Results for “active-directory”

Assess an authorized Active Directory environment by simulating attacks against credentials, permissions, and trust relationships. Use BloodHound and related testing tools to identify paths to administrator access, evaluate detection capabilities, and document findings with remediation recommendations.

• Assessing Active Directory security with written authorization
• Finding paths from ordinary users to administrator access
• Reviewing Kerberos and delegation settings

Investigate DCSync attacks, which abuse Active Directory replication to steal password hashes. Use audit events and network traffic to identify suspicious replication requests, examine their sources, and check for subsequent credential misuse.

• Hunting for credential theft in Active Directory
• Investigating suspected Mimikatz or Impacket use
• Auditing accounts with directory replication permissions

Deploy decoy accounts, service entries, and policy objects in Active Directory to detect suspicious activity. Configure monitoring rules for Windows security events and validate alerts for credential misuse, reconnaissance, and movement between systems.

• Detecting Kerberoasting with decoy service entries
• Monitoring attempts to use decoy credentials
• Placing credential traps in decoy Group Policy objects

Plan tiered administration for Active Directory by separating administrative accounts and systems into three levels. Cover dedicated administration workstations, authentication restrictions, and verification checks to help limit credential theft and the spread of compromise.

• Designing tiered Active Directory administration
• Separating privileged accounts by administrative tier
• Planning dedicated administration workstations

Audit Microsoft Entra ID identity settings to uncover weak authentication policies, excessive administrator privileges, inactive accounts, and guest access risks. Review conditional access rules and sign-in logs, then organize findings into a prioritized security report.

• Auditing authentication and administrator access in an Azure tenant
• Assessing identity settings before integrating an acquired tenant
• Finding inactive accounts and privileged guest users

Review Active Directory permissions with ldap3, a Python library for directory queries. Identify excessive access granted to non-administrative accounts, explain potential privilege escalation paths, and produce a JSON report with affected objects and remediation recommendations.

• Auditing excessive Active Directory permissions
• Investigating privilege escalation paths from ordinary accounts
• Reporting affected objects and permission remediation recommendations

Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege paths, and exploitable trust relationships that could lead to domain compromise. The tester uses BloodHound for attack path analysis, Mimikatz for credential extraction, and Impacket for protocol-level attacks including Kerberoasting, AS-REP Roasting, and delegation abuse. Activates for requests involving Active Directory pentest, AD attack simulation, domain compromise testing, or Kerberos attack assessment.

The English summary is being prepared. Showing the original description.

Execute a Kerberoasting attack to extract Service Principal Name (SPN) ticket hashes from Active Directory and crack them offline. This allows an attacker with any valid domain credentials to escalate privileges by obtaining the plaintext password of highly-privileged service accounts.

The English summary is being prepared. Showing the original description.

Forge highly privileged Kerberos Ticket Granting Tickets (TGTs) to gain persistent, undetectable, and long-term administrative access across an entire Active Directory domain. Use this skill during the final stages of a Red Team operation after Domain Admin access has been achieved, simulating an Advanced Persistent Threat (APT) establishing deep persistence that survives password resets.

The English summary is being prepared. Showing the original description.

Execute a Kerberoasting attack to extract and systematically crack the NTLM hashes of Service Principal Name (SPN) accounts in an Active Directory environment. Uses tools like Rubeus, Impacket (GetUserSPNs), and Hashcat to achieve domain privilege escalation domain: cybersecurity

The English summary is being prepared. Showing the original description.

Execute AS-REP Roasting to extract and crack the NTLM hashes of Active Directory user accounts that have the "Do not require Kerberos preauthentication" flag explicitly enabled. This attack generates a recoverable Ticket Granting Ticket (TGT) without requiring the attacker to authenticate first.

The English summary is being prepared. Showing the original description.

