Windows Active Directory

Windows Active Directory (AD) is a directory service developed by Microsoft for managing users, computers, and resources in a network. It provides centralized authentication, authorization, and administration, enabling organizations to control access to data and applications securely. AD uses a hierarchical structure with domains, organizational units (OUs), and group policies to enforce security settings. It supports Kerberos authentication, LDAP, and Group Policy Management, making it essential for enterprise IT environments.

Kerberos is a network authentication protocol designed to provide secure and encrypted authentication between users and services. It uses a ticket-based system to verify identities without transmitting passwords over the network. Developed by MIT, Kerberos is widely used in Windows Active Directory and other enterprise environments. It relies on a Key Distribution Center (KDC) to issue tickets, ensuring secure authentication and preventing credential theft through replay attacks.

Active Directory enumeration is the process of gathering information about users, groups, computers, and permissions within an organization's Active Directory (AD) environment. Attackers or security professionals use enumeration techniques to identify vulnerabilities, misconfigurations, or potential attack paths. Common methods include LDAP queries, PowerShell scripts, and specialized tools. Understanding AD enumeration helps organizations strengthen security by implementing least privilege access, monitoring suspicious queries, and enforcing strict authentication and authorization controls.

LDAP (Lightweight Directory Access Protocol) is an open, industry-standard protocol used to access and manage directory services over a network. It enables authentication, authorization, and information retrieval from directory servers like Microsoft Active Directory. LDAP stores hierarchical data, including user credentials, groups, and policies, making it essential for identity management. Organizations use LDAP for centralized authentication, ensuring secure access control while integrating with various applications and services for seamless user management.

ADExplorer is a free tool from Microsoft’s Sysinternals suite used for exploring and analyzing Active Directory (AD) structures. It provides a detailed, real-time view of AD objects, attributes, and permissions, allowing administrators to inspect and modify directory data. ADExplorer enables offline snapshots for auditing and comparison, making it useful for troubleshooting, security assessments, and forensic investigations. Its intuitive interface helps manage AD environments efficiently while ensuring compliance and security best practices.

Kerberos is a network authentication protocol designed to provide secure and encrypted authentication between users and services. It uses a ticket-based system to verify identities without transmitting passwords over the network. Developed by MIT, Kerberos is widely used in Windows Active Directory and other enterprise environments. It relies on a Key Distribution Center (KDC) to issue tickets, ensuring secure authentication and preventing credential theft through replay attacks.

Pass-the-Hash (PtH) is a cyberattack where an attacker captures hashed passwords and uses them to authenticate without cracking them. It exploits weak authentication mechanisms in Windows systems, allowing unauthorized access by reusing stolen hash values. Attackers often gain initial access via phishing or malware, then escalate privileges laterally across networks. Organizations can mitigate PtH attacks through strong authentication, least privilege access, credential protection, and implementing multifactor authentication (MFA).

A DCSync attack is a credential theft technique where an attacker impersonates a domain controller to request password hashes from Active Directory. Using tools like Mimikatz, the attacker abuses replication permissions to extract credentials, including NTLM hashes and Kerberos tickets. This enables lateral movement and privilege escalation. To mitigate DCSync attacks, organizations should restrict replication rights, monitor unusual replication requests, enforce least privilege, and implement multifactor authentication (MFA).

A Golden Ticket attack is a Kerberos-based cyberattack where an attacker forges authentication tickets using a stolen NTLM hash of the KRBTGT account in Active Directory. This allows them to create valid tickets granting persistent access with any privileges. Attackers use tools like Mimikatz to generate these tickets, enabling stealthy lateral movement. Mitigation includes protecting KRBTGT credentials, monitoring unusual ticket activity, enforcing least privilege, and periodically resetting KRBTGT passwords.

Tunneling is a technique used to securely transmit data from one network to another by encapsulating it within a different communication protocol. It allows users to bypass firewalls, NAT restrictions, or segmented networks by forwarding traffic through an intermediate system—commonly referred to as a "tunnel". Tunneling is widely used in cybersecurity, remote administration, and penetration testing to access internal or protected resources. Tools like SSH, VPNs, and SSHuttle are often used to create tunnels for secure and controlled network communication, especially when accessing services in environments like Active Directory.