What is the primary goal of the ‘Discovery’ tactic [TA0007] in an adversarial attack?
An adversary attempts to enumerate information about the environment they are operating in.
Why is ‘Discovery’ often considered a prerequisite step to Lateral Movement?
Adversaries need to know what systems and resources an impersonated user can access before they can move to other systems.
What protocol do most domain enumeration tools leverage to query Active Directory?
LDAP (Lightweight Directory Access Protocol) or LDAPS (LDAP over SSL).
What is ADWS, and how does it relate to LDAP?
Active Directory Web Services (ADWS) is a protocol that wraps LDAP queries in HTTP requests.
Why is running a default BloodHound collector like SharpHound considered risky when emulating an advanced threat?
Many security vendors have signatured the hardcoded queries, session enumeration traffic, and inefficient data retrieval methods used by default collectors.
What is a stealthier alternative to using default BloodHound collectors for data gathering?
Perform data collection using custom LDAP queries with a tool like ldapsearch and then parse the output for BloodHound.
The Python script _____ is used to parse the output of tools like ldapsearch into BloodHound-compatible JSON files.
BOFHound
What is the standard TCP port for unencrypted LDAP communication?
TCP port 389.
What is the standard TCP port for LDAPS (LDAP over SSL)?
TCP port 636.
In LDAP, what does the ‘objectClass’ attribute define for an object?
It defines the types of attributes the object can have.
What is a potential issue when searching for LDAP objects with an objectClass of ‘user’ or ‘person’?
The search will also return computer accounts, as they share these object classes.
What is the purpose of an LDAP filter?
An LDAP filter defines the criteria for a search to find specific objects in the directory.
What sAMAccountType value corresponds to a standard user account in Active Directory?
The decimal value 805306368.
In an LDAP filter, what character represents the logical ‘AND’ operator?
The ampersand character (&).
In an LDAP filter, what character represents the logical ‘OR’ operator?
The pipe character (|).
In an LDAP filter, what character represents the logical ‘NOT’ operator?
The exclamation mark (!).
What is the correct syntax placement for logical operators (&, |, !) within an LDAP filter group?
The logical operator must always appear at the beginning of the grouping (prefix notation).
What LDAP filter would find all user accounts (sAMAccountType=805306368) that also have their adminCount attribute set to 1?
(&(samAccountType=805306368)(adminCount=1))
How can you limit the attributes returned by an ldapsearch query?
Use the --attributes parameter followed by a comma-separated list of attribute names.
Which attribute must be included in an ldapsearch query to identify ACL-based attack paths in BloodHound?
ntsecuritydescriptor
What is the LDAP OID for the bitwise AND matching rule (LDAP_MATCHING_RULE_BIT_AND)?
1.2.840.113556.1.4.803
The bitwise AND filter is particularly useful for querying which specific Active Directory attribute that consists of bitwise flags?
userAccountControl
What LDAP filter would find computer accounts (sAMAccountType=805306369) configured for unconstrained delegation (a userAccountControl flag of 524288)?
(&(samAccountType=805306369)(userAccountControl:1.2.840.113556.1.4.803:=524288))
What is the LDAP OID for the matching rule LDAP_MATCHING_RULE_IN_CHAIN?
1.2.840.113556.1.4.1941
-
Module 144
-
Module 243
-
Module 360
-
Module 466
-
Module 550
-
Module 660
-
Module 762
-
Module 856
-
Module 918
-
Module 1052
-
Module 1153
-
Module 1250
-
Module 1336
-
Module 1441
-
Module 1567
-
Module 1653
-
Module 1728
-
Module 1851
-
Module 1954
-
Module 2022
-
Cobalt Strike User Guide161
-
Cobalt Strike Installation Guide37
