Active Directory Attacks Explained Kerberoasting, BloodHound and Golden Tickets — in the order they actually happen

What are Active Directory attacks?

Active Directory attacks are techniques that abuse the intended features of Microsoft Active Directory — Kerberos service tickets, LDAP queries, NTLM authentication, delegation and replication rights — rather than exploiting a software vulnerability. Nearly all of them are post-compromise. MITRE ATT&CK files Kerberoasting as technique T1558.003 under Credential Access, which already tells you the attacker holds an account.

That last point is the one beginners lose money on. There is no patch for Kerberoasting, because nothing is broken. A domain user is allowed to request a service ticket; the ticket is encrypted with a key derived from the service account’s password; you are allowed to take it away and crack it offline. Microsoft’s own guidance on mitigating Kerberoasting, published 11 October 2024, calls it “a low-tech, high-impact attack” and offers configuration advice, not a fix. That is what makes Active Directory the single most productive target in an internal penetration test.

Why “top 10 AD attacks” lists teach the wrong thing

A flat list of ten Active Directory attacks hides the only thing that decides whether you can run one: the prerequisite. Semperis’ widely cited page on five common Active Directory attack methods lists BloodHound at number four and ADFind at number five. Both are tools, not attacks. A learner reading that list forms the wrong mental model on day one.

The list format also flattens difficulty. Specops’ November 2025 piece on six Active Directory attack paths opens with weak and compromised passwords, which is honest and unglamorous. The reference sites go the other way: HackTricks’ Active Directory methodology and the PayloadsAllTheThings Active Directory file are excellent once you know what you are doing, and unusable if you do not, because they are organised by technique rather than by what you currently hold. Neither camp is wrong. Both are written for someone who already has the map.

What is Kerberos used for, and why attackers care

Kerberos is the default authentication protocol in an Active Directory domain: it issues time-limited encrypted tickets so a user can prove identity to a service without sending a password over the network. Attackers care because those tickets are encrypted with keys derived from account passwords, and any domain user may request one.

Two pieces matter for everything below. The first is the KRBTGT account, a hidden account on the domain controller whose password hash signs every ticket-granting ticket in the domain. The second is the Service Principal Name, or SPN, which maps a service to the account that runs it. Kerberoasting exists because of SPNs. Golden Tickets exist because of KRBTGT. Learn those two objects and most of the Kerberos attack family stops looking like magic.

Stage 1: Active Directory enumeration with one valid account

Active Directory enumeration is reading the domain’s own directory — users, groups, computers, service accounts, delegation settings and group policy — using nothing but a valid low-privilege account and LDAP. It is the first sub-topic of Module 11 in the AimNxt VAPT syllabus, and it is where every real engagement genuinely begins.

LDAP stands for Lightweight Directory Access Protocol, and in a default domain an ordinary user can query an enormous amount of it. That is by design: clients need to find printers, shares and services. The consequence is that one phished password, one reused credential from a breach dump, or one anonymous share turns into a full inventory of the domain. The AimNxt syllabus names PowerView in Module 03 for exactly this work. Nothing in stage one requires an exploit.

Stage 2: Kerberoasting, the attack that needs only a valid user

Kerberoasting requests a Kerberos service ticket for any account that has a Service Principal Name, then cracks that ticket offline to recover the service account’s plaintext password. MITRE ATT&CK lists it as T1558.003 under Credential Access. Its only prerequisite is one working domain account, which is why it is the first real attack you learn.

The mechanics are short. You ask the domain controller for a ticket to a service. The controller encrypts part of that ticket with a key derived from the service account’s password and hands it over, because you are a legitimate user asking a legitimate question. You then take it offline and run a wordlist against it with Hashcat, which the AimNxt curriculum names in Module 03’s tool list alongside Mimikatz and PowerView. Nothing is logged as a failure, because nothing failed.

Why it pays so well: service accounts are frequently over-privileged. A SQL service account in Domain Admins is not rare, and it is often carrying a password set in 2019 and never rotated because rotating it would break the application.

Is Kerberoasting still a thing in 2026?

Yes, and Microsoft’s own mitigation guidance is the proof: on 11 October 2024 it advised setting service account passwords to a 14-character minimum, moving all service accounts to AES 128 and 256 bit ticket encryption, and said it plans to disable RC4 by default in future Windows updates. Those are configuration changes, not patches.

RC4 is the weak link. Microsoft’s post explains that RC4 “uses no salt or iterated hash when converting a password to an encryption key”, which makes offline cracking dramatically cheaper. The important sentence, and the one most training material skips, is Microsoft’s own caveat that “AES alone is not a solution for brute forcing and needs to be used in combination with strong passwords”. An AES-only domain with a ten-character service password is still Kerberoastable.

The real fix Microsoft points at is a Group Managed Service Account. gMSA passwords are 120 characters long, complex and randomly generated by the domain. Delegated Managed Service Accounts, new in Windows Server 2025, carry the same protection. If a target uses gMSAs properly, Kerberoasting that account is over before it starts — which is exactly the kind of finding a report should say out loud.

