Skip to content

40 results for “Active Directory”

ListGrid
What you seeeverything
RecentOldestAddedA–Z
All types40Write-ups16Repos13Articles8Papers2Other1
“Active Directory”
securityweek.comarticle🛡️ Security

China-Linked Hackers Exploit PHP2Shell to Root Firewalls

A China-linked actor chained PHP2Shell (CVE-2026-109618, CVE-2026-109619) with the Fragnesia Linux kernel privilege escalation (CVE-2026-46300) to root firewalls and drop PHP webshells, per Dream. Using FOFA, the actor narrowed 19,000 firewalls to 240 targets and rooted 24 on 23-24 October. On two US government-affiliated devices it used a reverse SSH tunnel, hit the firewall management server, and attempted LDAP and Active Directory abuse.

PHPLinux kernelSSH+2
CVE-2026-109618CVE-2026-109619CVE-2026-46300+7

Threat Intel, Offensive Security· Published and added 28 Oct 2026

github.comrepo🧠 AI

SnailSploit/Claude-Red

claude-red is an MIT-licensed library of offensive security skills for the Claude Skills system, planned at about 130 skills across 23+ categories (web, Active Directory, cloud, exploit development, EDR evasion and others). Each skill is a SKILL.md file that loads on conversational triggers, so unused skills cost no context. It installs by git clone, sparse checkout per category, install.sh or pasting into a system prompt.

ClaudeGitGitHub
Kai AizenSnailSploitSahar Shlichov

prompting, coding-agents· Added 22 Oct 2026

github.comrepo🛡️ Security

SnailSploit/Claude-Red

claude-red is a library of offensive security skills for the Claude Skills system, each a SKILL.md file that loads on conversational triggers (for example, mentioning SQL injection loads offensive-sqli). Categories include web, Active Directory, cloud, mobile, exploit development, fuzzing, privilege escalation, post-exploitation and AI. It targets about 130 skills across 23+ categories, with an install script and sparse-checkout install per category. Built on Sahar Shlichov's offensive checklists, MIT licensed.

ClaudeClaude CodeActive Directory
Kai AizenSahar ShlichovSnailSploit

Offensive Security, AI Security· Added 22 Oct 2026

arxiv.orgpaper🛡️ Security

Thinking in Graphs: Neo4j-Backed Exploit-Chain Reasoning for LLM Penetration-Testing Agents

Presents ChainGraph, a pattern that externalizes exploit-chain reasoning for LLM pentest agents (Claude Code, Codex) into a Neo4j property graph exposed via the Model Context Protocol. Findings, attack steps, credentials, assets and tamper-evident evidence receipts are typed nodes with pre/post-condition edges, queried with Cypher and Graph Data Science for next-step inference, entry-to-crown-jewel pathing, chain-severity promotion, provenance and chokepoints. On a synthetic GOAD-style multi-forest Active Directory engagement, three Medium findings become Critical once chained, betweenness centrality identifies break-points, and reasoning payload drops ~98% (token proxy); results are single-run and illustrative.

Neo4jModel Context ProtocolClaude Code+3
ChainGraphGOADchain-severity score+1

Offensive Security, AI Security· Added 17 Oct 2026, published 14 Oct 2026

arxiv.orgpaper🧠 AI

Thinking in Graphs: Neo4j-Backed Exploit-Chain Reasoning for LLM Penetration-Testing Agents

ChainGraph is a pattern that moves exploit-chain reasoning out of the flat context window and into a Neo4j property graph. Findings, attack steps, credentials, assets and tamper-evident evidence receipts are typed nodes with pre/post-condition edges. The graph is wired to Claude Code or Codex through MCP with no custom harness. Five operator questions (next-step inference, entry-to-crown-jewel pathing, combined-severity promotion, evidence provenance, chokepoint identification) become reusable Cypher and Graph Data Science queries, plus a chain-severity score. On a synthetic multi-forest Active Directory lab modeled on GOAD, three findings rated Medium in isolation become Critical once their path to the forest root is materialized. Scoping each decision to a graph result cut the reasoning payload by about 98% on a token proxy. The authors say the results are illustrative single-run measurements, not a benchmark.

