password extraction

8.3 dMSA

• Fundamentals, architecture, migration from legacy service accounts
• Attack: BadSuccessor

8.4 Windows Server 2025 Identity Changes

• Local KDC & SMB/Kerberos authentication rate limiting
• PKINIT SHA-1 deprecation option
• Tightened default account lockout policy

8.5 Privileged Access Management

• Tier Model (Tier 0/1/2), Enterprise Access Model
• JIT Administration, JEA
• ESAE / bastion forest concept

Chapter 9: Active Directory Certificate Services

9.1 PKI Fundamentals

• Symmetric/asymmetric crypto, hashing, digital signatures, X.509 structure
• Root/intermediate/enterprise CA, trust chain, CRL/AIA/OCSP

9.2 Certificate Templates & Enrollment

• Template versions, EKU, key usage, enrollment permissions
• Manual / autoenrollment / web / RPC enrollment

9.3 AD CS Enumeration

• CA enumeration, template enumeration, enrollment-permission mapping

9.4 ESC1 – ESC8: Classic Escalation Paths

• ESC1 Template allows SAN
• ESC2 Any Purpose EKU
• ESC3 Enrollment Agent
• ESC4 Template ACL abuse
• ESC5 PKI object ACL abuse
• ESC6 EDITF_ATTRIBUTESUBJECTALTNAME2
• ESC7 CA permission abuse (Manage CA / Manage Certificates)
• ESC8 NTLM relay to web enrollment

9.5 ESC9 – ESC16: Modern Escalation Paths

• ESC9 No security extension
• ESC10 Weak certificate mapping
• ESC11 NTLM relay to RPC/ICPR
• ESC12 CA private key extraction via YubiHSM misconfiguration
• ESC13 Issuance policy → privileged group link
• ESC14 altSecurityIdentities abuse
• ESC15 / EKUwu application-policy abuse
• ESC16 CA-wide security extension disabled

9.6 Certificate-to-Kerberos Attacks

• PKINIT authentication flow
• UnPAC-the-hash extraction

9.7 AD CS Detection & Hardening

• Template-permission & CA-configuration hardening (CIS/Microsoft guidance)

Chapter 10: Active Directory Federation Services (AD FS)

10.1 AD FS Architecture

• Federation server, relying party trust, claims provider trust, claims rules
• Token signing/decryption certificates, MSIS internals

10.2 Federation Protocols

• SAML, WS-Fed, OIDC token issuance flow

10.3 AD FS Attacks

• Golden SAML (stolen token-signing certificate)
• DKM container abuse

10.4 AD FS Hardening

• Certificate rotation policy, DKM container ACL review, signing-key-access monitoring

Chapter 11: Active Directory Rights Management Services (AD RMS)

11.1 AD RMS Architecture

• Licensing server, certification, Service Connection Point (SCP), RMS templates

11.2 Rights-Protected Content Flow

• Publishing license, use license, RMS client

11.3 AD RMS Attacks

• SCP enumeration, RMS service-account compromise, template-permission abuse

11.4 AD RMS Hardening

• Service-account least privilege, template review, SQL back-end protection

Chapter 12: DHCP & IPAM

12.1 DHCP Architecture

• Scope, reservation, options, relay, authorization, failover

12.2 IPAM Overview

• IPAM architecture & role in enterprise DNS/DHCP management

12.3 DHCP Attacks

• Rogue DHCP, DHCP poisoning

12.4 DHCP Hardening

• AD authorization enforcement, logging, CIS baseline

Chapter 13: WSUS

13.1 WSUS Architecture

• Upstream/Downstream server, computer groups, approval workflow, content store, client targeting via GPO

13.2 WSUS Attacks

• Unsigned HTTP WSUS MITM, WSUS spoofing tooling (e.g. PyWSUS-class attacks)

13.3 WSUS Hardening

• Enforcing HTTPS/SSL for WSUS, GPO-enforced trusted publisher checks, CIS baseline guidance

Chapter 14: NPS / RADIUS

14.1 NPS Architecture

• RADIUS client/server, network policy, authentication/authorization

14.2 Authentication Methods

• PEAP, EAP, certificate-based auth, 802.1X

14.3 NPS Hardening

• Shared-secret handling, logging, CIS guidance

Chapter 15: Windows Firewall

15.1 Architecture

• Windows Filtering Platform, firewall profiles, inbound/outbound, connection security rules

15.2 Firewall Configuration

• Domain/private/public profiles, rule precedence, RPC firewall, GPO deployment

15.3 Firewall Hardening

• CIS baseline firewall rules, logging

Chapter 16: File & Storage Services

16.1 DFS Namespace & Replication

• Namespace, folder, target, referral
• Replication, SYSVOL, database, staging, conflict resolution

16.2 FSRM & Dynamic Access Control

• File screening, quotas, classification, storage reports
• Claims, Central Access Policies, resource/user/device claims

Chapter 17: IIS

17.1 IIS Architecture

• Worker process, application pool, application pool identity, config

17.2 Windows Integration

• Windows Authentication, Kerberos SPNs, application pool identity, machine account

17.3 IIS Attacks & Hardening

• Configuration exposure, machine-key attacks, IIS-to-AD attack paths
• CIS Benchmark for IIS