Execute a complete Active Directory penetration test from initial enumeration to domain dominance. Use this skill for AD security assessments including LDAP enumeration, Kerberos attacks (Kerberoasting, AS-REP roasting), BloodHound attack path analysis, credential dumping with Mimikatz, lateral movement via PsExec/WMI/DCOM, DCSync for NTDS extraction, and Golden/Silver ticket forging. Covers the full kill chain from domain user to domain admin.

The English summary is being prepared. Showing the original description.

Execute a DCSync attack mimicking the behavior of a legitimate Active Directory Domain Controller (DC). Leverage Directory Replication Service Remote Protocol (DRSR) permissions to silently request and extract the password hashes (NTLM/Kerberos) of any or all users in the domain without executing code on the target Domain Controller.

The English summary is being prepared. Showing the original description.

Hunts for Active Directory credential and replication attacks — DCSync, Golden/Silver Ticket, and DCShadow — by analyzing directory-service-access (4662), Kerberos TGS (4769), and logon (4624) events for replication abuse and forged-ticket anomalies. Activates for requests to hunt DCSync, detect golden/silver tickets, or find Active Directory replication abuse.

The English summary is being prepared. Showing the original description.

Detect DCSync attacks where adversaries abuse Active Directory replication privileges to extract password hashes by monitoring for non-domain-controller accounts requesting directory replication via DsGetNCChanges.

The English summary is being prepared. Showing the original description.

Deploys deception-based honeytokens in Active Directory including fake privileged accounts with AdminCount=1, fake SPNs for Kerberoasting detection (honeyroasting), decoy GPOs with cpassword traps, and fake BloodHound paths. Monitors Windows Security Event IDs 4769, 4625, 4662, 5136 for honeytoken interaction. Use when implementing AD deception defenses for detecting lateral movement, credential theft, and reconnaissance.

The English summary is being prepared. Showing the original description.

Implement Microsoft's Enhanced Security Admin Environment (ESAE) tiered administration model for Active Directory. Covers Tier 0/1/2 separation, privileged access workstations (PAWs), administrative f

The English summary is being prepared. Showing the original description.

Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, stale accounts, conditional access gaps, and guest user risks using AzureAD PowerShell, Microsoft Graph API, and ScoutSuite.

The English summary is being prepared. Showing the original description.

Detect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and WriteOwner abuse paths

The English summary is being prepared. Showing the original description.

Dağıt:s deception-based honeytokens in Active Directory including fake privileged accounts with AdminCount=1, fake SPNs for Kerberoasting Tespit (honeyroasting), decoy GPOs with cpassword traps, and fake BloodHound paths. Monitors Windows Security Event IDs 4769, 4625, 4662, 5136 for honeytoken interaction. Use implementing yaparken AD deception defenses for Tespit etme lateral movement, credential theft, and reconnaissance.

The English summary is being prepared. Showing the original description.

Auditing Microsoft Entra ID (Azure Active Directory) configuration to identify risky authentication policies, overly permissive role assignments, stale accounts, conditional access gaps, and guest user risks using AzureAD PowerShell, Microsoft Graph API, and ScoutSuite.

The English summary is being prepared. Showing the original description.

Deploys deception-based honeytokens in Active Directory including fake privileged accounts with AdminCount=1, fake SPNs for Kerberoasting detection (honeyroasting), decoy GPOs with cpassword traps, and fake BloodHound paths. Monitors Windows Security Event IDs 4769, 4625, 4662, 5136 for honeytoken interaction. Use when implementing AD deception defenses for detecting lateral movement, credential theft, and reconnaissance.

The English summary is being prepared. Showing the original description.

Detect DCSync attacks where adversaries abuse Active Directory replication privileges to extract password hashes by monitoring for non-domain-controller accounts requesting directory replication via DsGetNCChanges.

The English summary is being prepared. Showing the original description.

Implement Microsoft's Enhanced Security Admin Environment (ESAE) tiered administration model for Active Directory. Covers Tier 0/1/2 separation, privileged access workstations (PAWs), administrative f

The English summary is being prepared. Showing the original description.