Red Team Playbook: Active Directory Reconnaissance and Privilege Escalation

The Heart of Enterprise Infrastructure

Over 90% of Fortune 1000 organizations rely on Microsoft Active Directory to manage identity and access. During a Red Team engagement, breaching the internal perimeter is only the first phase. The real objective is escalating privileges to Domain Admin while avoiding detection by the Blue Team.

Reconnaissance with BloodHound

Using SharpHound to ingest LDAP queries and session data allows operators to visualize shortest attack paths to high-value targets. By identifying unconstrained delegation and nested security groups, an operator can leapfrog through intermediate machines without triggering standard antivirus alarms.

Kerberoasting and AS-REP Roasting

Any authenticated user in a domain can request service tickets (TGS) for service principal names (SPNs). These tickets are encrypted using the NTLM hash of the service account password. Extracting and cracking these tickets offline gives attackers legitimate credentials without ever touching the target server.

How Defenders Can Neutralize the Threat

• Implement Group Managed Service Accounts (gMSA) with 128-character randomly generated passwords.
• Deploy Active Directory Tiering Models isolating Domain Controllers from workstation traffic.
• Enable Sysmon Event ID 1 (Process Creation) and Event ID 3 (Network Connection) for anomaly detection.