Active Directory:

Post-Exploitation

AD post-exploitation: enum trusts, dump creds, abuse domain trusts

4 guides • Created Apr 5, 2026 • Updated Aug 11, 2026

4 guides

Credential Harvesting

Techniques for extracting credentials from AD environments post-compromise, covering LSASS dumping, DCSync attacks, and Kerberoasting for lateral movement.

Apr 5, 2026 • 6 min read

Cross-Forest Trust Abuse

Exploiting Active Directory cross-forest trust relationships to escalate privileges, move laterally, and access resources across trusted forest boundaries.

Jun 11, 2026 • 6 min read

Domain Trust Abuse

Techniques for abusing AD domain trust relationships to escalate privileges, move laterally across forests, and compromise linked domains via ticket attacks.

Apr 30, 2026 • 4 min read

Situational Awareness

Enumerating AD objects, trusts, ACLs, and privilege paths post-compromise to map attack surface and identify lateral movement or escalation opportunities.

Apr 5, 2026 • 4 min read

Post-exploitation in AD focuses on extracting credentials, mapping trust relationships, and building situational awareness across the domain. The goal is to identify escalation paths and high-value targets from your current position.

DPAPI secret extraction recovers saved credentials, browser passwords, and Wi-Fi keys from compromised hosts. Group Policy Preferences and SYSVOL scripts may contain plaintext passwords. Trust mapping reveals cross-domain relationships and potential lateral movement paths you missed during enumeration.

Domain situational awareness, including who is logged in where, recent authentication events, and admin session locations, guides your next move.