Attack Techniques

Explore the most common and devastating attack techniques used against Active Directory environments, from credential theft to domain dominance.

16 Topics0/16 complete

AD Enumeration Without Admin Rights

Any domain user can map your entire Active Directory -- every user, group, computer, trust, and policy -- without a single admin privilege.

BeginnerT1087.002

SPN Scanning & Service Discovery

Service Principal Names let attackers discover every service running in your domain -- including SQL servers, web apps, and Exchange -- without sending a single network scan packet.

IntermediateT1558.003

Password Spraying & Brute Force

Instead of trying many passwords against one account (and getting locked out), attackers try one password against every account in the domain -- and statistically, someone always uses "Summer2025!".

BeginnerT1110.003

NTLM Relay Attacks

NTLM relay captures an authentication attempt in transit and replays it to a different server -- the victim unknowingly authenticates the attacker to a target they never intended to reach.

IntermediateT1557

Kerberoasting Deep Dive

Any domain user can request a service ticket encrypted with a service account's password hash -- then crack it offline with no lockout, no alerts, and no time limit.

IntermediateT1558.003

AS-REP Roasting

Accounts configured with "Do not require Kerberos pre-authentication" hand out password-encrypted data to anyone who asks -- no valid credentials needed.

IntermediateT1558.004

Pass-the-Hash & Pass-the-Ticket

Attackers skip passwords entirely by reusing stolen hashes or Kerberos tickets to authenticate as any user — no cracking required.

IntermediateT1550

Kerberos Delegation Abuse

Kerberos delegation lets servers impersonate users to access other services — attackers exploit misconfigurations to impersonate anyone, including Domain Admins.

AdvancedT1558

DCSync Attack

DCSync tricks a Domain Controller into sharing all password hashes by impersonating the replication process — no malware on the DC required.

AdvancedT1003.006

AD CS Abuse (Certificate Attacks)

Active Directory Certificate Services can issue certificates that work like passwords — misconfigured templates let attackers forge certificates to become Domain Admin.

AdvancedT1649

Golden & Silver Ticket Attacks

With the KRBTGT hash, attackers forge their own Kerberos tickets and become anyone in the domain — an invisible master key that survives password resets.

AdvancedT1558.001

AD Persistence Techniques

After achieving domain compromise, attackers embed themselves so deeply that even a password reset across the entire domain may not be enough to evict them.

AdvancedT1098

ACL/ACE Abuse Attack Paths

Misconfigured Active Directory permissions let low-privileged users reset passwords, add themselves to admin groups, or grant themselves DCSync rights — all without exploiting a single vulnerability.

AdvancedT1222.001

Print Spooler Abuse & PrintNightmare

The Windows Print Spooler service has been a goldmine for attackers — from coercing Domain Controller authentication to achieving remote code execution as SYSTEM.

IntermediateT1547.012

MSSQL Server & AD Abuse

SQL Servers in AD environments can be chained together via trusted links to execute commands across domains — turning a database connection into a path to Domain Admin.

AdvancedT1210

Authentication Coercion Attacks

Coercion attacks force Windows machines to authenticate to attacker-controlled servers — the critical first step in NTLM relay chains, delegation abuse, and full domain compromise.

IntermediateT1187