# Adaz | Automatically Deploy Customizable Active Directory Labs In Azure **URL:** \ **Category:** Tools & Scripts\ **Tags:** tools, freebies, windows\ **Created:** [June 5, 2021, 10:18am UTC](https://onehack.st/t/adaz-automatically-deploy-customizable-active-directory-labs-in-azure/187920 "2021-06-05T10:18:07Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![BlueHacker](https://onehack.st/user_avatar/onehack.st/bluehacker/32/174721_2.png) [@BlueHacker](https://onehack.st/u/BlueHacker)\ **Post date:** [June 5, 2021, 10:18am UTC](https://onehack.st/t/adaz-automatically-deploy-customizable-active-directory-labs-in-azure/187920/1 "2021-06-05T10:18:07Z")
![image](https://onehack.st/uploads/default/original/3X/e/1/e13ff85664e8700f7cee97eecd939ad3417484b3.png) This project allows you to **easily spin up Active Directory labs in Azure** with domain-joined workstations, Windows Event Forwarding, Kibana, and Sysmon using Terraform/Ansible. It exposes a high-level configuration file for your domain to allow you to customize users, groups and workstations. ```auto dns_name: hunter.labdc_name: DC-1initial_domain_admin: username: hunter password: MyAdDomain!organizational_units: {}users:- username: christophe- username: danygroups:- dn: CN=Hunters,CN=Users members: [christophe]default_local_admin: username: localadmin password: Localadmin!workstations:- name: XTOF-WKS local_admins: [christophe]- name: DANY-WKS local_admins: [dany]enable_windows_firewall: yes ``` **Features** - Windows Event Forwarding pre-configured - Audit policies pre-configured - Sysmon installed - Logs centralized in an Elasticsearch instance which can easily be queried from the Kibana UI - Domain easily configurable via YAML configuration file Here’s an incomplete and biaised comparison with [DetectionLab](https://github.com/clong/DetectionLab): | | Adaz | DetectionLab | | --- | --- | --- | | Public cloud support | Azure | AWS, _Azure ([beta](https://github.com/clong/DetectionLab/tree/master/Azure))_ | | Expected time to spin up a lab | 15-20 minutes | 25 minutes | | Log management & querying | Elasticsearch+Kibana | Splunk Enterprise | | WEF | | | | Audit policies | | | | Sysmon | | | | **YAML domain configuration file** | |  | | **Multiple Windows 10 workstations support** | |  | | VirtualBox/VMWare support |  | | | osquery / fleet |  | | ([vote!](https://github.com/christophetd/adaz/issues/10))|| |Powershell transcript logging| ([vote!](https://github.com/christophetd/adaz/issues/5))|| |IDS logs| ([vote!](https://github.com/christophetd/adaz/issues/7))|| **Use-cases** - **Detection engineering** : Having access to clean lab with a standard is a great way to understand what traces common attacks and lateral movement techniques leave behind. - **Learning Active Directory** : I often have the need to test GPOs or various AD features (AppLocker, LAPS…). Having a disposable lab is a must for this. **Screenshots** ![image](https://onehack.st/uploads/default/original/3X/0/9/09d81ab1a1872bc0603ce2d086af882d881c412b.png) ![image](https://onehack.st/uploads/default/original/3X/3/d/3de4b235228b04cf20168b93b6baae90c97e304a.png) **Getting started** **Prerequisites** - An Azure subscription. You can [create one for free](https://azure.microsoft.com/en-us/free/) and you get $200 of credits for the first 30 days. Note that this type of subscription has a limit of 4 vCPUs per region, which still allows you to run 1 domain controller and 2 workstations (with the default lab configuration). - A SSH key in `~/.ssh/id_rsa.pub` - [Terraform](https://www.terraform.io/downloads.html) \>= 0.12 - [Azure CLI](https://docs.microsoft.com/en-us/cli/azure/install-azure-cli?view=azure-cli-latest) - You must be logged in to your Azure account by running `az login`. Yu can use `az account list` to confirm you have access to your Azure subscription **Installation** - Clone this repository ```auto git clone https://github.com/christophetd/Adaz.git ``` - Create a virtual env and install Ansible dependencies ```auto # Note: the virtual env needs to be in ansible/venvpython3 -m venv ansible/venv source ansible/venv/bin/activatepip install -r ansible/requirements.txtdeactivate ``` - Initialize Terraform ```auto cd terraformterraform init ``` **Usage** Optionally edit [`domain.yml`](https://github.com/christophetd/Adaz/blob/master/domain.yml) according to your needs (reference [here](https://github.com/christophetd/Adaz/blob/master/doc/configuration_reference.md)), then run: ```auto terraform apply ``` Resource creation and provisioning takes 15-20 minutes. Once finished, you will have an output similar to: ```auto dc_public_ip = 13.89.191.140kibana_url = http://52.176.3.250:5601what_next =####################### WHAT NEXT? #######################Check out your logs in Kibana:http://52.176.3.250:5601RDP to your domain controller:xfreerdp /v:13.89.191.140 /u:hunter.lab\hunter '/p:Hunt3r123.' +clipboard /cert-ignoreRDP to a workstation:xfreerdp /v:52.176.5.229 /u:localadmin '/p:Localadmin!' +clipboard /cert-ignoreworkstations_public_ips = { "DANY-WKS" = "52.165.182.15" "XTOF-WKS" = "52.176.5.229"} ``` > Don’t worry if during the provisioning you see a few messages looking like `FAILED - RETRYING: List Kibana index templates (xx retries left)` By default, resources are deployed in the `West Europe` region under a resource group `ad-hunting-lab`. You can control the region with a Terraform variable: ```auto terraform apply -var 'region=East US 2' ``` **Documentation** - [Frequently Asked Questions](https://github.com/christophetd/Adaz/blob/master/doc/faq.md) - [`domain.yml` reference](https://github.com/christophetd/Adaz/blob/master/doc/configuration_reference.md) - [Audit policies enabled](https://github.com/christophetd/Adaz/blob/master/doc/audit_policies.md) - [Detailed architecture](https://github.com/christophetd/Adaz/blob/master/doc/architecture.md) - [Troubleshooting common issues](https://github.com/christophetd/Adaz/blob/master/doc/troubleshooting.md) - [Common Operations: adding users, destroying the lab, etc.](https://github.com/christophetd/Adaz/blob/master/doc/operations.md) - [Project structure and directory organization](https://github.com/christophetd/Adaz/blob/master/doc/structure.md) - [Terraform variables available](https://github.com/christophetd/Adaz/blob/master/terraform/vars.tf) **Roadmap** I will heavily rely on the number of thumbs up votes you will leave on [`feature-proposal` issues](https://github.com/christophetd/adaz/issues?q=is%3Aissue+is%3Aopen+label%3Afeature-proposal+sort%3Areactions-%2B1-desc) for the next features! **Suggestions and bugs** Feel free to open an issue or to tweet [@christophetd](https://twitter.com/christophetd). ## GitHub: > **[GitHub - christophetd/Adaz: :wrench: Deploy customizable Active Directory labs...](https://github.com/christophetd/Adaz)** > > :wrench: Deploy customizable Active Directory labs in Azure - automatically.