Active Directory Kill Chain Attack & Defense

1739454833948.webp​

Summary​

This document was designed to be a useful, informational asset for those looking to understand the specific tactics, techniques, and procedures (TTPs) attackers are leveraging to compromise active directory and guidance to mitigation, detection, and prevention. And understand Active Directory Kill Chain Attack and Modern Post Exploitation Adversary Tradecraft Activity.

Table of Contents​

Discovery​

SPN Scanning​

Data Mining​

User Hunting​

LAPS​

AppLocker​

Active Directory Federation Services​

Privilege Escalation​

sAMAccountName Spoofing​

Abusing Active Directory Certificate Services​

PetitPotam​

Zerologon​

Passwords in SYSVOL & Group Policy Preferences​

MS14-068 Kerberos Vulnerability​

DNSAdmins​

Kerberos Delegation​

Unconstrained Delegation​

Constrained Delegation​

Resource-Based Constrained Delegation​

Insecure Group Policy Object Permission Rights​

Insecure ACLs Permission Rights​

Domain Trusts​

DCShadow​

RID​

Microsoft SQL Server​

Red Forest​

Exchange​

NTLM Relay & LLMNR/NBNS​

Lateral Movement​

Microsoft SQL Server Database links​

Pass The Hash​

System Center Configuration Manager (SCCM)​

WSUS​

Password Spraying​

Automated Lateral Movement​

Defense Evasion​

In-Memory Evasion​

Endpoint Detection and Response (EDR) Evasion​

OPSEC​

Microsoft ATA & ATP Evasion​

PowerShell ScriptBlock Logging Bypass​

PowerShell Anti-Malware Scan Interface (AMSI) Bypass​

Loading .NET Assemblies Anti-Malware Scan Interface (AMSI) Bypass​

AppLocker & Device Guard Bypass​

Sysmon Evasion​

HoneyTokens Evasion​

Disabling Security Tools​

Credential Dumping​

NTDS.DIT Password Extraction​

SAM (Security Accounts Manager)​

Kerberoasting​

Kerberos AP-REP Roasting​

Windows Credential Manager/Vault​

DCSync​

LLMNR/NBT-NS Poisoning​

Others​

Persistence​

Diamond Ticket​

Golden Ticket​

SID History​

Silver Ticket​

DCShadow​

AdminSDHolder​

Group Policy Object​

Skeleton Keys​

SeEnableDelegationPrivilege​

Security Support Provider​

Directory Services Restore Mode​

ACLs & Security Descriptors​

Tools & Scripts​

  • AD_Miner - AD Miner is an Active Directory audit tool that leverages cypher queries to crunch data from the #Bloodhound graph database to uncover security weaknesses.
  • Certify - Certify is a C# tool to enumerate and abuse misconfigurations in Active Directory Certificate Services (AD CS).
  • PSPKIAudit - PowerShell toolkit for auditing Active Directory Certificate Services (AD CS).
  • PowerView - Situational Awareness PowerShell framework
  • BloodHound - Six Degrees of Domain Admin
  • Impacket - Impacket is a collection of Python classes for working with network protocols
  • aclpwn.py - Active Directory ACL exploitation with BloodHound
  • CrackMapExec - A swiss army knife for pentesting networks
  • ADACLScanner - A tool with GUI or command linte used to create reports of access control lists (DACLs) and system access control lists (SACLs) in Active Directory
  • zBang - zBang is a risk assessment tool that detects potential privileged account threats
  • SafetyKatz - SafetyKatz is a combination of slightly modified version of @gentilkiwi's Mimikatz project and @subTee's .NET PE Loader.
  • SharpDump - SharpDump is a C# port of PowerSploit's Out-Minidump.ps1 functionality.
  • PowerUpSQL - A PowerShell Toolkit for Attacking SQL Server
  • Rubeus - Rubeus is a C# toolset for raw Kerberos interaction and abuses
  • ADRecon - A tool which gathers information about the Active Directory and generates a report which can provide a holistic picture of the current state of the target AD environment
  • Mimikatz - Utility to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory but also perform pass-the-hash, pass-the-ticket or build Golden tickets
  • Grouper - A PowerShell script for helping to find vulnerable settings in AD Group Policy.
  • Powermad - PowerShell MachineAccountQuota and DNS exploit tools
  • RACE - RACE is a PowerShell module for executing ACL attacks against Windows targets.
  • DomainPasswordSpray - DomainPasswordSpray is a tool written in PowerShell to perform a password spray attack against users of a domain.
  • MailSniper - MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network architecture information, etc.)
  • LAPSToolkit - Tool to audit and attack LAPS environments.
  • CredDefense - Credential and Red Teaming Defense for Windows Environments
  • ldapdomaindump - Active Directory information dumper via LDAP
  • SpoolSample - PoC tool to coerce Windows hosts authenticate to other machines via the MS-RPRN RPC interface
  • adconnectdump - Azure AD Connect password extraction
  • o365recon - Script to retrieve information via O365 with a valid cred
  • ROADtools - ROADtools is a framework to interact with Azure AD. I
  • Stormspotter - Stormspotter creates an “attack graph” of the resources in an Azure subscription.
  • AADInternals - AADInternals is PowerShell module for administering Azure AD and Office 365
  • MicroBurst: A PowerShell Toolkit for Attacking Azure - MicroBurst includes functions and scripts that support Azure Services discovery, weak configuration auditing, and post exploitation actions such as credential dumping.
  • sam-the-admin - Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user
  • CVE-2021-42287/CVE-2021-42278 Scanner & Exploiter. - CVE-2021-42287/CVE-2021-42278 Scanner & Exploiter. Yet another low effort domain user to domain admin exploit.
  • ADModule - Microsoft signed ActiveDirectory PowerShell module
  • ImproHound - Identify the attack paths in BloodHound breaking your AD tiering
  • ADExplorerSnapshot.py - ADExplorerSnapshot.py is an AD Explorer snapshot ingestor for BloodHound.
  • orpheus - Bypassing Kerberoast Detections with Modified KDC Options and Encryption Types
  • BackupOperatorToolkit

Ebooks​

Cheat Sheets​

Other Resources​

 
Click to expand...
Back
Top