hub

#redteam #training #windows #activedirectory #privesc

02 — Windows Hub

BLUF: Windows and Active Directory are common enterprise assessment environments. Begin with authorization, telemetry, and read-only discovery; demonstrate only the minimum approved proof for each path, then stop, preserve evidence, restore state, and document detection and mitigation.

Note

🟠 OW64 — P2: Windows/AD Action Items
Part 1 — Windows OS: 1. System & Environment Enumeration · 2. Privilege Escalation · 3. Credential Harvesting · 4. Persistence
Part 2 — Active Directory: 5. Windows/AD Recon & Enumeration · 6. Kerberos Attacks · 7. NTLM Relay & Lateral Movement · 8. ACL Abuse, ADCS & Domain Dominance · 9. Common Windows Services · ✦ Full Windows/AD Attack Chain

Layer 0: foundations/windows/architecture · Deep dives: 2.1a · 2.1b

Important

Authorized use only: Use these notes only in owned, explicitly authorized, or isolated lab environments.

Detection awareness: Assume commands, binaries, network calls, identity changes, and cloud or directory actions may be logged by endpoint tooling, audit frameworks, SIEM pipelines, proxy logs, DNS logs, auth logs, and platform telemetry.

Blue-team view: Treat every technique as a defender validation exercise too: note what artifacts it creates, what alerts or hunts could surface it, and what monitoring or hardening would prevent or contain it.

CTF/lab boundary: If a sandbox or CTF includes bypass-oriented exercises, keep them confined to that environment and translate the lesson into detection, prevention, and cleanup notes rather than real-world evasion guidance.

Attack Path Overview

graph TB
    Start([Initial Foothold]) --> WinEnum[Windows Enumeration]
    WinEnum --> PrivEsc{Privilege Escalation}
    PrivEsc --> Token[Token Abuse / Potatoes]
    PrivEsc --> SvcPath[Unquoted Service Paths]
    PrivEsc --> DLL[DLL Hijacking]
    Token --> LocalAdmin([Local Admin / SYSTEM])
    SvcPath --> LocalAdmin
    DLL --> LocalAdmin
    LocalAdmin --> CredHarvest[Credential Harvesting]
    CredHarvest --> ADEnum[Manual AD Enumeration]
    ADEnum --> Kerb[Kerberos Attacks]
    ADEnum --> Relay[NTLM Relay / Coercion]
    Kerb --> ACL[ACL Abuse]
    Relay --> ACL
    ACL --> ADCS[ADCS ESC1 and ESC8]
    ACL --> ShadowCreds[Shadow Credentials]
    ADCS --> DCSync[DCSync / Golden Ticket]
    ShadowCreds --> DCSync
    DCSync --> DA([Domain Admin / Full Compromise])
    style Start fill:#ff6600
    style LocalAdmin fill:#ff8800
    style DA fill:#ff0000

MITRE ATT&CK Mapping

Technique ID	Name	Tactic	Pillar Relevance
T1087.001	Local Account Discovery	Discovery	Windows local enumeration
T1548.002	Bypass UAC	Privilege Escalation	UAC bypass techniques
T1134.001	Token Impersonation/Theft	Privilege Escalation	SeImpersonatePrivilege abuse
T1003.001	LSASS Memory	Credential Access	LSASS dump for hashes
T1552.002	Credentials in Registry	Credential Access	AutoLogon and other credentials stored in Registry values
T1003.002	Security Account Manager	Credential Access	SAM credential material; do not conflate with Registry-stored AutoLogon values
T1558.003	Kerberoasting	Credential Access	Service ticket cracking
T1557.001	NTLM Relay	Credential Access	SMB relay attacks
T1484.001	Domain Policy Modification	Defense Evasion / Privilege Escalation	Map only when a domain policy is modified
T1547.001	Registry Run Keys / Startup Folder	Persistence / Privilege Escalation	Run-key or Startup-folder persistence behavior
T1053.005	Scheduled Task	Execution / Persistence / Privilege Escalation	Windows scheduled-task behavior
T1543.003	Windows Service	Persistence / Privilege Escalation	Windows service creation or modification
T1546.003	Windows Management Instrumentation Event Subscription	Persistence / Privilege Escalation	WMI event subscription behavior
T1649	Steal or Forge Authentication Certificates	Credential Access	ADCS ESC1/ESC8
T1003.006	DCSync	Credential Access	Domain replication abuse

Layer 0 — Architecture

Read foundations/windows/architecture first: boot → GUI, tokens/UAC, process model, critical processes, memory (LSASS concept), NTFS/VSS/BitLocker, registry, local vs domain identity, observe map.

Action Item index → deep dives

AI	Topic	Where
1–4	Local box enum / privesc / creds / persist	foundations/windows/local-box
5–9 + full chain	AD recon → dominance + services	foundations/windows/active-directory/attacks

Former standalone 2.1 Windows-ad-attacks catalog is merged into 2.1b (see note at top of that file).

Reading order

Part of Red Teaming 101.