The Active Directory
attack reference.
Atomic, cross-linked notes written the way they get used — enumerate, exploit, escalate, persist. Every page carries the protocol mechanics, the exact commands, the detection footprint, and how each technique chains into the next.
Topic map
by kill-chain phaseThe objects, protocols and stores an attacker reasons over: directory structure, Kerberos flow, NTLM, and where the secrets live.
Getting authentication material out of the domain: roasting, replication, and reusing hashes, keys, tickets and certs.
Once you hold a signing secret, forge tickets offline: Golden, Silver, Diamond, and SID-history injection.
Unconstrained, constrained and resource-based delegation misconfigurations that turn into impersonation and privilege escalation.
Force a machine to authenticate, then relay it: PetitPotam, the printer bug, mitm6/WPAD, and Kerberos relay.
Active Directory Certificate Services misconfigurations — the ESC1–ESC15 family — that mint authentication certificates.
Abusing DACLs on directory objects and GPOs — GenericAll, WriteDACL, WriteOwner — to walk edges toward Domain Admin.
Turning credentials into code execution across hosts: SMB, WMI, WinRM, PSRemoting and RDP.
Durable footholds once you own the domain: DCShadow, Skeleton Key, AdminSDHolder and DSRM backdoors.
Attacking the deployment plane: SCCM/MECM network access accounts and WDS/MDT imaging shares.
Crossing the domain and forest boundary: SID filtering, TREAT_AS_EXTERNAL and trust-key abuse.
The defender's side: tiering baselines, honeytokens and the log artifacts each technique leaves behind.
Recently updated
Featured attack paths
GPO Edit Rights → Code Exec on DCs → Domain Admin
DCSync AES128 → Diamond Ticket → Durable Domain Admin
Enrollment Rights on ESC1 Template → Domain Admin Cert
Constrained Delegation (TrustedToAuth + high-priv SPN) → impersonate Administrator → Domain Admin