operator
ChainsTTPsBlogLogin
menu
Prelude chain browser

Python AD discovery

Install a Python packet and protocol library, and stage discovery scripts to gather user and account information from Active Directory.

2022-04-06

/static/assets/windows-logo.svg/static/assets/linux-logo.svg
Professional
This is a professional attack chain. A professional subscription automatically gives you access to this chain + 50 more, with direct integration inside of Operator.info
Authors:vvx7

TTP Tuesday: Python for AD discovery

Using Python for active directory discovery.

Theme Overview

For this week’s TTP Tuesday we’re releasing a chain to demonstrate the use of Python for Active Directory discovery. Python offers several libraries containing low-level classes for working with packets and protocols. As with many open-source software projects, these libraries are primarily used for legitimate purposes but also by adversaries.

This year, Red Canary ranked one such Python library as one of the top threats in the Red Canary 2022 Threat Detection Report. Fortunately, the use of these tools is often easy to detect and Red Canary has published some detection opportunities in their report which can be replicated across many Python-based tools.

Python for AD discovery

Our chain starts by installing a Python networking library. We then stage and execute a Python script to extract Group Policy Preference passwords from a target host. Next, a second script is used to enumerate the users on the domain. Finally, we enumerate the Service Principal Names associated with a user account. Together, these scripts show some of the many ways Python can be used for AD discovery.

Watch a demonstration: Python AD Discovery

Staying up to date

Thanks for reading our latest TTP Tuesday release! Please subscribe and reach out with any feedback. We love to hear from our community!

There are several ways to follow us and learn more about Prelude and our team members:

Get our products

Download Prelude Operator: https://www.prelude.org/download/current
See the latest kill chain and TTP Releases: https://chains.prelude.org/
See our open-source repositories: https://github.com/preludeorg

Join our community

Discord: https://discord.gg/gzUv4XNquu
Reddit: https://www.reddit.com/r/preludeorg/
Twitter: https://twitter.com/preludeorg

Read, watch, and listen

Listen to our Podcast: https://anchor.fm/preludeorg
Read our blog: https://feed.prelude.org
Watch our live streams: https://www.twitch.tv/preludeorg
Watch our pre-recorded content: https://www.youtube.com/c/preludeorg

Follow our team

David: privateducky
Alex: khyberspache
Kris: Xanthonus
Octavia: VVX7
Sam: wasupwithuman

Source: https://feed.prelude.org
Read more

Execute this chain

Download Operator (1.7.1)
Learn about Operator

TTPs

Install Python network protocol library
Use Python to enumerate domain users
Use Python to enumerate Service Principal Names
Use Python to extract Group Policy Preferences passwords

Tags

python ad discovery

Tactics

User-Set Custom Variables

  • domain: domain-name
  • domain.user.name: domain-user
  • domain.user.password: domain-user-password
  • domain.dc: domain-controller
About PreludePrelude hardens an organization's defenses by continuously “asking” it questions through the form of safe cyberattacks. These attacks respond immediately to the latest vulnerabilities and cyber events, turning complex technical descriptions into deployable “questions”.Our mission is to increase the reach, frequency and usage of advanced security for all organizations.
twitterFollow @preludeorg on Twitter for new chains and more.
discordJoin the Prelude Discord to discuss chains and more.
githubKeep up to date with code changes and community activity on Github
operator
preludesecurity.comCareersTactics & TechniquesAttack themes
Privacy Policysupport@preludesecurity.com© 2023 Prelude Research, Inc.All rights reserved. Prelude, its logo and other trademarks are trademarks of Prelude Research, Inc. and may not be used without permission.