Neo4jModel Context ProtocolClaude Code+4
ChainGraphGOADarXiv

agents, mcp, research· Added 17 Oct 2026, published 14 Oct 2026

securityweek.comarticle🛡️ Security

Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN

Ivanti disclosed CVE-2026-104935, an authentication bypass plus RCE in Connect Secure VPN appliances, exploited in the wild; patched in ICS 22.8R2.5, 25.1.1.2, 25.1.3.0 and 25.1.3.1. Volexity found threat actor UTA0576 chained three zero-days, including a still-unpatched privilege escalation, to get unauthenticated root on a fully patched appliance. Post-exploitation focused on stealing domain credentials, Active Directory reconnaissance (LAPS passwords, BitLocker keys), password spraying, a custom Kerberos tool and log tampering. Volexity assesses with medium confidence that the actor uses LLMs for exploit development.

Ivanti Connect SecureVPNActive Directory+2
CVE-2026-104935UTA0576Volexity+5

Threat Intel, Offensive Security· Published and added 13 Oct 2026

hackers-arise.comwriteup🛡️ Security

Artificial Intelligence (AI) in Cybersecurity, Part 28: Using ADStrike to Compromise Active Directory

ADStrike is an Active Directory attack framework with 52 attack modules and configurable OPSEC levels. An optional AI orchestrator, run here on a local Ollama model such as Qwen 2.5-coder 7b, picks the next tool from each step's output. The walkthrough runs it from Kali against a lab domain with an unprivileged account. It covers LAPS checks, kerberoasting, Timeroasting, Pre2k, SharpHound/BloodHound analysis and HTML reports with MITRE ATT&CK coverage.

ADStrikeActive DirectoryOllama+3
kerberoastingTimeroastingPre2k+3

Offensive Security, AI Security· Published and added 12 Oct 2026

securityweek.comarticle🛡️ Security

US Disrupts Chinese State-Sponsored Hacking Tools

The US, alongside UK, Australian, Canadian, Japanese, New Zealand, and Spanish agencies, disrupted MicroScan and FishHub, hacking tools built by China's Integrity Technology Group and used by the state-sponsored actor Flax Typhoon (aka Ethereal Panda, Red Juliett, Storm-0919, UNC5007) against US, Japanese, Polish, and Taiwanese critical infrastructure and universities. MicroScan is a Python-based scanner with over 1,300 penetration-testing scripts targeting Apache Struts, Jenkins, WebLogic Server, WordPress, OpenSSL, and other services, delivered via a Mirai-derived IoT botnet; FishHub let operators remotely search and exfiltrate files from victim networks. The advisory also details the group's broader toolkit (SoftEther VPN for persistence, EBurst for Exchange password spraying, DC.ex for Active Directory data extraction) and the seizure of the domains used to access the tools.

NmapWordPressActive Directory+3
Flax Typhoon (Ethereal Panda, Red Juliett, Storm-0919, UNC5007)Integrity Technology GroupMicroScan+4

Threat Intel, Offensive Security· Published and added 9 Oct 2026

blog.talosintelligence.comarticle🛡️ Security

One breach, please, and make no mistakes

Cisco Talos commentary arguing that today's public AI-agent attacks (citing Hugging Face, DSEWiki, and RubyGems incidents) resemble loud, high-volume pentests rather than stealthy red-team operations, and that agent swarms will grow quieter and more OPSEC-conscious over time. The piece lays out concrete resilience steps: rehearsed incident response plans mapped to the incident lifecycle, assumed-breach attack-path mapping (including Active Directory GPO abuse paths), AI-specific tabletop exercises, end-to-end hardening with phishing-resistant MFA (FIDO2/passkeys), broad EDR and east-west traffic visibility, and watching for early noisy indicators like WAF/SQLi spikes and non-browser user agents.

