Listen to this Post
Introduction:
Active Directory (AD) remains the crown jewel of enterprise networks, making it a prime target for attackers. The newly released AdStrike is a modular, AI‑powered red‑team framework that automates AD enumeration, attack‑path analysis, Kerberos workflows, and reporting – all while maintaining session state. Designed for authorized penetration testing, AdStrike bundles 58 interactive modules to help operators move from discovery to persistence with unprecedented efficiency.
Learning Objectives:
- Understand how AdStrike uses AI to prioritise attack paths and automate AD post‑exploitation.
- Learn to configure and execute Kerberos‑aware and NTLM‑disabled environment attacks.
- Apply defensive measures to detect and mitigate AI‑driven AD attack frameworks.
You Should Know:
1. Deploying AdStrike – Installation & Core Configuration
AdStrike is designed for Kali Linux 2024+ or Parrot OS. It expects Python 3.10 or higher and uses normal user privileges for most operations, requiring root only for packet capture or privileged network actions. The following steps install the framework and configure its core environment file.
Step‑by‑step deployment guide:
Clone the repository git clone https://github.com/capture0x/AdStrike.git cd AdStrike Make install and run scripts executable chmod +x install.sh run.sh Run the installer (do NOT use sudo) bash install.sh Launch the framework bash run.sh
After installation, edit the `.env` configuration file to match your engagement environment:
DC_IP=10.10.10.10 DC_FQDN=dc1.corp.local DOMAIN=corp.local BASE_DN=DC=corp,DC=local USERNAME=user PASSWORD= NT_HASH= USE_KERBEROS=false KRB5_CCACHE= ATTACKER_IP=10.10.14.5 ATTACKER_IFACE=tun0 ENGAGEMENT_NAME=Corp-Internal-2026 ADSTRIKE_SHOW_SECRETS=false
Important: Do not run `install.sh` with `sudo` – the installer creates repo‑local files such as adrt_venv/, .env, and output/. Running as root can leave those files root‑owned. If you already used sudo, fix ownership with:
sudo chown -R "$(id -un):$(id -gn)" .
2. AI‑Driven Attack Path Analysis
AdStrike includes Smart Analyst – an AI component that parses command outputs, identifies high‑value targets, and ranks the next actions for the operator. This feature reduces decision fatigue during time‑sensitive engagements.
Step‑by‑step: using Smart Analyst
- From the main menu, navigate to the Smart Analyst module.
- Provide the output of a previous enumeration command (e.g., BloodHound data or LDAP queries).
3. The AI agent will:
- Highlight potential privilege escalation vectors.
- Suggest the most probable next attack steps.
- Automatically set environment variables for the suggested modules.
Example: manually trigger a basic LDAP query
ldapsearch -H ldap://$DC_IP -x -D "$USERNAME" -w "$PASSWORD" -b "$BASE_DN" "(objectClass=user)" sAMAccountName
Paste the output into Smart Analyst. The AI will identify high‑value accounts and recommend targeted Kerberoasting or AS‑REP roasting attacks.
3. Kerberos Attacks in NTLM‑Disabled Environments
Modern AD environments often disable NTLM and enforce LDAP signing. AdStrike provides dedicated Kerberos‑aware workflows to operate in such hardened configurations.
Step‑by‑step: Kerberoasting with AdStrike
1. Ensure `USE_KERBEROS=true` in your `.env` file.
- Set the path to a valid Kerberos ticket cache:
export KRB5CCNAME=/path/to/your/krb5cc
- From the main menu, select the Kerberos attacks category.
4. Choose the Kerberoasting module. AdStrike will automatically:
- Request service tickets for all SPNs.
- Save the extracted hashes to
output/kerberoast_hashes.txt.
5. Crack the hashes offline using `hashcat`:
hashcat -m 13100 output/kerberoast_hashes.txt -a 0 /usr/share/wordlists/rockyou.txt
AdStrike also supports AS‑REP roasting for users without pre‑authentication, using the same modular workflow.
4. Lateral Movement and Credential Reuse
Once initial access is obtained, AdStrike automates lateral movement through PSExec, WMI, WinRM, and scheduled tasks. The framework reuses credentials (plaintext or NTLM hashes) stored in the active session.
Step‑by‑step: pass‑the‑hash lateral movement
- Ensure you have an NTLM hash for a privileged user in your `.env` file:
NT_HASH=3c2e2b5a5c3f8d1e9a4b7c6d8e2f1a3b
- From the Lateral Movement menu, select Pass‑the‑Hash – PSExec.
