Active Directory

This section is under construction

Name	Tags
🥔 PetitPotam (MS-EFSRPC)
👻 PrintNightmare	Privilege EscalationLateral MovementInitial AccessDomain Admin
🥸 NoPac (SamAccountName Spoofing)	LocalAuthenticatedLateral MovementPrivilege EscalationDomain Admin
✌️ Kerberos Double Hop
🏝️ Living Off the Land Enumeration	AuthenticatedOPSECLocal
🔍 Enumerating Security Controls	OPSECAuthenticated
☠️ LLMNR Poisoning	Initial AccessNETBIOSLLMNR
❤️‍🔥 Kerberoasting	KerberosAuthenticated
🔄 DCSync	AuthenticatedDS-Replication-Get-Changes
🫢 ASREPRoast	KerberosUnauthenticatedInitial Access
📃 Domain ACLs	GenericAllGenericWriteWritePropertySelf-MembershipForceChangePasswordWriteOwnerWriteDACLDS-Replication-Get-ChangesAllExtendedRightsAddselfAdd MembersLateral MovementPrivilege EscalationPersistence
©️ ADCS	AuthenticatedCertificate ServicePrivilege Escalation
💽 MSSQL Abuse	AuthenticatedLateral MovementPrivilege Escalation
👀 Domain Wide Enumeration	Privilege EscalationAuthenticatedBloodhoundPingCastleDACL
🔫 Credential Hunting
🔒 Password Stuff	Lateral MovementPrivilege EscalationInitial AccessAuthenticatedUnauthenticated
📜 Password Policy Enumeration
👨‍👩‍👧‍👧 Domain User Enumeration
👥 Group Membership	Privilege EscalationAuthenticatedLateral Movement
DCShadow	Domain AdminOPSECAuthenticated
Golden Ticket	KerberosPersistenceAuthenticated
Silver Ticket	KerberosPersistenceAuthenticated
Diamond Ticket	KerberosAuthenticatedPersistenceOPSEC
Constrained Delegation	KerberosAuthenticatedmsds-allowedtodelegatetoElevated
Unconstrained Delegation	KerberosAuthenticatedElevated
Resource-Based Constrained Delegation	KerberosAuthenticatedmsDS-AllowedToActOnBehalfOfOtherIdentityElevated
Pass The Ticket	KerberosAuthenticatedElevatedLateral Movement
Pass The Hash	KerberosAuthenticatedLateral MovementLSASS
Overpass The Hash	KerberosElevatedAuthenticatedLateral Movement
🔠 Credential Dumping	AuthenticatedPrivilege EscalationElevatedLSASSLateral MovementKerberosMimikatzImpacketRubeus
LNK File Attacks	Initial AccessLateral Movement
🔑 GPP Password	SMBAuthenticatedUnauthenticatedLateral MovementPrivilege Escalation
Relay Attacks	Initial AccessSMBNETBIOSLLMNR
IPv6 Attacks	Initial AccessMITM6
Hash Cracking	Privilege EscalationLateral Movement
Word Doc Macro	Initial Access
Host Persistence
Unquoted Service Path	Privilege EscalationAuthenticatedLocal
Weak Service Permissions	Privilege Escalation
Weak Service Binary Permissions	Privilege Escalation
UAC Bypasses	Privilege Escalation
Lateral Movement
Alternate Service Name
Service for User to Self	S4U2SelfS4U2Proxy
Pivoting
📒 Group Policy Abuse
Microsoft Configuration Manager
🌲 Forest & Domain Trusts
Local Administrator Password Solution	LAPS
AppLocker
Host Enumeration
🤝 NetNTLM Hash Stealing Locations
📁 SMB
Token Privileges	LocalPrivilege EscalationSeImpersonatePrivilegeSeAssignPrimaryPrivilegeSeTcbPrivilegeSeBackupPrivilegeSeRestorePrivilegeSeCreateTokenPrivilegeSeLoadDriverPrivilegeSeTakeOwnershipPrivilegeSeDebugPrivilege

misc

Active Directory

Active Directory Attacks