Ravi Sir's Cyber Security Cards › Revision Cards
Enumeration of AD
Enumeration of AD AD enumeration means mapping the directory: who can admin what, and who is logged in where. BloodHound with its collectors ( SharpHound or bloodhound-python ) gathers the relationships into a graph. Lab creds only. Attackers use it to find the shortest path to Domain Admin. Defende
Read card text
What this card says
What it is
AD enumeration means mapping the directory: who can admin what, and who is logged in where.
Tools
BloodHound with its collectors (SharpHound or bloodhound-python) gathers the relationships into a graph.
Lab creds only.
Why it matters for security
Attackers use it to find the shortest path to Domain Admin.
Defenders use the same view to remove risky rights. Watch for LDAP enumeration patterns.
| Red team (attacker) does | Blue team (defender)… |
|---|---|
| nxc ldap / GetADUsers.py / BloodHound collect after any… | Alert on mass LDAP queries; UEBA; restrict who can read… |
| Looks for Domain Admins, AdminSDHolder, SPN accounts | Privileged group change auditing (4728/4732); periodic… |
| Enumerates shares for creds files | Share auditing; block plaintext password files; DLP |
Learn more in the lesson: 38.3 Enumeration of AD