- Specify the target hostname or IP. AdStrike will:
– Use Impacket’s `psexec.py` to establish a remote shell.
– Log the output to output/lateral_movement/psexec_<target>.log.
4. For WinRM over HTTP/HTTPS, use the Evil‑WinRM wrapper module, which supports both password and hash authentication.
Manual alternative for testing:
Using Impacket directly impacket-psexec -hashes :$NT_HASH $DOMAIN/$USERNAME@$TARGET_IP Using Evil-WinRM evil-winrm -i $TARGET_IP -u $USERNAME -H $NT_HASH
5. BloodHound Automation and Data Ingestion
AdStrike includes a BloodHound Helper module that automates data collection and ingestion. It wraps SharpHound (Windows) or BloodHound.py (Linux) and integrates the output directly into your session.
Step‑by‑step: automated BloodHound collection
1. From the Reconnaissance menu, select BloodHound Helper.
2. Choose the collection method:
- SharpHound (remote) – requires a Windows host with administrative access.
- BloodHound.py (direct) – queries LDAP from the attack host.
- Provide the target domain controller IP and credentials (already present in
.env).
4. After collection, AdStrike automatically:
- Imports the `.zip` or `.json` files into a local Neo4j database.
- Launches the BloodHound GUI (if installed).
- Saves a copy of the data in
output/bloodhound/.
Manual BloodHound.py command:
bloodhound-python -d $DOMAIN -u $USERNAME -p $PASSWORD -dc $DC_IP -c All -ns $DC_IP
Smart Analyst can then parse BloodHound’s Cypher queries to highlight the shortest path to Domain Admin.
6. Defensive Detection & Mitigation
AI‑powered frameworks like AdStrike pose a new challenge for blue teams. Defenders must monitor for unusual LDAP queries, Kerberos ticket requests, and lateral movement patterns that these tools automate at scale.
Step‑by‑step: detecting AdStrike‑like behaviour
- Monitor LDAP query volume and patterns – Excessive `ldapsearch` or `bloodhound-python` queries from a single source may indicate enumeration. Use Windows Event ID 4662 (Directory Service Access) with filtering:
Get-WinEvent -FilterHashtable @{LogName='Security';ID=4662} | Where-Object { $_.Message -match "Object Type:.user" }
- Detect Kerberoasting – Event ID 4769 (Kerberos service ticket request) with a large number of tickets requested from the same IP is suspicious. Audit using PowerShell:
Get-WinEvent -FilterHashtable @{LogName='Security';ID=4769} | Where-Object { $_.Properties[bash].Value -eq "0x0" }
- Identify pass‑the‑hash attacks – Monitor Event ID 4624 (logon) for logon type 3 (network) combined with authentication package “NTLM” and elevated privileges.
Hardening recommendations:
- Enforce Kerberos-only authentication and disable NTLM where possible.
- Enable Advanced Threat Analytics (ATA) or Microsoft Defender for Identity to flag abnormal ticket requests.
- Implement tiered administration and Local Administrator Password Solution (LAPS) to block lateral movement.
What Undercode Say:
- Key Takeaway 1 – AI accelerates but does not replace skill: While AdStrike automates enumeration and prioritises paths, a red‑team operator still needs deep AD knowledge to interpret AI suggestions and avoid detection.
- Key Takeaway 2 – Defenders must adapt to tool‑level AI: Traditional signature‑based detection fails against modular, AI‑driven frameworks. Blue teams should shift to behaviour analytics and anomaly detection, focusing on LDAP query rates and ticket request patterns.
Analysis: AdStrike represents a significant evolution in red‑team tooling. Its session‑aware, AI‑assisted workflow reduces manual overhead and enables faster, more consistent AD assessments. However, the same capabilities, if misused, could accelerate real attacks. The framework’s strict licensing and watermarking of reports attempt to prevent abuse, but defenders cannot rely on attacker goodwill. The most effective defence remains proper AD hardening: restrict LDAP anonymous access, enforce Kerberos, monitor for anomalous queries, and adopt a Zero Trust model for administrative privileges. Red teams, in turn, must use AdStrike responsibly and treat its AI outputs as suggestions, not gospel.
Prediction:
AI‑powered attack frameworks will become standard in both offensive and defensive security within the next 18 months. Tools like AdStrike will push blue teams to deploy behavioural detection engines and automated response playbooks. As generative AI improves, we can expect frameworks that write custom exploits on the fly, adapt to network defences in real time, and evade logging by mimicking legitimate administrator behaviour. Organisations that fail to upgrade from static, signature‑based detection will face an unmanageable gap in their security posture.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: 0xfrost Adstrike – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
