Active Directory & Red Teaming

Because the directory stores the identities, groups, machines and trust relationships for the whole organisation, and nearly every workstation and server authenticates against its controller. Compromise one ordinary account and you inherit a map of the entire company, so a single misconfiguration can cascade into total network ownership without any software exploit.

It means directory red teaming is rarely about memory-corruption bugs. Instead it abuses features working exactly as designed, such as authentication protocols, delegation and permission inheritance. This makes the attacks stealthy and hard to patch, because you cannot fix a group membership with an update; a human has to find, understand and correct it.

Create a virtual machine, install a Windows Server evaluation image and promote it to host a fresh test domain, then join two or three client VMs. Seed sample users, groups and service accounts, including a few deliberate weak configurations. Put every machine on a host-only or internal network with no route out, and snapshot each one so experiments are easy to roll back.

Early on, every tester and auditor asks who is in the Domain Admins group. On a healthy network that group is tiny and carefully managed. If it is large, contains a service account or includes someone who has left, you have found the first thread to pull. You can read it with built-in commands such as net group Domain Admins /domain.

By noticing abuse of legitimate features rather than blocking a single exploit: watching for mass directory queries that look like mapping, unusual service-account ticket requests, and ordinary users authenticating to machines they never touch. The core defences are hygiene: keep privileged groups tiny, give service accounts strong least-privilege settings, separate admin accounts, and monitor the revealing events.

Kerberos is a ticket-based protocol. You prove your identity once to the domain controller's Key Distribution Center and receive a Ticket-Granting Ticket (TGT). From then on, each time you reach a service you exchange the TGT for a short-lived service ticket for just that service. Because of this, defenders watch ticket-request events such as 4768 and 4769 rather than passwords.