Windows:
Enumeration
Guides covering Windows and AD enumeration for privesc and pivoting
Active Directory Enumeration
Techniques for enumerating AD objects, users, groups, GPOs, trusts, and misconfigurations using tools like BloodHound, ldapsearch, and PowerView.
Windows Antivirus and EDR Enumeration
Techniques for identifying installed AV and EDR solutions on Windows systems, including registry queries, process enumeration, and WMI-based detection methods.
Windows Network Enumeration
Covers active Windows network enumeration techniques including host discovery, share mapping, SMB reconnaissance, and user/group extraction via native and third-party tools.
Windows Service and Process Enumeration
Enumerate Windows services and processes to identify running applications, privileges, and potential attack vectors using native tools and commands.
Windows System Enumeration
Covers techniques for enumerating Windows systems, including users, groups, privileges, network config, running processes, and installed software to identify attack paths.
Windows User and Group Enumeration
Techniques for enumerating local and domain users, groups, and memberships on Windows systems using built-in tools and commands.
Windows enumeration is about understanding exactly what you have landed on. Local users and groups, network shares, running services, scheduled tasks, installed software, firewall rules, and antivirus products all shape what you can do next. Commands like net user, net localgroup, tasklist, sc query, and schtasks give you the baseline.
PowerShell makes deep enumeration practical. Get-Process, Get-Service, Get-NetFirewallRule, and WMI queries pull detailed system state. Tools like winPEAS, Seatbelt, and SharpUp automate the collection and flag common escalation paths, weak permissions, and misconfigurations in a single pass.
Network enumeration from the host (arp -a, netstat, route print, DNS cache) reveals the internal landscape and adjacent systems. Start here to map the local attack surface before moving into privilege escalation or lateral movement.