Active Directory: Full Attack Name
1️⃣ Initial Access 🚪
These attacks focus on gaining initial entry into the network.
Phishing Attack – Sending a malicious email to a user that executes malware or a payload.
Malicious Attachments / Macros – Injecting macro-based payloads into Word/Excel files.
Credential Stuffing – Attempting logins using leaked passwords.
Pass-the-Cookie Attack – Hijacking a session by stealing web session cookies.
Pass-the-Ticket Attack – Reusing an active Kerberos ticket.
Malicious USB / Rubber Ducky – Infiltrating the network via physical access.
Exposed SMB Shares – Stealing confidential files from public SMB shares.
VPN Credential Hijacking – Capturing remote VPN login credentials.
Zero-Day Exploitation – Exploiting unpatched vulnerabilities (e.g., Log4Shell).
LLMNR/NBT-NS Poisoning – Stealing credentials by intercepting name resolution queries.
Evil Twin Attack – Capturing credentials from a fake Wi-Fi access point.
Watering Hole Attack – Targeting users by placing malware on trusted websites.
Supply Chain Attack – Infiltrating via third-party software or services.
2️⃣ Credential Dumping Attacks 🔑
These attacks aim to extract credentials from systems or memory.
Mimikatz Attack – Extracting plain text passwords and hashes from LSASS memory.
DCSync Attack – Obtaining NTLM hashes directly from a domain controller.
LSASS Dumping – Extracting passwords by dumping the LSASS process.
SAM & SYSTEM Hive Dumping – Obtaining local password hashes.
Kerberos Ticket Extraction – Capturing active Kerberos tickets (TGT/TGS).
NTDS.dit Dumping – Extracting all user credentials from the domain controller database.
WDigest Credential Theft – Obtaining plain text passwords from Windows memory.
LSASS Memory Injection – Stealing credentials by injecting malicious code into LSASS.
Cached Credentials Dumping – Extracting and cracking stored mscache credentials.
Browser Credential Theft – Stealing passwords and cookies stored in browsers.
DPAPI Attack – Decrypting encrypted data by abusing the Data Protection API.
3️⃣ Privilege Escalation Attacks 🚀
These attacks escalate privileges to gain higher access levels.
Kerberoasting – Extracting user passwords by cracking Kerberos service ticket hashes.
AS-REP Roasting – Brute-forcing Kerberos AS-REP responses.
Token Impersonation Attack – Stealing the security token of a high-privilege user.
Pass-the-Hash Attack – Bypassing authentication with NTLM hashes.
Print Spooler Exploit – Gaining SYSTEM access from the Print Spooler service.
Unconstrained Delegation Abuse – Stealing NTLM hashes of unconstrained delegation users.
Constrained Delegation Abuse – Abusing the Kerberos delegation feature.
Local Privilege Escalation – Gaining admin privileges from system vulnerabilities (CVEs).
SeBackupPrivilege Abuse – Abusing privileges to copy sensitive files.
SeRestorePrivilege Abuse – Abusing privileges to modify registry or files.
Kerberos S4U2Self Abuse – Abusing the S4U2Self protocol to create tickets.
Kerberos S4U2Proxy Abuse – Abusing S4U2Proxy for unauthorized access.
DNSAdmins Group Abuse – Having DNSAdmins members load malicious DLLs.
AD Certificate Services Attack – Abusing AD Certificate Services to issue unauthorized certificates.
4️⃣ Lateral Movement ↔️
These attacks help spread within the network after initial access.
Pass-the-Hash – Lateral movement from a compromised machine to another.
Pass-the-Ticket – Accessing machines by reusing Kerberos TGTs.
SMB Relay Attack – Exploiting SMB and LDAP services by relaying NTLM.
PSExec Attack – Executing commands with SYSTEM access on remote machines.
RDP Hijacking – Hijacking active RDP sessions without credentials.
