0-1. Starting Position & Domain/Host Enumeration

Usually given:

• Domain name
• A low-priv domain user's creds (password or NTLM hash)
• IP of a domain-joined client machine (not the DC)

See Domain & Host Enumeration for confirming access, fingerprinting the DC, and DNS/hosts setup.

2. BloodHound Collection

Run early, as soon as any valid creds exist. See BloodHound Collection for the collection command, what to look for in BloodHound CE, and the manual fallback.

3. Manual LDAP / AD Enumeration

Fallback when BloodHound isn't available, or to cross-check its output. See Manual LDAP Enumeration for the ldapdomaindump/rpcclient/net commands and what to look for.

4. Grabbing Creds

Run against everything reachable. See Grabbing CredsCheatsheets/Active Directory/Grabbing Credsing, spraying, LAPS, and gMSA commands.

5. ACL / Edge Abuse

Once BloodHound or manual enum shows a path, match the edge to the abuse technique. See ACL & Edge Abuse for the abuse cheat sheet and the forced-password-reset command.

6. Lateral Movement

With a second set of creds, repeat steps 1-5 against any new machines those creds touch. See Lateral Movement for the full pivoting playbook (LOTL checks, cred hunting on box, tunnel setup with Ligolo-ng).

7. Domain Admin / DC Compromise

Once DA-equivalent rights land (DCSync, DA group membership, or an ADCS domain-escalation cert), see DCSync & DC Takeover for the full command set: dump every hash via DCSync, then land on the DC with the recovered Administrator hash to grab the flag.

Key Mindset

1. Enumerate before exploiting: every AD set path is discoverable through BloodHound or manual LDAP; guessing wastes exam time.
2. Every foothold yields some new info (new creds, new sessions, new group memberships); loop back to step 2/3 after any win.
3. Don't fixate on one edge/path if it's not panning out; re-check BloodHound with newly Owned principals, since the graph updates.