Active Directory Pentesting Checklist

AD Attack Paths

✅ Active Directory Pentesting Checklist

A structured guide to learning every major technique and path in AD exploitation, based on the visual map by Orange Cyberdefense

✅ Active Directory Pentesting Checklist

🧭 Initial Access

  • Spearphishing Attachment
  • Spearphishing Link
  • Valid Accounts (default/reused creds)
  • Exploit Public-Facing App
  • Drive-by Compromise

⚙️ Execution

  • PowerShell
  • Cmd Shell
  • Scheduled Task/Job
  • Malicious Service
  • Office Macros

🗺️ Discovery

  • Account Enumeration
  • Group Enumeration
  • Domain Trust Enumeration
  • GPO & ACL Enumeration
  • DNS Enumeration
  • SPN Enumeration / Kerberoasting
  • AS-REP Roasting

📡 Lateral Movement

  • SMB / PSExec
  • WinRM / WMI
  • RDP
  • Token Impersonation
  • Kerberos Delegation
  • RBCD (Resource-Based Constrained Delegation)
  • DCOM Abuse

🛑 Privilege Escalation

  • UAC Bypass
  • Abuse SeDebug / SeImpersonate
  • Credential Theft & Reuse
  • GPO Misconfiguration Abuse
  • DLL Hijacking
  • AlwaysInstallElevated
  • Unquoted Service Path

🔐 Credential Access

  • LSASS Dumping
  • SAM Dump
  • NTDS.dit Extraction
  • secretsdump.py / DCSync
  • LSA Secret Extraction
  • Cleartext Password Discovery
  • Credential Manager Theft

🧠 Defense Evasion

  • Script Obfuscation
  • Timestomping
  • Event Log Clearing
  • AMSI Bypass
  • Disabling Defender
  • EDR Tampering

🏰 Persistence

  • Golden Ticket
  • Silver Ticket
  • Skeleton Key
  • AdminSDHolder Abuse
  • DCShadow
  • Create Shadow Admin Account
  • WMI Event Subscription

🧨 Domain Dominance

  • Full Domain Hash Dump
  • KRBTGT Account Compromise
  • Rogue Domain Controller (backdoor)
  • Trust Path Abuse (forest/domain trust manipulation)

🔎 Collection

  • File Share Harvesting
  • Email Harvesting
  • Clipboard Monitoring
  • Keylogging
  • Screenshot / Webcam Capture

☁️ Hybrid / Azure AD

  • AzureAD Token Theft
  • AzureAD Enumeration
  • Conditional Access Bypass
  • AzureAD Privilege Escalation
  • Hybrid Join Attack Paths
  • AAD Connect Abuse

🛠 Tool Recommendations

  • BloodHound / SharpHound
  • Mimikatz / Rubeus / Kekeo
  • CrackMapExec / Evil-WinRM
  • Impacket (secretsdump.py, wmiexec)
  • AADInternals / Roadtools