WMI Lateral Movement – Remote system control via Windows Management Instrumentation.
BloodHound Enumeration – Finding high-privilege users and attack paths in AD.
DCOM Lateral Movement – Remote code execution via DCOM.
WinRM Lateral Movement – Running remote commands via Windows Remote Management.
Printer Bug – Lateral movement via printer service vulnerabilities.
PetitPotam – Compromising domain controllers with NTLM relay attacks.
Domain Trust Attacks – Abusing inter-domain trust relationships.
Forest Trust Attacks – Exploiting inter-forest trust relationships.
5️⃣ Persistence & Domain Takeover 🔒
These attacks ensure long-term access or full control of the domain.
Golden Ticket Attack – Domain takeover by creating unlimited Kerberos TGTs.
Silver Ticket Attack – Gaining access by creating Kerberos TGS for specific services.
Skeleton Key Attack – Injecting a universal password on domain controllers.
AdminSDHolder Abuse – Modifying permissions of protected accounts.
GPO Hijacking – Deploying malicious Group Policy Objects.
SID History Injection – Escalating privileges by creating fake SID history.
Shadow Credentials Attack – Gaining unauthorized access by abusing Key Trust authentication.
RBCD Attack – Exploiting AD's delegation mechanisms.
DCShadow Attack – Making arbitrary changes by abusing domain controller replication rights.
WMI Event Subscription – Setting up persistent backdoors with WMI events.
Registry Run Keys – Running malicious programs at startup by modifying the registry.
AD Recycle Bin Exploitation – Restoring deleted objects for backdoor access.
AD FS Token Forgery – Creating fake tokens by stealing ADFS token signing certificates.
Azure AD Connect Exploitation – Accessing hybrid environments by compromising sync accounts.
6️⃣ NTLM & Kerberos Exploitation 🔐
These attacks target NTLM and Kerberos authentication protocols.
NTLM Relay Attack – Gaining unauthorized access by relaying NTLM authentication requests.
NTLMv1 Downgrade Attack – Brute-forcing by downgrading NTLM authentication.
Kerberos Downgrade Attack – Downgrading Kerberos to weaker encryption modes.
Kerberos Overpass-the-Hash – Bypassing authentication without Kerberos tickets.
Brute-Force Kerberos Pre-Auth – Attacking pre-auth disabled users.
PAC Tampering Attack – Modifying Kerberos PAC.
TGT Delegation Abuse – Using Kerberos delegation to use another user's ticket.
Kerberos Bronze Bit Attack – Bypassing PAC validation for unauthorized access.
LDAP Relay Attack – Gaining unauthorized access by relaying LDAP authentication requests.
7️⃣ Data Exfiltration & Domain Persistence 💼
These attacks focus on data theft or maintaining access.
LdapDomainDump Attack – Extracting sensitive information from LDAP enumeration.
Group Policy Preference Exploit – Dumping stored credentials from GPP XML files.
LSA Secrets Dumping – Extracting Local Security Authority secrets.
SYSVOL Credential Theft – Recovering plain text credentials from SYSVOL shares.
MSSQL Server Exploitation – Privilege escalation from AD integrated MSSQL databases.
VSS Shadow Copy Exploit – Extracting passwords and sensitive data from Windows VSS.
Cloud Sync Attack – Exploiting the sync process of hybrid AD and Azure AD.
ADFS Token Signing Certificate Theft – Stealing ADFS server certificates to create fake tokens.
Azure AD Attacks – Exploiting Azure AD misconfigurations or weak permissions.
8️⃣ Miscellaneous AD Attacks 🛠️
These are additional techniques that don't fit into other categories.
AD Reconnaissance with PowerView – Detailed enumeration of the AD environment with PowerView.
AD Object Permission Abuse – Abusing excessive permissions for unauthorized changes.
Kerberos Unconstrained Delegation Abuse – Capturing TGTs from unconstrained delegation.
Last updated