Attack cards

Eight common Active Directory attacks, ordered along the attacker's chain: requirements, detection and defense.

AS-REP Roasting

🟢 Easy

MITRE ATT&CK T1558.004

Requires: A list of usernames
Detection: 4768 (RC4, no pre-authentication)4768
Defense: Never disable pre-authentication; strong passwords

GetNPUsers.py lab.local/ -usersfile users.txt

Leads to: Kerberoasting

Kerberoasting

🟢 Easy

MITRE ATT&CK T1558.003

Requires: Any domain user
Detection: 4769 (RC4)4769
Defense: gMSA, long service-account passwords, AES only

GetUserSPNs.py -request lab.local/user:pass

Leads to: Delegation Abuse, DCSync

NTLM Relay

🟡 Medium

MITRE ATT&CK T1557.001

Requires: Network access + unsigned SMB
Detection: 4624 (type 3, anomalous source)4624
Defense: SMB Signing, LDAP Signing, EPA, disable LLMNR

ntlmrelayx.py -t smb://target

Leads to: AD CS (ESC1), Pass-the-Hash

Pass-the-Hash

🟡 Medium

MITRE ATT&CK T1550.002

Requires: A user's NTLM hash + local rights
Detection: 4624 (type 3, NTLM), 46274624 4627
Defense: LAPS, Credential Guard, Protected Users

pth-winexe -U user%hash //target cmd

Leads to: Delegation Abuse, DCSync

AD CS (ESC1)

🟡 Medium

MITRE ATT&CK T1649

Requires: Vulnerable certificate template + enroll right
Detection: 4886/4887, 47684886 4887 4768
Defense: Audit templates, remove EDITF_ATTRIBUTESUBJECTALTNAME2, EPA

certipy req -template VulnTemplate -upn admin@lab.local

Leads to: DCSync

Delegation Abuse

🟡 Medium

MITRE ATT&CK T1134.001

Requires: An account with Unconstrained/Constrained Delegation
Detection: 4768/4769 (S4U), 46244768 4769 4624
Defense: RBCD instead of Unconstrained; audit delegated accounts

Rubeus s4u /user:svc /impersonateuser:admin

Leads to: DCSync

DCSync

🔴 Hard

MITRE ATT&CK T1003.006

Requires: Replicating Directory Changes (All) rights
Detection: 4662 (GUID 1131f6aa-…)4662
Defense: Minimize replication rights; monitor 4662; reset krbtgt twice

mimikatz: lsadump::dcsync /user:krbtgt

Leads to: Golden Ticket

Golden Ticket

🔴 Hard

MITRE ATT&CK T1558.001

Requires: The krbtgt hash (after DCSync)
Detection: TGT with an anomalous lifetime
Defense: Reset krbtgt twice, Tiering, monitoring

mimikatz: kerberos::golden /user:admin /krbtgt:hash

End of the chain — full domain control

I have a problem — search by symptom →