A cool Active Directory attack map

Active Directory is old, and attacks on it keep coming. Every year brings new certificate abuse paths, new coercion tricks, and new CVEs. Most of what you need to know is spread across blog posts, conference talks, tool READMEs, and GitHub issues. Keeping it all in your head isn't realistic.

The Active Directory Attack Architecture Map, published on GitHub Pages by kypvas, collects it on one long page. It's now at version 2.0, which the page calls the "expanded edition." The earlier v1.1 is still linked from the page.

Start with the map

The page opens with a diagram that splits an AD compromise into six phases.

1. Reconnaissance
2. Credential access
3. Privilege escalation
4. Lateral movement
5. Persistence
6. Domain dominance

Each phase lists the techniques and tools that belong to it. Solid lines show direct attack paths. Dashed lines mark what the author added in v2.0. The diagram helps you place a technique. If you read about a new ADCS abuse, you can see where it sits in the chain and what usually comes before and after it.

It explains the basics first

Before the attacks, the page covers how AD works. There are sections on domains, forests, and trusts, on objects like SIDs, SPNs, and DACLs, and on how Kerberos and NTLM authentication flow.

There's also a hash reference table that lists each hash type, where you find it, and the matching hashcat mode. If you've ever searched for "which hashcat mode is Kerberos AS-REP" in the middle of an engagement, this table alone saves time.

What it covers

The scope is wide. Here are the main areas.

• Initial access. Network attacks without credentials, password spraying, and phishing.
• Credential dumping. LSASS, SAM, NTDS.dit, cached credentials, DPAPI secrets, SCCM, and LAPS.
• Coercion. PetitPotam, PrinterBug, DFSCoerce, ShadowCoerce, WebDAV, and Kerberos relay.
• Delegation. Unconstrained, constrained, and resource-based constrained delegation (RBCD).
• ACL abuse. ForceChangePassword, GenericWrite, WriteDACL, AddMember, and reading gMSA passwords.
• ADCS. ESC1 through ESC16, the certificate template and CA misconfigurations that turn a low-privilege user into a domain admin.
• Persistence. Golden, Diamond, and Sapphire tickets, Golden Certificates, Skeleton Key, DCShadow, the DSRM backdoor, and AdminSDHolder.
• Other systems in the domain. GPOs, SCCM, WSUS, ADIDNS, MSSQL linked servers, Exchange, and Linux and macOS hosts joined to AD.
• Hybrid identity. Azure AD Connect, Primary Refresh Token theft, device code phishing, consent phishing, Intune abuse, and pivots between on-prem and Entra ID.

It also has a section on AI agents as an attack target, covering prompt injection and agent identities. That's a sign the author keeps the map current, not just a list of 2019 techniques.

Attack chains, not just techniques

Lists of techniques are easy to find. What I like here is the "attack flow chains" section. It walks through complete paths step by step, like RBCD to an NT hash, an ADCS ESC15 path to Domain Admin, and noPac. Seeing the whole chain explains why a "medium" finding in a pentest report can matter a lot. One writable attribute on a computer object can be the first step to owning the domain.

Useful for defenders too

This isn't only a red team page. Several sections are written for the blue team.

• A detection section maps Windows Event IDs to the attacks they reveal.
• A misconfiguration checklist groups audit items by Kerberos, NTLM, ADCS, ACLs, credentials, and network services.
• A defensive controls section covers the Protected Users group, Credential Guard, AES-only Kerberos, LDAP signing, and the tiered administration model.
• An OPSEC section rates how noisy each attack is. Attackers use it to stay quiet. Defenders can use the same table to see which attacks their logging will probably miss.

If you're responsible for an AD environment, the misconfiguration checklist is a good place to start. Work through it, and you'll have a better audit than many paid assessments deliver.

The practical extras

A few sections earn the page a permanent bookmark.

BloodHound Cypher queries. Ready-to-use queries for finding delegation, ACL paths, trusts, and the shortest path to Domain Admin.

Tool arsenal. Tools grouped by stage, covering enumeration, path mining, exploitation, and post-exploitation.

Password cracking methodology. A cracking strategy per hash type, plus wordlists, rules, masks, and notes on cloud GPU setups.

Notable CVEs. The classics like ZeroLogon, PrintNightmare, noPac, and Certifried, along with newer entries from 2025 and 2026. On one Netlogon entry the page gives advice that applies to most of the list: "treat unpatched DCs as compromised until proven otherwise."

Try it

Open the Active Directory Attack Architecture Map and look for one technique you hadn't heard of. If you defend AD, run through the misconfiguration checklist this week.