Active Directory:
Post-Exploitation
AD post-exploitation: enum trusts, dump creds, abuse domain trusts
Credential Harvesting
Techniques for extracting credentials from AD environments post-compromise, covering LSASS dumping, DCSync attacks, and Kerberoasting for lateral movement.
Cross-Forest Trust Abuse
Exploiting Active Directory cross-forest trust relationships to escalate privileges, move laterally, and access resources across trusted forest boundaries.
Domain Trust Abuse
Techniques for abusing AD domain trust relationships to escalate privileges, move laterally across forests, and compromise linked domains via ticket attacks.
Situational Awareness
Enumerating AD objects, trusts, ACLs, and privilege paths post-compromise to map attack surface and identify lateral movement or escalation opportunities.
Post-exploitation in AD focuses on extracting credentials, mapping trust relationships, and building situational awareness across the domain. The goal is to identify escalation paths and high-value targets from your current position.
DPAPI secret extraction recovers saved credentials, browser passwords, and Wi-Fi keys from compromised hosts. Group Policy Preferences and SYSVOL scripts may contain plaintext passwords. Trust mapping reveals cross-domain relationships and potential lateral movement paths you missed during enumeration.
Domain situational awareness, including who is logged in where, recent authentication events, and admin session locations, guides your next move.