AD Recon Demonstration for Active Directory Penetration Tests

Summary

The presenter demonstrates AD Recon for Active Directory penetration tests, covering LDAP/ADWS enumeration, report parsing, password-spraying reconnaissance, and execution through a C2 framework, PowerShell, and WinPwn.

Key points

The video presents AD Recon as a way to collect and organize Active Directory information during penetration tests.
AD Recon uses the current domain-authenticated context to query domain controllers through LDAP or ADWS; a VPN-connected, non-domain-joined system needs credentials to connect.
The demonstration uses a low-privileged account and shows CSV output that can be parsed into a combined Excel report.
The report includes users, groups and memberships, computers, SPNs, operating-system data, DNS records, trusts, and password policy information.
The presenter explains that usernames and passwords left in account description fields could inform password-spraying attempts, and that password-policy details matter for assessing lockout risk.
Execution methods shown include a C2 framework, PowerShell, and WinPwn; the presenter also discusses bypassing AMSI and demonstrates disabling Defender with an admin account.

Article Details

Topics: [00:00] AD Recon's purpose in Active Directory reconnaissance
[00:50] Running AD Recon through a C2 framework and querying domain controllers
[02:18] Domain access contexts and credential requirements for a VPN-connected external system
[05:07] Low-privilege demonstration, CSV output, and offline report parsing
[09:14] Reviewing collected domain data and its use in password-spraying assessments
[13:02] AMSI bypass, Defender, and running AD Recon through PowerShell
[15:34] Using WinPwn to run AD Recon

MITRE ATT&CK

T1562.001 · Disable or Modify ToolsThe presenter says the C2-based approach can bypass AMSI and demonstrates disabling Defender with an admin account for another execution method.

Summary

Key points

Article Details

MITRE ATT&CK

Related Articles