SANS Workshop: Understanding and Detecting User Impersonation and Lateral Movement in

https://www.sans.org/webcasts/understanding-detecting-user-impersonation-lateral-movement

In this workshop, we will be taking a guided approach to some common lateral movement techniques adversaries like to use, we will be using a mini AD range in AWS.

During the creation of this workshop, I have used Ubuntu 24.04.03 LTS, so this is the only "supported" VM, feel free to use something else, but if you run into installation issues, they'll be in you to fix!

While the info in this workbook should suffice to act as a self guided walkthrough, I do recommend you following along the live workshop for maximum enjoyment as well as the opportunity to network with your peers, ask questions and just in general some good vibes.

With that said, let's dive in - with ... setup :D