Active Directory Kill Chain Attack & Defense

Summary

This document was designed to be a useful, informational asset for those looking to understand the specific tactics, techniques, and procedures (TTPs) attackers are leveraging to compromise active directory and guidance to mitigation, detection, and prevention. And understand Active Directory Kill Chain Attack and Modern Post Exploitation Adversary Tradecraft Activity.

Table of Contents

• Discovery
• Privilege Escalation
• Defense Evasion
• Credential Dumping
• Lateral Movement
• Persistence
• Defense & Detection

---

Discovery

SPN Scanning

• SPN Scanning – Service Discovery without Network Port Scanning
• Active Directory: PowerShell script to list all SPNs used
• Discovering Service Accounts Without Using Privileges

Data Mining

• A Data Hunting Overview
• Push it, Push it Real Good
• Finding Sensitive Data on Domain SQL Servers using PowerUpSQL
• Sensitive Data Discovery in Email with MailSniper
• Remotely Searching for Sensitive Files
• I Hunt Sysadmins - harmj0y

User Hunting

• Hidden Administrative Accounts: BloodHound to the Rescue
• Active Directory Recon Without Admin Rights
• Gathering AD Data with the Active Directory PowerShell Module
• Using ActiveDirectory module for Domain Enumeration from PowerShell Constrained Language Mode
• PowerUpSQL Active Directory Recon Functions
• Derivative Local Admin
• Automated Derivative Administrator Search
• Dumping Active Directory Domain Info – with PowerUpSQL!
• Local Group Enumeration
• Attack Mapping With Bloodhound
• Situational Awareness
• Commands for Domain Network Compromise
• A Pentester’s Guide to Group Scoping

LAPS

• Microsoft LAPS Security & Active Directory LAPS Configuration Recon
• Running LAPS with PowerView
• RastaMouse LAPS Part 1 & 2

AppLocker

• Enumerating AppLocker Config

Active Directory Federation Services

• 118 Attacking ADFS Endpoints with PowerShell Karl Fosaaen
• Using PowerShell to Identify Federated Domains
• LyncSniper: A tool for penetration testing Skype for Business and Lync deployments
• Troopers 19 - I am AD FS and So Can You

---

Privilege Escalation

BadSuccessor

• BadSuccessor: Abusing dMSA to Escalate Privileges in Active Directory
• Operationalizing the BadSuccessor: Abusing dMSA for Domain Privilege Escalation

sAMAccountName Spoofing

• sAMAccountName spoofing
• CVE-2021-42287/CVE-2021-42278 Weaponisation

Abusing Active Directory Certificate Services

• Certified Pre-Owned
• AD CS Domain Escalation

PetitPotam

• PetitPotam
• From Stranger to DA // Using PetitPotam to NTLM relay to Domain Administrator

Zerologon

• Cobalt Strike ZeroLogon-BOF
• CVE-2020-1472 POC
• Zerologon: instantly become domain admin by subverting Netlogon cryptography (CVE-2020-1472)

Passwords in SYSVOL & Group Policy Preferences

• Finding Passwords in SYSVOL & Exploiting Group Policy Preferences
• Pentesting in the Real World: Group Policy Pwnage

MS14-068 Kerberos Vulnerability

• MS14-068: Vulnerability in (Active Directory) Kerberos Could Allow Elevation of Privilege
• Digging into MS14-068, Exploitation and Defence
• From MS14-068 to Full Compromise – Step by Step

DNSAdmins

• Abusing DNSAdmins privilege for escalation in Active Directory
• From DNSAdmins to Domain Admin, When DNSAdmins is More than Just DNS Administration

Kerberos Delegation

• Constructing Kerberos Attacks with Delegation Primitives
• No Shells Required - a Walkthrough on Using Impacket and Kerberos to Delegate Your Way to DA
• CVE-2020-17049: Kerberos Bronze Bit Attack – Overview