integration-it/active-directory-exploitation-cheat-sheet

A cheat sheet that contains common enumeration and attack methods for Windows Active Directory.

Active Directory Cheat Sheet

This repository contains a general methodology in the Active Directory environment. It is offered with a selection of quick commands from the most efficient tools based on Powershell, C, .Net 3.5 and .Net 4.5.

---

General Process:

• Recon
• Domain Enum
• Local Privilege Escalation
• Local Account Stealing
• Monitor Potential Incoming Account
• Local Account Stealing
• Admin Recon
• Lateral Movement
• Remote Administration
• Domain Admin Privileges
• Cross Trust Attacks
• Persistance and Exfiltrate

Active Directory Kill Chain:

Cheat Sheet Tree:

• /A - Recon

• /B - Domain Enum

• /C - Local Privilege Escalation

• /D - User Hunting

• /E - Monitor Potential Incoming Account

• /F - BloodHound

• /G - Lateral Movement

• /H - Persistence

• /I - Domain Admin Privileges

• /J - Cross Trust Attacks

• /K - Database Hunting

• /L - Security Downgrade

• /M - Privileged Accounts and Groups in Active Directory

• /N - Data Exfiltration

• /O - Looting

• /P - .NetPayload

• /X - Reverse PSShell FUD

• /Y - UL-DL-EXEC Skills

• /Z - Tool Box

  👷

---

Contribution, Proposal, Issue:

• ISSUE TEMPLATE
• MAIL: [email protected]

active-directory-exploitation-cheat-sheet's Issues

Microsoft Account Base SID

Hi:

Microsoft Accounts all start with a SID of S-1-11-96-*. You will find these when a Windows system is linked to a Microsoft account. For example, systems not connected to a domain.

Cheers.

ActiveDirectoryCheatSheet