Active Directory Exploitation Cheat Sheet is a reference guide that documents common enumeration and attack methods for Windows Active Directory environments.
The guide addresses the need for a consolidated resource covering Active Directory attack and defense techniques. It organizes methods across the attack lifecycle, from initial domain enumeration using tools like PowerView, the AD Module, and BloodHound, through local privilege escalation, lateral movement techniques including PowerShell remoting and RDP abuse, and domain-level privilege escalation via Kerberoast, ASREPRoast, and delegation abuse. The cheat sheet also covers persistence mechanisms such as golden tickets and DCsync attacks, as well as cross-forest attack scenarios.
This resource suits penetration testers and security professionals conducting Active Directory assessments or red team exercises who need quick reference to exploitation techniques and their corresponding tools. It works best as a companion during engagements rather than as a learning resource for those new to Active Directory security, given its focus on practical methods rather than foundational concepts. The guide draws inspiration from similar payload and technique repositories in the security community.
The project maintains a structured, categorized format covering distinct attack phases and techniques. The repository includes a comprehensive table of contents organizing content by attack stage, from enumeration through persistence and cross-forest scenarios. Tool recommendations are integrated throughout each section, providing practitioners with specific utilities for executing the documented methods.