Active DirectoryRubyGemsHugging Face+1
DSEWiki

AI Security, Blue Team & Detection, Offensive Security· Published and added 7 Oct 2026

hackers-arise.comwriteup🛡️ Security

Living off The Browser: Running Popular Hacking Tools Inside Chrome

Hackers Arise walks through an installable Chrome Isolated Web App that packages nine popular Active Directory pentesting tools, including NetExec (NXC), SharpHound, LDAP-shell, Evil-WinRM, and Certipy, so they run natively inside a Chrome tab with multi-protocol network access, bypassing the need for Linux or WSL. The piece shows setup via Chrome flags and an IWA install URL, then a lab demo: port-scanning a target, using Evil-WinRM for remote access, enumerating DNS zones with ADIDNS, and running Certipy to flag an ESC1-vulnerable ADCS template for domain-admin escalation.

ChromeActive DirectoryKerberos+3
ESC1ADIDNS

Offensive Security· Added 7 Oct 2026, published 6 Oct 2026

github.comrepo🛡️ Security

Sift — Open-Source Secrets/Credential Scanner

Sift is Stratus Security's open-source successor to Snaffler: a Native AOT credential/secrets scanner for pentesters that crawls local drives, SMB shares/subnets, Active Directory, SharePoint/OneDrive/Teams, Slack, and Jira/Confluence for exposed secrets. It supports Kerberos/NTLM/pass-the-hash authentication, resumable checkpointed scans, a JSON rule/ignore-rule system compatible with Snaffler's detection catalogue, and optional local-LLM (Ollama) validation to cut false positives without sending sensitive findings to a cloud API.

.NETActive DirectoryMicrosoft 365+3
Snaffler

Offensive Security· Added 30 Sep 2026

github.comrepo🛡️ Security

crypt0p3g/adnullenum

adnullenum is a single-pass Active Directory enumerator that uses anonymous (null) SMB sessions over the \samr and \lsarpc named pipes to pull domain info, password/lockout policy, RID-cycled account inventory, per-user detail, and group membership without credentials. It consolidates what rpcclient, impacket's samrdump.py/lookupsid.py, enum4linux-ng, and NetExec each do separately into one run, falls back to LSA lookups when SAMR is locked down, flags interesting accounts (AS-REP-roastable, PASSWORD_NOT_REQUIRED, unconstrained delegation, etc.), and writes ready-to-use userlist.txt/computerlist.txt plus a reusable RID cache. The README also gives blue-team guidance on closing null-session access (RestrictAnonymousSAM, Pre-Windows 2000 Compatible Access group) and detecting it via Event 4661/4662/4624/5140.

Active DirectoryImpacketPython+2
AS-REP roastingRID cyclingunconstrained delegation+1

Offensive Security· Added 2 Oct 2026, published 17 Sep 2026

huntress.comarticle🛡️ Security

AD Rights Management Service (Part 1): Architecture, Deprecation, and Reconnaissance

Part 1 of a Huntress research series on Active Directory Rights Management Services (AD RMS), explaining its PKI-based trust model (Server Licensor Certificate signing content keys), why it's still deployed despite Microsoft's deprecation push toward Azure Information Protection, and how to fingerprint and enumerate a cluster from an unprivileged domain account. It introduces SharpRMS, a custom C# tool that speaks the AD RMS SOAP protocol to enumerate clusters and rights-policy templates, and shows how local AD RMS Service Group membership (not Domain Admin) gates the administrative surface where the SLC private key can eventually be reached — setting up Part 2's key extraction and offline decryption.

