Theme Overview

For this week’s TTP Tuesday we’re releasing a chain to demonstrate the use of Python for Active Directory discovery. Python offers several libraries containing low-level classes for working with packets and protocols. As with many open-source software projects, these libraries are primarily used for legitimate purposes but also by adversaries.

This year, Red Canary ranked one such Python library as one of the top threats in the Red Canary 2022 Threat Detection Report. Fortunately, the use of these tools is often easy to detect and Red Canary has published some detection opportunities in their report which can be replicated across many Python-based tools.

Python for AD discovery

Our chain starts by installing a Python networking library. We then stage and execute a Python script to extract Group Policy Preference passwords from a target host. Next, a second script is used to enumerate the users on the domain. Finally, we enumerate the Service Principal Names associated with a user account. Together, these scripts show some of the many ways Python can be used for AD discovery.

Check it out on the Prelude chains website.

Watch a demonstration:

Staying up to date

Thanks for reading our latest TTP Tuesday release! Please subscribe and reach out with any feedback. We love to hear from our community!

There are several ways to follow us and learn more about Prelude and our team members:

Get our products

Download Prelude Operator: https://www.prelude.org/download
See the latest kill chain and TTP Releases: https://chains.prelude.org/
See our open-source repositories: https://github.com/preludeorg

Join our community

Discord: https://discord.gg/gzUv4XNquu
Reddit: https://www.reddit.com/r/preludeorg/
Twitter: https://twitter.com/preludeorg

Read, watch, and listen

Listen to our Podcast: https://anchor.fm/preludeorg
Read our blog: http://feed.prelude.org
Watch our live streams: https://www.twitch.tv/preludeorg
Watch our pre-recorded content: https://www.youtube.com/c/preludeorg

Follow our team

David: https://twitter.com/privateducky
Alex: https://twitter.com/khyberspache
Kris: https://twitter.com/Xanthonus
Octavia: https://twitter.com/VV_X_7
Sam: https://twitter.com/wasupwithuman