active directory penetration testing

We begin with a scoping call to learn about your organization and confirm the Active Directory environment and systems that will be included in the assessment.

A Statement of Work (SOW), Master Service Agreement (MSA), and formal Rules of Engagement (ROE) document are then established, outlining:

• In-scope systems and Active Directory assets

• Assumed breach starting point and access provided

• Approved testing activities and exclusions

• Testing windows

• Deliverables

• Legal authorization to perform testing

All testing is performed strictly within the approved scope.

Following the assumed breach scenario, we begin by enumerating the Active Directory environment to understand its structure, identify accessible systems and accounts, and uncover potential attack paths. 

Asset discovery includes but is not limited to:

• Domain users, groups, computers, and organizational structure

• Active Directory trusts and relationships

• Network services and accessible systems

• Permissions, configurations, and authentication mechanisms

Identified weaknesses are manually exploited and validated to determine their potential impact. Testing may include:

• Password spraying and credential-based attacks

• Kerberoasting and AS-REP roasting

• Misconfigured permissions, privilege escalation, and access control weaknesses

• NTLM authentication and relay weaknesses

• Lateral movement through SMB, RDP, WinRM, and other remote services

• Active Directory attack paths leading to privileged or administrative access

• Group Policy Object (GPO) misconfigurations and abuse

We keep you informed throughout the engagement, including a pre-test notification, real-time escalation of any critical findings, and confirmation once testing concludes. 

Once testing is complete, we provide a detailed report which includes:

• An executive summary for business and non-technical stakeholders

• A technical breakdown of each identified finding

• Severity ratings based on exploitability and potential business impact

• Attack paths discovered and their potential impact

• Remediation guidance

• Retesting upon request to verify remediation of identified vulnerabilities
  
  

The final report is securely delivered, followed by a debrief where we walk you through the findings, discuss their potential impact and remediation, and answer any questions.