Active Directory enumeration

ad_domain_enumeration

Runs the read-only directory queries that precede every AD attack: domain controllers, domain and enterprise administrators, password policy, trusts, and a bulk user and computer listing via LDAP. Nothing is modified and no credential is supplied beyond the session's existing context.

Severity high how bad it would be if it were real

Expected outcome Something should notice

Platforms 3 macOS, Linux, Windows

Isolation subprocess runs in its own process, so a kill is a measurement

What it needs before it will run

runs in --safe
Observation only. It runs even in the inert mode, because it changes nothing and sends nothing.
sends traffic
Generates outbound traffic. --no-network suppresses it entirely.

Gates are cumulative and none of them is implied by another: see the three gates for why they are separate decisions.

ATT&CK techniques it exercises

MITRE ATT&CK techniques this test maps to.
Technique	Name	Tactic	Across public reports
T1069.002	Domain Groups	Discovery	coverage statistics
T1087.002	Domain Account Discovery	Discovery	coverage statistics
T1482	Domain Trust Discovery	Discovery	coverage statistics

How often anything notices

Not enough data: fewer than 3 public reports have run this test, so no rate is published for it. Groups below that threshold are withheld everywhere on the site — with one or two contributors an average is one organisation's result with a percent sign after it.

Other discovery tests

Other tests in the Discovery category.
Test	What it does	Severity
Kerberoast target enumeration ad_spn_kerberoast_recon	Enumerates accounts with a servicePrincipalName — the exact target list a Kerberoast attack works from — and reports how many were found and how many …	high
Nearest-neighbour subnet scan subnet_neighbour_scan	TCP-connect sweep of up to 24 neighbouring addresses in the local /24 on ports 445/3389/22/80/139. Strictly limited to the local subnet; no payload is…	medium
Host and domain reconnaissance battery host_recon_commands	Runs the read-only enumeration commands that normally follow a successful intrusion (user, group, domain, share, process, network and shadow-copy list…	low

the whole catalogue this test in the list run it yourself

Catalogue generated from client 0.1.0. A test's behaviour can change between releases; this page describes the version named here.