Attacking Active Directory

When to Use

• AD reconnaissance and enumeration
• Kerberos-based attacks
• Credential dumping from domain controllers
• Lateral movement within domains
• BloodHound attack path analysis
• Domain persistence techniques

When NOT to Use

• Non-Windows / Linux-only environments — use enumerating-network-services
• Cracking the hashes you collected — use cracking-passwords
• Post-domain-compromise persistence — use establishing-persistence
• Entra ID / Azure AD as the primary target — use attacking-entra-id
• Detecting these attacks defensively — use engineering-detections