Active DirectoryWindows.NET+1
DisARMSMSRC Case 33210Sean Metcalf+1

Offensive Security, Identity & Access· Published and added 8 Sep 2026

aws.amazon.comwriteup🛡️ Security

Managing identity source transition for AWS IAM Identity Center

AWS Security Blog runbook for migrating the identity source behind AWS IAM Identity Center from Active Directory to an external SAML 2.0 IdP such as Okta, which is a destructive cutover that deletes all users, groups, and permission-set/application assignments at the moment of switch. It walks through pre-migration backup, SCIM provisioning setup, SAML metadata/ACS configuration, scripted assignment restoration with drift detection (drift_report.csv), post-migration validation, and a manual rollback procedure, linking to an aws-samples GitHub migration tool for the scripted steps.

AWS IAM Identity CenterActive DirectoryOkta+2

Identity & Access· Added 7 Oct 2026, published 2 Sep 2026

github.comrepo🛡️ Security

ADScanPro/Claude-AD

Claude-AD is a Claude Code plugin that packages Active Directory pentest methodology as skills, agents, and slash commands, directing Claude to run standard tooling (netexec, Impacket, certipy, bloodyAD, BloodHound CE) in the correct setup-collection-exploitation-post order. It covers environment constraints that break tooling in hardened domains (AES-only Kerberos, LDAP channel binding, Protected Users, LAPS, gMSA), techniques like Kerberoasting, AS-REP roasting, ADCS ESC1-ESC17, ACL abuse, coercion/NTLM relay (PetitPotam, PrinterBug, DFSCoerce) and delegation abuse with their Windows Event IDs/MDI telemetry, and maps each technique to DORA/NIS2/ENS compliance controls. Exploitation agents require human confirmation before directory-modifying actions.

Claude CodeActive DirectoryBloodHound+3
KerberoastingAS-REP roastingDCSync+7

Offensive Security, GRC· Added 2 Oct 2026, published 24 Aug 2026

kuwaitist.github.ioarticle🛡️ Security

ARTOC by White Knight Labs - Review

A reviewer's first-person writeup of the Advanced Red Team Operations Certification (ARTOC) by White Knight Labs, covering a full red team engagement curriculum: building C2 infrastructure with Cobalt Strike and Adaptix, cloud redirectors across AWS, Azure and GCP via CDNs and serverless functions, Active Directory and ADCS exploitation, and kernel and user mode EDR evasion, tested against real enterprise EDR products. The exam is a 48-hour infrastructure build and compromise exercise followed by a 48-hour red team report. The post is a positive testimonial encouraging enrollment rather than a technical walkthrough of any attack.

Cobalt StrikeActive DirectoryAWS+3
ADCS exploitation

Offensive Security, Learning· Added 2 Oct 2026, published 6 Aug 2026

github.comrepo🛡️ Security

Dark-Moon

DarkMoon is a self-hosted, GPLv3 AI penetration testing platform that orchestrates 50 specialist agents over an MCP-gated toolbox (Nuclei, BloodHound, sqlmap, Impacket, Naabu, httpx, ffuf, etc.) to autonomously run recon-to-exploitation across web, API, Active Directory, Kubernetes, multi-cloud, CI/CD, databases, IoT firmware, and AI/LLM inference endpoints. It uses a Privacy Gateway that tokenizes real IPs/hosts/credentials into placeholders so raw infrastructure data never reaches the (optionally local, e.g. Ollama/llama.cpp) LLM, and can generate sandbox-validated, exploit-retested pull requests for findings. It also ships a dedicated LLM agent that probes OpenAI-compatible/Ollama/vLLM/TGI inference endpoints for the OWASP LLM Top 10 (prompt injection, jailbreaks, system-prompt leakage) using garak-backed probes.

