SOP-12: Active Directory Attack Response

Analyst playbook for Kerberos and AD attacks — Kerberoasting, DCSync, Golden Ticket, KRBTGT double-reset, mimikatz / Rubeus / Impacket detection, full containment via MDI and EDR.