labs
04 — AD intermediate labs
After Active / Sauna / Forest. ANG + agentctl objectives.
Core Medium sequence
| Order | Machine | Diff | Primary objective |
|---|---|---|---|
| 1 | Resolute | Medium | Domain enum → DnsAdmins / delegated DNS abuse path |
| 2 | Cascade | Medium | LDAP/SMB/app → deleted AD objects / recycle-bin creds |
| 3 | Monteverde | Medium | Domain enum → Azure AD Connect credential recovery |
| 4 | Escape | Medium | MSSQL / auth capture → intro AD CS (ESC1 idea) |
| Stretch | Certified | Medium | Object control → shadow credentials → AD CS ESC9 — after Escape |
Easy bridge (if beginner thin)
Support / Timelapse / Cicada — one each max, then Resolute.
Prep
- Academy AD modules matching this week’s objective only
- Note template: users · groups · SPNs · ACLs · tickets · what got DA
Success
Named Kerberos or permission abuse → high value → detection/cleanup notes.
Defer
Hard multi-forest trusts; every ESC number; Certified as box #1.