Model Context ProtocolMITRE ATT&CKNuclei+3
ISO 27001NIST SP 800-115OWASP Top 10 for LLM Applications

Offensive Security, AI Security· Published and added 5 Aug 2026

hackers-arise.comwriteup🛡️ Security

Speeding Up AD Pentests with ADScan & ADPulse

Walkthrough of two Active Directory pentesting utilities: ADScan, a Docker/BloodHound-integrated tool for automated DNS/LDAP/SMB/Kerberos enumeration and attack (Kerberoasting, AS-REP roasting, DCSync, password spraying, ADCS escalation path discovery, DACL/GenericAll abuse via SDProp misconfig), and ADPulse, a read-only LDAP/LDAPS auditing tool that produces CLI/JSON/HTML security posture reports for AD environments. The piece demonstrates installation on Kali and a worked example where a low-privileged account is shown to have GenericAll rights over Domain Admins, plus checks for known DC vulnerabilities like Zerologon and NoPac.

Active DirectoryBloodHoundDocker+3
ZerologonNoPacSDProp+1

Offensive Security· Added 3 Sep 2026, published 31 Jul 2026

github.comrepo🛡️ Security

aniqfakhrul/CVE-2026-54121

Certighost is a Python PoC for CVE-2026-54121, an Active Directory Certificate Services attack that spins up rogue SMB/LSA and LDAP listeners to intercept the CA's NetLogon-based identity resolution during certificate enrollment. By impersonating a low-privileged computer account and redirecting the CA's lookups to the target Domain Controller's identity, the tool causes the CA to issue a valid certificate for the DC, then uses PKINIT with that certificate to retrieve the DC's Kerberos TGT/ccache and NT hash — a full domain-compromise chain from a single low-privileged account. The repo includes fixes for an in-the-wild NetLogon trust-account error (STATUS_NOLOGON_SERVER_TRUST_ACCOUNT) and a SAN-spoofing bypass for CAs enforcing ESC6-style EDITF_ATTRIBUTESUBJECTALTNAME2 protections.

Active DirectoryImpacketLDAP+2
CVE-2026-54121CertighostESC6+3

Offensive Security, Identity & Access· Added 5 Oct 2026, published 23 Jul 2026

github.comrepo🛡️ Security

OSCP & CPTS Study Notes

A GitHub repository (also published as a GitBook) of study notes compiled while pursuing the Hack The Box CPTS certification, structured to double as OSCP prep material. It covers networking fundamentals, enumeration, privilege escalation, Active Directory attacks, and pivoting with hands-on methodologies and tool usage rather than just theory.

Active Directory
OSCPCPTS

Learning, Offensive Security· Added 3 Sep 2026, published 18 Jul 2026

github.comrepo🛡️ Security

0x1ceKing/HTB-Certified-Penetration-Testing-Specialist

A GitHub repository compiling personal study notes and cheatsheets for HackTheBox's CPTS (Certified Penetration Testing Specialist) certification, organized by module: network enumeration (Nmap), web footprinting, file transfers, shells/payloads, Metasploit, password attacks, pivoting/tunnelling, Active Directory enumeration and attacks, web app attacks (SQLi, SQLMap, XSS, LFI, file upload, command injection, Ffuf), and Linux/Windows privilege escalation. It functions as a reference guide mirroring the official HTB Academy course structure rather than original research.

NmapMetasploitsqlmap+2

Learning, Offensive Security· Published and added 18 Jul 2026

github.comrepo🛡️ Security

icedracon/adhammer

ADhammer is an open-source Rust CLI for authorized Active Directory assessments that discovers domain state, maps attack paths to Tier-0, and reports findings with an explicit evidence/validation status. Its v1.5.2 release adds an ESC1-based KB5014754 PKINIT bypass against Full-Enforcement KDCs, pass-the-hash DCSync, workstation preflight checks, and a hardened error classifier. It exposes a 74-method catalog spanning enumeration, Kerberos/credential attacks, delegation/S4U abuse, coercion/relay, and remote execution, plus reusable Rust protocol crates and an SDK.

