# AD Attack & Defense Playbook — Complete Edition (Book + Lab Kit)

> Learn to attack and defend Active Directory for real. A 203-page practitioner’s guide plus a full lab kit, 10 hands-on labs, detection rules, and…

Canonical: https://resources.codelivly.com/product/ad-attack-defense-playbook-complete-edition-book-lab-kit/
Last updated: 2026-11-14

Learn to attack and defend Active Directory for real. A 203-page practitioner’s guide plus a full lab kit, 10 hands-on labs, detection rules, and hardening scripts.

## Details

| | |
|---|---|
| Price | £49.99, on sale for £14.99 |
| Format | PDF, instant download, DRM-free |
| Language | English |
| Publisher | Codelivly |

Buy or download: https://resources.codelivly.com/product/ad-attack-defense-playbook-complete-edition-book-lab-kit/

## Description

**Active Directory runs the authentication for most of the world's companies, and it is where most real breaches end up. This is the practical guide to attacking it, defending it, and understanding both sides well enough to do either for a living.**

Most Active Directory security material falls into one of two traps. It is either pure theory that explains Kerberos in the abstract but never shows you a single attack landing, or it is a disconnected pile of commands you copy without understanding why they work or how a defender would catch them. This playbook is built to be neither.

It walks the full attack chain the way a real engagement actually unfolds, from an unauthenticated position on the network all the way to domain dominance and recovery, and it pairs every attack with the detection and the defense that stops it. You finish each chapter knowing how the technique works, how to run it, how it looks in the logs, and how to shut it down. That attacker-and-defender pairing is the whole point, and it is what separates someone who memorized a tool from someone who understands the system.

## What makes it different

- **Attack paired with defense, every time.** No technique is left as an offensive trick. Each one comes with a "Defender's Note" covering detection and hardening.
- **Hands-on, not just theory.** Every chapter ends with a practical exercise you run in your own lab, and the book ships with a full companion toolkit so you can do everything you read.
- **The whole lifecycle.** It does not stop at Domain Admin. It covers detection engineering, hardening, incident response, and forest recovery, because reaching Domain Admin is the middle of the story, not the end.
- **Realistic.** The techniques are the ones practitioners actually use, with the friction and failure modes included, not sanitized CTF tricks.

## What is inside the book

203 pages, 14 chapters across 5 parts, 20 diagrams, a glossary, and a hands-on exercise in every chapter:

- How Active Directory really works: Kerberos and NTLM internals, domains, forests, and trusts
- Building your own isolated practice lab from scratch
- Initial foothold and enumeration: LLMNR and NBT-NS poisoning, password spraying, AS-REP roasting, Kerberoasting, BloodHound
- Credential access and lateral movement: LSASS, pass-the-hash, overpass-the-hash, pass-the-ticket, DCSync
- Privilege escalation: unconstrained, constrained, and resource-based delegation, ACL abuse chains
- ADCS certificate attacks: the ESC1 through ESC8 family
- Domain dominance and persistence: golden, silver, and diamond tickets, AdminSDHolder, DSRM, skeleton key
- Coercion and NTLM relay: PetitPotam, PrinterBug, and the relay-to-takeover chain
- Domain and forest trusts: SID history, SID filtering, and crossing the boundary
- Detection engineering for Active Directory
- Hardening and defense, as an actionable playbook
- Incident response and domain recovery, including the krbtgt double reset
- A full attack chain walkthrough, start to finish

## What is inside the companion pack

The Complete Edition turns the book into a practice course with a full toolkit:

- **Lab kit:** PowerShell that stands up a deliberately vulnerable domain in minutes with every weakness pre-seeded, a verification script, a reset script, and the attacker-box setup (Impacket, Certipy, NetExec, Responder, and more)
- **10 guided labs** with a fillable, printable workbook and a skills tracker, so you practice cold instead of copying answers
- **Detection pack:** ready-to-adapt Sigma rules, Splunk, Microsoft Sentinel, and Elastic queries, and the audit configuration that makes the attacks visible in the first place
- **Hardening pack:** runnable scripts to apply and verify the key controls, a Tier 0 inventory tool, a guided krbtgt double-reset, and a full hardening checklist
- **Professional deliverables:** an Active Directory penetration test report template in Word and Markdown, a printable incident-response runbook, and a one-page attack-and-defense reference poster

## Who it is for

Aspiring and working penetration testers, red and blue teamers, SOC analysts, and system administrators who want to understand both sides of Active Directory security. If you can build three virtual machines, you can follow every technique in this book from start to finish. No prior red-team experience is assumed, but you will come out able to run a full internal AD assessment and defend against one.

## What you will be able to do

Go from no credentials to Domain Admin in a lab, map attack paths with BloodHound, abuse delegation and certificate services, establish and evict persistence, build the detections that catch each attack, apply the hardening that prevents them, and run the recovery when prevention falls short. More importantly, you will understand why each step works, which is what lets you adapt when a real environment does not match the book.

## Format

Instant digital download. The book is a 203-page PDF with a clickable table of contents and bookmarks. The companion pack is a zip of scripts, the workbook and poster as PDFs, the report template in Word and Markdown, and the detection and hardening files ready to use.

*For authorized security testing and education only. Every technique is intended for systems you own or are explicitly authorized to test.*