In June 2017, the destructive wiper disguised as ransomware that the world called NotPetya spread across Ukrainian and global networks in hours. Its most potent weapon was not novel malware — it was Mimikatz, harvesting Kerberos tickets and NTLM hashes from lsass.exe memory to move laterally at machine speed. Investigators at Maersk later confirmed the attackers had compromised a single domain controller and used Kerberos ticket-forgery to authenticate across 45,000 PCs and 4,000 servers before a single alarm fired.
The lesson wasn't that Kerberos was broken — it was that defenders had never mapped the attack paths Kerberos trust made possible.
Kerberos is a ticket-based authentication protocol introduced in Windows 2000 and still the default in every modern Active Directory environment. A client requests a Ticket-Granting Ticket (TGT) from the Key Distribution Center (KDC), then exchanges it for service tickets (TGS) to access resources — all without sending passwords over the wire.
This architecture creates several well-documented attack surfaces. The protocol's reliance on symmetric encryption means that anyone who obtains the right cryptographic secrets can forge or reuse tickets without triggering normal authentication failures. Three attack classes dominate real-world AD engagements: AS-REP Roasting, Kerberoasting, and Golden/Silver Ticket forgery.
Modern AI tools — primarily large language models integrated into pentesting frameworks — accelerate three enumeration tasks that traditionally required hours of manual BloodHound graph analysis:
1. Attack path synthesis. BloodHound Community Edition and BloodHound Enterprise both expose raw graph data. AI can parse JSON exports and identify shortest-path chains from low-privilege users to Domain Admin, ranking them by exploitability (e.g., "User A has GenericWrite over Group B which has WriteDacl over Domain Controller C").
2. SPN discovery and prioritization. Querying LDAP for SPNs produces hundreds of results in large enterprises. AI can cross-reference SPNs against account types, password age (via pwdLastSet), and privilege indicators to rank Kerberoasting targets by expected cracking success.
3. ACL abuse path identification. AD Access Control Lists encode thousands of delegated permissions. AI tools can reason across multi-hop ACL chains — GenericAll → WriteDacl → DCSync — that human analysts miss in large ACL dumps.
Kerberoasting generates Event ID 4769 (Kerberos Service Ticket Operations) with encryption type 0x17 (RC4). Hunting for bulk 4769 events with RC4 encryption where the requesting account is not a service account is the primary SIEM detection. AI-assisted attackers increasingly use AES encryption requests to blend with legitimate traffic.
All techniques in this module apply exclusively to authorized penetration testing engagements under signed scope agreements. Unauthorized use of these techniques against systems you do not own or have explicit written permission to test is a federal crime under the Computer Fraud and Abuse Act (18 U.S.C. § 1030) and equivalent statutes internationally.
You are conducting an authorized internal penetration test. You have obtained a low-privilege domain user account. You need to plan a Kerberos-based attack path using AI assistance to identify and prioritize targets.
The NOBELIUM intrusion — attributed to Russia's SVR and disclosed in December 2020 — demonstrated AD privilege escalation at nation-state scale. After compromising the SolarWinds build system, attackers used their initial foothold in victim networks to enumerate Active Directory ACLs, identifying delegated permissions that allowed movement from low-trust cloud service principals to on-premises AD objects. Microsoft's MSTIC team documented that the attackers specifically hunted ACL-based paths to Azure AD and federated on-premises AD, abusing trust relationships that defenders had never audited. The attack remained undetected across hundreds of organizations for nine months.
BloodHound, developed by Andy Robbins, Rohan Vazarkar, and Will Schroeder and first released in 2016, revolutionized AD attack path discovery. It uses SharpHound (or AzureHound for Azure AD) to collect relationship data via LDAP, SMB, and DNS, then stores it in a Neo4j graph database. Analysts query paths using Cypher, Neo4j's graph query language.
The key insight is that AD attack paths are graph problems. The question "can low-privilege user X reach Domain Admin?" translates to "does a directed path exist in the AD relationship graph from node X to node 'Domain Admins'?" BloodHound's built-in queries answer this in seconds — but interpreting and chaining results across thousands of paths requires human expertise or AI assistance.
BloodHound Community Edition (BHCE) is the free, self-hosted version. BloodHound Enterprise is SpecterOps' commercial offering with continuous monitoring, attack path prioritization scoring, and API access for automated analysis.
The limitation of manual BloodHound analysis is cognitive load. In environments with 50,000+ objects, the number of potential attack paths is astronomical. AI tools address this in three concrete ways:
Natural language querying. Instead of writing Cypher, analysts can ask "find all paths from helpdesk users to domain controllers that use fewer than 4 hops" in plain English. LLM wrappers translate this to Cypher queries and interpret the results.