RustActive DirectoryLDAP+3
KB5014754ESC1DCSync+4

Offensive Security, Identity & Access· Added 2 Oct 2026, published 17 Jul 2026

huntress.comwriteup🛡️ Security

AI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress

Huntress recovered and reconstructed "Untitled1.ps1," a PowerShell Active Directory enumeration script used by an attacker during a June 3 incident via RDP access with compromised credentials, and identified it as AI-generated ("vibe-coded") based on artifacts like an unedited LLM placeholder hostname, a "FULLY FIXED" prompt-iteration title, over-engineered five-method DC-discovery fallback logic, and gratuitous colored console/HTML reporting output. The attack chain paired this bespoke recon tool with off-the-shelf abuse of s5cmd (legitimate AWS S3 CLI used for exfiltration) and SharpShares (share enumeration), illustrating how LLM-generated one-off malware evades hash/signature-based detection and pushes defenders toward behavioral analytics on Active Directory enumeration patterns.

PowerShellActive DirectoryRDP+2
SharpShares

Threat Intel, Blue Team & Detection, Offensive Security· Added 3 Sep 2026, published 8 Jul 2026

huntress.comwriteup🛡️ Security

From Code to Coverage (Part 6): What netlogon.log Sees That Event 1644 Never Will

Part 6 of Huntress's "From Code to Coverage" series reverse-engineers ldapnomnom's LDAP Ping (cLDAP-style) Active Directory username enumeration technique, tracing its Go source down to the Windows Filtering Platform to test the tool's claim of generating "no Windows audit logs." Lab testing shows Event 1644 never fires for LDAP Ping (it's processed by netlogon.dll, not the ntdsa.dll LDAP engine it monitors), but netlogon.log captures every queried username including disabled-account detail attackers can't see, while Event 5156 attributes source IP for ldapnomnom's TCP connections — a gap that disappears entirely if an attacker switches to true UDP cLDAP (as demonstrated with a custom cldap_ping.py), leaving only MDI's threshold-based external ID 2437 as network-layer coverage. The piece also audits the ldeep tool's enum_users transport and provides a PowerShell correlation script joining netlogon.log and Event 5156 within a 5-second window.

Active DirectoryLDAPWindows+3
ldapnomnomEvent 1644Event 5156+12

Blue Team & Detection, Offensive Security, Identity & Access· Added 3 Sep 2026, published 24 Jun 2026

github.comrepo🛡️ Security

HackTricks-wiki/hacktricks

HackTricks is a large, community-maintained wiki/repo of penetration-testing and hacking tradecraft covering web/API exploitation, privilege escalation, Active Directory attacks, cloud misconfigurations, and mobile hacking, served locally via mdbook/Docker. It's one of the most referenced practical hacking knowledge bases used by pentesters, red teamers, and CTF players for step-by-step technique notes and cheat sheets.

DockerGit

Offensive Security, Learning· Published and added 31 May 2026

github.comrepo🛡️ Security

Hack Skills

hack-skills is a GitHub repo (yaklang/hack-skills) that packages offensive security knowledge into installable "Agent Skills" — one master entry, six category entries, and 102 deep-topic SKILL.md files across 14 domains including web/API security, auth, Linux/Windows/macOS privilege escalation, Active Directory attacks, mobile, binary exploitation, reverse engineering, crypto attacks, blockchain/smart contracts, AI/LLM security, network pivoting, and forensics. It's designed for AI coding agents (installed via `npx skills add yaklang/hack-skills` or a raw SKILL.md URL) to use during authorized pentesting, bug bounty, and CTF work, and explicitly strips destructive PoCs (DROP/TRUNCATE, FLUSHALL, service shutdown/DoS) in favor of non-destructive proofs like time-based SQLi and read-only recon, while retaining RCE/webshell/reverse-shell primitives as access proofs.

