Initial commit - 611 cybersecurity skills across all subdomains

skills/performing-active-directory-bloodhound-analysis/references/standards.md

@@ -0,0 +1,56 @@
+# Standards and References: BloodHound AD Analysis
+
+## MITRE ATT&CK Techniques
+
+### Discovery (TA0007)
+- **T1087.002** - Account Discovery: Domain Account
+- **T1069.001** - Permission Groups Discovery: Local Groups
+- **T1069.002** - Permission Groups Discovery: Domain Groups
+- **T1018** - Remote System Discovery
+- **T1482** - Domain Trust Discovery
+- **T1615** - Group Policy Discovery
+- **T1016** - System Network Configuration Discovery
+- **T1049** - System Network Connections Discovery
+- **T1033** - System Owner/User Discovery
+
+### Lateral Movement (TA0008) - Paths Identified by BloodHound
+- **T1550.002** - Use Alternate Authentication Material: Pass the Hash
+- **T1550.003** - Use Alternate Authentication Material: Pass the Ticket
+- **T1021.002** - Remote Services: SMB/Windows Admin Shares
+- **T1021.001** - Remote Services: Remote Desktop Protocol
+- **T1021.006** - Remote Services: Windows Remote Management
+
+### Credential Access (TA0006) - Attacks Enabled by BloodHound
+- **T1558.003** - Steal or Forge Kerberos Tickets: Kerberoasting
+- **T1558.004** - Steal or Forge Kerberos Tickets: AS-REP Roasting
+- **T1003.006** - OS Credential Dumping: DCSync
+- **T1558.001** - Steal or Forge Kerberos Tickets: Golden Ticket
+
+### Privilege Escalation (TA0004)
+- **T1484.001** - Domain Policy Modification: Group Policy Modification
+- **T1078.002** - Valid Accounts: Domain Accounts
+- **T1134** - Access Token Manipulation
+
+## BloodHound Software Entry
+- **MITRE ATT&CK ID**: S0521
+- **Type**: Tool
+- **Platforms**: Windows, Azure AD
+- **Associated Groups**: FIN7, APT29, Wizard Spider
+
+## NIST References
+- **NIST SP 800-53 Rev. 5** - AC-6: Least Privilege
+- **NIST SP 800-53 Rev. 5** - AC-2: Account Management
+- **NIST SP 800-53 Rev. 5** - IA-5: Authenticator Management
+- **NIST SP 800-171** - 3.1.5: Least Privilege
+
+## CIS Benchmarks
+- **CIS Microsoft Windows Server 2022** - Section 2.3.10: Network access
+- **CIS Active Directory Benchmark** - Section 1: Account Policies
+- **CIS Controls v8** - Control 6: Access Control Management
+- **CIS Controls v8** - Control 5: Account Management
+
+## Active Directory Security Hardening Standards
+- Microsoft Tier Model for Active Directory Administration
+- Microsoft Privileged Access Workstation (PAW) Architecture
+- ANSSI Active Directory Security Hardening Guide
+- ASD Essential Eight: Restrict Administrative Privileges