BloodHound

The content repeatedly states that threat actors 'obtained,' 'acquired,' or 'used' publicly available, open-source, legitimate, or modified tools such as Mimikatz, Cobalt Strike, PsExec, Empire, Impacket, and many others.

The content repeatedly describes threat actors and malware using PowerShell scripts/commands for execution, download, staging, reconnaissance, persistence, credential access, lateral movement, and defense evasion; e.g., "Sandworm Team used PowerShell scripts to run a credential harvesting tool in memory to evade defenses."

Zachary_Hunt had either GenericWrite or WriteProperty with all 0s on quite a few users... if we hold WriteProperty with GUID f3a64788–5306–11d1-a9c5–0000f80367c1 on a user account we can set a SPN on their account.

In this scenario, our current domain user LAB.LOCAL\Black Wasp has Full Control, including both WriteOwner and WriteDacl rights over the template... the screenshot below shows that our user blwasp@lab.local has GenericAll rights over the ESC4 template.

Zachary_Hunt had either GenericWrite or WriteProperty with all 0s on quite a few users... if we hold WriteProperty with GUID f3a64788–5306–11d1-a9c5–0000f80367c1 on a user account we can set a SPN on their account.

По классификации MITRE ATT&CK - подтехника T1003.006 (DCSync). ... ты прикидываешься вторым контроллером домена и запрашиваешь у настоящего DC репликацию учётных данных через протокол MS-DRSR.

Background This was a nifty little room that stressed basic enumeration, eleciting NTLMv2 authentication attempts, enumeration with BloodHound, and abusing msds-AllowedToDelegateTo... BloodHound immediately found a path from svc.scanner to the DC

They can also use BloodHound/SharpHound to enumerate Active Directory, abuse Kerberoastable service accounts, or exploit trust relationships between VMware-hosted systems and the broader domain.

In BOFHound output mode, all attributes for every object are parsed and outputted to BOFHound format... Computers collection

LDAP is commonly used by criminals for lateral movement and critical assets enumeration in on-premises cyberattacks. | Threat actors often use LDAP for network enumeration during the discovery phase of an attack. Attackers query directories to extract sensitive information such as user accounts, group memberships and permissions, which they then use to escalate privileges and target critical assets.

The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking whether the current user is an administrator, enumerating user sessions, and gathering account details from compromised hosts.

For four days – March 24-28 – they conducted network reconnaissance using Cobalt Strike and Bloodhound before Capita detected three compromised staff devices and contained them.

System Networks Connections Discovery [T1049]: A common tool used for this network enumeration tactic is Bloodhound.

We’ll use BloodHound to find users we have these rights over. Our current user is blwasp, so we’ll look for “Outbound Object Control” permissions in BloodHound.

Impacket Active Directory user enumeration identifying SQL service users, Citrix administrators and CyberArk vault operators from AD logs; GPP XML privilege mapping.

T1069.003: Permission Groups Discovery: Cloud Groups Once threat actors know the identities within the target environment, they need to understand the relationships between the identities by discovering permission structures... For Permissions Groups Discovery: Cloud Accounts, AzureHound has the following capabilities: list groups list roles list group-members list group-owners list role-assignments list app-role-assignments list key-vault-access-policies list management-group-role-assignments list resource-group-role-assignments list subscription-role-assignments list virtual-machine-role-assignments

GeminiDuke focuses primarily on gathering details about the victim’s computer’s configuration.

In Active Directory environments, attackers search for accounts that are unjustifiably members of privileged groups, service accounts with unnecessary administrative rights, or delegation settings that allow them to impersonate other users. Tools like BloodHound automatically map these relationships, revealing the shortest path from their compromised account to domain administrator privileges.

PasswordLastSet and LastLogon attribute correlation to reconstruct the IT hierarchy; SAP BAPI_USER_GET_DETAIL role and profile enumeration.

We also know the DC’s name is Deaddrop-DC and the domain is deaddrop.loc. Let’s try collecting all the domain information to feed into BloodHound

T1580: Cloud Infrastructure Discovery To fully grasp the architecture of the target environment, a threat actor must discover the foundational infrastructure components... For Cloud Infrastructure Discovery, AzureHound has the following capabilities: list tenants list subscriptions list resource-groups list management-groups list virtual-machines list key-vaults

Oracle CSV spooling to /tmp followed by exfiltration; TFTP pull-based retrieval of network-device configurations; compressed 407 MB BloodHound Active Directory dataset exfiltration.