Active Directory

Offensive Security, Learning· Added 3 Sep 2026, published 13 May 2026

github.comrepo🛡️ Security

0xSteph/pentest-ai-agents

pentest-ai-agents is a GitHub repo providing 50+ Claude Code subagent markdown files that turn Claude into a routed offensive-security assistant, covering recon, web, Active Directory, cloud, mobile, wireless, social engineering, payload crafting (msfvenom/Donut), reverse engineering (Ghidra/JadX/Radare2), C2 tuning (Sliver/Mythic/Havoc/Cobalt Strike), container breakout, and LLM red-teaming (OWASP LLM Top 10, prompt injection, RAG poisoning, MCP abuse). It distinguishes Tier 1 advisory agents from Tier 2 execution-capable agents that enforce a declared-scope guard before running commands, and ships a SQLite findings database, hardened CI validator, and an offline Docker bundle.

Claude CodeCobalt StrikeGhidra+3
CVE-2019-0708MS17-010

Offensive Security, AI Security· Published and added 6 May 2026

huntress.comwriteup🛡️ Security

The 60ms Window: How Event 5156 Solves the ADWS Attribution Problem

Huntress researchers solve the long-standing 'ADWS attribution problem' where tools like SOAPy abuse Active Directory Web Services to hide the attacker's real source IP behind localhost ([::1]) in LDAP diagnostic logging (Event 1644). By correlating Windows Filtering Platform Event 5156 (which captures the real inbound source IP on port 9389 before ADWS proxies to loopback) with Event 1138 (ADWS session) and Event 1644 (LDAP query) using a stable ~60-80ms timestamp window, they demonstrate reliable attribution even when port-based correlation fails due to log rollover. The post includes a released PowerShell script (Get-ADWSAttribution.ps1) and addresses the false-positive concern of RSAT tools also using ADWS via pattern detection on suspicious 1644 query attributes.

Active DirectoryBloodHoundPowerShell+3
Event 1644Event 5156Event 1138+4

Blue Team & Detection, Offensive Security· Added 3 Sep 2026, published 9 Apr 2026

huntress.comwriteup🛡️ Security

The ADWS Architecture That Hides PowerShell AD Enumeration

Part 5A of Huntress's LDAP/AD detection series explains why native PowerShell commands like Get-ADComputer -Properties * evade traditional LDAP-based detections: PowerShell's ActiveDirectory module uses Active Directory Web Services (ADWS) over encrypted SOAP on port 9389 rather than LDAP on 389/636, and the resulting Event 1644 log shows the query originating from localhost ([::1]) instead of the attacker's real IP. The author shows how to correlate Event 1644 with ADWS connection/session events (1138, 1139, 1166, 1167) via shared Operation ID to reconstruct full enumeration sessions, and flags the "[all_with_list]" attribute prefix and "SDflags:0x7" server control as high-fidelity indicators of PowerShell bulk property/security-descriptor dumps (as used by tools like BloodHound). It also demonstrates that case obfuscation of cmdlets (e.g., geT-aDcompUTER) is irrelevant at the LDAP layer since PowerShell is case-insensitive and translates to standard LDAP filters before reaching the DC.

PowerShellActive DirectoryLDAP+2
Event 1644Event 1138Event 1139+2

Blue Team & Detection, Offensive Security· Added 3 Sep 2026, published 8 Apr 2026

mayfly277.github.ioother🛡️ Security

Dracarys

Dracarys is a new "not for beginners" Active Directory attack lab built on top of Orange Cyberdefense's GOAD (Game of Active Directory) framework. The lab consists of two Windows Server 2025 hosts (a DC and a member server) and an Ubuntu 24.04 server, all joined to the domain dracarys.lab; the goal is to pivot from the domain-joined Linux box to full domain admin. The post gives deployment instructions (VirtualBox, VMware, Ludus, Proxmox, AWS, Azure), rules (no vagrant user, no reading recipe secrets), and promises follow-up walkthroughs of the Linux-side exploitation techniques.

Active DirectoryWindowsLinux+2

Offensive Security, Learning· Added 2 Oct 2026, published 8 Mar 2026

Showing 30 of 40

Show more