domains / families / security / executing-active-directory-attack-simulation

executing-active-directory-attack-simulation

separate

'Executes authorized attack simulations against Active Directory environments

When to use

• Assessing the security of an Active Directory domain and forest against common and advanced attack techniques
• Identifying attack paths from low-privilege domain user to Domain Admin using privilege relationship analysis
• Validating that Kerberos security configurations, credential policies, and delegation settings resist known attacks
• Testing detection capabilities of the SOC and EDR tools against Active Directory-specific TTPs
• Evaluating the effectiveness of tiered administration models and privileged access workstations

When not to use

• without explicit written authorization from the domain owner
• against production domain controllers during business hours unless approved
• testing that could cause account lockouts affecting real users without prior coordination

Skill page

Source