Active Directory Attack Paths

Identify and demonstrate Active Directory misconfigurations during authorized internal assessments.

When to Use

• You have a foothold (or credentials) inside an authorized internal network
• You need to map privilege-escalation paths to Domain Admin or Enterprise Admin

Methodology

1. Initial Enumeration

• whoami /all, domain trusts, nested groups
• BloodHound / SharpHound collection (small collection first: --collectionmethod All --exclude-dc if stealth matters)
• Look for: Kerberoastable SPNs, AS-REP roastable accounts (no preauth), unconstrained delegation, DCSync rights, GPO abuse

2. Credential Attacks