Windows / Active Directory
This section organizes Windows and Active Directory concepts and investigation steps by purpose. Start with Authentication to understand authentication methods, or Credentials and Analysis to work with recovered values and password candidates.
These commands include credential extraction, relay, remote execution, persistence, and other features that can have a substantial impact on target systems. Use them only in a test environment or one for which you have explicit authorization.
Starting an Investigation
Section titled “Starting an Investigation”- Enumeration with NetExec and WinRM: follows what to check from obtaining initial credentials through a WinRM connection.
- Windows Local Privilege Escalation Map: surveys what to inspect on a local system.
Authentication
Section titled “Authentication”- Authentication methods and related mechanisms: Kerberos, NTLM, Negotiate, SSPI, and SPNEGO, CredSSP
- Tickets and delegation: PAC and Silver/Golden Tickets, Kerberos Delegation and SPN Abuse
- Abusing authentication paths: NTLM Relay and Authentication Coercion
- Keys and certificates: Certificate and Smart Card Authentication, Windows Hello for Business
- Mechanisms with similar names: Netlogon Secure Channel and Schannel
Credentials and Analysis
Section titled “Credentials and Analysis”Authentication methods and the values used for authentication are explained separately.
- NTHash and HMAC-MD5: examine the values and calculations used in NTLM responses.
- Password Cracking Rules: covers rules for transforming candidate words.
- Investigating Windows Local Credentials: looks for DPAPI data, Credential Manager entries, and information left in files or the registry.
Active Directory Structure and Operations
Section titled “Active Directory Structure and Operations”- Accounts: Account Design, Service Account Design and Operations, Using Computer Accounts and gMSAs
- Permissions and changes: AD Access Control and BloodHound Edges, LDAP Modify Operations
- Infrastructure operations: Domain Controller Operations, Active Directory Recycle Bin
Windows Local Privilege Escalation
Section titled “Windows Local Privilege Escalation”Start with the overview, then continue according to what needs investigating.
- System Information and Installers, Security Features and Detection Settings
- Users, Processes, and Services, Applications, DLLs, and Networks
- Credentials, Privilege Escalation Paths
Access Token Manipulation and JuicyPotato examine specific mechanisms in detail. Related tools are collected in Investigation Tools and References.
Examples from Practice
Section titled “Examples from Practice”Understanding Windows and AD through Pirate uses a separate writeup to examine NTLM relay, RBCD, and SPN changes.