Path ranking and triage. AI can evaluate each discovered path for factors like: account age and activity, whether intermediate accounts have logged in recently (indicating creddentials may be valid), whether ACLs appear intentional or misconfigured, and estimated exploitation difficulty. This turns 500 paths into a ranked top-10 list.
Multi-hop reasoning. Human analysts often stop at direct relationships. AI can follow chains like: "User A has GenericWrite on Computer B → Computer B has AllowedToDelegate to Service C → Service C account has WriteDacl on Domain Object → grant DCSync." These four-hop chains are regularly missed in manual reviews.
Kerberos delegation allows services to authenticate to other services on behalf of users — enabling multi-tier applications. Three delegation types exist, each with distinct attack vectors:
Unconstrained Delegation: The delegated service receives the user's full TGT. Any account (computer or service) configured with unconstrained delegation that can be coerced into authenticating from a privileged principal (via printer bug / SpoolSample, MS-RPRN, or PetitPotam) will cache a Domain Controller TGT — granting full domain compromise. First weaponized by @tifkin_ and others circa 2018.
Constrained Delegation (KCD): Limits delegation to specific target services. Abuse requires compromising an account with KCD configured, then using s4u2proxy/s4u2self to impersonate any user against the allowed target service.
Resource-Based Constrained Delegation (RBCD): Configured on the target resource rather than the delegating account. If an attacker has GenericWrite on a computer object, they can write an msDS-AllowedToActOnBehalfOfOtherIdentity attribute pointing to an attacker-controlled account, then impersonate any domain user to that computer — including Domain Admins.
AI-generated attack path analysis should always be validated manually before execution. LLMs can hallucinate ACL relationships or misidentify object types in large AD exports. Treat AI path suggestions as hypotheses to verify against raw BloodHound data, not as confirmed exploit chains.
You have run SharpHound and collected AD data. BloodHound shows 847 potential attack paths. You need to triage and prioritize them efficiently using AI assistance before your 4-hour engagement window closes.
In March 2018, the SamSam ransomware operators encrypted approximately 3,789 government computers across the City of Atlanta, causing an estimated $17 million in recovery costs. Post-incident forensics revealed the attackers had spent weeks inside the network before deploying ransomware — using Mimikatz to dump NTLM hashes from domain controllers and pass-the-hash to authenticate across the network without ever needing to crack a single password. The city's lack of network segmentation and absence of Privileged Access Workstations meant that once one domain controller's hashes were captured, every system was accessible.
DCSync is a technique developed by Benjamin Delpy (creator of Mimikatz) and Vincent Le Toux, first demonstrated around 2015. It abuses the MS-DRSR (Directory Replication Service Remote Protocol) — the legitimate mechanism Domain Controllers use to synchronize AD data between each other.
When an account holds the DS-Replication-Get-Changes and DS-Replication-Get-Changes-All extended rights (or DS-Replication-Get-Changes-In-Filtered-Set for fine-grained password policies), it can request that a DC replicate any AD object's data — including NTLM password hashes and Kerberos keys — without any local access to the DC itself.
The Mimikatz command is: lsadump::dcsync /domain:target.local /user:krbtgt. This requests the KRBTGT account's hash, enabling Golden Ticket creation. Running with /all /csv dumps every account in the domain. The operation generates Event 4662 on the domain controller and should trigger high-confidence SIEM alerts — but these alerts are frequently misconfigured or suppressed in many enterprises.
NTLM authentication never requires the plaintext password — only its hash. Pass-the-Hash exploits this by injecting a captured NTLM hash directly into the authentication process, authenticating as the hash owner without cracking it. The technique has existed since 1997 (Paul Ashton) and remains effective because NTLM is still supported across Windows for backward compatibility.
Common PtH tools: Mimikatz's sekurlsa::pth spawns a process with the injected hash; impacket's psexec.py, smbexec.py, wmiexec.py authenticate over SMB/WMI using the hash directly. CrackMapExec (now NetExec) can spray a hash across an entire subnet to identify where it grants access.
Pass-the-Ticket (PtT) injects Kerberos tickets rather than NTLM hashes. Rubeus' ptt command or Mimikatz's kerberos::ptt inject a .kirbi ticket file into the current logon session. This is particularly powerful for service tickets (silver tickets) that grant access to specific resources without contacting the KDC.
Overpass-the-Hash converts an NTLM hash into a Kerberos TGT — useful in environments where NTLM is blocked but Kerberos is available. Mimikatz: sekurlsa::pth /user:X /domain:Y /ntlm:HASH /run:cmd.exe — the spawned process authenticates via Kerberos using the hash to request a TGT.
