Active Directory Cloud IAM Exploitation ├── Kerberos Golden Ticket ├── AWS IAM Role Assumption ├── Pass-the-Hash Attacks ├── Azure AD PIM Abuse ├── DCSync Domain Replication ├── S3 Bucket Enumeration └── BloodHound AD Paths └── GCP Service Account Abuse

AWS Security Azure Security Google Cloud Security ├── IAM Access Analyzer ├── Defender for Cloud ├── Forseti Security ├── GuardDuty Threat Detect ├── PIM Conditional Access ├── Security Command Center ├── CloudTrail Analysis ├── Sentinel ML Workbooks └── Chronicle Detection └── Config Compliance Rules └── Azure AD Identity Secure

Core Fundamentals (Study Focus): ├── Windows Event Logs (Security 4624/4672) ├── Sysmon Logging (Process Creation) ├── Basic SIEM Concepts (Splunk Free/TryHackMe) ├── Network Traffic Analysis (Wireshark) └── File Integrity Monitoring (OSSEC Basics)

RED TEAM: Mimikatz - Impacket - BloodHound - CrackMapExec - Rubeus - Responder - Privilege Escalation - Network Pivoting BLUE TEAM: Splunk - Elastic - Wazuh - MITRE ATT&CK Navigator CLOUD: AWS Security Hub - Azure Sentinel - GCP Chronicle - Terraform Cloud - IAM - CloudTrail - EC2 - VPC - GauardDuty DFIR: Volatility3 - KAPE - Rekall - Autopsy - Sleuth Kit - FTK Forensic Toolkit

PURPLE TEAM VALIDATION:

RED TEAM LABS (✅ Completed): • Pass-the-Hash (Mimikatz) • Kerberoasting (Rubeus)
• PS Remoting Abuse • LSASS Credential Dump

BLUE TEAM LEARNING (📚 Active): • Windows Event ID 4624 (Logon) • Event ID 4769 (Kerberos) • Sysmon Process Creation • Network Connection Logs