Red Team Lab Demonstrates Password Spraying and Active Directory Certificate Abuse

Summary

A red team lab walkthrough combines password spraying, Active Directory certificate abuse and custom command-and-control infrastructure. The speakers also discuss AI-generated implants and defensive monitoring.

Key points

• The lab starts with network access and uses a password-spraying tool to find a known valid domain account.
• The demonstration uses Certify to identify an ESC1 certificate-template configuration and obtain administrator authentication material.
• Using that material, the presenter demonstrates remote command execution on the lab domain controller via WinRM.
• The presenter sets up Lupo command-and-control infrastructure and generates a custom implant with AI, while emphasizing the need to test generated code.
• The speakers discuss monitoring authentication patterns and certificate-service activity, noting that IP rotation can complicate password-spray detection.
• They recommend protecting engagement data and securing red team infrastructure against unauthorized access.

MITRE ATT&CK

People

Products

Tools

Related Articles

• Claude Code Reaches Domain Admin in a 40-Minute Active Directory Lab TestLsecqtMicrosoft Active Directory · Mythic C2 · T1110.003 · T1649
• Red-Team Lab Demonstrates Active Directory Escalation Through AD CS ESC1LsecqtCertify · Microsoft Active Directory · T1110.003 · T1649
• Certighost Flaw Lets Low-Privilege AD Users Impersonate Domain Controllersbleepingcomputer.comActive Directory Certificate Services · Microsoft Active Directory · T1649
• ADCS ESC17 Abuse Enables TLS Server Impersonation and WSUS Privilege EscalationBlack Hills Information SecurityCertify · Microsoft Active Directory
• Sopra Steria’s 2026 Security Report Highlights Identity Threats and Nordic Infrastructure Risksgithub.com/jacobdjwilsonMicrosoft Active Directory · T1110.003