How do you identify and prevent Kerberoasting?

You detect Kerberoasting by watching Windows Event ID 4769, the Kerberos service ticket request, for tickets issued with RC4 encryption type 0x17 and for single accounts requesting an unusual number of service tickets in a short window. Microsoft Defender XDR raises external ID 2410, “suspected Kerberos SPN exposure”, for the same behaviour.

That detection logic is written down in the MITRE ATT&CK entry for T1558.003 Kerberoasting, which also recommends service account passwords of 25 characters or more, AES over RC4 where feasible, and keeping service accounts out of privileged groups. This is the point where attack training and defence training meet: the same event ID is a detection rule in the AimNxt SOC Analyst L1 & L2 programme and a footprint to think about on the offensive side.

For a penetration tester the practical takeaway is not stealth for its own sake. It is that your report should state which of these controls was missing, because “we cracked a service account” is a finding and “4769 with RC4 is not alerted anywhere and the account has been in Domain Admins since 2019” is a remediation.

Stage 3: NTLM relay, which needs no password at all

An NTLM relay attack takes an authentication attempt that a Windows machine makes towards the attacker and forwards it, unchanged, to a third system that accepts it — so the attacker authenticates as that victim without ever learning a password or a hash. It is Module 11’s third sub-topic in the AimNxt syllabus.

It works because Windows clients are enthusiastic about authenticating. A mistyped share name, a stale mapped drive or a spoofed name-resolution response makes a machine reach out and offer its credentials, and if SMB signing is not enforced on the destination the relayed authentication is accepted. This is the attack that surprises people most, because it inverts the usual model: you are not cracking anything, you are standing in the middle of a conversation the network wanted to have.

It also explains why the order in this article matters. Relay is often how you get your first account — and stage two needs an account. Read the chain as a loop rather than a straight line, and it starts to make sense.

BloodHound is not an attack. It is a map.

BloodHound is a graph analysis tool: a collector such as SharpHound gathers data from Active Directory, and BloodHound draws the shortest path from an account you control to an account you want. It attacks nothing. Every list that files it as an Active Directory attack method is teaching a category error, and one page-one result does exactly that.

There is a second problem, and it comes from the people who build the tool. In a post published on 11 April 2026, SpecterOps reviewed five courses that teach BloodHound and found four of the five were teaching versions roughly three years old. The current line is BloodHound Community Edition v8, which added OpenGraph for identity data outside Active Directory and Entra ID, moved to PostgreSQL in place of Neo4j, and installs through BloodHound CLI rather than hand-assembled Docker containers. Kali images released before August 2025 shipped BloodHound Legacy.

So when you evaluate any course on this subject, including ours, ask which BloodHound it demonstrates and whether the database it stands up is PostgreSQL or Neo4j. It is a fast, specific question, and the answer tells you when the material was last touched. The AimNxt syllabus names PowerView for enumeration rather than a graphing tool, and the live class is where the current collector and interface get shown — which is the honest version of that answer.

Stage 4: Domain privilege escalation to Domain Admin

Domain privilege escalation is the step that converts a cracked or relayed account into control of the domain, usually by abusing an access control entry, a delegation setting or a group membership rather than by running an exploit. It is Module 11’s fourth sub-topic, and it is where most of the real thinking in an internal test happens.

The classic shape is an unremarkable account that has been granted one specific right it should not have: permission to reset another user’s password, write to a group, or replicate directory changes. That last one is the one to know. An account with directory replication rights can ask a domain controller for password data directly, which is how an attacker reaches the KRBTGT hash without ever logging on to a domain controller.

This is also the stage where enumeration pays off. You do not find these rights by scanning. You find them by reading the directory carefully, which is why stage one is stage one.

Stage 5: Golden Tickets and why they come last

A Golden Ticket is a forged Kerberos ticket-granting ticket signed with the domain’s KRBTGT account hash, which lets an attacker impersonate any user to any service for as long as that hash is unchanged. MITRE ATT&CK lists it as T1558.001. Forging one requires the KRBTGT hash, so the domain is already lost before it is used.

That is the sentence missing from almost every list. A Golden Ticket is not an intrusion technique. It is persistence — Module 11’s fifth and final sub-topic is Domain Persistence Techniques, and this is what sits there. Its cousin, the Silver Ticket (T1558.002), is narrower: it forges a service ticket using one service account’s hash, so it only works against that one service, and it never touches the domain controller.

The defensive consequence is worth stating in a report, because clients rarely know it: recovering from a Golden Ticket means rotating the KRBTGT password twice, with a replication interval in between. Resetting an administrator’s password does nothing.

Which prerequisite does each Active Directory attack need?

Every technique in this family has exactly one gate: the thing you must already hold before it is even possible. Kerberoasting needs one valid domain account. NTLM relay needs none. A Golden Ticket needs the KRBTGT hash, which means full domain compromise. Pick a technique below and the finder states its gate, its stage and what it hands you.

