TTP Tuesday: Python for AD discovery

Using Python for active directory discovery.

Apr 07, 2022

Theme Overview

For this week’s TTP Tuesday we’re releasing a chain to demonstrate the use of Python for Active Directory discovery. Python offers several libraries containing low-level classes for working with packets and protocols. As with many open-source software projects, these libraries are primarily used for legitimate purposes but also by adversaries.

This year, Red Canary ranked one such Python library as one of the top threats in the Red Canary 2022 Threat Detection Report. Fortunately, the use of these tools is often easy to detect and Red Canary has published some detection opportunities in their report which can be replicated across many Python-based tools.

Python for AD discovery

Our chain starts by installing a Python networking library. We then stage and execute a Python script to extract Group Policy Preference passwords from a target host. Next, a second script is used to enumerate the users on the domain. Finally, we enumerate the Service Principal Names associated with a user account. Together, these scripts show some of the many ways Python can be used for AD discovery.

Check it out on the Prelude chains website.

Watch a demonstration:

Staying up to date

Thanks for reading our latest TTP Tuesday release! Please subscribe and reach out with any feedback. We love to hear from our community!

There are several ways to follow us and learn more about Prelude and our team members:

Get our products

Download Prelude Operator: https://www.prelude.org/download
See the latest kill chain and TTP Releases: https://chains.prelude.org/
See our open-source repositories: https://github.com/preludeorg

f33d by Prelude

Discussion about this post