Python AD discovery

Install a Python packet and protocol library, and stage discovery scripts to gather user and account information from Active Directory.

TTP Tuesday: Python for AD discovery

Using Python for active directory discovery.

Theme Overview

For this week’s TTP Tuesday we’re releasing a chain to demonstrate the use of Python for Active Directory discovery. Python offers several libraries containing low-level classes for working with packets and protocols. As with many open-source software projects, these libraries are primarily used for legitimate purposes but also by adversaries.

This year, Red Canary ranked one such Python library as one of the top threats in the Red Canary 2022 Threat Detection Report. Fortunately, the use of these tools is often easy to detect and Red Canary has published some detection opportunities in their report which can be replicated across many Python-based tools.

Python for AD discovery

Our chain starts by installing a Python networking library. We then stage and execute a Python script to extract Group Policy Preference passwords from a target host. Next, a second script is used to enumerate the users on the domain. Finally, we enumerate the Service Principal Names associated with a user account. Together, these scripts show some of the many ways Python can be used for AD discovery.

Watch a demonstration: Python AD Discovery

Staying up to date

Thanks for reading our latest TTP Tuesday release! Please subscribe and reach out with any feedback. We love to hear from our community!

There are several ways to follow us and learn more about Prelude and our team members:

Get our products

Download Prelude Operator:
See the latest kill chain and TTP Releases:
See our open-source repositories:

Join our community


Read, watch, and listen

Listen to our Podcast:
Read our blog:
Watch our live streams:
Watch our pre-recorded content:

Follow our team

David: privateducky
Alex: khyberspache
Kris: Xanthonus
Octavia: VVX7
Sam: wasupwithuman

Read more

Execute this chain

Download Operator (1.7.1)
Learn about Operator


Install Python network protocol library
Use Python to enumerate domain users
Use Python to enumerate Service Principal Names
Use Python to extract Group Policy Preferences passwords


python ad discovery

User-Set Custom Variables

  • domain: domain-name
  • domain-user
  • domain.user.password: domain-user-password
  • domain.dc: domain-controller