Theme Overview
For this week’s TTP Tuesday we’re releasing a chain to demonstrate the use of Python for Active Directory discovery. Python offers several libraries containing low-level classes for working with packets and protocols. As with many open-source software projects, these libraries are primarily used for legitimate purposes but also by adversaries.
This year, Red Canary ranked one such Python library as one of the top threats in the Red Canary 2022 Threat Detection Report. Fortunately, the use of these tools is often easy to detect and Red Canary has published some detection opportunities in their report which can be replicated across many Python-based tools.
Python for AD discovery
Our chain starts by installing a Python networking library. We then stage and execute a Python script to extract Group Policy Preference passwords from a target host. Next, a second script is used to enumerate the users on the domain. Finally, we enumerate the Service Principal Names associated with a user account. Together, these scripts show some of the many ways Python can be used for AD discovery.
Check it out on the Prelude chains website.
Watch a demonstration:
Staying up to date
Thanks for reading our latest TTP Tuesday release! Please subscribe and reach out with any feedback. We love to hear from our community!
There are several ways to follow us and learn more about Prelude and our team members:
Get our products
Download Prelude Operator: https://www.prelude.org/download
See the latest kill chain and TTP Releases: https://chains.prelude.org/
See our open-source repositories: https://github.com/preludeorg
Join our community
Discord: https://discord.gg/gzUv4XNquu
Reddit: https://www.reddit.com/r/preludeorg/
Twitter: https://twitter.com/preludeorg
Read, watch, and listen
Listen to our Podcast: https://anchor.fm/preludeorg
Read our blog: http://feed.prelude.org
Watch our live streams: https://www.twitch.tv/preludeorg
Watch our pre-recorded content: https://www.youtube.com/c/preludeorg
Follow our team
David: https://twitter.com/privateducky
Alex: https://twitter.com/khyberspache
Kris: https://twitter.com/Xanthonus
Octavia: https://twitter.com/VV_X_7
Sam: https://twitter.com/wasupwithuman