Active-Directory-Exploitation-Cheat-Sheet for mapping Active Directory attack paths

S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet is a curated Markdown reference cataloguing enumeration, privilege escalation, and persistence techniques against Windows Active Directory for authorized penetration testers.

Tool	S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet — a comprehensive Markdown cheat sheet of Active Directory enumeration and attack methods
Category	Knowledge base / attack technique reference (Markdown documentation)
Primary Use	A lookup reference for authorized testers who need quick command syntax for PowerView, the AD Module, BloodHound, and Mimikatz during scoped assessments
Safe Use	Strictly for authorized penetration tests, internal labs, and defensive research; every technique documented presumes a signed engagement against systems you own or control
Telemetry Note	The sheet documents tools like SharpHound and Mimikatz that generate distinctive LDAP query patterns, Kerberos traffic anomalies, and Windows event log signatures defenders can alert on

S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet is one of those repositories that has quietly become a standard reference in the offensive security community, and its 6,735 stars under an MIT license explain why: it condenses years of Active Directory attack tradecraft into a single, well-structured Markdown document. Created by Nikos Katsiopis and Nikos Vourdas, and openly inspired by PayloadsAllTheThings, it is not a tool you install but a knowledge artifact you consult mid-engagement. This writeup treats it as an educational document for authorized professionals working inside scoped assessments or lab environments.

Structurally, the README is organized along the classic attack lifecycle: Domain Enumeration, Local Privilege Escalation, Lateral Movement, Domain Privilege Escalation, Domain Persistence, and Cross Forest Attacks. That progression mirrors how a real engagement unfolds once a foothold exists, which is what makes the sheet useful as a checklist as much as a command reference. Each section links out to the canonical tooling — PowerSploit, PowerUpSQL, Powermad, Impacket, Mimikatz, Rubeus, BloodHound, and Adalanche — effectively functioning as an index to the broader AD attack ecosystem.

The enumeration section is the densest part of the document, and it compares three tooling philosophies side by side. PowerView offers situational-awareness cmdlets like Get-Domain, Get-DomainUser, Get-DomainComputer, Find-DomainShare, and Find-DomainUserLocation. The Microsoft AD Module provides the same reach through signed cmdlets such as Get-ADDomain, Get-ADUser, and Get-ADTrust, which some operators prefer because the binaries blend into legitimate administrative activity. BloodHound and Adalanche represent the graph-analysis approach, ingesting LDAP data to compute attack paths rather than leaving the analyst to correlate objects manually.

What the README reveals about the authors' priorities is instructive. The Adalanche subsection includes realistic troubleshooting: an x509: certificate signed by unknown authority error resolved with --tlsmode NoTLS --port 389, and an invalid-credentials case handled via --authmode basic. That level of detail — showing failure modes, not just happy paths — signals the sheet was written by practitioners who actually ran these commands, not curators copying snippets from elsewhere. It is the difference between documentation and experience.

The Domain Privilege Escalation section is effectively a taxonomy of AD misconfiguration classes. It catalogues Kerberoast, ASREPRoast, password spraying, forced SPN assignment, Unconstrained/Constrained/Resource Based Constrained Delegation, DNSAdmins abuse, Backup Operators abuse, ACL attacks, mitm6 for IPv6 abuse, SID History injection, Zerologon, PrintNightmare, and an Active Directory Certificate Services segment covering certificate abuse. For defenders, this table of contents doubles as a hardening checklist: every named technique corresponds to a detectable or preventable configuration error.

The persistence section covers the classic ticket-forging family — Golden Ticket, Silver Ticket, DCSync, Skeleton Key, DSRM abuse, and custom SSP — all centered on the consequences of compromising the krbtgt account or domain secrets. The Cross Forest Attacks section extends the same logic to trust relationships, trust tickets, and MSSQL server abuse. We deliberately do not reproduce the operational command sequences here; the value of this analysis is mapping what the document covers, and the repository itself is the reference for those who need syntax during authorized work.

There is a defensive reading of this repository that is worth stating explicitly. Blue teams can use the sheet as an adversary-behavior catalog: if SharpHound collection via --CollectionMethod All is documented as standard attacker practice, then LDAP enumeration bursts against a domain controller deserve detection rules. If Mimikatz appears in the lateral movement section, then credential-dumping artifacts in memory and lsass access patterns belong in the monitoring baseline. The cheat sheet is, unintentionally, an excellent purple-team syllabus.

Assessment of quality: the repository is documentation rather than executable code, has no language metadata (consistent with pure Markdown), and its topic tags — active-directory, pentesting, privilege-escalation, windows — accurately describe the content. The one caveat for readers is currency: sections reference historically significant vulnerabilities like Zerologon and PrintNightmare, which are old enough to be patched in any competent environment but remain relevant in legacy labs and as teaching cases. Verify technique applicability against your target's patch level rather than assuming relevance.

For authorized professionals, the practical use pattern is straightforward: clone the repo locally before an engagement, git clone https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet, and keep it open as a syntax aid while working through a lab like a HackTheBox domain machine or a client environment covered by a signed rules-of-engagement document. The document's example domains such as windcorp.local are clearly lab fixtures, not real targets.

In summary, S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet earns its popularity through breadth, honest troubleshooting detail, and clean organization along the attack lifecycle. It is not novel research and does not pretend to be; it is a well-maintained map of established AD attack surface, equally valuable to an operator mid-engagement and to a defender building detection coverage. Treat it as a shared vocabulary document for both sides of Active Directory security.

Official project repository for S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet.

Download Tool

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.