This is the tool we wish existed when we were learning. Use it to sanity-check any tutorial you follow: if a write-up jumps to Golden Tickets on step two, it has skipped the four stages that make it possible.

What Hyderabad employers actually pay for AD attack skills

Naukri listed 993 Active Directory vacancies in Hyderabad and Secunderabad on 30 September 2026, but only 155 of them sat in the IT Security role category — the rest were administration, support and infrastructure roles. Active Directory knowledge is widely paid for in Hyderabad. Attacking it is a narrow speciality inside that market, not a job title.

Filtering the same site for “active directory penetration testing” returned 531 Hyderabad listings, 200 of them under IT and Information Security. The distribution is the interesting part: 67 roles in the ₹0–3 lakh band against 296 in ₹6–10 lakh and 211 in ₹10–15 lakh. This is a mid-career market with a thin bottom.

The clearest single data point we found was one listing: a Red Team / Purple Team / Network Penetration Testing Specialist role at a CMMI Level 5 MNC, posted four days before we read it, advertising ₹15–25 lakh per annum for 5–10 years of experience. Its first skill tag, ahead of Metasploit, MITRE ATT&CK and Cobalt Strike, was literally “Active Directory Attacks”. The skill is priced. It is priced at five years.

Source: Naukri.com listing counts and filter facets for Hyderabad and Secunderabad, read on 30 September 2026. Naukri keyword matching is fuzzy — a listing appears if the phrase matches anywhere, which is why administration roles dominate the wider count. These are market estimates and vacancy counts, not guarantees; pay depends on experience, employer and interview performance.

The zero-year filter is the honest part. Of the 33 Hyderabad listings open to freshers on that query, 8 were in IT and Information Security, 4 carried an unpaid stipend, and the first page included a Service Desk role and a listing titled OFFICE BOY. Nobody hires a fresher to attack a domain. What a fresher can realistically land is the support, NOC or SOC seat next to the people who do — which is why the honest route into this work usually runs through the SOC Analyst L1 & L2 route or a service-desk year, with the Active Directory attack skill built in parallel.

What you need to build an Active Directory attack lab

You cannot practise Active Directory attacks on one machine, because the attacks are conversations between machines: you need at least a domain controller and one joined workstation, plus your Kali box, running at the same time. That is three virtual machines, and it is the prerequisite no listicle mentions.

Plan for memory rather than disk. A Windows Server domain controller and a Windows 10 or 11 client will each want a few gigabytes while Kali is also running, so 16 GB of RAM on the host is comfortable and 8 GB is tight. The AimNxt curriculum puts this work in Module 03, Windows Internals & Active Directory, whose third sub-topic is Active Directory Setup & Configuration — you build the domain before you are shown how to break it, which is the correct way round and also the part learners skip.

If your laptop cannot hold three machines, that is a real constraint and worth saying out loud when you choose a course. Ask whether the provider hosts the lab domain or expects you to build it on your own hardware. The answer changes what the course costs you.

How AimNxt teaches Active Directory attacks

Active Directory attacks are Module 11 of the fifteen-module AimNxt VAPT & Ethical Hacking programme, a four-month course delivered at KPHB 5th Phase in Kukatpally, online, or hybrid. Its five sub-topics run in the order this article uses, and the two modules that make it possible — Windows Internals and Post-Exploitation — come before it, not after.

The sequence is the point. By the time Module 11 starts you have already built a domain in Module 03, learned PowerShell for security testing, cracked hashes with Hashcat, and practised lateral movement and pivoting in Module 10. Module 11 is not an introduction to Active Directory; it is the module where everything earlier gets pointed at one target.

Module names and sub-topics above are taken verbatim from the AimNxt VAPT & Ethical Hacking curriculum. The programme issues an AimNxt certificate of completion. Cisco, EC-Council and CompTIA are the certification bodies for their own exams; AimNxt is an independent training provider that prepares you for them, and buys none of their vouchers on your behalf. Placement support runs through the AimNxt Job Interview Guarantee program, which guarantees interview opportunities through the hiring-partner network — not a job offer, a placement, or any salary.

Where to learn this in Hyderabad, and what the local search tells you

Searching for Active Directory attack training in Hyderabad on 30 September 2026 returned mostly Active Directory administration courses, with Google explicitly flagging “Missing: attacks” against its top three local results. There is genuine demand in Hyderabad and very little local teaching aimed at the offensive side of it.

That gap is the reason this post exists. The institutes ranking locally teach domain administration — Group Policy, organisational units, Entra ID, migrations — which is a good career and a different one. Of the local results that did address attacks, one was a Kukatpally provider’s blog post and one was our own guide from September. If you are in Hyderabad and want the offensive half taught in a lab domain rather than in slides, there are very few places to go, and you should ask all of them the BloodHound version question from earlier in this article.