BloodHound / SharpHound Enumeration

§ Where this technique fits

§ Dossiers chaining this technique

• LAPS read → local admin on every endpoint

  A delegated 'helpdesk' group gains read access to ms-Mcs-AdmPwd. Compromising any member of that group cascades to local admin on every LAPS-managed machine.

  step 1 / 5

• Unconstrained delegation → Capture DC TGT → DCSync

  Compromise a host with TRUSTED_FOR_DELEGATION, coerce a DC to authenticate to it, harvest the DC's TGT from its LSASS, then DCSync.

  step 1 / 7

• GPO write rights → Immediate scheduled task → SYSTEM on OU

  GenericWrite on a linked GPO (or write rights to its SYSVOL folder) lets you drop a ScheduledTasks.xml that fires as SYSTEM on every machine in the OU at the next gpupdate.

  step 2 / 5

• WriteDACL on a privileged user → ForceChangePassword → takeover

  Discover a misconfigured ACL that lets a low-priv user modify the ACL of a Tier-0 account, grant ForceChangePassword to themselves, reset the victim's password, and log in.

  step 2 / 6

• GenericWrite on Domain Admins → AddMember → DA

  A misconfigured 'member' attribute write on a privileged group lets the attacker silently add themselves as a Domain Admin.

  step 2 / 5

• Leaked legacy VPN credential → ransomware (Colonial-class)

  A dormant VPN account whose password appeared in a third-party breach is still active, has no MFA enforced. Sign in, recon AD, deploy ransomware across the estate.

  step 4 / 6

• Group Policy Preferences cpassword → user takeover

  Pre-MS14-025 GPPs left cpassword-encrypted credentials in SYSVOL with a published AES key. Any authenticated user can decrypt them.

  step 5 / 5

• SCCM Network Access Account disclosure → privileged creds

  Any authenticated user on a SCCM-managed endpoint can recover the Network Access Account credentials from WMI / client cache — and the NAA is usually over-privileged.

  step 5 / 5

• SNMPv2c write-community → router config exfil → cred sprays

  Find a router with 'private' RW community. Trigger SNMP-to-TFTP config download to attacker host. The config has RADIUS shared secret, AAA server IP, ISAKMP PSKs, and SSH user-pubkeys — spray harvested creds.

  step 6 / 6

• Citrix Bleed → steal authenticated session → MFA bypass

  Send a long Host header to a vulnerable NetScaler — memory disclosure leaks an authenticated session token already past MFA. Replay the token to log into the corporate VPN.

  step 6 / 6

• No creds → Domain Admin via LLMNR poisoning and NTLM relay

  Unauthenticated attacker on the LAN poisons name resolution, relays the captured NetNTLMv2 to a host with SMB signing disabled, then escalates to Domain Admin.

  step 6 / 8

• RODC compromise → cracked NT hashes of revealed accounts

  A Read-Only Domain Controller stores password material only for principals on its msDS-RevealedList. Compromising the RODC + cracking those hashes gives you the corresponding users.

  step 6 / 6

§ What commonly comes next

1. 01
   Valid Accounts

   T1078 · Initial Access
   seen 2×
2. 02
   WriteDACL

   AD-DACL-WRITEDACL · Privilege Escalation
   seen 2×
3. 03
   AddMember (WriteProperty on member)

   AD-DACL-ADDMEMBER · Privilege Escalation
   seen 1×
4. 04
   GPO Immediate Scheduled Task

   AD-GPO-IMMEDIATE · Privilege Escalation
   seen 1×
5. 05
   Pass the Hash

   T1550.002 · Lateral Movement
   seen 1×