AI tools integrated into C2 frameworks (Cobalt Strike, Sliver, Havoc) or used as external analysis layers accelerate post-exploitation in measurable ways during authorized engagements:
Target selection. Given a dump of domain hashes and BloodHound data, AI can identify which accounts are worth prioritizing — cross-referencing hash age, group memberships, last logon, and ACL paths to determine which cracked or PtH'd accounts provide the most lateral movement value.
Credential reuse analysis. After dumping hundreds of hashes, AI can cluster accounts by hash value (identifying password reuse), flag accounts with identical hashes across departments, and predict which hashes are most likely to crack quickly based on password policy configuration.
OPSEC guidance. AI can reason about detection risks: "DCSync from a non-DC IP generates Event 4662 and typically triggers EDR. Recommend using a compromised DC as the replication source if available, or staging the operation during backup windows when replication events are baseline-heavy."
DCSync, NTDS.dit extraction, and LSASS dumping generate significant evidence in endpoint and network logs. In authorized engagements, confirm with the client whether destructive-adjacent actions (that generate extensive logging) are within scope and whether a "purple team" approach where the defender is watching in real time is expected.
You have compromised an account with DCSync rights (DS-Replication-Get-Changes-All) on an authorized engagement. You need to plan the post-exploitation phase — credential extraction, lateral movement, and OPSEC to avoid triggering the client's SOC before the test window closes.
After NOBELIUM (APT29) achieved initial access through the SolarWinds Orion supply chain, Microsoft and Mandiant documented a persistence strategy of exceptional sophistication. Attackers created new federated identity providers in Azure AD using forged SAML tokens, added credentials to existing service principals, and modified AAD Connect synchronization accounts to maintain access even after the initial Orion backdoor was removed. In some victim organizations, credential access persisted across full AD password resets because the attackers had established trust relationships at the federation layer — effectively re-rooting their access above the credential level.
The lesson: persistence at the trust and identity provider layer survives conventional remediation entirely.
Active Directory supports trust relationships between domains and forests, enabling users in one domain to authenticate to resources in another. These trust relationships — especially when misconfigured — create attack paths that bypass the security boundaries defenders believe they have established.
SID History Injection (Extra SIDs): When users migrate between domains, their previous SID is stored in the SIDHistory attribute to preserve resource access. An attacker who compromises a child domain can forge a TGT with a SIDHistory field containing the parent domain's Enterprise Admins SID (S-1-5-21-[domain]-519). If the parent domain has SID filtering disabled (the default for child domains within the same forest), this ticket grants Enterprise Admin access across the forest. This is the cross-forest child-to-parent privilege escalation first documented by Sean Metcalf at DerbyCon 2015.
Trust Ticket Forgery: Inter-domain trust relationships use shared trust keys for Kerberos referral. An attacker who extracts the trust key (via Mimikatz lsadump::trust) can forge inter-realm TGTs, authenticating from a child domain to a parent domain or a forest-trusted domain as any user.
Forest-to-Forest Trust Abuse: External forest trusts with SID filtering disabled (FilterSIDs=0) allow SIDHistory attacks across forest boundaries — a full forest compromise from a compromise of any trusted forest. Even with SID filtering enabled, resource forest trusts configured with Selective Authentication gaps or over-provisioned permissions frequently allow escalation.
AI tools in authorized red team engagements assist with persistence selection and evasion planning in three documented use cases:
Persistence mechanism selection. Given environment parameters (EDR vendor, Windows version, logging configuration, SOC monitoring hours), AI recommends which persistence technique has the lowest detection probability. AdminSDHolder abuse, for example, is less likely to trigger EDR behavioral alerts than in-memory skeleton key patching.
Cleanup timing optimization. AI can reason about SOC shift patterns and logging retention windows to recommend when to remove persistence artifacts for minimal forensic exposure — a capability that makes AI genuinely dangerous in adversarial hands and emphasizes why AI governance in security tooling matters.
Trust enumeration acceleration. Enumerating all trust relationships in a complex multi-forest environment using native tools (nltest, Get-ADTrust) produces raw data that AI can map into an attack-relevant graph — identifying which trusts have SID filtering disabled, which are bidirectional, and which cross organization boundaries without proper security controls.
Active Directory attack paths form a layered kill chain: enumeration (BloodHound + AI path analysis) → initial access via Kerberos abuse → credential extraction (DCSync, LSASS) → lateral movement (PtH/PtT) → persistence (Golden Tickets, AdminSDHolder, Shadow Credentials) → trust abuse (SID History, trust ticket forgery). AI accelerates each phase but the underlying protocols and misconfigurations are the root cause. Defenders must address the attack surface structurally, not just monitor for tool signatures.
You have achieved Domain Admin on a child domain within a multi-forest enterprise environment during an authorized red team assessment. The engagement scope includes demonstrating persistence and cross-forest impact. You need to plan and justify your technique selection to the client's CISO.